Irregularities in EU and PNRR Funding for SMEs: From Financial Corrections and Audit Reports to EPPO / DNA Cases and Asset Recover

• the difference between a simple administrative irregularity, a financial correction, and a reasonable suspicion of fraud;
• the roles of Managing Authorities, audit bodies, DLAF (Romania’s Anti-Fraud Department), OLAF, EPPO and DNA in the life-cycle of a project;
• how you can move from an apparently technical audit finding to a criminal case and asset-freezing/confiscation measures;
• what defence strategies you have on the administrative side (complaints, actions in administrative court) and on the criminal side (EPPO/DNA investigations, measures ordered by Romanian courts);
• how EU case law (CJEU, ECtHR) and EU regulations on freezing/confiscation influence what may happen to your company’s assets.

Throughout the text you will find links to EU legislation and official guidance, but also internal links to related articles on maglas.ro about EPPO, ANAF tax controls, enforcement and confiscation, so you can build a coherent defence strategy, not isolated reactions to each separate authority.

1. The big picture: why EU and PNRR funds are treated differently

EU funds and PNRR (RRF) money are not just “another grant”. At EU level, Article 325 TFEU requires both the Union and Member States to counter fraud and other illegal activities affecting the Union’s financial interests with effective and dissuasive measures. This obligation is operationalised through a complex framework:

• Regulation (EC, Euratom) No 2988/95 on the protection of the European Communities’ financial interests, which sets out common rules for administrative checks, limitation periods and sanctions related to irregularities affecting the EU budget;
• Regulation (EU) 2021/241 establishing the Recovery and Resilience Facility (RRF), the main instrument behind PNRR;
• Regulation (EU, Euratom) No 883/2013, governing OLAF investigations into fraud, corruption and other unlawful activities affecting the EU’s financial interests;
• Directive (EU) 2017/1371 (PIF Directive) on the fight against fraud affecting the Union’s financial interests by means of criminal law;
• Regulation (EU) 2017/1939 establishing the European Public Prosecutor’s Office (EPPO), competent to investigate and prosecute PIF offences;
• Regulation (EU) 2018/1805 on mutual recognition of freezing and confiscation orders, which allows confiscation measures ordered in one Member State to be executed quickly in another.

At national level, Romania has adopted special rules for irregularities and fraud in the field of EU funds. For “classic” EU funds (ESIF), the main instrument is Government Emergency Ordinance No 66/2011 on preventing, finding and sanctioning irregularities in the obtaining and use of European funds and/or related national public funds. For PNRR money, the key act is Government Emergency Ordinance No 70/2022 on preventing, verifying and finding irregularities/double financing and serious irregularities related to funds under the Recovery and Resilience Mechanism and related national public funds, plus recovery of resulting claims.

This means your PNRR / EU-funded project is monitored in parallel by:

• Managing Authorities and Intermediate Bodies, which perform ex-ante and ex-post administrative and on-the-spot checks;
• Audit Authorities and the Court of Accounts, which verify systems and sample projects;
• DLAF (Romania’s Anti-Fraud Department), as national coordination service for the protection of the EU’s financial interests and point of contact with OLAF;
• OLAF and EPPO, which may open investigations in parallel or after national checks;
• DNA and other Romanian prosecutors, when national criminal offences are in play (corruption, subsidy fraud, money laundering, organised crime etc.);
• ANAF and ANABI, for tax treatment/enforcement of corrections and for administration of seized/confiscated assets.

The key practical consequence: an irregularity in your project is never “just” a misunderstanding with a Managing Authority. It is an event inside a larger EU protection system, where every finding can be escalated – horizontally (to OLAF / EPPO) and vertically (to courts and asset-recovery authorities).

2. Irregularity, serious irregularity, suspected fraud: three different levels of risk

2.1. What is an “irregularity”?

In EU law, “irregularity” is usually defined as any breach of EU law or national rules relating to its application, resulting from an act or omission by an economic operator which has, or would have, the effect of prejudicing the EU’s financial interests by charging an unjustified item of expenditure to the EU budget. This concept appears in Regulation 2988/95 and later legislation on structural funds and irregularity reporting.

