Criminal Defence for Sole Directors and Board Members

Criminal liability of directors in Spain requires personal imputation: merely holding office is not sufficient. Article 31 of the Criminal Code permits transferring to the director the material authorship of an offense committed by the company when the elements of the offense are present in their person (factual control, knowledge, specific duty). However, the most recent Supreme Court case law has reinforced the principle of personal and culpable liability, rejecting any automatic attribution based merely on registration in the Commercial Registry.

Director Types and Imputation Regime

The sole director concentrates all representation and is liable for offenses they knew or should have known. The joint director requires combined signatures, diluting individual factual control and opening defense avenues when the criminal decision did not require their intervention. The several director responds individually as if they were sole. The alternate director is only liable for acts performed during their effective tenure. The de facto director (Art. 236 LSC) responds when exercising governance functions without formal appointment: doctrine of major relevance in family structures and holdings.

Supervisory Duty of the Board Member

The non-executive board member is not liable for the company's offenses unless they breach the specific supervisory duty set out in Art. 225 LSC. The defense must prove: (1) that the member exercised their function with the diligence of an orderly businessperson, (2) that they requested information from executives, (3) that there were no objective indications of the criminal conduct, and (4) that, had they detected them, they would have reacted in accordance with the board's protocol (recorded opposition, resignation, communication through the whistleblower channel).

Delegation of Functions

The delegation of functions is one of the most solid defenses. The delegating director is exonerated when: (a) culpa in eligendo is excluded (the chosen person was suitable), (b) culpa in vigilando is excluded (reasonable supervisory mechanisms existed), and (c) there was no knowledge or consent of the delegated criminal conduct. It is the basis of the defense in large corporations where the board member could not materially know each operation.

The six requirements of an effective organisation and management model (Art. 31 bis 5 CP)

For the legal entity to invoke the exemption under Art. 31 bis 2 of the Criminal Code it is not enough to hold a compliance document: the programme must be suitable, must have been adopted and effectively implemented before the offence was committed, and must contain the six elements listed in Art. 31 bis 5 CP. These are: identifying the activities in which the offences to be prevented may be committed (risk map); establishing protocols that govern how the entity forms its will, takes decisions and executes them; having financial resource management models adequate to prevent the commission of offences; and keeping these elements up to date.

The two remaining requirements are central for the sole director or board member. The model must impose an obligation to report potential risks and breaches to the body charged with overseeing the functioning of the programme (the internal reporting channel), and it must establish a disciplinary system that adequately penalises non-compliance. In addition, Art. 31 bis 5 requires periodic verification of the model and its amendment whenever significant breaches come to light or whenever there are changes in the organisation, the control structure or the activity carried out. A static programme, not adapted to the real workings of the company, will rarely persuade a court of its preventive effectiveness.

The autonomous oversight body and the role of the board

Art. 31 bis 2.2 CP requires that supervision of the functioning of and compliance with the model be entrusted to a body of the legal entity with autonomous powers of initiative and control. This autonomy is decisive: the compliance body (often called the compliance officer) must be able to act without being hierarchically dependent on those who take the business decisions it is meant to monitor, must have sufficient resources, and must have direct access to the highest management body. The law allows that, in small legal entities (those entitled to file an abbreviated profit and loss account), the supervisory functions may be assumed directly by the management body.

For a sole director or board member this means that responsibility is not discharged simply by delegating: the board retains a non-delegable duty to supervise the compliance function itself. The exemption under Art. 31 bis 2 further requires that there has been no omission or insufficient exercise of the supervision, monitoring and control functions by that body. If the offence is committed by a director or representative who fraudulently circumvents an adequate model, the entity may be exempt; but if the oversight body existed only on paper, lacked resources or was ignored by management, the exemption fails and the legal entity is liable.

Autonomy of the legal entity's liability and the burden of proving the exemption

The criminal liability of the legal entity is autonomous from that of the natural person. Art. 31 ter CP provides that the entity may be liable even where the specific natural person responsible has not been individualised or it has not been possible to direct the proceedings against them, and that circumstances affecting the guilt of the individual defendant or aggravating their liability do not exclude or modify the entity's liability. Art. 31 quinquies in turn excludes from the regime, among others, the State and certain public entities. It bears stressing that this is a regime specific to the company: one cannot transpose to the legal entity a penalty or limitation scheme designed for an offence committed by a natural person.

As to who must establish the existence and effectiveness of the model, case law has debated whether the suitability of the programme operates as an element of the offence or as a ground of exemption. In practice, the company's defence must be in a position to produce and robustly document the real implementation of the model: the risk map, training records, minutes of the compliance body, periodic verifications and the traceability of the reporting channel. An effective defence is built before the proceedings, with a living and documented programme, not by improvising evidence once the investigation is opened.

The investigated company: Art. 33.7 penalties, succession in corporate transactions and the lawfulness of internal-investigation evidence

When proceedings are directed against the legal entity, it acquires the procedural status of an investigated party, with the right to an autonomous defence, to appoint its own lawyer and court representative, and not to have its position conflated with that of its directors. The catalogue of applicable penalties is set out in Art. 33.7 CP: a fine by daily quotas or proportional; dissolution; suspension of activities; closure of premises and establishments; prohibition of carrying out certain activities; disqualification from obtaining subsidies and public aid, contracting with the public sector or enjoying tax benefits; and judicial intervention. The entity may reach a separate plea agreement from the natural persons. The specific mitigating factors of Art. 31 quater (confession, cooperation by providing evidence, repair of the harm and establishment of effective measures before trial) can substantially modulate the penal response.

Two points demand the director's attention. First, Art. 130.2 CP: the criminal liability of the legal entity is not extinguished by its transformation, merger, absorption or division, passing instead to the resulting entity, which is why M&A transactions require criminal due diligence to identify inherited contingencies. Second, internal investigations must respect the rights of the affected employees: the lawfulness of the evidence obtained (interviews, analysis of devices and corporate email, review of documentation) depends on observing the principles of proportionality, prior notice and respect for privacy and data protection, also within the framework of the internal reporting system under Law 2/2023. A poorly conducted internal investigation can invalidate the evidence and compromise the company's own defence.