This article is for general information only and does not constitute legal advice. Laws change, and your facts matter—consult Philippine counsel for a case-specific strategy.

Big picture

When an employee pockets client payments or client trust funds that passed through the company, two crimes under the Revised Penal Code (RPC) are typically examined:

Qualified Theft (Art. 310 in relation to Art. 308): taking another’s personal property, without consent, with intent to gain, aggravated because the offender abused grave trust (e.g., employee–employer).
Estafa (Swindling) (Art. 315): defrauding another by abuse of confidence or deceit, including misappropriating money received in trust, on commission, or for administration.

Which one applies largely turns on what kind of possession the employee had over the money (material vs juridical possession), and who legally owned or had the right to possess the funds at the time of the misappropriation (the employer or the client).

Core definitions and elements

Qualified theft (employee context)

To convict, prosecutors must typically show:

Personal property belonging to another (e.g., cash collected for the employer or already receipted to the employer).
Taking without the owner’s consent (this can be “constructive” taking—e.g., skimming, siphoning, or withholding remittances).
Intent to gain (animus lucrandi), inferable from acts like concealment, flight, falsified receipts, or refusal to return.
No violence or force upon things (otherwise it’s robbery).
Qualifying circumstance: abuse of confidence—often present in employer–employee relations.

Tell-tale scenario: A cashier/collector only has material (physical) possession of money that immediately becomes the employer’s when paid by a client. If she pockets it, that is commonly qualified theft against the employer.

Estafa by misappropriation or conversion (Art. 315(1)(b))

Prosecutors usually look for:

Money/property was received in trust, on commission, or for administration, or under an obligation to deliver or return.
Misappropriation or conversion to the employee’s own use, or denial of receipt.
Prejudice or damage to another (client or employer).
Demand is not an element, but it’s strong evidence of misappropriation when ignored.

Tell-tale scenario: An employee (or agent) receives juridical possession—lawful authority to hold and dispose in a limited way (e.g., sales agent holding client escrow to pay a specified third party). Misappropriation then points to estafa against the person/entity who entrusted the funds.

Why “juridical possession” matters

Material possession: mere custody or holding for the employer (typical for cashiers, tellers, roving collectors). Misappropriation ⇒ qualified theft (offended party usually employer).
Juridical possession: the law recognizes the employee/agent’s independent authority to possess (e.g., funds entrusted to her for a specific purpose). Misappropriation ⇒ estafa (offended party is the entruster—could be the client).

In many client-payment situations, ownership or right to possess shifts to the employer the moment payment is validly made to an authorized company representative; the employee who fails to turn over the money typically commits qualified theft against the employer. But where the client’s money was entrusted to the employee for a specific purpose (not yet the employer’s), failure to apply the funds as agreed may be estafa against the client.

Can the employer file the case?

Criminal complaints: who is the “offended party”?

Qualified theft: Yes. The employer (as owner or lawful possessor) is the offended party and can file a criminal complaint, submit evidence, and claim civil damages.
Estafa (client entrustment):
- If the client entrusted funds and was prejudiced, the client is the primary offended party.
- The employer may still file a complaint if it also suffered prejudice (e.g., it reimbursed the client, is legally liable to the client, or its own property/possession was affected). Often, employer and client co-file or execute supporting affidavits to streamline proof of entrustment, damage, and misappropriation.

Practice tip: You don’t need to “choose” the crime in your complaint. Allege all material facts. Prosecutors will evaluate whether the elements fit qualified theft, estafa, or both (charging decisions can change at inquest or after preliminary investigation).

Evidence you’ll need (both crimes)

Authority trail: proof that the employee was authorized (or not) to receive funds and in what capacity (job description, written authority, collection policies).
Flow of money: client invoices, official receipts, collection reports, deposit slips, POS/Z-readings, bank logs, e-wallet ledgers, and accounting entries tying the receipts to the company or to a specific entrusted purpose.
Proof of taking or conversion: shortages, unremitted funds, duplicate or cancelled ORs, altered ledgers, transfers to personal accounts, device logs, CCTV, access logs.
Demand (optional but helpful): written demand to account/return; proof of receipt; lack or inadequacy of response.
Damage: reconciliation reports, audit findings, affidavit of the client (if a client was prejudiced), company loss summaries.
Digital forensics: device imaging, email/chat extractions, audit trails. Preserve chain of custody.

