The impossible inventory
To write this part we tried to do the most obvious thing: count. How many professionals, in Italy, present themselves as experts in Decree 231 and white-collar crime? It seemed a question for an afternoon's work. It is not. LinkedIn, the shop window where that expertise is displayed, allows no reliable count from open sources: search engines no longer return the counters, and the platform's internal numbers are sold only with its commercial tools. There is no professional roll: "231 expert" is not a title; anyone can award it to himself tomorrow morning. There is no public register of supervisory bodies (organismi di vigilanza), though they sit in thousands of companies. The trade associations of compliance professionals do not publish their membership numbers, with a single exception of which we shall speak. The sector journals classify, reward, celebrate — but they do not count.
The reader will recognise the pattern, because it is the same as in the first part: just as there is no database of Decree 231 case law, so there is no census of the Decree 231 market. The sector that sells companies the mapping of risks has never mapped itself. This is not a paradox: it is a rational choice, and this part serves to explain its convenience. Meanwhile, with the fragments available, the inventory can be sketched. And it is instructive.
The tip of the pyramid can be counted on one's fingers
Let us begin with the elite, the one certified by the international directories that guide sophisticated buyers. Chambers Europe, 2026 edition, ranks for Italy in the white-collar crime category fifteen departments and thirty-seven lawyers in all. Legal 500 records seventeen firms plus three "ones to watch", and fourteen individuals. TopLegal, in its report on corporate criminal law, worked on thirty-two firms, with some forty professionals ranked, and noted that "firms with three or more corporate criminal law experts can be counted on the fingers of one hand". Il Sole 24 Ore, with Statista, flags every year several hundred firms "of the year" spread across fifteen practice areas, and reports that criminal law is among the most crowded. Put together: the recognised tip of the market is made up of a few dozen firms and fewer than a hundred names. Known people, recurring, often excellent. So far, nothing strange: every professional market has a narrow elite.
The base of the pyramid is not counted at all
The problem begins below. The only public membership figure is that of AODV231, the association of members of supervisory bodies: more than one thousand six hundred declared members today, against around nine hundred in 2019 — almost a doubling in six years, while the judicial application of the law, as we have seen, stagnated. And the members of a voluntary association are, by definition, a fraction of the field: how many supervisory bodies are active in Italy nobody knows, because nobody has ever counted them; we know only that the model is adopted by almost all large companies, by around half of listed small and medium-sized companies and by a third of SMEs, and that every model entails a body of one or three seats, each remunerated. Around it, the qualification industry: dozens of "231 Expert" master's programmes and courses running every year — from the business schools of the big publishers to the universities, down to the private certification bodies that issue "Expert" and "231 Auditor" licences — each of which puts on the market new experts certified by other experts. All this within a population of two hundred and thirty-three thousand Italian lawyers, of whom eight to ten thousand are criminal lawyers belonging to the criminal bar associations (Camere Penali).
The conclusion of the inventory is a widening gap: at the top, an elite of a few dozen countable, counted names; at the bottom, a field of thousands of self-styled experts whom nobody counts, nobody qualifies and nobody verifies. In between, the product: paper.
The paradox: more experts than judgments
Now let us line up the two inventories — that of the professionals just sketched and that of the case law, seen in the first part — because the comparison internal to Decree 231 suffices on its own. On one side: more than one thousand six hundred members of the supervisory bodies' association alone, thousands of Supervisory Body seats never counted, dozens of courses that every year put new certified "experts" on the market. On the other: around five hundred headnoted judgments in twenty-five years in the richest private collection; two hundred and twenty-eight decisions in seven years in the most active court in Italy, with fifty-one convictions — seven a year —; two acquittals on the merits for suitability of the model in the entire history of the law; and, for the foreign bribery that was Decree 231's founding rationale, twenty-two convictions of entities in twelve years according to the OECD counts, with a single new investigation in the last two-year period observed.
The proportions, then: the members of one association of Supervisory Body members alone outnumber, several times over, all the Decree 231 judgments ever collected in a quarter of a century; and Italy produces every year more new certified 231 experts than judicial decisions on Decree 231. Nothing similar is on record in any other professional sector: even the most asphyxiated litigation generates more final rulings than the conferences that comment on it. An expertise that grows in inverse proportion to the subject matter on which it is supposed to be exercised is not a market in competence: it is a market in fear. And fear, unlike case law, knows no production crisis.
