What training does Portugal's anti-corruption regime (RGPC) require?

The General Regime for the Prevention of Corruption (Regime Geral da Prevenção da Corrupção, RGPC) is Portugal's statutory anti-corruption compliance regime for medium and large organizations. It was approved as an annex to Decree-Law 109-E/2021 of December 9, 2021, which also created the National Anti-Corruption Mechanism (Mecanismo Nacional Anticorrupção, MENAC), the independent authority that issues guidance, supervises compliance, and decides administrative offense cases under the regime.

Under Article 2 of the RGPC, the regime applies to legal persons with their seat in Portugal that employ 50 or more workers, and to branches in Portugal of legal persons based abroad that employ 50 or more workers. It also covers direct and indirect state administration, the autonomous regions, local authorities, and the public enterprise sector where they employ 50 or more workers, as well as independent regulators and Banco de Portugal. The regime calls these "entidades abrangidas" (covered entities).

The RGPC is national law, not a transposition of an EU directive. It sits alongside Portugal's whistleblower protection law, Law 93/2021, which transposes the EU Whistleblower Directive. The RGPC's whistleblowing channel requirement (Article 8) points directly to that law.

Article 9 requires every covered entity to run internal training programs for all of its managers and workers, so they know and understand the corruption prevention policies and procedures the entity has put in place. Paragraph 1 reads, in the original Portuguese:

The remaining paragraphs of Article 9 add three further rules:

1. Risk based content and frequency (9(2)). The content and frequency of training must take account of the different exposure of managers and workers to the risks identified, which in practice means the risks recorded in the entity's risk prevention plan.
2. Counts as continuous training (9(3)). Hours spent on this training count as hours of the continuous training the employer must provide to each worker. See Portugal's Labor Code continuous training rules.
3. Communication to third parties (9(4)). Covered entities must take steps to make their anti-corruption policies and procedures known to the entities they deal with, such as suppliers, agents, and partners.

Article 9 is titled "training and communication" for that reason: the duty reaches beyond employees to the organization's business relationships, although only workers and managers must be trained.

Training is one of four mandatory components of the compliance program that Article 5 requires every covered entity to adopt and implement. The other three are a plan for the prevention of risks of corruption and related offenses (PPR), a code of conduct, and a whistleblowing channel. The program must prevent, detect, and sanction corruption carried out against or through the entity.

Article 11 makes the management body or senior manager responsible for adopting and implementing the compliance program. For how to build these links in practice, see how to map training to compliance obligations.

MENAC expects a structured, annual program based on a training needs survey, with behavioral, normative, and practical components. The main source is MENAC Guide 1/2023 on the instruments of the RGPC, summarized in a short MENAC note on the training and communication program. These are guidance, not binding law, but they show what the supervisor looks for.

• Present each instrument. Training should explain the purpose of the code of conduct (integrity culture), the risk prevention plan (risk prevention), and the internal whistleblowing channel (reporting and detection).
• Survey needs every year. An annual survey of training needs in ethics, integrity, and risk prevention, both general and for specific functions such as public procurement, asset and financial management, and information access.
• Use program data. Evaluations of the risk plan and code of conduct, and irregularities reported through the whistleblowing channel, are named as key inputs to the needs survey.
• Three components. A behavioral component (about 25% of session time), a normative component on the law and the entity's own instruments (about 25%), and group work on ethical dilemmas (preferably about 50%), in small groups of 3 to 5 followed by plenary discussion.
• Induction and annual cycles. Training should be part of induction for new workers and part of annual continuing training for existing workers and managers. MENAC suggests 6 to 12 hours for induction and, as a rule, no more than 6 to 7 hours per continuing session.
• Internal delivery preferred. Sessions should preferably be run internally, for example by department heads, with external specializts useful for the behavioral and dilemma components.

MENAC's Guidance 1/2025 on designating the compliance officer, approved on October 8, 2025, adds that if the compliance officer lacks specific technical training or relevant experience in areas such as audit, compliance, or risk management, initial and periodic specific training is relevant, ideally before designation or as soon as possible afterward.

The RGPC has applied since Decree-Law 109-E/2021 entered into force 180 days after its December 9, 2021 publication, in June 2022. Under Article 28 of the decree-law, the penalty chapter took effect one year after entry into force, and two years after entry into force for private entities that qualified as medium enterprises at that date.

As at September 2026, Decree-Law 109-E/2021 has been amended twice. Decree-Law 70/2025 of April 29, in force from May 29, 2025, restructured MENAC (a board of directors in place of a single president, new units, and staffing changes) and republished Decree-Law 109-E/2021 in full. Law 37/2026 of July 28, in force from September 1, 2026, added asset recovery functions to MENAC's statute. Both amended only the decree-law's own articles on MENAC, not the RGPC in its annex: in the republished text, the scope in Article 2, the training duty in Article 9, and the fine ranges in Article 20 of the RGPC are unchanged.

MENAC's Recommendation 1/2026 withdrew an earlier recommendation that compliance officers report to MENAC monthly. It now recommends that compliance officers carry out internal reviews of irregularities in the compliance program at the frequency they consider appropriate, using an optional tracking template that covers each instrument.

Article 20 of the RGPC sets fines of €2,000 to €44,891.81 for legal persons, and up to €3,740.98 for individuals, for failing to adopt or implement a risk prevention plan, failing to adopt a compliant code of conduct, or failing to implement an internal control system. Lesser failures, such as not reviewing, publishing, or reporting the plan or code, carry fines of €1,000 to €25,000 for legal persons and up to €2,500 for individuals. Limits are halved for negligence. MENAC publishes a table of these sanctions.

Article 20 does not list a missing training program as a separate administrative offense. That does not make training optional. Article 5 makes it a mandatory element of the compliance program, Article 11 places responsibility on the management body, and weak training undermines the risk plan and code of conduct, whose failures are sanctioned. Under Article 21, managers, the compliance officer, and heads of the relevant areas can also be personally liable for offenses they commit, or that they know or should know about and do not act to stop immediately.

Evidence should show that training was planned from the risk prevention plan, reached every manager and worker, varied by risk exposure, and was evaluated. A completion list alone does not show that Article 9(2) was applied. The table below is an illustrative mapping, not MENAC text.

A structured training needs analysis tied to the risk prevention plan makes Article 9(2) demonstrable, and a training matrix records which role receives which content and how often. For inspection readiness, see how to prepare training records for an audit and how to design a compliance training program.

Knowledge Foundry models the risks in an entity's risk prevention plan, the rules in its code of conduct, and the whistleblowing procedure as linked concepts with assessment points by role. Training for each role is then generated from its risk exposure, so the link Article 9(2) requires is visible in the framework itself, and the record of that link is ready for MENAC or an internal auditor.