Defense Against Internal Channel Complaints (Law 2/2023)

The Spanish Whistleblower Protection Law 2/2023 has transformed the panorama of internal investigations in Spain. Companies with 50 or more employees are obliged to have an operational internal complaints channel, with reinforced guarantees for the whistleblower. But the channel also generates a new defensive front: that of the reported director or employee, who may see their reputation, career and freedom compromised before any judicial proceeding even exists.

Legal Framework of the Whistleblower Channel

Law 2/2023 transposes EU Directive 2019/1937 and obliges companies and public bodies with 50 or more employees to maintain an operational internal information channel, overseen by an Independent Whistleblower Protection Authority. The law protects the whistleblower against retaliation, but it is not a one-way street: it also imposes processing obligations on the company and grants the reported person a set of guarantees. Understanding this dual structure is the starting point of any defence, because a channel operated negligently or in bad faith breaches the very law that created it.

Rights of the Reported Person

European and Spanish regulations require the reported person to have: (a) information about the subject of the complaint and their status as investigated within a reasonable period, (b) legal assistance if the internal interview may be used in a criminal or disciplinary process, (c) right against self-incrimination, (d) access to documentation affecting them, and (e) reasoned resolution within a reasonable period —maximum 3 months extendable to 6—.

Confidentiality and Its Limits

The whistleblower's identity is confidential and, as a rule, can only be revealed by criminal judicial order; the reported person therefore has no right to know who reported them. That confidentiality is not, however, unlimited: the reported person must be informed of the content of the complaint and the facts imputed within a reasonable period in order to defend themselves, and an anonymous complaint on its own is insufficient to ground a procedurally valid dismissal —the company must establish the facts with its own evidence. Data-protection rules and the principle of proportionality govern what may be accessed and disclosed throughout.

Defense Against Malicious Complaints

The channel may become an instrument of retaliation or internal conflict: complaints between confronted partners, resentful ex-employees, conflicts over management succession. The defense must identify early the improper motivation and articulate the response on two planes: (1) defensive, showing the inconsistency of the complaint and the chain of facts motivating it; (2) offensive, evaluating counter-complaint for false accusation (Art. 456 CP), slander (Art. 205 CP) or fraudulent use of the channel with labor consequences.

Counter-Complaint and Criminal Actions

Where the channel has been used fraudulently, the reported person can move from defence to attack. A false accusation (Art. 456 CP) carries six months to two years' imprisonment and a fine; slander (Art. 205 CP) applies where an offence is imputed knowingly or with reckless disregard for the truth; and, where the complaint forms part of a sustained campaign, harassment (Art. 173.1 CP) and labour actions may also come into play. Timing is strategic: the counter-complaint is usually best articulated after the internal investigation is dismissed, since that dismissal operates as powerful evidence of the falsity of the original accusation. A civil claim for the reputational and professional damage caused completes the response.

The effective organisation and management model: requirements of Art. 31 bis 5 of the Criminal Code

When an internal report leads to criminal proceedings against the company, the central line of defence is not to dispute the conduct of an isolated employee, but to prove that the legal person had in place an effective organisation and management model, adopted and implemented before the offence was committed. Article 31 bis 2 and 4 CP frames that model as grounds for exemption where it meets the conditions of paragraph 5 and where the oversight body did not omit or insufficiently exercise its functions. A well-designed whistleblowing channel is one of the pillars of that model, but it produces an exempting effect only when it is embedded in a complete and living programme.

Article 31 bis 5 CP requires six cumulative elements: identifying the activities in whose scope the offences to be prevented may be committed (risk map); establishing protocols that set out how the legal person forms its will and adopts and implements decisions; having financial-resource management models adequate to prevent the commission of those offences; imposing a duty to report risks and breaches to the oversight body, which connects directly with the channel; establishing a disciplinary system that sanctions non-compliance; and carrying out periodic verification of the model, with amendment whenever relevant breaches surface or the organisation changes. The defence documents each requirement with objective, traceable evidence.

Forensic practice distinguishes a merely cosmetic model -signed documents that no one applies- from one that is genuinely implemented. What matters is not the formal existence of the manual but its effective operation: training delivered, risks reviewed, reports handled, disciplinary sanctions imposed and minutes of the oversight body. Our task is to reconstruct and organise that body of evidence to show that the offence was committed by fraudulently circumventing controls that existed and were operating, not because they were absent or inert.