What is it worth? The turnover nobody declares
If the professionals cannot be counted, can the money at least be counted? Not even that. There exists no official estimate — academic or associative — of the turnover of Decree 231 consultancy in Italy: in twenty-five years nobody — not Censis, not the bar associations, not the business press — has ever published the figure. Here too, the proxies remain. The market of the top fifty Italian business law firms is worth around three billion eight hundred million euros a year, growing at double-digit rates, and there is not a name in that group that does not display a white-collar and compliance practice; the sector's awards devote dedicated categories to corporate criminal law; the criminal boutiques born on the wave of Decree 231 multiply with every ratings season. Anyone who wants an order of magnitude can perform an exercise declared as such: tens of thousands of entities equipped with a model, each with a Supervisory Body to remunerate every year and a periodic update to pay for, produce — even at prudent average rates — a recurring flow of hundreds of millions of euros a year, before even counting new models, training, software and certifications. It is an exercise, not a datum: the datum does not exist. But let the reader note the coherence of the system: the only professional market we know of whose product, price and result are all three unmeasured is also the one that sells companies the measurement of risk.
What is being sold
The catalogue on offer is by now a complete ecosystem. The centrepiece is the organisational model: a document — often hundreds of pages across general section, special sections, code of ethics, disciplinary system — sold, according to the operators' own surveys, from a few thousand euros for the small company up to fifty or sixty thousand and beyond for structured groups. Then comes the annuity: the Supervisory Body, with fees devoid of any statutory parameter — practice starts from a few thousand euros a year and climbs, in the more casual advertisements, above eighty thousand — renewable at every term of office. Then the perpetual update: every new predicate offence that the legislature adds to the catalogue — and it has happened almost every year for twenty years — reopens all the files, as the change of collection reopens the wardrobes. Around the core, the derivatives: compulsory staff training, management software for the information flows to the Supervisory Body, attestations, certifications. And here the system touches its symbolic peak: Italy is the first country in the world for ISO 37001 certifications, the anti-bribery standard — almost three thousand certificates, a multiple of any other country — and at the same time the country the OECD reproaches for anti-corruption sanctions "inadequate to the purpose" and an enforcement reduced to almost zero. First in the world in badges, last in the courtrooms: no pair of figures tells better what is really being bought.
The market has even institutionalised its own seriality. Since 2023 there has been a UNI reference practice for the "simplified" models intended for small and medium-sized enterprises: the standard of the standard product, the certified photocopy of the photocopy. The dedicated publishing business has prospered since 2005 with a journal that has passed one thousand three hundred articles — almost all on how to build, update and perfect the model; almost none on the question whether the model prevents anything. Management software for supervisory bodies is a segment of its own, with the big business-software groups in the field. And the prizes: every year the sector celebrates itself with the corporate criminal law awards, categories and plaques for the best sellers of the product whose working nobody measures. Nothing is missing, except the one thing that in any mature industry would have existed for decades: the defect rate.
The mystery of the Supervisory Body
At the centre of the catalogue sits a figure that deserves a chapter of its own, because it is the true zoological enigma of Decree 231: the Supervisory Body. The image that governs this section is a whistle: the legal order hired a watchman, had the company pay him so that he would keep watch, and then established — with growing care over the years — that he is under no obligation to use the whistle. What breed of animal it is can be grasped better from what the law does not ask of it than from what it asks.
The law asks two things of it: to supervise the functioning of and compliance with the model, and to see to its updating. Everything else — the periodic reports to the board, the powers of verification, the intervention protocols — sits in the models and in private guidelines, not in the law. The information flows run in one direction only: everyone must inform the Body; the Body, by law, must inform no one. It is neither a public official nor a person entrusted with a public service: if a possible notice of an offence surfaces from the documents it receives, it is under no duty to report — it has, like any private citizen, the option. What it should do with the offences it encounters, the legal order does not say: at most it will report them to the management body — that is, not infrequently, to the very person suspected of the offence — and no rule sanctions its silence. Nothing is owed; everything is discretionary.