In Romanian law, GEO 66/2011 defines “irregularity” as any deviation from legality, regularity and conformity in relation to the obtaining and use of European funds and/or the corresponding national public funds, which prejudices or may prejudice the budgets concerned. GEO 70/2022 uses similar language for PNRR, adding a focus on double funding, conflicts of interest, corruption and fraud indicators as “serious irregularities”.

For you, as an SME beneficiary, the practical meaning is:

• You can have an irregularity even without bad faith – for example, a tender notice that does not respect all transparency rules, a minor breach of publicity requirements, or a cost included outside the eligibility period.
• An irregularity does not automatically mean fraud, but the same facts can be re-qualified as fraud if intentional elements, forged documents or corrupt agreements are identified later.
• Even if criminal elements are never found, an irregularity may still trigger financial corrections and recovery of amounts, with interest and enforcement measures very similar to tax debts.

2.2. What is a “serious irregularity” under PNRR rules?

GEO 70/2022 introduced the concept of “serious irregularities” specifically for funds under the Recovery and Resilience Mechanism and related national co-financing. The text explicitly targets:

• double funding (for example, the same costs being financed under both a PNRR scheme and a traditional ESIF programme);
• conflicts of interest, corruption and fraud in procurement and project implementation;
• other irregularities which, by nature and financial impact, seriously affect the achievement of PNRR milestones and targets.

In practice, “serious irregularity” is a red flag: it indicates higher financial corrections, more intense reporting to the European Commission, and a higher likelihood that DLAF, OLAF or EPPO will become involved.

2.3. When does “irregularity” become “suspected fraud”?

The distinction between administrative irregularity and suspected fraud follows EU anti-fraud guidance: fraud implies an intentional act or omission, often involving false documents, misrepresentation or concealment, aimed at obtaining undue EU funds or avoiding obligations. The PIF Directive harmonises the criminalisation of such conduct (fraud, corruption, misappropriation, money laundering, serious VAT fraud) in Member States.

Typical indicators that push an irregularity into “suspected fraud” territory include:

• artificial splitting of contracts to circumvent thresholds or competition rules;
• rotating winners and bid-rigging between related companies;
• fake competition in procurement (only “friendly” bidders invited, identical wording in offers, shared contact details or IP addresses);
• invoices from shell companies without real activity, used to justify inflated prices or non-existent deliveries;
• systematic misreporting of deliveries, outputs or milestones.

Once such patterns are identified, Managing Authorities and audit bodies are under an obligation to report suspected fraud to DLAF and OLAF, and, where the case falls within its competence, to EPPO.

3. Who controls you: Managing Authorities, DLAF, OLAF, EPPO, DNA and ANABI

3.1. Managing Authorities, Intermediate Bodies and Audit Authorities

For both traditional EU funds (ESIF) and PNRR, the first line of control is at national level:

• Managing Authorities (MAs), such as the ones coordinated by the Ministry of European Investment and Projects (MIPE), approve projects, verify reimbursement claims and carry out on-the-spot checks;
• Intermediate Bodies may be delegated certain tasks (evaluation, contracting, verification);
• Audit Authorities and the Court of Accounts perform system and sample audits, often years after project completion.

Their powers include requesting documents, conducting site visits, recalculating eligible costs and imposing financial corrections based on national and EU guidelines (for example, the Commission’s flat-rate correction tables for procurement irregularities).

For an SME, this layer is where you can still solve issues mainly as administrative problems, by clarifying documents, renegotiating corrective measures or challenging a correction decision through administrative complaint and then in court.

3.2. DLAF – the national anti-fraud coordination service for EU funds

DLAF (Departamentul pentru Lupta Antifraudă) is Romania’s Anti-Fraud Department and acts as the national coordination service to protect the EU’s financial interests (AFCOS). It receives fraud suspicions from Managing Authorities and other bodies, carries out its own controls and may forward cases to the prosecution services or OLAF.

In practice, when an MA or audit body believes that irregularities in your project show fraud indicators, they draft a fraud suspicion report, which is sent to DLAF. DLAF may:

• ask for additional documents and explanations from you as beneficiary;
• carry out its own on-the-spot control;
• propose financial corrections and recovery of funds;
• refer the case to prosecutors (DNA, PICCJ or other competent units) or cooperate with OLAF and EPPO, depending on the nature of the case.

