Criminal Lawyers in Criminal Compliance for SMEs

Criminal compliance for SMEs is the adaptation of crime prevention models from Art. 31 bis CP to the dimensions, resources and specific risks of small and medium-sized enterprises. Since the introduction of corporate criminal liability by Organic Law 5/2010, reformed by Organic Law 1/2015 and expanded by Organic Law 14/2022, SMEs are fully exposed to fines, closure, contracting prohibition and even dissolution for crimes committed within them. Supreme Court doctrine has consolidated the principle that a real, effective and living compliance model exonerates the legal entity from criminal liability, even if the crime was committed. The UNE 19601 standard establishes technical standards and ISO 37301 offers the international framework.

Adapted Modalities for SMEs

The compliance modalities adapted to SMEs contemplate simplified but effective structures. Art. 31 bis 3 CP expressly allows that, in small-sized companies (those that may present an abbreviated profit and loss account under Art. 258 of the Consolidated Text of the Corporate Enterprises Act), the supervisory body functions be assumed by the governing body itself. Adapted modalities include: sectoral risk map focused on typical crimes of the SME sector (construction: labor/environmental/urban planning; hospitality: labor/cash money laundering; technological: cybercrime/intellectual property; industry: environmental/labor safety); simplified decision-making protocols; internal whistleblowing channel (mandatory for companies with more than 50 workers under Act 2/2023); code of ethics and anti-corruption, anti-money laundering and data protection policies; periodic training of employees and managers.

Benefits for the SME

The technical benefits for the SME are significant and quantifiable. First, exoneration or attenuation of criminal liability: a compliance program meeting the six requirements of Art. 31 bis 5 CP can completely eliminate the SME's criminal liability. Second, director protection: compliance documents the due diligence of the governing body, serving as exculpatory evidence in individual investigations for unfair administration, tax fraud or labor crimes. Third, access to public contracting: Public Sector Contracts Act 9/2017 prohibits contracting with convicted companies; without compliance, a conviction destroys the business. Fourth, contractual requirements: banks, large clients, insurers and digital platforms already require compliance programs via contractual clauses. Fifth, compliance with GDPR, LOPDGDD and Act 2/2023 on whistleblower protection, unavoidable for companies with more than 50 employees.

Defence Strategy

The technical defense in criminal investigations of SMEs rests on four consolidated axes. First, proof of ex ante effectiveness of compliance: documentation of program adoption prior to the criminal act (governing body minutes, allocated budget, training delivered, active whistleblowing channel). Second, fraudulent circumvention of the model: case-law admits exoneration when the individual perpetrator fraudulently circumvented the model's controls. Third, autonomy and sufficiency of the supervisory body: even in SMEs where the director assumes these functions, it must be proven they acted with criteria of functional independence and diligence. Fourth, external certification under UNE 19601 and ISO 37301: although it does not exonerate per se, it significantly reinforces the presumption of effectiveness at trial.

Current Forensic Practice

In current forensic practice, SMEs are increasingly the target of criminal investigations by the AEAT, the Labor Inspectorate, the SEPRONA, the UDEF and the Anti-Corruption Prosecutor's Office. Act 2/2023 on Whistleblower Protection, Organic Law 14/2022 reforming embezzlement, Organic Law 1/2025 on Justice Service Efficiency, the EU Regulations DSA, MiCA, AI Act and NIS2 and consolidated Supreme Court case-law on cosmetic compliance configure a demanding regulatory framework. The cost of implementing a compliance program in an SME ranges between €3,000 and €30,000 depending on size, against criminal fines that can reach five times the benefit obtained or several hundred thousand euros. At Alonso Sala, with more than 15 years of experience in economic criminal law, we design compliance programs adapted to SMEs from a forensic perspective: we know how they are attacked at trial and configure them to withstand the most demanding judicial scrutiny. We accompany the SME in risk audit, implementation, training, periodic monitoring and, when necessary, defense in criminal investigations.