Once, in truth, there was a duty. The only rule in the entire legal order that ever attached a penalty to the conduct of Supervisory Body members sat in the anti-money-laundering legislation: a duty to report detected violations to the authorities without delay, with imprisonment of up to one year for those who failed to do so. In 2017 the legislature erased it, removing the Body from the list of parties required to report. The members' trade association greeted its disappearance by observing that the duty "raised not a few misgivings": it was — the verbatim words of its position paper — "a sort of 'duty to report' to the detriment of the entity to which one belongs". Read it again, slowly: for the profession of the watchers, reporting discovered violations to the authority is a harm, and the harmed party is the supervised entity. We know of no more honest definition of the trade.
As for the consequences of inertia, the picture is quickly told. The broadly prevailing legal scholarship, endorsed by the case law, rules out that the Body holds a position of guarantor: it has no powers of prevention, and therefore does not answer criminally for the offences it fails to prevent; the reference essay is entitled, with some irony, Vigilantes puniri possunt, and demonstrates in substance that they possunt very little. On the civil side, liability towards the entity is configurable in theory: in twenty-four years there is not a single published precedent on record, criminal or civil, of a member being found liable. Not even when judges have certified the inertia in definitive words. In the Monte dei Paschi trial the Milan Court wrote that the Body, "though endowed with penetrating powers of initiative and control", had "looked on inertly at the events, confining itself to insignificant acknowledgements": that inertia served to ground the bank's organisational fault, and cost the members exactly nothing. In Vicenza the Court of Appeal photographed an "almost complete de facto osmosis" between the Body and the top managers it was meant to control: the Supervisory Body was chaired by the head of internal audit, an employee of the general manager; the external members received fees from group companies; one of them declared himself "intimidated and conditioned" by the general manager. There too, personal consequences: none.
The defence of the institution should be stated in its best form. The Body is not a sheriff: it is a system auditor; loading it with reporting duties would turn it into an internal informer and would dry up the information flows that are its raw material; and a principle of civilisation demands that one not punish for omission those who lack the power to prevent. It is a serious argument, and it explains well why the Supervisory Body is made this way. It does not explain why it should be paid this way — for a trade in which nothing is owed, everything is discretionary and no outcome has ever been measured —; and it does not explain why even the reforms now on the drawing board, which do indeed want to professionalise it and fund it better, have refused both to write its independence into the law and to assign it a single duty towards the outside. The watchman stays at his post, well remunerated, whistle in pocket: the legal order has explained to him in writing that blowing it would be a harm.
The defence of the institution should be stated in its best form. The Body is not a sheriff: it is a system auditor; loading it with reporting duties would turn it into an internal informer and would dry up the information flows that are its raw material; and a principle of civilisation demands that one not punish for omission those who lack the power to prevent. It is a serious argument, and it explains well why the Supervisory Body is made this way. It does not explain why it should be paid this way — for a trade in which nothing is owed, everything is discretionary and no outcome has ever been measured —; and it does not explain why even the reforms now on the drawing board, which do indeed want to professionalise it and fund it better, have refused both to write its independence into the law and to assign it a single duty towards the outside. The watchman stays at his post, well remunerated, whistle in pocket: the legal order has explained to him in writing that blowing it would be a harm.
Who buys, and why
Those who buy are not buying prevention: they are buying cover. Demand is born of fear — the disqualification order that can halt the company, the seizure, the reputational damage — and of external constraints: the tenders that reward those who have the model, the legality ratings, the principals who demand it along the supply chain, the banks that ask for it in their questionnaires. In this market the buyer cannot assess the quality of the product: no standard says what an adequate model is (first part), no statistic says which models have ever held up in court (no data exist), and the seller is the same party that certifies the need. It is the textbook of adverse selection: when quality is not observable, the winner is whoever produces the appearance of quality at the lowest cost. The result is admitted, with periodic candour, by the trade press itself: "photocopy" models, "window-dressing" compliance, the model as a "whited sepulchre" — not our words, but those of people who tell the story of that market from the inside. And the judicial figure from the first part closes the circle: in the most active court in Italy, eighty-one per cent of the entities put on trial had no model at all. Translated: the product is sold above all to those who will never end up on trial, and those who end up on trial had not bought it. A market like this does not fear judicial verification: it simply almost never encounters it.
