INTRODUCTION
International tourism has rebounded strongly from the pandemic, with an estimated 1.52 billion international tourist arrivals in 2025.1 The expanding demand for outbound travel from developing countries, meeting highly asymmetric visa regimes, has given rise to a multi-tier visa service ecosystem. At the first tier, authorised application centres—operated by government-appointed providers such as VFS Global and TLScontact, or by consular-affiliated facilities such as the Korea Visa Application Centre—perform intake functions on behalf of diplomatic missions under inter-state or consular authorisation. At a second and legally distinct tier, travel agency intermediaries act under contractual mandate from the individual applicant to prepare and submit applications. The present article concerns the second tier: agencies authorised by the applicant, not by the diplomatic mission.2
Short-term visas are also exploited by organised networks as a cover for irregular migration, often through fabricated documents and staged itineraries.3 Such networks routinely route applications through lawfully operating travel agency intermediaries—sometimes with their complicity, but more often by exploiting the structural position of agencies that do not know the true nature of the end-client.4 When such cases are uncovered, criminal investigations typically extend across the entire chain, including intermediary agencies whose role was limited to formal verification. This raises a core legal question: where does the boundary lie between unavoidable professional risk in the service industry and genuine corporate criminal liability? The existing literature on corporate criminal liability has been developed primarily around legal persons as primary actors; the position of a structural intermediary—performing only a formal function, without substantive access to the underlying transaction—remains analytically underdeveloped.
Vietnam offers a particularly instructive context. The 2015 Penal Code introduced corporate criminal liability for the first time in Vietnamese legal history,5 yet nearly a decade of implementation shows that the procedural apparatus has not kept pace with substantive recognition, particularly for legal persons occupying complex structural positions in service chains.6 Combining doctrinal analysis with scenario-based modelling, the article proceeds as follows: Part II develops the structural intermediary as an analytical category; Part III sets out a two-axis framework for fault attribution; Part IV applies the framework to a scenario synthesised from recurring industry practice and to Vietnamese law; Part V advances recommendations; and Part VI concludes.
THE STRUCTURAL INTERMEDIARY AS AN ANALYTICAL CATEGORY
The term structural intermediary is used here to designate a legal person characterised by four concurrent features. First, it operates under formal mandate—whether granted by a public authority, a private principal such as the end-client, or an upstream commercial partner—that expressly bounds the scope of its legal function. Second, the mandated function is predominantly or entirely formal in nature, such as document preparation and checklist-based submission, and does not include substantive verification of the underlying facts that the documents represent. Third, the firm lacks meaningful access to information about the true motivations and personal circumstances of the end-client. Fourth, its economic contribution to the transaction is typically modest relative to the overall value at stake for the end-client, reflecting the formal nature of the function it performs.7
In the visa service ecosystem examined in this article, the paradigmatic structural intermediary is the travel agency that acts under contractual authorisation from the individual applicant. Such an agency undertakes to prepare and submit an application package at an authorised application centre or embassy, in accordance with the checklist published by the receiving mission. It does not exercise consular functions, does not receive any delegation from the foreign state, and does not acquire substantive investigative powers over the applicant’s personal circumstances. This position must be distinguished from that of outsourced consular intake operators, whose mandate runs from the diplomatic mission itself and whose legal position is governed by inter-state or consular arrangements; the framework developed here does not aim to analyse that category.
Traditional attribution doctrines—the identification doctrine associated with English law, vicarious liability as developed in United States federal jurisprudence, and aggregation-based approaches—were designed primarily for the primary-actor scenario.8 Applied to structural intermediaries, these doctrines either over-include or under-include. The identification doctrine requires attributing the criminal state of mind of a senior individual to the corporation, but in a structural intermediary no directing mind engages with the substance of the underlying transaction. Vicarious liability would attribute liability to the corporation for any employee conduct within the scope of employment that partly benefits the corporation—mechanically applied, this converts the intermediary into a strict-liability backstop for offences committed elsewhere. Aggregation approaches run into the same information-access problem: the structural intermediary’s aggregate corporate knowledge is, by design, bounded by its formal function.9
The classic concern that corporate punishment risks either failing to deter or punishing innocent stakeholders10 takes on a distinct shape in the structural-intermediary context, where the firm itself is, in a meaningful sense, an unintended stakeholder in someone else’s wrongdoing. Recognising the structural intermediary as a distinct analytical category reframes the inquiry: the question is no longer whether a firm has committed an offence, but how responsibility should be allocated along a chain in which the offence originates from a different link.
