An ISO standard to make the fight against the Mafia a common language for international markets

The anti-Mafia culture originated in Italia within its institutions. Since 2001, with Decree 231, it has been incorporated into businesses : an organisation is accountable for the way it is structured, and may be exploited by others without its knowledge. Today, it has no transferable form. In these pages, together with Marco Letizi, we have proposed giving it an ISO standard, based on the practices developed over thirty years of the Italian anti-Mafia movement. Here we show why the international dimension is essential.

Jared Cohen, writing in Foreign Affairs on 7 October, states that what distinguishes African countries that attract capital from those that lag behind is the response of their governments: are contracts honoured? Do the rules hold? These are questions directed at the states. For a business, there is a question directed at the market: who will it be dealing with? The Africa Organised Crime Index 2025 (ENACT) records the growth of foreign criminal actors, with West Africa scoring the highest in the world; the DIA (2023 report) identifies Côte d’Ivoire, Guinea-Bissau and Ghana as logistical bases for Calabrian mafia groups. A ruling by the investigating magistrate in Locri in May 2021 reveals the mechanism: three Italians, one of whom was already subject to special surveillance and asset confiscation, facing charges of money laundering aggravated by mafia involvement, set up a mining company in the Ivory Coast, 51 per cent of which is registered in the name of a local partner – as required by Ivorian law – though a parallel agreement reserves 5 per cent of the profits for that partner, and an import-export company to finance it; to obtain the permit, according to the prosecution, they paid the regional director of mines and, when the parks authority blocked it, also his local manager, via intermediaries: approximately 12,000 euros; Canadian partners, according to the wiretaps, are waiting to invest once the concession has been obtained, unaware that it does not exist. Corruption, in this case, is already covered by ISO 37001, through checks on partners and intermediaries.

No legislation covers the rest: the hidden partner subject to preventive measures, the fictitious ownership arrangement designed to circumvent them, the profit-sharing agreement. These are the indicators an Italian prefect uses to justify a disqualification order – and which a Canadian investor cannot interpret. Three legal systems, no common language. An Italian company that enters into a relationship with such a partner is held liable in Italia on three levels: criminally, only where there is intent, including constructive intent (Criminal Court of Cassation, Section II, No. 43968/2022); corporate liability, because Article 4 of Legislative Decree 231/2001 extends liability to offences committed abroad (Criminal Court of Cassation, Section VI, No. 11442/2016); in terms of prevention, because the prefectural disqualification order is independent of convictions (Article 91(6) of Legislative Decree 159/2011; Council of State No. 1101/2024) and excludes entities from contracts, concessions and public funding. In every context, what counts is the organisational framework the company had put in place prior to the offence: an exculpatory factor for the entity, an indication of good faith for individuals, and a predictor of prevention. However, anti-money laundering obligations apply to financial intermediaries and designated categories, not to industrial enterprises, and voluntary measures are designed to address offences committed by the organisation, not the influence to which it is subjected.

A technical standard on infiltration would not certify the absence of the Mafia, but rather the organisation’s ability to recognise it and keep it at bay: the responsibility of senior management; the mapping of exposed processes, partners, intermediaries, suppliers and concessions; checks on ownership structures and the beneficial owners of counterparties; risk indicators based on Italian judicial and administrative experience. All of this already exists, scattered amongst 231 models, legality protocols and prefectural practices. What is missing is the format that makes it accessible to non-Italians.

In Italia , a company facing an infiltration attempt has at its disposal a prefect, a district public prosecutor’s office, the single national database of anti-Mafia documentation, and a shared language with those who monitor it. In a mining office in West Africa, it interacts with institutions that do not share that language, and with banks and partners that do not recognise the safeguards. The same applies in the Maghreb, where over 800 companies with Italian shareholdings operate and where Algeria still requires, in mining and other strategic sectors, a local majority shareholder – the same structure as in the Ivorian case; and in the Gulf, from which new capital flows into Africa, with the Emirates set to be outside FATF monitoring from 2024 and Kuwait within it from 2026. There is no common language on infiltration. A technical standard does not replace the state, but it gives companies, foreign officials and banks a way of referring to the same risk by the same name. The United Kingdom has done this with corruption: from the Bribery Act to BS 10500 and on to ISO 37001, now adopted everywhere without intergovernmental agreements.