CSRD: Impact on the Criminal Audit of Multinationals in Spain
In this article
Key Takeaways
- Administrative, civil and criminal risk
- ESG report falsification: 1-3 years (Art. 290)
- Auditor: possible participant in the falsification
- Defence: documented delegation
The CSRD (2022/2464/EU) integrates sustainability information into the management report and requires external verification (Royal Decree-Law 9/2024, cited as transposing it, did not include it). Falsifying it may amount to falsification of accounts by directors (Art. 290 CP, 1 to 3 years and a fine), falsification of listed issuers' information (Art. 282 bis CP, 1 to 4 years) or forgery of a commercial document (Art. 392 CP).
Need help with your case? Talk to a criminal defence lawyer at Alonso Sala.
Directive 2022/2464/EU (CSRD) has brought the legal regime of sustainability information closer to that of traditional annual accounts. This means external verification is no longer optional and the criminal risk grows for directors and, as possible participants, for auditors. As economic crime lawyers, we analyse the real impact of the CSRD on corporate criminal audit.
CSRD Transposition in Spain
The CSRD is a directive and requires transposition: Royal Decree-Law 9/2024, sometimes cited as a partial transposition, did not include it and was repealed in January 2025. The directive's original rollout was phased: 2024 (large public-interest entities with over 500 employees), 2025 (the rest of large companies), 2026 (listed SMEs), 2028 (subsidiaries of non-EU parents); Directive (EU) 2025/794 postponed the 2025 and 2026 phases by two years, and Directive (EU) 2026/470 (the Omnibus I package) has since made substantive changes to the obligation, so whether and when a company is covered must be checked case by case. The obligation consists of publishing a sustainability report integrated into the management report, drafted under the European Sustainability Reporting Standards (ESRS).
Penalties for Non-Compliance
The sanctioning regime operates on three levels. Administrative: the directive requires Member States to provide for effective, proportionate and dissuasive penalties, whose amounts will be set by the Spanish transposing law. Civil: shareholders and bondholders can bring liability actions against directors. Criminal: false non-financial information can constitute three different offences.
Falsification of Non-Financial Information as an Offence
- Article 290 CP (falsification of annual accounts): where directors falsify the accounts or other documents that must reflect the company's legal or financial position, in a way capable of causing economic harm. Penalty of 1 to 3 years in prison and a fine of 6 to 12 months, in the upper half of the range if the harm is caused.
- Article 282 bis CP (fraud against investors): where the directors of an issuer whose securities are traded on markets falsify the financial information in its prospectuses or in the information it must publish, to attract investment or financing. Penalty of 1 to 4 years; 1 to 6 years and a fine if the harm is of notable gravity.
- Article 392 CP (document falsification): subsidiary: altering or forging a commercial document (6 months to 3 years and a fine of 6 to 12 months); for a private individual, misstating its content is not an offence.
Under Art. 290 CP the falsification must be capable of causing economic harm to the company, its members or third parties and must be intentional (there is no negligent form); the harm need not actually occur, although if it does the penalty is imposed in the upper half of the range.
External Audit and Documentary Chain of Custody
The CSRD introduces a critical change: sustainability information must undergo independent external verification. It is carried out with limited assurance, a lower level than a financial audit. The sustainability auditor cannot commit the Art. 290 CP offence as principal, since it is reserved to directors, but may be a participant (co-operator or accomplice) if they knowingly assist the falsification, just like the financial auditor. The documentary chain of custody is the most sensitive element: companies must retain, for at least six years, all the supporting documentation for each published metric.
Criminal Risk for Directors
The directors of multinationals subject to the CSRD assume a direct criminal risk. The areas of greatest exposure are: misapplied double materiality (deliberate omission of negative impacts), unverified value-chain data, climate-transition metrics with no technical support, and social indicators presented with biased methodologies. Preventive defence involves documented delegation, cascading internal certifications, detailed board minutes and a criminal compliance programme with a specific CSRD module.
CSRD risk in your multinational?
We audit the criminal exposure of your sustainability reports and design robust defences against falsification investigations.
📞 Call us: +34 91 078 65 74
Official text: article 290 of the Spanish Criminal Code (BOE)
Frequently asked questions
What does the CSRD require of multinationals in Spain?
The CSRD Directive (2022/2464/EU) requires a sustainability report integrated into the management report under the European Sustainability Reporting Standards (ESRS), together with independent external verification. Directive (EU) 2025/794 postponed the 2025 and 2026 phases of its 2024-2028 timetable, and Directive (EU) 2026/470 has since amended the obligation. Royal Decree-Law 9/2024, sometimes cited as a partial transposition, did not include it and was repealed in January 2025.
What offences can falsifying sustainability information involve?
Depending on the context and intent, three offences: falsification of annual accounts by directors (Art. 290 CP, 1 to 3 years in prison and a fine of 6 to 12 months), falsification of the information of issuers of listed securities where it is falsified to attract investment or financing (Art. 282 bis CP, 1 to 4 years; up to 6 if the harm is of notable gravity), and, subsidiarily, forgery of a commercial document (Art. 392 CP) where the document is altered or forged.
Can the sustainability auditor face criminal liability?
Yes, as a participant. Only a director can commit the Art. 290 CP offence as principal, but an auditor who knowingly assists the falsification is liable as a co-operator or accomplice, just like the financial auditor. The typical risks are issuing reports with insufficient qualifications despite erroneous data, accepting inadequate documentary evidence, failing to declare conflicts of interest, or covering up detected irregularities.
What is required to convict for falsifying non-financial information?
Under Art. 290 CP, the falsification must be capable of causing economic harm to the company, its members or third parties and must be intentional; the harm need not actually occur (if it does, the penalty is imposed in the upper half of the range). The criminal defence is built around denying or minimising the falsification, its capacity to cause harm or the intent.
How can directors protect themselves against the CSRD's criminal risk?
Through documented delegation of ESG data capture and consolidation to directors with the power and means to do so, cascading internal certifications that leave a trail of who validates each figure, detailed board minutes on the information to be published, and a criminal compliance programme with a specific CSRD module. The documentary chain of custody must be kept for at least six years.
Do you need criminal defence in this area?
We are criminal defence lawyers specialising in criminal compliance. We act urgently to protect your rights.
This page is for information purposes only and does not constitute legal advice: every case requires individual assessment. How this content is produced and verified: editorial policy.