3.3. OLAF – EU anti-fraud investigations and cooperation with EPPO

OLAF (European Anti-Fraud Office) is the EU body mandated to detect, investigate and stop fraud, corruption and other illegal activities affecting the EU budget. It can conduct administrative investigations across Member States, recommend financial corrections and recovery, and transmit information to national authorities and EPPO for criminal follow-up.

According to the OLAF 2023 Annual Report, the office recommended recovery of around €1.04 billion, prevented over €200 million in undue expenses and opened or handled hundreds of investigations, including 79 cases where cooperation with EPPO was involved. Many of these concern cohesion policy and agricultural funds, but fraud schemes in the context of the RRF/PNRR are increasingly on the radar.

A recent example highlighted by OLAF concerns misuse of EU funds for development projects in Romania’s Danube Delta, where dozens of projects were allegedly used in fraudulent schemes, with OLAF cooperating closely with EPPO and national authorities. While each case is different, the message is clear: project chains and networks of SMEs used as “vehicles” in larger schemes are a priority.

3.4. EPPO and DNA – when your project becomes a criminal file

The European Public Prosecutor’s Office (EPPO) is an independent EU prosecution office, created by Regulation (EU) 2017/1939, with competence to investigate and prosecute crimes affecting the Union’s financial interests (PIF offences) in participating Member States, including Romania. Its jurisdiction covers:

• fraud and other offences related to EU expenditure and revenue (including EU grants and PNRR funds);
• cross-border VAT fraud with damage of at least €10 million involving at least two Member States;
• corruption, misappropriation and money laundering involving EU funds;
• other offences inextricably linked to such crimes.

Romania also has a specialised anti-corruption prosecution office – DNA – which retains competence for certain corruption and fraud offences not falling under EPPO jurisdiction or for non-participating EU Member States / third country elements. In practice, complex cases may involve parallel or sequential work by EPPO and DNA, with rules on which office has priority.

On maglas.ro you already have several articles explaining what happens in EPPO cases and how to react in the first 48 hours, such as:

• 10 scenarii neplăcute în dosare EPPO (și ce faci în primele 48 de ore);
• Ghid practic pentru inculpatul „mâncat” de un dosar EPPO;
• Sechestrul EPPO: cum îți deblochezi conturile și bunurile (ANABI, Reg. 2018/1805).

3.5. ANABI and cross-border freezing / confiscation

Once a criminal case is opened (EPPO or national), asset freezing and confiscation become central. At EU level, Regulation (EU) 2018/1805 introduced a common regime for mutual recognition of freezing and confiscation orders, so that a seizure ordered in Romania can be executed rapidly in another Member State, and vice versa.

In Romania, ANABI (National Agency for the Management of Seized Assets) plays a central role in registering, managing and often selling seized assets under Law No 318/2015 and in the context of Regulation 2018/1805, as recognised also in the National Strategy on Asset Recovery and participation in EU projects such as RECOVER. In EU funds cases, this may include bank accounts, equipment purchased under the project, real estate, or even shares in your company.

For entrepreneurs, this means that once a case escalates beyond an administrative irregularity, the risk is no longer limited to “paying back the grant” – it extends to your broader asset base, in Romania and across the EU.

4. From audit finding to financial correction

In most SME cases, the first tangible consequence of an irregularity is a financial correction, not a criminal file. The typical steps are:

1. Detection of irregularity by the MA/IB, audit authority or Court of Accounts (through desk checks or on-the-spot visits).
2. Draft report or “note of findings”, communicated to the beneficiary, with a possibility to submit observations and additional documents.
3. Classification of the irregularity according to national and EU guidelines (for example, a procurement irregularity, ineligible cost, breach of publicity obligations, double funding, state aid issue).
4. Application of a financial correction, either exact (based on the specific financial impact) or flat-rate (for example 5%, 10%, 25% of the contract value for certain types of procurement irregularities, based on Commission guidelines and national instructions).
5. Issuance of a recovery decision (debit note, recovery order), with a due date and information on how to challenge it.

