Criminal Defence in ESG Investigations in Spain: 2026 Strategy

Investigations for ESG (environmental, social and governance) breaches have gone from exceptional to a daily risk for large and listed companies. Early criminal intervention, coordinated with compliance and corporate communications, is the difference between a provisional dismissal and a conviction with severe reputational consequences. As criminal lawyers specialising in corporate compliance, we set out the comprehensive defence strategy for 2026.

Types of ESG Investigation

Internal investigations: initiated by the company itself in response to a whistleblower-channel alert or an internal-control incident. Their aim is to clarify facts, assess legal risk and design corrective measures. External investigations: conducted by public authorities (prosecution, market regulator, data-protection authority, labour inspectorate). Both usually coexist in time, and the coordination is critical because internal findings can be transferred to the external file.

Reporting vs. the Right Against Self-Incrimination

The main legal dilemma is the conflict between transparency obligations (CSRD, relevant facts to the regulator) and the fundamental right not to incriminate oneself (Art. 24.2 of the Constitution). The Constitutional Court and the European Court of Human Rights have held that administrative information obligations subsist even where the company is being investigated, but that information obtained under administrative compulsion cannot later be used in the criminal proceedings (the Saunders v. UK doctrine). This requires a careful strategy: distinguishing documentation handed over in the administrative sphere from that handed over in the criminal one, and reserving the statements of investigated directors.

Lawyer-Compliance Officer Coordination

The compliance officer is the company's first point of contact for an ESG alert, but their position is complex: they are part of the investigated organisation and may become a witness. Coordination with the defence rests on three principles: reinforced lawyer-client privilege (all internal-investigation documentation channelled through external counsel), functional independence of the compliance officer (reporting to the board, never to the investigated director), and robust documentation (minutes, evidence preserved with a forensic chain of custody).

Whistleblowing and Law 2/2023

Law 2/2023 on the protection of whistleblowers has changed the map of ESG investigations: a mandatory internal channel for companies with over 50 employees, reinforced confidentiality guarantees, a maximum 3-month deadline to resolve reports, and the option of reporting to the Independent Whistleblower Protection Authority. Most ESG investigations begin with an internal report. Professional management of the channel is decisive: handling the report rigorously strengthens the defensive position; archiving it without serious investigation or retaliating against the whistleblower greatly aggravates liability.

Anatomy of an Investigation: Detection, Assessment, Containment

1. Detection: the initial alert. The first step is activating the crisis protocol — preservation of evidence, assignment of an external legal team, briefing of the audit committee. The first 72 hours are critical. 2. Assessment: forensic analysis of the documentation, interviews of the implicated employees (with the safeguards of the right against self-incrimination), technical expert evidence. 3. Containment: design of corrective measures, the final report, and the decision on communication to the authorities. Self-reporting, where appropriate, must be perfectly prepared.

Pre-Trial and Trial Defence Strategy

• Evidential front: proactively providing the internal-investigation evidence that benefits the defence.
• Normative front: building the legal position on the interpretation of the CSRD and CSDDD Directives, still with many grey areas.
• Expert front: early appointment of experts in ESG methodologies.
• Communications front: coordination with corporate communications for crisis management that does not compromise the defence line.

The costliest mistake in ESG investigations is a late, uncoordinated reaction.