Telephone
02-77093611
Line
@fdlaw
address
17th Floor, No. 180, Section 2, Dunhua South Road, Da'an District, Taipei City
Legal content provided by:Lawyer Li Yusheng
When an employer discovers that an employee is suspected of embezzling funds, accepting kickbacks, falsifying documents, or violating job duties, it should first preserve legally obtained relevant evidence, clarify the employee's job authority and the facts of the conduct, and simultaneously assess the termination date of the employment contract, criminal liability, and civil claims. A company's suspicion that an employee has committed wrongdoing does not equate to meeting all the requirements for dismissal and criminal conviction.
This article focuses on how companies can integrate investigations into major disciplinary violations, termination of employment contracts, and civil and criminal prosecution. If the dispute primarily concerns the private interests and transaction prices between purchasing personnel and suppliers, a separate discussion should be held.Supplier relationships and cash flow related to procurement manager kickbacksA thorough comparison is necessary; a single crime charge cannot replace the entire investigation.
What should a company do if it discovers that an employee is suspected of embezzlement, breach of trust, or serious misconduct?
Shortages of company funds by finance or cashier, failure to collect business receivables, private kickbacks by purchasing and suppliers, falsifying expenses or creating false reimbursement forms, and unauthorized handling of company assets or material information by supervisors may all require immediate intervention. However, the ownership relationships, scope of authorization, purpose of the behavior, and potential harm differ for each type of incident, and "what the company deems unreasonable" cannot be directly equated with a crime.
The first step is to secure the original information that the company legally possesses, confirming who manages the funds, who has the approval authority, who actually operates the transaction, and on what day the abnormal transaction occurred. If the account can still make payments, delete files, or send data, risk permissions can be adjusted within the scope of legal management authority, and records before and after the adjustment should be retained; do not delete the account or reinstall the device first, so that the login and transaction evidence disappear together.
Next, an event timeline and document index are established, with HR, finance, IT, and other decision-making personnel confirming the facts they possess. Before interviews, objective documents are prepared, employees are asked to explain specific transactions and instructions, and questions, answers, times, and attendees are faithfully recorded. Access controls, temporary work arrangements, or investigative measures themselves must remain legal; an investigation cannot be equated with unpaid suspension or pre-trial conviction.
Can a company dismiss an employee directly under Article 12 of the Labor Standards Act for serious misconduct?
An assessment is possible, but it must meet specific legal grounds.Article 12, Paragraph 1, Subparagraph 4 of the Labor Standards ActThe requirement is a violation of the employment contract or work rules, and the violation must be serious. Whether it is serious should be determined by considering factors such as the job position, the nature of the violation, intent or negligence, impact and damage, the relationship of trust, and whether a lighter sentence could still maintain the employment relationship. The internal regulations stating "dismissal in all cases" does not mean the court will not review the case.
For example, the basis of liability for an employee responsible for safekeeping funds may differ from that of someone who has no such responsibility but merely submits documents on behalf of others. A single instance of negligence, unclear procedures, or explicit consent from a supervisor can also influence the judgment. The company must first prove the content of the regulations, the obligations that employees should abide by, and the actual facts of the violations; it cannot wait until an employee files a lawsuit before rewriting rules that were not previously communicated.
Section 1, paragraph 5 of the same article pertains to the intentional damage to machinery, tools, raw materials, products, or other property owned by the employer, or the intentional disclosure of technical or business secrets, causing harm to the employer. This requires specific conduct, intent, and the element of harm; it cannot be simply applied to any breach of confidentiality, misdirected attachments, or downloaded data. Paragraphs 4 and 5 should be examined separately and should not be lumped together as a single, abstract phrase like "violation of company interests."
When the law complies with Article 12, termination may be carried out without prior notice and no severance pay is required. However, wages already paid, unpaid special leave wages that should be settled, and other items payable shall still be handled in accordance with the law.Article 11. Dismissal for IncompetenceThe grounds and legal effects of disciplinary termination differ from those of Article 12; Article 12 cannot be used simply to avoid paying severance pay. A more comprehensive employee management and termination framework can be combined with...Labor law services for companies/employersEvaluate.