Under GEO 66/2011 and GEO 70/2022, the process-verbal (PV) for establishing irregularities and resulting budgetary claims usually constitutes both a budgetary claim title and an enforceable title, if not paid voluntarily. The outstanding amounts may then be enforced similarly to tax debts, often via ANAF, with measures such as attachment of accounts and seizure of movable or immovable assets – a topic analysed in detail in:

• Poprirea pe conturi și executarea silită fiscală: ce poate face ANAF și ce poți contesta;
• Contestarea deciziilor de impunere și a altor acte ANAF: strategii de apărare.

For your defence, this stage is crucial, because:

• you can still handle the matter primarily as an administrative / fiscal dispute, through complaints and court actions, without the stigma and constraints of a criminal case;
• the way you document good-faith behaviour, internal controls and corrective measures now may later be used in your favour if criminal proceedings are opened.

5. When and how an administrative file becomes a criminal case

The transition from irregularity to suspected fraud usually follows one of these paths:

• Direct reporting by the MA, audit authority or Court of Accounts to DLAF and the prosecution services when fraud indicators are strong (e.g., false documents, clear conflicts of interest, collusion);
• DLAF investigation that identifies fraud elements beyond a mere irregularity, leading to a referral to the prosecutor (DNA or another competent unit);
• OLAF investigation initiated based on whistle-blower reports, information from EU institutions, or irregularity data, with recommendations to both the Commission (for financial corrections) and national authorities / EPPO (for criminal follow-up);
• EPPO investigations triggered by information from national authorities, OLAF, EU bodies or private parties, where the facts fall under PIF offences affecting the EU’s financial interests.

Once a criminal investigation begins, the focus shifts from eligibility and documentation to offences such as:

• fraud to the financial interests of the EU (as implemented from the PIF Directive into national criminal law);
• corruption and trading in influence in award of contracts financed from EU funds;
• money laundering of proceeds of EU funds fraud;
• organised criminal group (when networks of companies and individuals are involved).

At this point, asset freezing becomes a priority. Under Regulation 2018/1805 and national law, prosecutors can request freezing of bank accounts, movable and immovable property, often enforced via ANABI and recognised quickly in other Member States. Your project assets – equipment purchased with EU money, buildings, intellectual property – can be caught in these measures.

6. Your defence strategy – administrative phase

6.1. Engage early in the audit process

When you receive an audit report or a draft irregularity finding:

• React within the deadlines given for observations. Late or superficial reactions are often interpreted as acceptance.
• Provide complete documentation – tender files, evaluation reports, contracts, technical justifications, minutes, board decisions, emails if relevant.
• Explain the context – for example, market disruptions, price volatility, pandemic or supply-chain issues that justified certain choices.
• Distinguish human error from intent – where the facts are clearly due to negligence or misinterpretation, emphasise corrective measures (updated procedures, training, four-eye checks, segregation of duties).

6.2. Challenge financial corrections where they are disproportionate

Under GEO 66/2011 and GEO 70/2022, you usually have two main paths:

• Administrative complaint against the PV and recovery decision, within the time-limit indicated therein (often 30 days);
• Action in administrative court against the decision / PV, where you can invoke both national law and EU law (proportionality, legal certainty, legitimate expectations) as interpreted by the CJEU.

In court, it may be possible to argue that:

• the irregularity is purely formal and has no real financial impact;
• a lower flat-rate correction should apply;
• the calculation of the correction is mathematically wrong or based on incorrect data;
• the national authority did not proportionately balance the need to protect the EU budget with your good-faith conduct and corrective actions.

These disputes often intersect with tax issues (treatment of recovered amounts, deductibility) and with enforcement. For a broader picture on how to defend yourself against ANAF acts and enforcement, see:

• Controlul fiscal ANAF: ce verifică inspectorii, care sunt drepturile tale și cum te pregătești;
• Contestarea deciziilor de impunere și a altor acte ANAF;
• Moștenirea datoriilor fiscale și executarea silită ANAF împotriva moștenitorilor.

7. Your defence strategy – criminal phase (EPPO / DNA)

7.1. Understand your procedural position

In a criminal file you may appear as:

• witness – at an early stage, providing explanations about the project;
• suspect – once there are reasonable grounds to believe you committed an offence;
• defendant – if the case goes to court.