Procedure: from discovery to filing

Immediate containment
- Secure records, devices, and access (HR/IT coordination).
- Consider preventive suspension under the Labor Code (observe due process).
- Freeze internal credentials; alert banks/payment partners if needed.
Internal fact-finding / audit
- Issue written notice to explain (for admin due process).
- Conduct cash count and reconciliation; document variances.
- Collect affidavits (auditor, supervisor, client).
Criminal route
- Prepare a Complaint-Affidavit with annexes.
- Inquest (if caught/ arrested without warrant) or regular preliminary investigation at the Office of the City/Provincial Prosecutor.
- Name the proper offended party (employer and/or client), identify the mode (qualified theft or estafa), and reserve or assert civil claims.
- Coordinate with PNP or NBI if specialized cyber/financial forensics are needed.
Civil and ancillary remedies (often parallel)
- Sum of money or damages suit; consider preliminary attachment to secure assets.
- If company paid/reimbursed the client, assert subrogation or indemnity.
- Restitution may mitigate but does not erase criminal liability; be careful with releases.
Labor/administrative action
- Observe twin-notice rule and reasonable opportunity to explain.
- Grounds: serious misconduct, fraud, or willful breach of trust (positions of trust).
- Keep administrative and criminal tracks documentarily consistent.

Demand letters and novation myths

Demand is not a legal element of qualified theft and not strictly an element of estafa by misappropriation; it mainly strengthens proof of conversion when the employee stays silent or evades.
Repayment plans or promissory notes (novation) do not extinguish criminal liability for theft/estafa, though they can affect damages and prosecutorial discretion.

Penalties and prescription (high level)

Penalties for theft and estafa scale with the value involved; amounts were updated by statute in recent years. Expect higher penalties as the value rises, and note that qualified theft imposes a higher penalty than simple theft.
Prescription (time-bar) depends on the penalty actually imposable, which is tied to the amount—file promptly to avoid defenses based on prescription.

Choosing the proper charge: a quick decision guide

Whose money was it at the time of taking?
- Already the employer’s (e.g., client paid the company via its authorized collector/cashier) → Qualified theft is likely.
- Still client’s entrusted funds (with a specific purpose; employee held in trust as agent/administrator) → Estafa is likely.
What possession did the employee have?
- Material only (custody for employer) → Qualified theft.
- Juridical (independent authority to possess for a purpose) → Estafa.
Who suffered the direct loss?
- Employer (shortage, non-remittance, shrinkage) → Employer is offended party; file.
- Client (entrusted funds diverted) → Client is offended party; employer may co-file or submit supporting affidavits, especially if it faces client claims or has reimbursed the client.

Practical drafting checklist (Complaint-Affidavit)

Parties and capacities (identify employee role and authority).
Collection/entrustment mechanics (who pays/entrusts whom, when money becomes the employer’s, or the specific purpose).
Reconciliation narrative (how shortage/misappropriation was discovered).
Acts showing intent to gain (concealment, false entries, fund transfers).
Annexes: ORs/invoices, policies/authorities, audit reports, bank/payment logs, device logs, demand and reply (if any), client affidavits.
Prayer: criminal prosecution and civil liability (restitution, damages, interest).
Certification and verification; jurat before a prosecutor/notary as applicable.

Data privacy and evidence handling

Collect and process personal data under legitimate interest and compliance with legal obligations; limit access to those who need to know.
Preserve forensic images of devices and keep a chain-of-custody log for digital evidence.
Coordinate with counsel before sharing data externally.

FAQs

1) Can we file both qualified theft and estafa? You can narrate facts covering both theories. The prosecutor will determine the correct charge based on possession and ownership at the time of the taking.

2) The employee is offering to pay—should we accept? You may accept restitution without waiving criminal liability. If considering a settlement with the client, structure it carefully; a poor release can complicate prosecution or civil recovery.

3) Do we need a demand letter? Not legally required for qualified theft and not strictly required for estafa by misappropriation, but a clear written demand that goes unheeded is powerful evidence.

4) Can we terminate employment immediately? Observe due process (notice and opportunity to be heard). For positions of trust, loss of trust based on substantial evidence can justify dismissal, independent of the criminal case.

5) Who testifies? Auditor/accounting head (reconciliation), immediate supervisor (policies and authority), custodian of records (business records), IT/forensics (digital trails), client (if funds were entrusted by the client).

Action plan for employers (one-page summary)

Secure cash, records, devices; suspend access; consider preventive suspension.
Audit and document shortages; gather client confirmations.
Demand accounting/return (optional but helpful).
Draft Complaint-Affidavit with annexes; decide whether employer files alone (qualified theft) or with the client (estafa), or both narratively.
File with the Prosecutor’s Office; consider attachment in a civil suit.
Align HR, criminal, and civil strategies; keep documentation consistent.
Communicate with affected clients and remediate promptly to reduce exposure.

Key takeaway

If client payments made to your authorized staff should have become company funds, non-remittance by the employee is commonly qualified theft—you, the employer, can file.
If the employee was entrusted with client funds for a specific purpose (juridical possession), non-application typically points to estafa, with the client as offended party—coordinate and consider co-filing.
Focus on possession, ownership at the time of taking, and documented loss—these decide the charge and who should file.