Criminal Compliance in Spain 2026: Is It Mandatory? A Company Guide
In this article
Key Takeaways
- Exemption from criminal liability
- Art. 31 bis CP
- Mandatory whistleblower channel
- Protects directors
Criminal compliance is not a general obligation in itself, but it is the only way to exempt or mitigate the criminal liability of the legal person under Art. 31 bis CP, in force since the 2015 reform. The programme must be a living system with a risk map, protocols, financial management, a duty to report, a whistleblowing channel (mandatory under Law 2/2023 for companies with more than 50 employees), a disciplinary regime and periodic review. A merely formal compliance programme does not exempt.
Need help with your case? Talk to a criminal defense lawyer at Alonso Sala.
In 2026, the question is no longer whether your company should have a criminal compliance programme, but whether it can afford not to. Since the 2015 reform of the Criminal Code, legal persons can be criminally convicted for offences committed by their executives or employees. Compliance is the only way to exempt or mitigate that liability. As criminal lawyers, we explain it.
What Is Criminal Compliance?
Criminal compliance is a crime-prevention programme designed to identify, assess and mitigate the criminal risks an organisation faces. It is not a document filed in a drawer: it is a living system of policies, controls, training and supervision that must be effectively applied. Art. 31 bis CP establishes that the legal person will be exempt from criminal liability if, before the offence, it adopted and effectively implemented an organisation and management model with surveillance and control measures suitable to prevent offences of the same nature.
Requirements of Art. 31 bis CP
- Risk map: identifying the activities in which offences could be committed.
- Protocols and procedures: establishing decision-making and execution protocols.
- Financial management: models suitable to prevent the commission of offences.
- Duty to report: an obligation to report possible risks to the supervisory body.
- Whistleblower channel: a confidential reporting system (mandatory under Law 2/2023).
- Disciplinary regime: a system that adequately sanctions breaches of the measures.
- Periodic review: the model must be updated when breaches or organisational or regulatory changes occur.
The Criminal Liability of the Legal Person
Corporate criminal liability can arise when an offence is committed by legal representatives or directors (in the company's name) or by employees (where the offence was possible due to a lack of control). The consequences of a conviction can be devastating: fines of up to five times the benefit obtained, dissolution, disqualification from contracting with the public administration, and judicial intervention.
The Personal Liability of the Director
Company directors can be personally liable for offences committed within the organisation. The director's duty of supervision means that, if they did not implement adequate controls, they may be an author by omission of offences committed by their subordinates.
⚖️ Key fact
The Supreme Court has confirmed that a purely formal compliance programme (a signed document but not applied) does not exempt from liability. The programme must be genuinely implemented and effective.
What Offences Can a Company Commit?
The catalogue of offences attributable to legal persons includes, among others: money laundering, tax offences, corruption between private parties, fraud, punishable insolvency, environmental offences, offences against workers and influence-peddling.
Need a criminal compliance programme?
We design and implement tailored compliance programmes that meet the standards of Art. 31 bis CP.
📞 Call us: +34 91 078 65 74
Frequently asked questions
Is criminal compliance mandatory for my company?
Criminal compliance is not a general obligation in itself, but since the 2015 reform of the Criminal Code it is the only way to exempt or mitigate the criminal liability of the legal person. The whistleblower channel that forms part of the programme is mandatory under Law 2/2023 for companies with more than 50 employees.
What requirements does Art. 31 bis CP set?
A risk map, decision-making protocols, financial resource management models that prevent the offence, a duty to report to the supervisory body, a confidential whistleblower channel, a disciplinary regime and periodic review of the model when breaches or organisational or regulatory changes occur.
What are the consequences of a criminal conviction for the company?
They can be devastating: fines of up to five times the benefit obtained from the offence, dissolution of the company, disqualification from contracting with the public administration, and judicial intervention, in which a court-appointed administrator takes control of the company.
Can the director be held personally liable?
Yes. The director's duty of supervision means that, if they did not implement adequate controls, they may be liable as an author by omission of offences committed by their subordinates within the organisation.
What offences can a company commit?
The catalogue includes, among others, money laundering, offences against the Public Treasury, corruption between private parties, fraud and deception, punishable insolvency, environmental offences, offences against workers, influence-peddling and illegal financing of political parties.
Do you need criminal defense in this area?
We are criminal defense lawyers specializing in criminal compliance. We act urgently to protect your rights.