Each status brings different rights and obligations (right to silence, access to file, right to a lawyer, privilege against self-incrimination). Exercising these rights intelligently – without obstructing justice, but without providing self-incriminating statements – is crucial. For general criminal procedure issues, see the broader criminal-law articles on the blog (witness hearings, pre-trial measures, plea agreements, etc.).

7.2. Coordinate the administrative and criminal strategies

Often, the same underlying facts generate:

• an administrative track (financial correction, recovery, administrative court litigation);
• a criminal track (EPPO/DNA investigation and trial).

EU and ECHR law are evolving on how far parallel administrative and criminal sanctions can go without violating the ne bis in idem principle (no double punishment for the same facts). The CJEU and ECtHR have accepted, under certain conditions, cumulative administrative and criminal measures in the field of tax and EU financial interests, provided that the overall burden is not disproportionate.

In practice, this means your defence must:

• ensure consistency between positions taken before the MA, DLAF and the criminal authorities;
• carefully assess whether to challenge administrative measures immediately or to align timing with criminal defence tactics;
• document any disproportionate cumulative effect of corrections and sanctions, as this may later be invoked under EU/ECHR standards.

On maglas.ro you already have a dedicated article on ne bis in idem in tax-crime scenarios, which explains how parallel ANAF and criminal proceedings can interact.

7.3. Protecting your assets against extended confiscation

In EU funds cases, prosecutors may request not only confiscation of the direct proceeds (the grant amounts), but also extended confiscation of other assets that appear disproportionate to lawful income. The ECtHR has accepted, in cases like Gogitidze and Others v. Georgia and Telbis and Viziteu v. Romania, that non-conviction based or extended confiscation can be compatible with the right to property, provided sufficient safeguards exist.

In Romania, these mechanisms are regulated by the Criminal Code and Criminal Procedure Code, complemented by Law 318/2015 (ANABI) and EU instruments like Regulation 2018/1805. Defence work must focus on:

• challenging the causal link between alleged fraud and specific assets;
• demonstrating legitimate sources of funds and proportionality;
• contesting freezing / confiscation orders nationally and, where relevant, in the executing Member State.

These topics are covered in detail in the article Confiscarea specială și confiscarea extinsă în dosarele economice: cum îți protejezi bunurile și conturile and in the analysis on cross-border recognition of confiscation and other criminal judgments.

8. Prevention: building an internal compliance system for EU / PNRR projects

The best defence remains prevention. The European Commission has long encouraged Member States and beneficiaries to build robust anti-fraud systems for EU funds, through Guidelines on National Anti-Fraud Strategies and specialised guidance on conflicts of interest, double funding and fraud risk assessment.

For SMEs, a realistic compliance programme could include:

• Clear internal allocation of responsibilities: who manages procurement, who signs contracts, who verifies technical delivery, who certifies expenses.
• Written procedures for procurement (including direct procurement and simplified procedures), documentation archiving and eligibility checks.
• Conflict-of-interest declarations for management and key staff involved in procurement and project management.
• Regular training on eligibility rules, documentation requirements and typical red flags (e.g., related-party suppliers, unexplained price differences).
• Internal audit or at least periodic internal checks before submitting reimbursement requests.
• Double-funding checks, especially if your company runs multiple projects or participates in consortia under different programmes (ESIF, PNRR, national schemes).

It may be useful to align internal policies with the big-picture analysis of EU-Romania dynamics in funding and conditionality, as discussed in the article Bruxelles vs. București: procedura de deficit excesiv, plafonarea prețului la gaze și condiționarea fondurilor europene.

9. Key takeaways for SME entrepreneurs with EU / PNRR projects

• Not every irregularity is fraud, but any irregularity is part of a system where information travels quickly between MAs, DLAF, OLAF, EPPO and DNA.
• Financial corrections under GEO 66/2011 and GEO 70/2022 can turn into enforceable budgetary claims, with ANAF-style enforcement against your accounts and assets.
• EPPO and DNA come into play when there is a reasonable suspicion of PIF offences – fraud, corruption, misappropriation, money laundering, serious VAT fraud – not for small, isolated clerical mistakes.
• ANABI and Regulation 2018/1805 mean that asset freezing and confiscation can have a cross-border dimension: what happens in a Romanian court can quickly impact assets in other EU countries.
• Defence must be coordinated: administrative complaints, actions in administrative court and criminal defence strategies should be designed together, not in isolation.
• Prevention is cheaper than litigation: an internal compliance system adapted to your size and sector drastically reduces the probability that an irregularity escalates into suspected fraud.

