Criminal Compliance: the Corporate Shield Against Liability

Since the 2010 reform of the Criminal Code, and with greater clarity after the 2015 reform, legal persons in Spain can be held criminally liable for offences committed in their name or on their behalf, and for their direct or indirect benefit, where the Code expressly so provides. This means a company can be "convicted" and face penalties ranging from severe fines to disqualification from obtaining subsidies, the closure of premises, or even the dissolution of the company (the corporate "death penalty"). Criminal Compliance has stopped being a good-governance recommendation and has become a matter of legal survival.

Article 31 bis and the Exemption from Liability

The key lies in Article 31 bis of the Criminal Code. This provision establishes that the legal person will be exempt from liability if, before the offence was committed, it adopted and effectively implemented an organisation and management model that includes the surveillance and control measures suitable to prevent offences of the same nature or to significantly reduce the risk of their commission (where the offender was a manager, the other conditions of Art. 31 bis 2 also apply). In other words, Compliance is the legal "shield" that can exempt a company from a criminal conviction.

Essential Elements of an Effective Model

For the Compliance programme to produce its exempting effect, it must meet the requirements of Art. 31 bis 5 CP (the UNE 19601 standard can serve as a guide, although certification does not exempt in itself):

• Risk Map: a detailed analysis of the company's activities to identify where offences are likely to be committed (tax, fraud, data, money laundering, environmental).
• Whistleblower Channel: a secure and confidential system that allows employees and third parties to report irregularities.
• Disciplinary System: an internal sanctioning regime that punishes breaches of the prevention model.
• Compliance Officer: an autonomous supervisory body with powers of initiative and control.

The New Whistleblowing Act

With Law 2/2023, the whistleblower channel is no longer just a Compliance requirement but a legal obligation for every company with 50 or more employees. This channel must allow anonymous reports and guarantee the protection of the whistleblower against retaliation. Failing to have it operational carries substantial administrative fines, independent of any criminal liability. We implement channels that comply with both the criminal-law standard and data-protection and whistleblowing regulations.

How Courts Assess the Model

Courts assess the programme against the requirements of Art. 31 bis CP, which the State Prosecutor's Office (Circular 1/2016) spells out in criteria such as these:

• Ex ante suitability: the model must properly identify the real criminal risks of the activity and provide for proportionate controls.
• Proven effectiveness: documentary existence is not enough; training, audits, records of managed reports and disciplinary consequences actually applied must be evidenced.
• Autonomous supervision: the Compliance Officer must have functional independence, sufficient resources and direct reporting to the management body.

So-called cosmetic compliance (copying templates, failing to update the risk map or failing to respond to internal alerts) does not meet those requirements. On the burden of proof there is disagreement: Circular 1/2016 holds that the legal person must prove the model's effectiveness, whereas since 2016 the Supreme Court has required the prosecution to prove the organisational defect. In practice, it is in the company's interest to produce that evidence.