Objectives <p>Relational hyperevent data, i.e., time-stamped events comprising two or more actors, provide the most granular picture of network dynamics. Using hyperevent data on communication related to corruption, we answer two research questions related to corruption network structure and dynamics. First, we test core-periphery structure fit and measure temporal escalation. Second, we test the relational micro-mechanisms that bring about these structures and dynamics. We include attribute-related mechanisms (selection, heterophily), hyperevent-specific endogenous mechanisms (repeated interaction, repeated co-participation, subordination), and general endogenous mechanisms (triadic closure, reciprocity, tie accumulation)</p> Methods <p>Utilising publicly available data on three dynamic corporate corruption networks from Deferred Prosecution Agreements in the UK, we first measure each network’s core-periphery structure and temporal escalation. Then, we test the mechanisms that drive their evolution by modelling the sequence of relational hyperevents with relational hyper-event model (RHEM) recently developed to model such data. In RHEM, events are modelled as hyperedges in a hypergraph allowing to connect multiple nodes simultaneously.</p> Results <p>Two networks display strong signs of both core-periphery structures and temporal escalation, whereas the last one displays temporal escalation but a rather weak signs of a core-periphery structure. Using RHEM, we find evidence for the effects of repeated interaction and repeated co-participation in all the networks together with various forms hierarchical tendencies, yet little evidence for triadic closure.</p> Conclusions <p>We highlight the usefulness of RHEM for vast array of criminal network data that is frequently recorded as hyperevents (e.g., co-offending). We also discuss potential practical implications for prevention and disruption of corruption networks using descriptive and model-based evidence.</p>