A TWO-AXIS FRAMEWORK FOR FAULT ATTRIBUTION
The framework proposed here rests on two parallel axes. The first axis concerns the duty of due diligence, which is decomposed into three tiers of increasing depth. Tier 1—formal verification—consists of checking documents against an officially issued checklist to ensure completeness and type-correctness. Tier 2—red-flag verification—involves recognising patently unusual features of an application that can be observed without specialised investigation, such as notable uniformity in document layout, concentrated geographic clustering of applicants, or internal inconsistencies within the file. Tier 3—substantive verification—involves investigating the underlying truth of documents, including direct contact with issuing parties and on-site inquiry. The tier applicable to any particular firm is determined by three factors: the scope of its mandate, prevailing industry standards, and its factual access to substantive information.11
The second axis concerns three possible levels of fault. Level 1—professional risk—denotes losses arising from legitimate professional activity where the firm has discharged its applicable duty; no criminal liability attaches. Level 2—organisational shortcoming—denotes fault flowing from the absence of adequate internal procedures, training, or control mechanisms necessary to detect red flags; administrative or civil consequences may follow, but criminal liability typically does not arise absent an intentional element. Level 3—corporate complicity—arises where the firm knew or ought to have known of the criminal conduct occurring elsewhere in the chain and nevertheless engaged in it, whether through internal policy, incentive structures, or a pattern of economic benefits disproportionate to lawful activity.
The two axes interact through a correspondence principle: the applicable standard is determined by the scope of the mandate and factual access—not by abstract expectation—and a firm that meets its applicable standard does not incur liability simply because an offence materialises elsewhere in the chain. Where a firm meets the formal standard but lacks systemic mechanisms to detect red flags, liability may shift to Level 2. Where indicia suggest that the firm knew or ought to have known of the criminal nature of the activity and continued to participate, Level 3 is implicated. Table 1 summarises the relationship.
Table 1. Relationship between the duty of due diligence and the three tiers of fault
| Verification tier | Criterion | Level of fault where duty is breached |
|---|---|---|
| Tier 1 – Formal | Checklist-based document verification | Breach may escalate from Level 2 to Level 3 depending on intent |
| Tier 2 – Red-flag | Recognising observable anomalies without specialised investigation | Breach of this duty when applicable → Level 2 (organisational shortcoming) |
| Tier 3 – Substantive | Verification of underlying truth, source contact, on-site inquiry | Expected only in narrowly defined contexts; intentional breach → Level 3 |
| Full compliance with applicable tier | Firm has discharged the duty under its mandate | Level 1 – Professional risk (no criminal liability) |
THE FRAMEWORK IN CONTEXT: A SCENARIO AND VIETNAMESE LAW
Consider a legal person (Firm M) operating as a travel agency in the visa service sector. Firm M enters into service contracts with individual applicants under which the applicant expressly authorises Firm M to prepare and submit visa applications on the applicant’s behalf. Firm M also maintains a network of partner small and medium-sized enterprises (Partner P)—typically regional or boutique agencies with direct client-facing capacity who subcontract the submission step. Partner P collects the applicant’s documents, assembles the file, and forwards completed files to Firm M, which performs a checklist-based check against the requirements published by the receiving diplomatic mission and submits the file at the authorised application centre or embassy. Firm M charges a nominal fee per submission, reflecting the formal character of its task. Firm M’s legal relationship is with the applicant (and, indirectly, with Partner P as an upstream subcontractor), not with the diplomatic mission.
In a given instance, Partner P forwards two application files that display no observable anomalies: the documents are complete, apparently regular on their face, and fall within a demographic category historically associated with high approval rates. Firm M performs its checklist-based verification, submits the files, and the visas are issued. Following entry, the two applicants are denied admission at the destination’s border and returned; subsequent domestic investigation reveals that they belonged to an organised network using fabricated documents to facilitate irregular overseas employment. Investigators summon both staff members of Firm M and Firm M itself as a legal person.
Applying the framework: Firm M’s contractual mandate from the applicant, read together with industry practice, confines it to Tier 1 verification—checklist-based completeness review of the documents the applicant chooses to provide; it discharged that duty; the observable features of the file did not trigger Tier 2 review; and its economic contribution was nominal rather than proportionate to any illicit benefit that the underlying scheme could have generated. The framework locates the case at Level 1—professional risk—and no substantive criminal liability should attach to Firm M. Yet current legal arrangements permit, and in practice have led to, the summoning of the firm during the investigation phase. This is the precise point at which the analytical framework meets the limits of the prevailing legal order.
