Preventing Corporate Crime: Compliance and White-Collar Criminal Law

Since the 2010 reform, and more clearly still after the 2015 amendment, a company in Spain can be criminally convicted for acts committed by its directors or employees. The practical consequence is an uncomfortable one: the company stops being merely the injured party or a witness and instead sits in the dock, facing fines calculated on its turnover and penalties that can extend to dissolution.

What It Means for a Company to Face Criminal Liability

Article 31 bis of the Spanish Criminal Code sets out two routes by which liability can attach to a company. The first covers offences committed by legal representatives and by those who, individually or as members of a governing body, are authorised to make decisions on the company's behalf or hold powers of organisation and control. The second covers offences committed by employees under the authority of the former, when the offence was made possible because supervisory, oversight and control duties were seriously breached.

That second route is the one that catches most companies off guard: the director does not need to have known anything about it. It is enough that the organisation had no reasonable mechanisms in place to prevent or detect what happened.

The list of offences that can trigger this liability is not open-ended, but it is broad: fraud, punishable insolvency, offences against the Public Treasury and Social Security, money laundering, corruption in business, environmental offences, discovery and disclosure of secrets, and offences against workers' rights, among others.

The Six Requirements of a Prevention Model

Section 5 of the same article lists what an organisation and management model must contain in order to operate as a full defence or a mitigating factor:

1. Identify the activities within which the offences to be prevented could be committed: an actual risk map for that specific company, not a generic one for its sector.
2. Establish protocols setting out how the company forms its decisions, how it adopts them, and how it carries them out.
3. Have in place financial resource management models suited to preventing the commission of the offences.
4. Impose an obligation to report risks and breaches to the body responsible for overseeing the model: the whistleblowing channel, now also required under Law 2/2023 on the protection of whistleblowers.
5. Establish a disciplinary system that sanctions failure to comply with the model's measures.
6. Periodically verify the model and amend it whenever significant breaches come to light, or when the organisation, its control structure or its activity changes.

Four Mistakes That Hollow Out a Compliance Programme

In practice, the programmes that fail to hold up in court tend to share the same defects:

• The off-the-shelf manual. A document downloaded and adapted with find-and-replace does not evidence any actual risk analysis. A judge will ask about the business's concrete risks, not the manual's table of contents.
• The compliance body with no real autonomy. If the person doing the overseeing reports, hierarchically and financially, to the person who is supposed to be overseen, the model fails to meet the requirement of autonomous supervision.
• Training nobody remembers. An annual session with no attendance record, no assessment and no traceability does not demonstrate that the model was effectively communicated.
• No documentary trail. A model approved in 2019 and never reviewed since, with no minutes from the compliance body and no evidence of controls actually carried out, reads as cosmetic.

A prevention model is not proven with a document: it is proven with a dated trail of decisions.

The Particular Case of the SME

The Criminal Code allows small companies — those authorised to file an abridged profit-and-loss account — to have the supervisory functions assumed directly by the governing body itself. This simplifies the structure, but it does not lower the substantive standard: the company still needs a risk analysis, decision-making protocols, a whistleblowing channel and periodic review.

For a twenty-person company, a proportionate model is entirely achievable. What is not achievable is improvising one after the summons has already arrived.

What to Do If an Investigation Is Already Under Way

Once a company receives a summons as a party under investigation, the first forty-eight hours shape much of the defence that follows. Three basic precautions:

• Preserve the information. Any deletion, even one that follows a legitimate retention policy, will be read as concealment if it takes place after the company becomes aware of the investigation.
• Keep the defences separate. The interests of the company and those of the director under investigation can diverge. Sharing a lawyer usually harms both.
• Appoint a special representative. The company appears in proceedings through a representative designated for that purpose — a decision that deserves careful thought, not a default appointment of the implicated director.

An internal investigation, properly conducted and documented, can support both the mitigating factor of cooperation and that of remedying the harm caused. Poorly conducted, it becomes the main source of evidence against the company.

A Canary Islands Quirk in Tax Crime

Article 305 of the Criminal Code protects state, regional, provincial (foral) and local tax revenue alike. That means defrauding IGIC can constitute a tax offence just as defrauding VAT does in the rest of Spain, with the same threshold of €120,000 per tax and tax period.

It is a consequence that catches many companies in the archipelago off guard, since they are used to treating IGIC as a lesser regional tax. The same applies to the misuse of incentives under the Economic and Fiscal Regime (REF): a Canary Islands Investment Reserve (RIC) that is allocated but never actually invested starts out as a matter of regularisation with interest; poorly documented and left unresolved over time, it can end up in criminal proceedings.

These cases are investigated by the Investigating Courts (Juzgados de Instrucción) of Las Palmas, with the involvement of the provincial Public Prosecutor's Office.

Need advice on Criminal Law? Our team is ready to help.

---

Notice: this article is for general information purposes and reflects the law in force on its publication date. It is not legal or tax advice for any specific case. Before making any decision, consult a professional.