There is, finally, the calculation that no buyer puts in writing but that every board of directors knows how to make: the expected sanction. The probability of being put on trial as an entity is, for the overwhelming majority of Italian companies, close to zero — the judicial volumes seen above say so —; the pecuniary sanction, if it ever came, has maxima at the level of an operating cost; the statute of limitations runs out in five years. In a rational market, with these parameters, investment in real prevention is not justified: what is justified is the minimum investment that unlocks the tender, reassures the bank and provides, if need be, the mitigating circumstance. The model is bought for the principal, not for the judge; for the rating, not for the risk. This is not cynicism on the buyers' part: it is the correct response to the incentives the State has laid on the table. Paper compliance is not a degeneration of the system: it is its equilibrium.
Milan, twenty-nine entries
That the market does not encounter the trial is no hyperbole: the numbers of the most important prosecutor's office in Italy say so. In 2017 the Milan Public Prosecutor's Office — the office that has been Decree 231's national laboratory — entered twenty-nine sets of proceedings in the register of entities: fewer than half those of two years earlier. In the years when, for every hundred abstractly eligible predicate offences, fifteen entries of entities were counted, the very head of the office spoke publicly of the risk that the institution would "fail". And Milan is the virtuous exception: the research promoted for the law's twentieth anniversary documented a "patchy" application, hanging on the sensibility of individual offices and individual deputy prosecutors — entire districts where Decree 231 is, quite simply, never charged. The law that was meant to be the criminal law of organisations is, in practice, a local speciality practised by a few metropolitan prosecutor's offices, with volumes that any labour office would call residual. It is inside this enforcement vacuum that the market has been able to say whatever it pleased: where the judge does not reach, the consultant faces no adversarial challenge.
The literature had foreseen it
Nothing of what precedes is an Italian discovery. The international literature on compliance had described the phenomenon before Decree 231 was even born. Kimberly Krawiec called it, in a 2003 essay that has become a classic, cosmetic compliance: internal structures that perform a "façade function", bought to reduce the expected sanction and not the real risk, and rewarded by judges and regulators incapable of distinguishing substance from appearance. William Laufer devoted a book to corporations' capacity to buy the "bodies and souls" of criminal liability. Brandon Garrett, studying the agreements between American prosecutors' offices and large companies, documented that not even the best-equipped prosecutors in the world "know how to measure, and before that how to define, effective compliance". If this holds for the American system — which does have standards, metrics, independent monitors and thirty years of practice — imagine a system that has never produced either a standard or a statistic. Italy did not invent paper compliance: it simply perfected it, stripping away even that modicum of verification which elsewhere disturbs it.
The jurist who improvises
There is a structural reason why paper dominates, and it is the least confessed of all: the Italian jurist — the public prosecutor, the judge, the lawyer, and with them the consultant who replicates the training of those three — does not possess the culture of organisation. In our courses of study and in our public examinations there is no sociology of organisations, no management science, no psychology of collective decision-making processes: the disciplines that explain how a company really decides, deviates, conceals, normalises. Corporate crime is an organisational fact; those who judge it are trained only on the individual fact. The result is that everyone improvises: the consultant transcribes organisational charts and procedures because that is what he knows how to produce; the public prosecutor charges the paper because that is what he knows how to read; the judge assesses the paper with hindsight because he has no other measuring instruments. The science that would have those instruments — there is a serious literature, Italian too, on how organisations generate deviance and on how they offload blame downwards — remains outside the courtroom and outside the models. Thus the circle closes: a document written by jurists to be judged by jurists, where the word "organisation" appears on every page and organisational reality on none. Corporate culture, the real thing — the incentives, the budgets, the commercial pressures, what the chief executive rewards and what he punishes — does not pass through the model: at most it bypasses it, as the processes that count bypass the procedures that do not.
What is lost by staying with the paper is told by the science that is missing. Organisational studies have shown for decades that corporate disasters are not born of the violation of the written procedure, but of its slow, tolerated erosion: the "normalisation of deviance", by which the departure that yesterday was an exception is today practice and tomorrow standard, until the system gives way; and they have shown, mirror-wise, how organisations survive their own disasters by manufacturing internal scapegoats — the weak link sacrificed to save the structure. These are exactly the phenomena that a true preventive safeguard should intercept: drifts in practice, distorted incentives, weak signals ignored. No organisational chart records them; no quarterly information flow to the Supervisory Body captures them; no risk matrix filled in around a meeting-room table sees them. What would be needed is observation in the field, analysis of the real incentives, true independence of those who control — things that cost, disturb and are not sold by catalogue. The average 231 model makes the opposite choice: it photographs the formal organisation, which is precisely the place where corporate crime does not live.
