Criminal Lawyers in Criminal Compliance

When a Spanish court directs proceedings against a company, the case follows specific procedural channels that should be understood from day one. The summons of the legal entity is served at its registered office (Article 119 LECrim, the Spanish Criminal Procedure Act), requiring the company to appoint a specially designated representative, together with a lawyer and a court agent (procurador). If it fails to do so, a lawyer and court agent are appointed ex officio and the proceedings continue: passivity never halts the case; it merely leaves the company without its own voice in it.

At the first appearance, the judge informs the representative —or, failing that, the lawyer— of the facts attributed to the entity, in writing or by handing over a copy of the complaint. The company's testimony is channelled through that representative (Article 409 bis LECrim), who enjoys the same rights as any individual suspect: to remain silent, not to testify against the entity and not to confess guilt; non-appearance is treated as exercising the right to remain silent. The representative also attends investigative measures and advance evidence (Article 120 LECrim), and a search of the company's centre of management —its registered office or the establishment where its reserved documentation is kept— requires the safeguards of a dwelling search (Article 554 LECrim).

Strategy is set in those first hours. Three decisions shape the rest of the proceedings: (i) the choice of representative, which should not fall on the executive personally under investigation for the same facts, to avoid conflicts of interest between the company's defence and their own; (ii) the coordination of separate defences for the company and the individuals, because their interests may diverge: it may suit the company to prove that the perpetrator fraudulently circumvented its controls; and (iii) the early filing of the prevention model with all its supporting documentation, aiming to argue for dismissal during the investigation phase rather than at trial. Art. 31 quater CP adds specific mitigating circumstances for legal entities: confession before learning of the proceedings, cooperation with new and decisive evidence, repairing the damage and adopting effective prevention measures before trial. After Organic Law 1/2025, the plea agreement (conformidad) regime has also been reformed —the previous sentencing cap disappears and a specific preliminary hearing is introduced—, opening negotiation avenues that we assess case by case, always with the entity's express authorisation. See also our page on corporate criminal liability.

The Spanish Criminal Code does not demand from a small business the same compliance architecture as from a listed company. Art. 31 bis 3 CP provides that in small legal entities the supervisory functions of the model may be assumed directly by the management body, and defines them as those entitled, under applicable accounting legislation, to file an abbreviated profit and loss account. In practice, an SME needs neither a compliance committee nor a dedicated compliance officer: it is enough for the director to assume that function expressly, in a documented and effective manner.

Proportionality does not mean a lower standard. The requirements of Art. 31 bis 5 CP are the same for every entity: identification of risk activities, decision-making protocols, adequate management of financial resources, the duty to report risks and breaches, a disciplinary regime and periodic review of the model. What changes is the scale: in a fifteen-employee company, the risk map may run to a few pages if it reflects the real activity of the business. A three-hundred-page manual copied from a template protects less than ten pages the workforce actually knows and applies every day.

The internal reporting channel is mandatory under Act 2/2023 from 50 employees; below that threshold it is not required, but voluntary implementation is one of the most highly valued indicators of compliance culture. The mistakes we see most often in SMEs are recurrent: buying a generic model without adapting it to the business, failing to document training, leaving the system unreviewed for years and keeping no records of its operation. We devote a dedicated page to criminal compliance for SMEs detailing the proportionate implementation process.

Settled Supreme Court case-law distinguishes between a genuine culture of compliance and paper compliance: a model that exists only on paper does not exempt the legal entity. What matters is not the document, but whether the organisation has internalised an effective culture of respect for the law, translated into operating controls, documented decisions and real reactions to detected incidents.

Recent Supreme Court doctrine (2025) has focused particularly on proving effectiveness: exemption is not obtained by exhibiting the manual, but by showing that the model was implemented and working before the offence. Effectiveness is assessed ex ante, looking at how the system actually operated rather than at the specific outcome. The company seeking exemption must put forward the elements allowing that assessment —minutes, training, channel files, sanctions, reviews—, without this reversing the burden of proof: it remains for the prosecution to establish the grounds of corporate liability.

The Spanish Public Prosecutor's Office, in its circulars on corporate criminal liability, points in the same direction: scepticism towards off-the-shelf programmes, the relevance of senior management commitment (tone from the top) and the particularly significant value of the company itself detecting and reporting the offence. In forensic practice, the indicators judges and prosecutors examine are recurrent:

• Management body commitment: formal approval of the model, an allocated budget and periodic monitoring reflected in board minutes.
• Effective training: sessions delivered, attendees recorded and assessments; merely handing out the code of ethics is not enough.
• A channel that works: reports received and processed with documented files; a channel at zero for years is a warning sign, not a sign of health.
• A disciplinary regime actually applied: real sanctions for breaches, including when they affect executives.
• A living review: updating the model after incidents, changes in activity or legal reforms.

Our firm, at Calle Velázquez 27 in Madrid, implements and defends prevention models for companies based in Madrid and across the country. Defending legal entities regularly takes us to the Investigating Courts of Plaza de Castilla and the Madrid Provincial Court, which concentrate a large share of the capital's economic crime proceedings; in cases of particular complexity —money laundering, corruption, large-scale fraud—, jurisdiction lies with the Central Investigating Courts and the Audiencia Nacional, also seated in Madrid.

That proximity is operational: it allows us to react quickly to a corporate summons, a search at the registered office or a documentary requirement, and to maintain direct interaction with the courts handling the case. If your company has received a summons or wants its prevention model reviewed, call us on +34 91 078 65 74 or write to us through our contact page.