Corporate Criminal Liability (Art. 31 bis CP) in Spain
In this article
Key Takeaways
- Autonomous liability since 2010
- Effective compliance exempts
- Dissolution as maximum penalty
- Formal compliance is NOT enough
Corporate criminal liability is governed by Article 31 bis of the Spanish Criminal Code (introduced by LO 5/2010 and perfected by LO 1/2015). The company is liable for offences committed for its direct or indirect benefit by its representatives and directors (Art. 31 bis 1.a) or by subordinates where the duty of supervision and control was seriously breached (Art. 31 bis 1.b). It is an autonomous liability, applying only to a closed catalogue of offences. A compliance programme adopted and effectively implemented before the offence can exempt liability (Art. 31 bis 2 CP).
Need help with your case? Talk to a criminal defence lawyer at Alonso Sala.
Since the 2010 reform of the Spanish Criminal Code (LO 5/2010), perfected by LO 1/2015, legal persons can be declared criminally liable in Spain. The conviction does not fall only on the directors or employees who materially commit the offence: the company itself can be sanctioned with multimillion-euro fines, judicial intervention and even dissolution. As criminal lawyers specialised in corporate criminal liability, we explain when this liability arises, how it is exempted through an effective compliance programme, and what to do if the indictment is already on the table.
What It Is: Autonomous Liability, Not Derivative
Art. 31 bis CP does not turn the company into an "accomplice" of the natural person's offence; it creates an autonomous criminal liability of its own. Its key features:
- It applies only to a closed catalogue of offences expressly provided for (not every offence in the Criminal Code generates corporate liability).
- The company can be convicted even without identifying the specific material author, provided it is established that the offence was committed within it.
- The extinction of the natural person's liability does not automatically extinguish that of the legal person.
The Two Routes of Imputation Under Art. 31 bis CP
Route 1 (Art. 31 bis 1.a) — Offences committed by representatives and directors:
The company is liable when the offence is committed by its legal representatives, de facto or de jure directors, or by those authorised to make decisions on its behalf. The conduct must have been carried out in the name or on behalf of the company and for its direct or indirect benefit.
Route 2 (Art. 31 bis 1.b) — Offences committed by subordinates with lack of control:
The company is liable when employees or subordinates, subject to the directors' control, were able to commit the offence because the duties of supervision, monitoring and control over them were seriously breached. Here the criminal reproach lies on the company's organisational defect.
💡 Key Concept: "Organisational Defect"
The core of the reproach is organisational: the company is liable because it did not put in place effective controls to prevent or detect offences. A well-designed and implemented compliance programme neutralises this reproach.
Catalogue of Offences That Trigger Corporate Liability
Among the most relevant for businesses:
- Offences against the Tax Authorities and Social Security (Arts. 305 onwards).
- Money laundering (Art. 302).
- Fraud (Art. 251 bis). Not, however, misappropriation or unfair administration, which are not in the catalogue.
- Bribery and influence peddling (Arts. 427 bis, 430).
- Corruption between private parties (Art. 286 bis).
- Environmental offences (Arts. 325 onwards).
- Financing of terrorism (Art. 576).
- Computer offences and discovery of secrets (Art. 197 quinquies).
The Compliance Programme That Exempts Liability
Art. 31 bis 2 CP regulates the requirements for full exemption and Art. 31 bis 5 the content of the model. The company may be exempt if before the offence was committed it had adopted and effectively implemented a programme that meets the following six criteria:
- Realistic and documented criminal-risk analysis: identify which offences may be committed in each area of the company.
- Protocols and procedures setting how decisions are made in risk areas.
- Financial-management models adequate to prevent the identified offences.
- Reporting obligation to the supervisory body on detected breaches and risks (whistleblowing channel).
- Disciplinary system that adequately sanctions breaches of the programme.
- Periodic verification and modification when relevant infringements are revealed or circumstances change.
Programme supervision must be entrusted to a body with autonomous initiative and control powers (the Compliance Officer); in small legal persons the management body may assume it. And where a manager committed the offence, it must also have been committed by fraudulently circumventing the model, without that body failing to exercise, or insufficiently exercising, its supervision.
⚖️ "Paper" Compliance vs. Effective Compliance
The law requires the model to have been effectively implemented: a purely formal programme (signed manuals never applied, inactive whistleblowing channel, training that is not delivered) does not exempt. The judge assesses real implementation, not printed documentation.