The two opacities are one
Let us recapitulate the two absences this investigation has documented. There is no public database of Decree 231 case law: the richest private collection declares around five hundred headnoted judgments in twenty-five years, behind a paywall; the decisions on the merits are largely unpublished; the dismissals — that is, the cases in which the model would have "worked" — are structurally invisible; the registry of sanctions exists by law but produces no statistics; counting the proceedings of a single court required a university agreement. And there is no census of the market: neither of the professionals, nor of the supervisory bodies, nor of the prices, nor — above all — of the results. Two mirror-image opacities which are, on closer inspection, a single one: the absence of any feedback loop. Nobody can verify whether the product works; therefore the product does not have to work, it only has to exist. In any market, transparency about results selects the suppliers; in this one, selection is done by renown, relationships and price. Those who would have an interest in building the database — the State that wrote the law, the academy that comments on it, the associations that practise it — largely coincide with those who live off its absence. There is no need to imagine a cartel: the converging inertia of those who have nothing to gain from measurement is enough.
Scholarship as supplier
Here the argument touches its most delicate point, and we address it as it should be addressed: without putting individuals on trial, looking at the structure. In what other field of law is the author of the theory, as a rule, also the seller of the product? Decree 231 is commented upon, taught and systematised in very large part by professors who draft models, sit on supervisory bodies, chair the scientific committees of the training providers, and edit the sector journals financed by the operators. There is nothing unlawful in this, and in many cases nothing even improper: there is a structural conflict of interest, which in any other discipline — medicine, finance — would demand at least disclosure. In Italian corporate criminal law not even that is customary. The effect is not mendacity: it is the selection of topics. A great deal is written on how to perfect the model, very little on the question whether the model serves any purpose; every favourable "first judgment" is celebrated, while the statistical series that would say how isolated it is is never built; the rare radically critical voices — they exist, and we have cited them — remain at the margins of the circuit that counts, that is, of the circuit that bills. When, for the law's twentieth anniversary, the most authoritative research centre had to admit in writing that "there has not been a satisfactory application at the level of case law", the admission passed without consequence: the market did not bat an eyelid, because the market does not depend on enforcement. Science would depend on it; but science, here, is a business partner.
The public price
All this would carry a bearable cost if it were only private money badly spent. It is not. The first public price is the missing deterrence: the OECD certifies that Italian pecuniary sanctions on entities are "inadequate to the purpose" — maxima which, for foreign bribery, stop, net of the mitigating circumstances that reduce them "radically", in the order of one and a half million euros: for a multinational, an operating cost —; that the limitation period for the entity's offence, five years against the fifteen for natural persons, mows down proceedings; and that enforcement shrank, in the last two-year period observed, to one new investigation and zero new trials. The second price is doped trust: every model on display, every framed certification, every sustainability report that cites Decree 231 produces an appearance of control that nobody has verified — and the appearance of control, in a market, is money: it is worth contracts, ratings, reputation. The third price we anticipated in the first part, and it is the bitterest: as long as the organisation's liability remains on paper, real criminal liability keeps travelling down the hierarchical chain to the scapegoat of the day, while the victims — the workers, the territories, the savers — meet a system that has monetised prevention without producing it.
The best objection, and the answer
In fairness, let us give the market its strongest defence. It goes like this: the absence of trials does not prove the failure of Decree 231 — it might prove its success. The models would have worked in silence: offences prevented that no statistic can count, because the crime averted leaves no trace; and the eighty-one per cent of those tried without a model would demonstrate precisely that those who have the model do not offend. It is a serious objection, and it deserves a serious answer. First: it is built to be invulnerable to the facts — any datum confirms it, no datum can refute it; and a non-falsifiable claim is not proof of effectiveness, it is an act of faith. Second: those who advance it are the same parties who have prevented, for a quarter of a century, the collection of the data that could verify it — no impact study, no control sample, no historical series of offences for companies with and without a model: if the industry truly believed in its own product, measuring its effect would be its first advertising investment. Third: the eighty-one per cent figure cuts both ways — the companies with a model are also the largest, the most legally fortified, the most capable of plea-bargaining early or of never being entered in the register at all; without statistical controls, attributing the difference to the model rather than to sheer size is a logical leap, not an inference. What remains, then, is what remains: an industry that asks to be believed on its word. On this blog the word, by itself, is enough for no one.
