CSRD: Impact on the Criminal Audit of Multinationals in Spain

Directive 2022/2464/EU (CSRD) has placed the legal regime of sustainability information on a par with that of traditional annual accounts. This means external audit is no longer optional, administrative penalties reach millions of euros, and the criminal risk for directors and auditors has multiplied. As economic crime lawyers, we analyse the real impact of the CSRD on corporate criminal audit.

CSRD Transposition in Spain

Spain partially transposed the CSRD through Royal Decree-Law 9/2024. The rollout is phased: 2024 (large public-interest entities with over 500 employees), 2025 (the rest of large companies), 2026 (listed SMEs), 2028 (subsidiaries of non-EU parents). The obligation consists of publishing a sustainability report integrated into the management report, drafted under the European Sustainability Reporting Standards (ESRS).

Penalties for Non-Compliance

The sanctioning regime operates on three levels. Administrative: fines of up to 5% of consolidated annual turnover for very serious infringements, temporary disqualification of directors, and publication of the sanction. Civil: shareholders and bondholders can bring liability actions against directors. Criminal: false non-financial information can constitute three different offences.

Falsification of Non-Financial Information as an Offence

1. Article 290 CP (falsification of annual accounts): where directors falsify the information the company must reflect in documents reproducing its true image. Penalty of 1 to 3 years in prison and a fine.
2. Article 282 bis CP (fraud against investors): where relevant data on the company is falsified to attract investment or financing. Penalty of 1 to 4 years, aggravable to 6 years.
3. Article 392 CP (document falsification): subsidiary, applicable where the falsification affects commercial documents filed in public registries.

Supreme Court case law requires the falsified information to be suitable to mislead, an intent to cause harm, and an economically assessable loss.

External Audit and Documentary Chain of Custody

The CSRD introduces a critical change: sustainability information must undergo independent external verification. From 2028, reasonable assurance — equivalent to that of annual accounts — will be required. This makes the sustainability auditor a potential subject of criminal liability, on the same terms as the financial auditor. The documentary chain of custody is the most sensitive element: companies must retain, for at least six years, all the supporting documentation for each published metric.

Criminal Risk for Directors

The directors of multinationals subject to the CSRD assume a direct criminal risk. The areas of greatest exposure are: misapplied double materiality (deliberate omission of negative impacts), unverified value-chain data, climate-transition metrics with no technical support, and social indicators presented with biased methodologies. Preventive defence involves documented delegation, cascading internal certifications, detailed board minutes and a criminal compliance programme with a specific CSRD module.