The nominal economic contribution deserves particular emphasis as an evidentiary matter. In the primary-actor model, disproportionate economic benefit to the firm functions as a strong circumstantial indicator of corporate complicity. The inverse configuration is equally probative for structural intermediaries: when the firm’s economic gain from the transaction is nominal and consistent with its narrow formal function, this tends to negate the inference of complicity. Courts and prosecutors assessing the liability of intermediaries in multi-tier chains should therefore treat the proportionality of economic benefit as a first-order evidentiary consideration.
Applying the framework to the Vietnamese legal context exposes two systemic gaps. The first concerns substantive law. Article 76 of the 2015 Penal Code specifies the offences for which commercial legal persons may bear criminal liability through an enumerated list.12 Offences involving the use of forged documents for irregular exit—such as the offence of forging seals or documents of agencies or organisations under Article 341 of the Penal Code13—are not included. The practical consequence is that the legal person is not the subject of criminal liability for such offences, with liability shifted entirely to individuals. The enumerated-list design produces under-inclusion in certain sectors and offers no calibrated instrument for allocating fault by degree across intermediary legal persons operating in service chains not encompassed by the list.14
The second gap concerns procedural law. Chapter XXIX of the 2015 Criminal Procedure Code establishes procedures for the prosecution of commercial legal persons15 but does not establish a preliminary screening mechanism specific to legal persons—that is, a front-end filter at the initiation or early investigation stage that would distinguish legal persons with indicia of substantive fault from those occupying purely structural formal positions. By contrast, the economic and social characteristics of legal persons are such that being summoned for investigation—even without eventual prosecution—generates significant costs.
These procedural costs fall disproportionately on Level 1 intermediaries and can be disaggregated into several distinct categories. First, direct compliance costs include the diversion of management time, the engagement of external counsel, and the internal document retrieval required to respond to investigative demands. Second, reputational costs emerge when the mere fact of being summoned becomes known to commercial partners, licensing authorities, or the public, potentially triggering contract terminations or loss of business opportunities. Third, mandate-dependency risk is particularly acute for firms whose business depends on ongoing authorisations: a licensing or professional authority may suspend or revoke an underlying authorisation pending the outcome of the investigation. Fourth, chain-spillover effects can arise when partner firms and clients disengage pre-emptively to limit their own exposure. Taken together, these costs mean that the investigation stage itself, not only the prosecution stage, functions as a quasi-sanction for structural intermediaries—regardless of the eventual legal outcome.
Taken together, the two gaps produce a procedural paradox: Vietnamese substantive criminal law narrows the scope of corporate liability through Article 76, while procedural law lacks a fault-calibrated filter at the investigation stage. The combined effect is that legal persons without substantive fault may nevertheless be drawn into the criminal investigation apparatus without a proportionate filtering mechanism.16
RECOMMENDATIONS
On the basis of the foregoing analysis, two targeted legislative recommendations are advanced, together with a third orientation directed at procedural design more broadly.
First, Vietnamese law should formally recognise a tiered duty of due diligence for service intermediaries. This recognition may proceed either through sectoral legislation—for example, amendments to the Law on Exit and Entry of Vietnamese Citizens17 or to the Law on Enterprises—or through authoritative guidance issued by competent agencies. The purpose is to provide a clear legal standard against which the conduct of intermediary legal persons can be assessed, replacing the current implicit and inconsistent benchmarks with an articulated framework that distinguishes formal, red-flag, and substantive verification duties.
Second, Chapter XXIX of the Criminal Procedure Code should be supplemented with a preliminary screening mechanism for legal persons prior to the application of formal investigative measures. Such a mechanism would require initial assessment of whether the legal person presents indicia of substantive fault at Level 2 or Level 3 before investigative summons, coercive measures, or public-facing procedural steps are taken. The mechanism should be calibrated to the structural position of the legal person, with a heightened threshold for firms whose mandate is bounded to formal verification functions. This proposal does not dilute the state’s investigative powers; it ensures those powers are deployed in proportion to the likelihood that the investigation will yield a prosecutable offence at the corporate level.
Third, for jurisdictions that are developing corporate criminal liability regimes for the first time, the broader orientation suggested by this analysis is to build fault-calibrated screening into procedural codes from the outset, rather than retrofitting such mechanisms after disproportionate investigative burdens have already accumulated. The innocent intermediary problem is a predictable by-product of mature service economies in which structural intermediaries proliferate; the procedural response should anticipate, not merely react to, that structure.
CONCLUSION
This article has identified and named an under-theorised legal phenomenon—the innocent intermediary problem—and has proposed a two-axis analytical framework combining a tiered duty of due diligence with a three-level classification of fault to distinguish professional risk, organisational shortcoming, and corporate complicity. Application of the framework through a scenario produced a clear analytical outcome for legal persons occupying purely structural formal positions: where the firm has discharged its mandated duty, no substantive criminal liability should attach.