Penalties Applicable to the Legal Person
Art. 33.7 CP sets out a specific catalogue of penalties:
- Fine: by quotas (day-fine) or proportional to the benefit obtained or damage caused.
- Dissolution of the legal person: the corporate "death penalty", reserved for multiple reoffending or use of the company as an instrument for crime (Art. 66 bis CP).
- Suspension of activities up to 5 years.
- Closure of premises and establishments up to 5 years.
- Prohibition of the activities in which the offence was committed, temporary (up to 15 years) or permanent.
- Disqualification from obtaining subsidies and aid, contracting with the public sector and enjoying tax or Social Security benefits up to 15 years.
- Judicial intervention to safeguard rights of workers and creditors, up to 5 years.
Procedural Particularities
- The legal person is summoned as investigated and must designate a specific representative (preferably not someone co-investigated for the same facts; the law only bars designating someone who is to testify as a witness).
- It has the same rights as any investigated person: not to declare, to the last word, to remain silent.
- Proceedings can run against it even when the natural-person author has not been identified or cannot be tried.
- Cooperation with justice after the offence (delivery of evidence, self-report, repair of harm) is a mitigating factor (Art. 31 quater CP); if several concur or one is highly qualified, the penalty can be lowered by one or two degrees (Art. 66 bis CP).
Defence Strategy When the Indictment Has Already Arrived
- Immediate audit of the existing compliance programme: identify evidence of effective implementation (committee minutes, whistleblowing-channel records, training sessions delivered, internal sanctions applied).
- Distance the conduct from the material author: document that the offence was an individual deviation against the programme, not covered by it.
- Adopt immediate corrective measures: programme review, internal sanction of the perpetrator, repair of harm. Activates the mitigating factor of Art. 31 quater.
- Careful designation of the specific representative: must not be a person affected by the investigation, to avoid conflicts of interest.
- Negotiate a plea bargain with corporate dimension: possible agreements that avoid penalties compromising the company's viability (judicial intervention vs. fine, etc.).
Has your company been summoned as investigated?
The difference between professional early defence and uncoordinated reactivity can be the difference between exemption and dissolution. Specialist criminal defence support for legal persons.
📞 Call us: +34 91 078 65 74
Official text: article 31 bis of the Spanish Criminal Code (BOE)
Frequently asked questions
Can a company itself be criminally convicted in Spain, separately from its directors?
Yes. Since the 2010 reform, Article 31 bis CP creates an autonomous criminal liability for legal persons, and a company can be convicted even if the individual who committed the offence is never identified, provided it is established the offence was committed within the organisation.
What are the two routes through which a company can become criminally liable?
Either through offences committed by its legal representatives or directors acting for its benefit (Art. 31 bis 1.a), or through offences committed by subordinate employees where the company seriously failed in its duty of supervision and control over them (Art. 31 bis 1.b).
Does having a compliance programme automatically protect a company from liability?
Only if it was adopted and effectively implemented before the offence, meeting six statutory requirements (Art. 31 bis 5) including a documented risk analysis, clear protocols, a whistleblowing channel and periodic verification, under the supervision of an autonomous body; where a manager committed the offence, it must also have been committed by fraudulently circumventing the model. The law requires effective implementation, so merely formal, 'paper' programmes that were never actually applied do not exempt.
What penalties can be imposed on a convicted company?
The catalogue in Art. 33.7 CP ranges from a fine to suspension of activities and closure of premises (up to 5 years), a ban on the activities in which the offence was committed (temporary, up to 15 years, or permanent), disqualification from subsidies, public-sector contracts and tax benefits (up to 15 years), judicial intervention (up to 5 years) and, in the most extreme cases (multiple reoffending or use of the company as an instrument for crime, Art. 66 bis), dissolution of the company.
Does every criminal offence trigger corporate liability if committed within a company?
No — corporate liability applies only to a closed catalogue of offences expressly listed in the Criminal Code, such as tax and Social Security offences, money laundering, fraud, bribery and corruption between private parties, not to every offence a company's staff might commit.
What should a company do if it receives a criminal summons?
Immediately audit its existing compliance programme for evidence of genuine implementation, document that the offence (if proven) was an individual deviation against the programme rather than something it enabled, and consider adopting corrective measures, which can qualify for a mitigating circumstance under Art. 31 quater CP.
Do you need criminal defence in this area?
We are criminal defence lawyers specialising in corporate vs individual liability (art. 31 bis cp). We act urgently to protect your rights.
This page is for information purposes only and does not constitute legal advice: every case requires individual assessment. How this content is produced and verified: editorial policy.