Before termination, a consistent written statement should be prepared, outlining the specific actions, applicable grounds, evidence, and investigation process. This statement should be clearly communicated and proof of arrival should be retained. If maternity leave, occupational injury medical treatment, or other special protections are involved, the termination restrictions must be confirmed separately. A judgment cannot be made solely based on Article 12.
There is a 30-day limit on dismissal. Can the company continue to investigate before making a decision?
It cannot be assumed that the internal investigation will automatically cease. Article 12, Paragraph 2 of the Labor Standards Act stipulates that the right to terminate under Paragraph 1, Subparagraphs 1, 2, and Subparagraphs 4 to 6 must be exercised within 30 days from the date the employer becomes aware of the situation; Subparagraph 3 is not an applicable clause under this period.
Preliminary rumors are not the same as having concrete facts sufficient to determine serious violations; however, whether legal knowledge has been obtained depends on actual information, organizational authority, and the content of the investigation, and cannot be determined solely by the company's final approval date, the date the investigation report was completed, or the date of criminal prosecution. Even if there are already remittances, authorizations, and employee statements sufficient for judgment, continuing to wait for irrelevant documents does not automatically allow for a delay in the calculation process.
It is recommended to record the dates of the initial discovery of the anomaly, the information received by each department, the acquisition of key data, employee statements, and the arrival of the decision and termination notice, and retain the versions actually held at that time. If the investigation is still necessary, the matters to be investigated and the completion timeline should be clearly listed so that lawyers can assess the risks during the process, rather than investigating for months and then looking back for grounds for dismissal.
What criminal offenses might an employee commit by embezzling company funds?
Embezzlement: First, confirm whether the employee has taken company property for business purposes.
Article 336, Paragraph 2 of the Criminal Law: EmbezzlementIt must be combinedArticle 335 EmbezzlementInspection: An employee, in the course of business, takes possession of another person's property with the intent to illegally possess it for themselves or a third party, thereby committing embezzlement. The cashier's custody of funds, collection of payments on behalf of customers, etc., should be proven by their position, payment and receipt procedures, and the destination of the money; mere discrepancies in accounts, short-term delays in reporting, or unclear debts are insufficient to circumvent the intent to illegally possess and the specific act of disposal.
The statutory penalty for embezzlement is imprisonment for a term of not less than six months and not more than five years, and may also be subject to a fine of not more than 90,000 yuan. Attempted embezzlement is also punishable. Subsequent return or settlement may affect the subsequent evaluation and does not mean that the original crime has been extinguished; it still needs to be judged based on the actual possession and use.
Breach of trust: Deviating from the entrusted task and causing damage to the company's interests.
Article 342 of the Criminal Law: Breach of TrustAn employee who primarily acts on behalf of others, intending to unlawfully benefit themselves or a third party, or to harm their own interests, engages in conduct that violates their duties, resulting in damage to company property or other interests. The company should explain what decisions the employee was entrusted with, which duty they violated, how they sought profit or caused harm, and how the harm occurred, rather than simply demonstrating familiarity with the vendor.
The statutory penalty for breach of trust is imprisonment for up to five years, detention, or a fine of up to NT$500,000, or both. Attempted breach of trust is also punishable. Embezzlement focuses on the possession of property for personal gain, while breach of trust involves a structure of entrusted matters and failure to perform duties. The constitution and application of the two must be determined based on the facts. It cannot be claimed that both crimes are committed simultaneously simply because an employee violates regulations or the company suffers losses.
False expense reports, fake invoices, and other liabilities should be compared item by item.
If a company makes payments through false information, or if false documents are created, altered, or used, it may constitute fraud or document offenses. When accounting matters are involved, the identity of the perpetrator, the content of the documents, and the requirements of commercial accounting law must also be verified. These are all further assessments based on the actual conduct; a crime is not established simply because a document contains a typo. The determination and evidentiary requirements for criminal conviction and termination of employment contracts must also be handled separately.
Should the company fire the employee first, or file a criminal complaint first?
There is no universally applicable order of priority for all cases. Companies can prepare labor law, criminal, and civil measures simultaneously; the fact that a criminal judgment is pending does not mean that one must wait before assessing Article 12, Paragraph 1, Subparagraphs 4 and 5. However, to dismiss a client, there must be a legal and sufficient basis of facts and evidence; "having reported the incident to the police" cannot be used as proof of seriousness.