Applying the framework to Vietnamese law reveals a procedural paradox arising from the interaction between Article 76 of the 2015 Penal Code and Chapter XXIX of the 2015 Criminal Procedure Code. The framework is not jurisdiction-specific; its two axes—the tiered duty of due diligence and the three levels of fault—are analytically independent of any particular statutory regime and can be mapped onto the legal concepts used in other systems. This portability extends to sectoral applications beyond the visa service industry: structural intermediaries exist in customs clearance, cross-border payment processing, platform-based gig work, labour export brokerage, and professional notarisation. In each case, the basic configuration recurs—a firm with a formally bounded mandate, narrowly defined legal functions, limited substantive information access, and modest economic reward, operating in a chain that may be exploited by primary offenders at other links.
Future research may pursue two directions. First, the framework can be tested across other service-intermediation sectors with comparable structures to refine the specification of each verification tier and the evidentiary triggers for each level of fault. Second, comparative application to other jurisdictions currently developing corporate criminal liability regimes—including Asian jurisdictions that have adopted different legislative philosophies—would stress-test the framework against varied doctrinal foundations. Empirical testing against actual litigation data would further strengthen the framework’s practical applicability.
*****
Footnotes
1. UN Tourism, World Tourism Barometer and Statistical Annex, January 2026 (World Tourism Organization 2026).
2. See generally Mark Pieth & Radha Ivory, eds., Corporate Criminal Liability: Emergence, Convergence, and Risk (Springer 2011) (surveying the development of corporate criminal liability across jurisdictions).
3. Marie McAuliffe & Linda Adhiambo Oucho eds., World Migration Report 2024 (Int’l Org. for Migration 2024).
4. Joanne van der Leun & Robert Kloosterman, Going Underground. The Labour Market Position of Undocumented Immigrants in the Netherlands, 97 Tijdschrift voor Economische en Sociale Geografie 59 (2006).
5. Do Thi Phuong, Criminal Prosecution Against the Crime of Legal Entities in Vietnam, 39 VNU J. Sci.: Legal Stud. 45 (2023), DOI: 10.25073/2588-1167/vnuls.4365.
6. Trinh Quoc Toan, Criminal Liability of Legal Entities in Criminal Law [Trach nhiem hinh su cua phap nhan trong phap luat hinh su] (National Political Publishing House, Hanoi 2011).
7. Brent Fisse & John Braithwaite, Corporations, Crime and Accountability (Cambridge Univ. Press 1993); see also James Gobert & Maurice Punch, Rethinking Corporate Crime (Butterworths 2003).
8. Pamela H. Bucy, Corporate Ethos: A Standard for Imposing Corporate Criminal Liability, 75 Minn. L. Rev. 1095 (1991); William S. Laufer, Corporate Bodies and Guilty Minds, 43 Emory L.J. 647 (1994).
9. See Celia Wells, Corporations and Criminal Responsibility (2d ed., Oxford Univ. Press 2001) (discussing the analytical limits of identification and vicarious liability doctrines).
10. John C. Coffee Jr., “No Soul to Damn: No Body to Kick”: An Unscandalized Inquiry Into the Problem of Corporate Punishment, 79 Mich. L. Rev. 386 (1981).
11. Konrad Zweigert & Hein Kötz, An Introduction to Comparative Law (Tony Weir trans., 3d ed., Clarendon Press 1998).
12. Penal Code [Bo luat Hinh su] 2015, Law No. 100/2015/QH13, art. 76 (Viet.), as amended by Law No. 12/2017/QH14.
13. Penal Code [Bo luat Hinh su] 2015, Law No. 100/2015/QH13, art. 341 (Viet.) (offence of forging seals or documents of agencies and organisations).
14. Tran Thanh Thao & Tran Trung Hieu, Scope of Criminal Liability of Legal Entities in the Criminal Law of Some Countries and Suggestions for Vietnam [Pham vi chiu trach nhiem hinh su cua phap nhan trong phap luat hinh su mot so quoc gia va nhung goi mo cho Viet Nam], 08(192) Vietnamese Journal of Legal Science 59 (2025), DOI: 10.70236/khplvn.300.
15. Criminal Procedure Code [Bo luat To tung hinh su] 2015, Law No. 101/2015/QH13, arts. 431–446 (Viet.) (Chapter XXIX: Procedures for legal persons).
16. Do Thi Phuong, supra note 6.
17. Law on Exit and Entry of Vietnamese Citizens [Luat Xuat canh, nhap canh cua cong dan Viet Nam] 2019, Law No. 49/2019/QH14 (Viet.), as amended 2023.