ESG Compliance and Criminal Liability in Spain (2026)

Sustainability has ceased to be a reputational matter and become a direct source of corporate criminal liability. The CSRD (Corporate Sustainability Reporting Directive) and CSDDD (Corporate Sustainability Due Diligence Directive) impose reporting and due-diligence obligations whose breach can trigger the criminal liability of the legal person (Art. 31 bis CP). As criminal lawyers specialising in compliance, we explain the new ESG criminal-risk framework.

The New Framework: CSRD and CSDDD

Directive 2022/2464/EU (CSRD), in force since January 2024 for large companies, requires the publication of an audited sustainability report under the ESRS standards. Directive (EU) 2024/1760 (CSDDD) imposes human-rights and environmental due-diligence obligations across the whole value chain. The criminal impact is threefold: document falsification where the published non-financial information does not reflect reality; fraud against investors and consumers (greenwashing); and offences against workers and the environment arising from the breach of supply-chain due diligence.

Greenwashing as Fraud (Art. 282 CP)

Greenwashing consists of passing off as sustainable an activity that is not. The economic-crime prosecution increasingly applies Article 282 CP (misleading advertising) and Article 248 CP (fraud) where three elements concur: false or misleading statements about environmental characteristics, identifiable recipients (consumers, investors) and verifiable asset loss. The most prosecuted cases are green labelling that does not meet the EU Taxonomy criteria, green bonds whose funds go to non-eligible purposes, and fictitious carbon offsets. The penalty can reach 4 years in prison. Where greenwashing occurs through systematic channels (annual reports, prospectuses), the offence of falsification of annual accounts (Art. 290 CP) also comes into play.

Document Falsification in ESG Reports

The CSRD sustainability report, once audited and filed with the Commercial Registry, acquires the status of a commercial document with effect against third parties. Its falsification constitutes an offence of falsification of a commercial document under Article 392 CP, with penalties of 6 months to 3 years in prison. Directors who approve or consent to manipulated data in ESG metrics may also incur the specific offence of Article 290 CP. The chain of responsibility extends to board members, financial and sustainability directors, auditors and external advisers who design manipulated calculation methodologies.

ESG Compliance Programme: Key Elements

The Art. 31 bis CP prevention programme must incorporate, from 2026, a specific ESG module. The essential elements are: an ESG risk map, data-capture procedures with documentary traceability, double validation of critical quantitative data, a specific ESG whistleblower channel, director training and periodic internal audit. Case law requires the programme to be suitable, proportionate and effectively applied — not merely approved on paper.

Defence Strategies in ESG Investigations

• Proof of compliance: providing the prevention-programme documentation early, seeking the exemption of Art. 31 bis.2 CP.
• Breaking the causal link: proving the investigated director's conduct evaded the internal controls in force.
• Technical expert evidence: hiring experts in ESG methodologies (GHG Protocol, GRI) to validate the reasonableness of the published calculations.
• Cooperation with the authority: a professional internal (forensic) investigation whose results can be offered to the prosecution as active collaboration.