CSRD: Impact on the Criminal Audit of Multinationals in Spain
In this article
Key Takeaways
- Penalties up to 5% of turnover
- ESG report falsification: 1-3 years (Art. 290)
- The external auditor under criminal risk
- Defence: documented delegation
The CSRD Directive (2022/2464/EU), partially transposed in Spain by Royal Decree-Law 9/2024, places sustainability information on a par with annual accounts and requires it to be externally audited. Falsifying that non-financial information can constitute three offences depending on the context: falsification of annual accounts (Art. 290 CP, 1 to 3 years), fraud against investors (Art. 282 bis CP, 1 to 4 years) and, subsidiarily, document falsification (Art. 392 CP). The Supreme Court requires the information to be suitable to mislead, an intent to cause harm and an economically assessable loss. The sustainability auditor assumes criminal liability on the same terms as the financial auditor.
Need help with your case? Talk to a criminal defense lawyer at Alonso Sala.
Directive 2022/2464/EU (CSRD) has placed the legal regime of sustainability information on a par with that of traditional annual accounts. This means external audit is no longer optional, administrative penalties reach millions of euros, and the criminal risk for directors and auditors has multiplied. As economic crime lawyers, we analyse the real impact of the CSRD on corporate criminal audit.
CSRD Transposition in Spain
Spain partially transposed the CSRD through Royal Decree-Law 9/2024. The rollout is phased: 2024 (large public-interest entities with over 500 employees), 2025 (the rest of large companies), 2026 (listed SMEs), 2028 (subsidiaries of non-EU parents). The obligation consists of publishing a sustainability report integrated into the management report, drafted under the European Sustainability Reporting Standards (ESRS).
Penalties for Non-Compliance
The sanctioning regime operates on three levels. Administrative: fines of up to 5% of consolidated annual turnover for very serious infringements, temporary disqualification of directors, and publication of the sanction. Civil: shareholders and bondholders can bring liability actions against directors. Criminal: false non-financial information can constitute three different offences.
Falsification of Non-Financial Information as an Offence
- Article 290 CP (falsification of annual accounts): where directors falsify the information the company must reflect in documents reproducing its true image. Penalty of 1 to 3 years in prison and a fine.
- Article 282 bis CP (fraud against investors): where relevant data on the company is falsified to attract investment or financing. Penalty of 1 to 4 years, aggravable to 6 years.
- Article 392 CP (document falsification): subsidiary, applicable where the falsification affects commercial documents filed in public registries.
Supreme Court case law requires the falsified information to be suitable to mislead, an intent to cause harm, and an economically assessable loss.
External Audit and Documentary Chain of Custody
The CSRD introduces a critical change: sustainability information must undergo independent external verification. From 2028, reasonable assurance — equivalent to that of annual accounts — will be required. This makes the sustainability auditor a potential subject of criminal liability, on the same terms as the financial auditor. The documentary chain of custody is the most sensitive element: companies must retain, for at least six years, all the supporting documentation for each published metric.
Criminal Risk for Directors
The directors of multinationals subject to the CSRD assume a direct criminal risk. The areas of greatest exposure are: misapplied double materiality (deliberate omission of negative impacts), unverified value-chain data, climate-transition metrics with no technical support, and social indicators presented with biased methodologies. Preventive defence involves documented delegation, cascading internal certifications, detailed board minutes and a criminal compliance programme with a specific CSRD module.
CSRD risk in your multinational?
We audit the criminal exposure of your sustainability reports and design robust defences against falsification investigations.
📞 Call us: +34 91 078 65 74
Frequently asked questions
What does the CSRD require of multinationals in Spain?
The CSRD Directive (2022/2464/EU), partially transposed by Royal Decree-Law 9/2024, requires a sustainability report integrated into the management report under the European Sustainability Reporting Standards (ESRS), together with independent external verification, on a phased timetable running from 2024 to 2028.
What offences can falsifying sustainability information involve?
Depending on the context and intent, three offences: falsification of annual accounts (Art. 290 CP, 1 to 3 years in prison), fraud against investors where data is falsified to attract investment or financing (Art. 282 bis CP, 1 to 4 years, aggravable to 6), and, subsidiarily, document falsification (Art. 392 CP) where it affects commercial documents filed in public registries.
Can the sustainability auditor face criminal liability?
Yes. The CSRD makes the sustainability auditor a potential subject of criminal liability, on the same terms as the financial auditor. The typical risks are issuing reports with insufficient qualifications despite erroneous data, accepting inadequate documentary evidence, failing to declare conflicts of interest, or covering up detected irregularities.
What does the Supreme Court require to convict for falsifying non-financial information?
Three requirements: the falsified information must be suitable to mislead, there must be intent to cause harm, and the harm must be economically assessable. The criminal defence is built around denying or minimising any of these three elements.
How can directors protect themselves against the CSRD's criminal risk?
Through documented delegation of ESG data capture and consolidation to directors with the power and means to do so, cascading internal certifications that leave a trail of who validates each figure, detailed board minutes on the information to be published, and a criminal compliance programme with a specific CSRD module. The documentary chain of custody must be kept for at least six years.
Do you need criminal defense in this area?
We are criminal defense lawyers specializing in criminal compliance. We act urgently to protect your rights.