Criminal Defence in ESG Investigations in Spain: 2026 Strategy
In this article
Key Takeaways
- Internal vs. external investigations
- Reporting / self-incrimination conflict
- Law 2/2023 whistleblowing is mandatory
- A coordinated four-front strategy
In ESG investigations, the internal investigation (by the company itself) and the external one (by the prosecution, the market regulator or other authorities) coexist, and coordinating them is critical because internal findings can be transferred to the external file. The central dilemma is the conflict between transparency obligations (CSRD, relevant facts) and the right against self-incrimination (Art. 24.2 of the Constitution): information obtained under administrative compulsion cannot later be used in the criminal proceedings. The defence rests on lawyer-client privilege (Art. 542.3 of the Judiciary Act), the independence of the compliance officer and the rigorous management of the whistleblower channel required by Law 2/2023. A late, uncoordinated reaction is the costliest mistake.
Need help with your case? Talk to a criminal defense lawyer at Alonso Sala.
Investigations for ESG (environmental, social and governance) breaches have gone from exceptional to a daily risk for large and listed companies. Early criminal intervention, coordinated with compliance and corporate communications, is the difference between a provisional dismissal and a conviction with severe reputational consequences. As criminal lawyers specialising in corporate compliance, we set out the comprehensive defence strategy for 2026.
Types of ESG Investigation
Internal investigations: initiated by the company itself in response to a whistleblower-channel alert or an internal-control incident. Their aim is to clarify facts, assess legal risk and design corrective measures. External investigations: conducted by public authorities (prosecution, market regulator, data-protection authority, labour inspectorate). Both usually coexist in time, and the coordination is critical because internal findings can be transferred to the external file.
Reporting vs. the Right Against Self-Incrimination
The main legal dilemma is the conflict between transparency obligations (CSRD, relevant facts to the regulator) and the fundamental right not to incriminate oneself (Art. 24.2 of the Constitution). The Constitutional Court and the European Court of Human Rights have held that administrative information obligations subsist even where the company is being investigated, but that information obtained under administrative compulsion cannot later be used in the criminal proceedings (the ECtHR case law on the right against self-incrimination, Art. 6 ECHR). This requires a careful strategy: distinguishing documentation handed over in the administrative sphere from that handed over in the criminal one, and reserving the statements of investigated directors.
Lawyer-Compliance Officer Coordination
The compliance officer is the company's first point of contact for an ESG alert, but their position is complex: they are part of the investigated organisation and may become a witness. Coordination with the defence rests on three principles: reinforced lawyer-client privilege (all internal-investigation documentation channelled through external counsel), functional independence of the compliance officer (reporting to the board, never to the investigated director), and robust documentation (minutes, evidence preserved with a forensic chain of custody).
Whistleblowing and Law 2/2023
Law 2/2023 on the protection of whistleblowers has changed the map of ESG investigations: a mandatory internal channel for companies with over 50 employees, reinforced confidentiality guarantees, a maximum 3-month deadline to resolve reports, and the option of reporting to the Independent Whistleblower Protection Authority. Most ESG investigations begin with an internal report. Professional management of the channel is decisive: handling the report rigorously strengthens the defensive position; archiving it without serious investigation or retaliating against the whistleblower greatly aggravates liability.
Anatomy of an Investigation: Detection, Assessment, Containment
1. Detection: the initial alert. The first step is activating the crisis protocol — preservation of evidence, assignment of an external legal team, briefing of the audit committee. The first 72 hours are critical. 2. Assessment: forensic analysis of the documentation, interviews of the implicated employees (with the safeguards of the right against self-incrimination), technical expert evidence. 3. Containment: design of corrective measures, the final report, and the decision on communication to the authorities. Self-reporting, where appropriate, must be perfectly prepared.
Pre-Trial and Trial Defence Strategy
- Evidential front: proactively providing the internal-investigation evidence that benefits the defence.
- Normative front: building the legal position on the interpretation of the CSRD and CSDDD Directives, still with many grey areas.
- Expert front: early appointment of experts in ESG methodologies.
- Communications front: coordination with corporate communications for crisis management that does not compromise the defence line.
The costliest mistake in ESG investigations is a late, uncoordinated reaction.
An ESG investigation at your company?
We activate internal investigation protocols from day one, design a coordinated defence strategy and represent the company and its directors. Discretion.
📞 Call us: +34 91 078 65 74
Frequently asked questions
What is the difference between an internal and an external ESG investigation?
The internal investigation is launched by the company itself (the board, the audit committee or the compliance officer) in response to an alert from the whistleblower channel or internal control, to clarify facts and design corrective measures. The external investigation is conducted by public authorities (the Prosecutor's Office, the CNMV market regulator, the data-protection authority, the labour inspectorate, environmental authorities) to sanction conduct. The two usually coexist in time, and internal findings can end up in the external file.
Does the duty to report clash with the right against self-incrimination?
Yes. Transparency obligations (CSRD, relevant facts to the market regulator) subsist even where the company is being criminally investigated, but information obtained under administrative compulsion cannot later be used in the criminal proceedings against whoever supplied it (Art. 24.2 of the Constitution). That is why documentation handed over in the administrative sphere must be distinguished from that handed over in the criminal one, and reservations must be recorded.
How do the lawyer and the compliance officer coordinate?
On three principles: channelling all internal-investigation documentation through external counsel to preserve lawyer-client privilege (Art. 542.3 of the Judiciary Act); guaranteeing the compliance officer's functional independence, reporting to the board or the audit committee and never to the investigated director; and robust documentation with minutes, evidence under chain of custody and protocolised interviews.
What role does the whistleblowing Law 2/2023 play?
Law 2/2023 requires companies with more than 50 employees to have an internal reporting channel, reinforces the whistleblower's confidentiality and prohibits retaliation, with a maximum deadline of 3 months (extendable to 6) to resolve reports. Since most ESG investigations begin with an internal report, handling the channel rigorously strengthens the defensive position; archiving it without a serious investigation or retaliating against the whistleblower aggravates liability enormously.
What is the costliest mistake in an ESG investigation?
A late, uncoordinated reaction: moving from initial denial to partial admission under media pressure destroys credibility before the court. The most successful investigations are those in which the company acts from day one with a cohesive legal team, a consistent account and a willingness to accept the evidentiary reality.
Do you need criminal defense in this area?
We are criminal defense lawyers specializing in criminal compliance. We act urgently to protect your rights.