The specific arrangements should be based on whether evidence is likely to be lost, whether the employee still has key authority, whether an explanation needs to be obtained first, and whether the 30-day period for exercising the right to terminate the employment contract is approaching. The company can first secure records, conduct interviews and verifications, and then issue a termination notice or file a lawsuit according to the procedural requirements; in serious criminal cases, it may also be necessary to immediately report to the police and prosecutors. A criminal complaint will not automatically terminate the employment contract, and a termination notice will not automatically generate a criminal case.
The conclusions of internal investigations, notices to employees, responses to labor authorities, and criminal complaints should all be based on the same set of verifiable facts. Do not use contradictory dates of events, damage figures, or authorization statements to justify different procedures, and do not threaten employees with legally mandated wages by threatening to sue.
How to preserve evidence of employee embezzlement, breach of trust, and serious misconduct?
Evidence is more than just a transfer or an admission. A more useful approach is to map each step of the process—from job authority to specific transaction, from the flow of funds and data to damages to the company—and to record what each document is trying to prove, as well as any remaining reasonable questions.
| Types of evidence | Prioritize saving data | Determine the purpose |
|---|---|---|
| Contracts and Jobs | Employment contract, confidentiality agreement, work rules, job description, authorization and approval scope. | Confirm what employees are supposed to do, what they should follow, and whether the rules have been communicated. |
| Transactions and Accounting | Payment, receipt, bank transactions, company books, payment requests, procurement, quotation and acceptance documents. | Reconcile specific transactions one by one to distinguish abnormal amounts, illegal profits, and actual damages to the company. |
| Communications and Systems | The company legally possesses work emails, communications, ERP, CRM, access logs, and internal audit data. | Preserve the complete context, time, and account correspondence; the operating account is not necessarily the same as the actual actor. |
| Interviews and surveys | Explanations from relevant personnel, interview attachments, investigation records, and a list of materials obtained at each stage. | Record the time, participants, information provided, and original words; do not create new explanations that did not exist previously. |
Original files, complete email headers, export formats, system time zones, sources, recipients, and acquisition processes should all be retained. When copying or handing over documents, checksums and transfer records should be established. When equipment identification is involved, appropriate personnel should preserve the original documents before analysis, avoiding repeated operations on the sole original. Records of authorizations, supervisor instructions, or corrections that may benefit employees should also be retained.
Company investigations still adhere to privacy and personal data boundaries. While employee accounts are managed by the company, this does not grant unlimited access to all private information; access must be based on legal grounds, necessity, and authorized procedures. Unauthorized access to employees' personal mobile phones, email accounts, or other accounts is prohibited, as is impersonating passwords or requesting others to log in secretly. If the focus is on company data downloaded or sent before resignation, further investigation may be conducted based on…Evidence preservation and legal action for departing employees who take confidential information with themDistinguish between the nature of the information and the remedy.
Can a company demand compensation from its employees, or even deduct their salary directly?
Civil claims can be assessed separately from criminal prosecutions, but they still require a basis for the claim, provable damages, causation, and the scope of compensation. The amount received by employees, the amount received by third parties, and the actual losses suffered by the company are not necessarily the same figures; all operating costs cannot be directly passed on to employees.
Article 26 of the Labor Standards ActWithholding wages as liquidated damages or compensation is prohibited. Companies should not arbitrarily deduct wages to cover unresolved or disputed damages. Even if employees have signed a statement, it must be verified whether it was truly voluntary, and whether the amount and legal basis are clearly defined. Standard consent forms cannot be used to circumvent wage protection.
The company may assess the information regarding formal requests, negotiations, civil litigation, or criminal incidental civil proceedings that meet the requirements; if there is a risk of asset stripping, the company may also determine whether the request for and reasons for preliminary attachment or other preservation measures can be explained. Preservation measures are not necessarily granted simply because the company claims losses, and criminal prosecution does not equate to the recovery of funds.
What can be done if an employee sues the company after being fired?
Employees may file for labor mediation, claim the dismissal is invalid, or initiate lawsuits to confirm the existence of the employment relationship and demand unpaid wages. In such cases, the company needs more than just information about the "employee's wrongdoing"; it also needs evidence of the applicable grounds for termination, the seriousness of the circumstances, the date of knowledge and notification, and proof that the notification was indeed delivered.