The autonomous oversight body and the burden of proving the exemption

Article 31 bis 2 CP makes the exemption conditional on the supervision of the model's operation and compliance being entrusted to a body with autonomous powers of initiative and control. That body -usually the compliance officer or a compliance committee- must enjoy functional independence, sufficient resources and direct access to the management body. Autonomy is substantive, not nominal: if the supervisor reports hierarchically to those who must be supervised, or lacks the means to investigate, the model's adequacy is undermined. In small legal persons, Article 31 bis 3 CP allows the supervisory functions to be assumed directly by the management body.

The allocation of the burden of proof is one of the most debated points. The settled view in practice is that the existence of an effective model operates as a fact benefiting the defence, which it must introduce and sustain with its own evidence, without prejudice to the prosecution's duty to prove the elements of the legal person's liability under Article 31 bis 1 CP, including the organisational defect or the grave breach of supervisory duties. The defence therefore does not merely deny: it proactively provides the risk map, evidence of implementation and proof of the compliance body's autonomy.

Where proof of adequacy does not reach the threshold for a full exemption, the final paragraph of Article 31 bis 2 provides for mitigation if the conditions are partially established. To this are added the specific mitigating circumstances of Article 31 quater CP -confession, cooperation in the investigation by providing decisive evidence, repair of the harm, and the establishment of effective measures to prevent and detect future offences before trial. The defence strategy weighs from the outset whether to steer the case towards exemption, towards mitigation, or towards a combination of both.

The company under investigation: procedural status, autonomous defence and the legal person's plea agreement

The criminal liability of the legal person is autonomous from that of the natural person. Article 31 ter CP allows the company to be convicted even where the specific responsible individual has not been identified or proceedings could not be directed against them, and it clarifies that circumstances affecting the individual's culpability or aggravating their liability neither exclude nor modify that of the legal person. This autonomy requires a separate and distinct defence for the company, whose interests may not coincide -and may even conflict- with those of the director or employee under investigation, which makes separate legal representation advisable.

In the proceedings, the legal person under investigation enjoys safeguards equivalent to those of a natural person: the right to be informed of the accusation, not to testify against itself, not to plead guilty, to legal assistance and to the presumption of innocence. It appears through a specially designated representative, distinct from anyone who may be charged individually, to avoid conflicts of interest. The company's evidentiary effort focuses on demonstrating the adequacy and effective implementation of its prevention model and, where applicable, the mitigating circumstances of Article 31 quater CP.

The legal person's plea agreement follows particular rules: it may be entered independently of any agreement by the co-accused natural persons and through its representative with special authority. Pleading may be a route to limit the scope of the penalties in Article 33.7 CP and reduce reputational exposure, but it demands rigorous assessment, because conviction of the company carries consequences beyond the fine -disqualifications, bans on public contracting, judicial intervention. We evaluate a plea only after exhausting the analysis of exculpatory evidence and of the options for exemption or mitigation.

Penalties of Art. 33.7, corporate succession under Art. 130.2 and the lawfulness of internal-investigation evidence

The penalties applicable to a legal person are those of Article 33.7 CP, all classified as serious: a fine by quota or proportional; dissolution, which definitively extinguishes legal personality; suspension of activities; closure of premises and establishments; a prohibition on carrying out in the future the activities in whose exercise the offence was committed, favoured or concealed; disqualification from obtaining public subsidies and aid, contracting with the public sector and enjoying tax or social-security benefits and incentives; and judicial intervention to safeguard the rights of workers or creditors. These penalties do not follow the natural-person scheme, and the defence must argue specifically on their applicability, duration and proportionality under the criteria of Article 66 bis CP.

The legal person's liability is not diluted by corporate transactions. Article 130.2 CP provides that transformation, merger, absorption or division does not extinguish criminal liability, which passes to the resulting entity or entities, with the penalty modulated according to the proportion that the original legal person bears to it. Nor is it extinguished by a covert or merely apparent dissolution. This turns criminal risk into a liability that must be identified in the due diligence of any M&A transaction; the successor entity's defence runs through delimiting the inherited perimeter and, where appropriate, asserting its own compliance programme.

The validity of evidence obtained in the internal investigation is a defensive axis of the first order. Evidence gathered -review of corporate email and devices, interviews, forensic analysis- is usable only if the principles of necessity, suitability and proportionality were respected, with an expectation of privacy delimited by prior policies known to the worker, and the safeguards of Ley 2/2023, which protects the reporter against reprisals and surrounds the channel with confidentiality. We examine whether the interviewed employee was informed of their position, could be assisted by counsel, and whether the chain of custody is intact: evidence obtained in breach of fundamental rights is null and taints the derivative evidence, which can prove decisive both for the reported person and for the company itself.