Criminal Compliance in Spain 2026: Is It Mandatory? A Company Guide

In 2026, the question is no longer whether your company should have a criminal compliance programme, but whether it can afford not to. Since the 2015 reform of the Criminal Code, legal persons can be criminally convicted for offences committed by their executives or employees. Compliance is the only way to exempt or mitigate that liability. As criminal lawyers, we explain it.

What Is Criminal Compliance?

Criminal compliance is a crime-prevention programme designed to identify, assess and mitigate the criminal risks an organisation faces. It is not a document filed in a drawer: it is a living system of policies, controls, training and supervision that must be effectively applied. Art. 31 bis CP establishes that the legal person will be exempt from criminal liability if, before the offence, it adopted and effectively implemented an organisation and management model with surveillance and control measures suitable to prevent offences of the same nature.

Requirements of Art. 31 bis CP

1. Risk map: identifying the activities in which offences could be committed.
2. Protocols and procedures: establishing decision-making and execution protocols.
3. Financial management: models suitable to prevent the commission of offences.
4. Duty to report: an obligation to report possible risks to the supervisory body.
5. Whistleblower channel: a confidential reporting system (mandatory under Law 2/2023).
6. Disciplinary regime: a system that adequately sanctions breaches of the measures.
7. Periodic review: the model must be updated when breaches or organisational or regulatory changes occur.

The Criminal Liability of the Legal Person

Corporate criminal liability can arise when an offence is committed by legal representatives or directors (in the company's name) or by employees (where the offence was possible due to a lack of control). The consequences of a conviction can be devastating: fines of up to five times the benefit obtained, dissolution, disqualification from contracting with the public administration, and judicial intervention.

The Personal Liability of the Director

Company directors can be personally liable for offences committed within the organisation. The director's duty of supervision means that, if they did not implement adequate controls, they may be an author by omission of offences committed by their subordinates.

What Offences Can a Company Commit?

The catalogue of offences attributable to legal persons includes, among others: money laundering, tax offences, corruption between private parties, fraud, punishable insolvency, environmental offences, offences against workers and influence-peddling.