If your company is facing audit findings, financial corrections or already has a DLAF / OLAF / EPPO or DNA file connected to EU or PNRR funds, specialised legal advice is not a luxury – it is a form of risk management for your entire business and personal assets.

FAQ – Irregularities, PNRR and criminal liability for SMEs

1. If my SME made a mistake in procurement, is that automatically fraud?

No. A procurement mistake (for example, missing an advertising requirement, using a wrong award criterion, or a documentation error) is usually treated first as an administrative irregularity. This may lead to a financial correction (percentage reduction of eligible costs) but not necessarily to a fraud qualification.

It becomes “suspected fraud” if there are indicators of intentional manipulation – collusion with certain bidders, fake competition, forged documents, conflicts of interest, or systematic misrepresentation. In those scenarios, MAs and audit bodies must report to DLAF, OLAF and, where applicable, EPPO.

2. How big must the amount be for EPPO to get involved?

EPPO’s competence is defined by Regulation (EU) 2017/1939 and the PIF Directive. There is no general minimum threshold for EPPO to be competent in non-VAT EU expenditure fraud cases; in practice, however, EPPO tends to focus on cases with significant financial impact or systemic importance.

For cross-border VAT fraud, EPPO competence generally requires total estimated damage of at least €10 million involving at least two Member States. For other PIF offences, the Regulation mentions lower thresholds (for example, above €10,000 damage, with certain conditions) but leaves room for EPPO to refer minor cases back to national authorities in the interest of efficiency.

3. Can I challenge a financial correction applied to my project?

Yes. Under GEO 66/2011 and GEO 70/2022, you can typically:

• submit an administrative complaint against the PV and recovery decision within the statutory deadline; and
• bring an action in administrative court to challenge the legality and proportionality of the correction.

In court, you can rely on both national rules and EU law (proportionality, legitimate expectations, interpretation of “irregularity” and extent of financial corrections) as clarified by CJEU case law on structural funds.

4. Can I be sanctioned both administratively (correction) and criminally for the same facts?

Yes, but with limits. EU and ECHR case law accepts that administrative financial corrections and criminal sanctions may coexist for the same underlying facts (for example, EU funds fraud and recovery of the grant), provided that the overall burden is not disproportionate and the mechanisms are sufficiently coordinated to respect the ne bis in idem principle.

In practice, this means that:

• you may need to litigate both the correction decision and the criminal charges;
• your defence should document and argue any excessive cumulative effect of corrections and sanctions;
• arguments based on EU law and ECHR jurisprudence may help reduce the overall burden or avoid double punishment in certain configurations.

5. Which of my assets can be frozen or confiscated in an EU funds case?

Prosecutors may request:

• freezing of bank accounts (personal and company accounts);
• seizure of project assets (equipment, vehicles, IT infrastructure financed under the project);
• freezing of real estate, company shares or other assets belonging to you or related parties;
• extended confiscation of assets that appear disproportionate to lawful income, if legally justified.

Under Regulation 2018/1805, such freezing and confiscation orders can be recognised and executed in other Member States, often with ANABI coordinating asset management in Romania. ECtHR case law confirms that, if properly justified and proportionate, such measures can be compatible with the right to property.

6. What should I do immediately if my company is notified about a DLAF / OLAF / EPPO investigation?

Some immediate steps to consider:

• Do not ignore the notification – acknowledge receipt and respect deadlines.
• Engage specialised legal counsel experienced in EU funds, administrative law and criminal law.
• Secure and organise documentation – contracts, procurement files, invoices, timesheets, technical documents, correspondence.
• Avoid destroying or altering documents, as this may lead to obstruction charges.
• Prepare a consistent narrative about how the project was designed, implemented and controlled internally.

For EPPO-specific scenarios, the articles already published on maglas.ro (practical guides for EPPO suspects, sequesters and cross-border enforcement) provide concrete checklists for the first 48 hours.