The company should systematically review employee requests, management regulations, factual findings, and termination procedures, and check whether internal investigations and external statements are consistent. The ongoing criminal proceedings do not exempt the company from its need to provide explanations and evidence in labor disputes; nor should it be assumed that a decision not to prosecute in a criminal case equates to any dismissal being illegal. Both procedures have their own criteria for judgment.
How does Fidelity Law Firm assist companies in handling serious employee misconduct?
These types of cases often involve company authority, accounting, transactions, employment contracts, and elements of criminal liability simultaneously. Fidelity can assist with legal assessments of internal misconduct, reviews of contracts and work rules, planning of investigations and evidence preservation, termination risk and notice of termination, criminal suits and civil claims, as well as subsequent labor mediation and litigation representation.
The specific work will be arranged according to the evidence gaps and procedural deadlines.Corporate criminal casesThis integrates job duties, cash flow, and behavioral analysis with employee disciplinary actions and external legal claims. Ongoing institutional and personnel risks can also be included.Legal ConsultantThe presiding attorney's business and legal background can help businesses understand the direction of their services; whether a case constitutes a crime or warrants lawful dismissal still depends on the specific information available.
Frequently Asked Questions (FAQ)
Can an employee who steals company funds be fired on the same day?
Arguments alone are insufficient. If specific actions and evidence have been confirmed, and the requirements of Article 12 regarding statutory grounds, circumstances, and timeframes are met, termination may be possible without prior notice; however, clear notification, retention of proof of arrival, and settlement of all outstanding payments are still required.
Can a company dismiss an employee simply because it suspects them of breach of trust?
Simply suspecting is insufficient. The entrusted duties, breach of obligation, objective actions, and impact should be confirmed first, and the materiality of the matter should be investigated and assessed in accordance with the law. Preservation and appropriate control of authority can be arranged initially, but this does not equate to having obtained grounds for dismissal.
If an employee admits to taking money, what other evidence does the company need?
A complete record of the acquisition process should be preserved, and then cross-checked using custody authority, original receipts and payments, ledgers, and fund usage. It should be acknowledged that there may still be disputes regarding advances, loans, or supervisor approvals for the funds received; a single sentence excerpt should not be retained.
From which day does the 30-day layoff period begin?
The grounds for applying Article 12, Paragraph 2, shall, in principle, be calculated from the date the employer becomes aware of the situation. The actual date of becoming aware must be determined based on the information available and the company's authority and responsibilities; initial rumors, fact-finding, and completion of internal approval cannot be mechanically considered as the same day. The investigation will not automatically cease.
The company has already filed a criminal lawsuit. Is it still necessary to process a separate dismissal?
These need to be handled separately. A statement does not automatically terminate the contract; termination still requires legal grounds, adherence to the exercise period, and proper notification. The first inspection period cannot wait until the criminal proceedings are over.
Can a company pursue liability for embezzlement or breach of trust after an employee leaves the company?
Leaving an employee does not absolve the company of any liability that has already been incurred. The company may still assess criminal prosecution and civil claims based on evidence, but must pay attention to the elements of a crime, the statute of limitations for prosecution or claims, the legal proceedings, and the assets available for execution.
Can the company directly deduct salaries to make up for the losses?
Wages cannot be withheld directly as compensation for damages that have not yet been determined. Wages should be settled in accordance with the law, and further recovery should be pursued through negotiation, litigation, and necessary preservation measures; internal disciplinary regulations cannot replace wage guarantees.
Does a company need legal assistance if it discovers serious misconduct, embezzlement, or breach of trust by an employee?
If a company has discovered abnormal cash flow, irregular transactions, false expense reports, or serious breaches of duty, it can first compile relevant personnel, accounting, and investigation materials, and have Fidelity Law Firm assess the risks of legal dismissal, criminal prosecution, civil claims, and related labor disputes.
Contact Fidelity Law Firm|LINE Inquiry|02-7709-3611
Regulatory verification: October 24, 2026. This article provides general legal information; specific handling still requires verification of case-by-case information and applicable regulations.
