Criminal Lawyers in Criminal Compliance for SMEs

Criminal compliance for SMEs is the adaptation of crime prevention models from Art. 31 bis CP to the dimensions, resources and specific risks of small and medium-sized enterprises. Since the introduction of corporate criminal liability by Organic Law 5/2010, reformed by Organic Law 1/2015 and expanded by Organic Law 14/2022, SMEs are fully exposed to fines, closure, contracting prohibition and even dissolution for crimes committed within them. Art. 31 bis 2 and 4 CP allows a real, effective and living compliance model, adopted before the offence, to exonerate the legal entity from criminal liability even if the crime was committed. The UNE 19601 standard establishes technical standards and ISO 37301 offers the international framework.

Adapted Modalities for SMEs

The compliance modalities adapted to SMEs contemplate simplified but effective structures. Art. 31 bis 3 CP expressly allows that, in small-sized companies (those that may present an abbreviated profit and loss account under Art. 258 of the Consolidated Text of the Corporate Enterprises Act), the supervisory body functions be assumed by the governing body itself. Adapted modalities include: sectoral risk map focused on typical crimes of the SME sector (construction: labor/environmental/urban planning; hospitality: labor/cash money laundering; technological: cybercrime/intellectual property; industry: environmental/labor safety); simplified decision-making protocols; internal whistleblowing channel (mandatory for companies with 50 or more workers under Act 2/2023); code of ethics and anti-corruption, anti-money laundering and data protection policies; periodic training of employees and managers.

Benefits for the SME

The technical benefits for the SME are significant and quantifiable. First, exoneration or attenuation of criminal liability: a compliance program meeting the six requirements of Art. 31 bis 5 CP can completely eliminate the SME's criminal liability. Second, director protection: compliance documents the due diligence of the governing body, serving as evidence of its diligence in individual investigations for unfair administration, tax fraud or labour crimes, although it does not exempt a director who took part in the offence. Third, access to public contracting: Public Sector Contracts Act 9/2017 prohibits contracting with companies convicted of certain offences (Art. 71.1.a); without compliance, a conviction can destroy the business. Fourth, contractual requirements: banks, large clients, insurers and digital platforms already require compliance programs via contractual clauses. Fifth, compliance with GDPR, LOPDGDD and Act 2/2023 on whistleblower protection, unavoidable for companies with 50 or more employees.

Defence Strategy

The technical defence in criminal investigations of SMEs rests on four consolidated axes. First, proof of ex ante effectiveness of compliance: documentation of program adoption prior to the criminal act (governing body minutes, allocated budget, training delivered, active whistleblowing channel). Second, fraudulent circumvention of the model: where the offence is committed by directors or senior managers, Art. 31 bis 2 CP requires, for exoneration, that the individual perpetrator fraudulently circumvented the model's controls. Third, autonomy and sufficiency of the supervisory body: even in SMEs where the director assumes these functions, it must be proven they acted with criteria of functional independence and diligence. Fourth, external certification under UNE 19601 and ISO 37301: it does not exonerate per se or prove the model's effectiveness, although it may be weighed as an additional element (FGE Circular 1/2016).

Current Forensic Practice

In current forensic practice, SMEs are increasingly the target of criminal investigations by the AEAT, the Labour Inspectorate, the SEPRONA, the UDEF and the Anti-Corruption Prosecutor's Office. Act 2/2023 on Whistleblower Protection, Organic Law 14/2022 reforming embezzlement, Organic Law 1/2025 on Justice Service Efficiency, the EU Regulations DSA, MiCA, AI Act and NIS2 and the statutory requirement of an effectively implemented model as opposed to cosmetic compliance (Art. 31 bis 2 CP) configure a demanding regulatory framework. Compliance is a modest investment against criminal fines that can reach five times the benefit obtained or several hundred thousand euros. At Alonso Sala, with more than 15 years of experience in economic criminal law, we design compliance programs adapted to SMEs from a forensic perspective: we know how they are attacked at trial and configure them to withstand the most demanding judicial scrutiny. We accompany the SME in risk audit, implementation, training, periodic monitoring and, when necessary, defence in criminal investigations.