A perfect market, with a single weak point
Looked at coldly, the Decree 231 market is an almost perfect one: demand fed by fear and by indirect obligations; a product whose quality is not observable; results unmeasured and unmeasurable; a judicial referee who intervenes rarely, late, and reading the very paper the market produces; a theory of reference written by the suppliers; competition by reputation rather than by result. An equilibrium of this kind can last indefinitely — on one condition: that producing the paper cost enough to justify the fee scales. It is here that the equilibrium has just broken. Ever since a machine has been able to write in an hour, at zero marginal cost, the document the law firm used to bill at sixty thousand euros, the entire economics of Decree 231 rests on a price that no longer has any technical justification. What happens to a paper market when the paper becomes free — and why, while that market was growing, the science that should have measured it, the criminology of the corporation, was dying in Italy — is the third and final part: "Is the Party Coming to an End?".
A note on method
The inventory of the professionals was also attempted on LinkedIn: we document that, from open sources, the counts cannot be obtained (search engines no longer expose the totals and the platform reserves the numbers for its commercial tools). We flag this because the method is part of the news: not even the sector's shop window allows it to be counted. All the figures cited come from the sources listed at the end, with the date of consultation. As with every whitecollarcrimes publication, any report of errors or inaccuracies will be verified and, if founded, accepted and corrected with due acknowledgement. The documentary research was also conducted with artificial-intelligence tools; every figure has been checked against an open source. The assessments are the collective's.
Main sources for this part
Chambers Europe 2026, Italy – White-Collar Crime (chambers.com) · Legal 500 EMEA, Italy – White-collar crime (legal500.com) · TopLegal, Rapporto Penale d'Impresa, January 2023 · Il Sole 24 Ore–Statista, Studi legali dell'anno 2026 (lab24.ilsole24ore.com) · IX Censis–Cassa Forense Report on the Legal Profession, 2025 · UCPI, camerepenali.it · AODV231, aodv231.it (membership; 2019 comparison: affaritaliani.it) · Confindustria–TIM 2017 survey on 231 models; ItaliaOggi, 15 April 2026, on "photocopy models" · ISO Survey 2024 and Accredia (ISO 37001 certifications) · Art. 6 of Legislative Decree 231/2001; Arts. 52 and 55 of Legislative Decree 231/2007 (previous wording) and Legislative Decree 90/2017 (normattiva.it) · AODV231, Antiriciclaggio: il ruolo dell'OdV, position paper, 22 January 2020, and Il ruolo dell'OdV nell'ambito del whistleblowing, 10 October 2023 (aodv231.it) · F. Consulich, "Vigilantes puniri possunt", Riv. trim. dir. pen. econ., 3/2015 · E. Fusco–B. Fragasso, Sul presunto obbligo di impedimento in capo all'OdV, Sistema Penale, 10/2020 · the Milan Court, no. 10748/2021 (MPS) and the Venice Court of Appeal, no. 3348/2023 (BPVi), texts at giurisprudenzapenale.com · Legislative Decree 24/2023 (whistleblowing) · OECD, Phase 4 Report: Italy (2022) and Two-Year Follow-Up (2024) · K. Krawiec, Cosmetic Compliance and the Failure of Negotiated Governance, Wash. U. L. Q., 2003 · W. Laufer, Corporate Bodies and Guilty Minds, 2006 · B. Garrett, Too Big to Jail, 2014 · Observatory on the Decree 231 case law of the Milan Court (Università Statale, 2023) · Rivista231.it (size of the collection) · Centonze–Manacorda (eds.), il Mulino, 2023 · Final report of the ministerial technical working group coordinated by G. Fidelbo, 2026, and A.C. 2632 (sistemapenale.it).
whitecollarcrimes a collective byline · guarantor: Avv. Luca Santa Maria · 10 July 2026