Criminal compliance (compliance penal): criminal compliance programmes for companies

It is the forensic evidence, capable of being proven before the criminal court, that allows the company to be exempted from penalty or to have it reduced. It involves a documented audit of the criminal risks the company may incur, together with effective measures to eliminate or minimise them. It entails the implementation of a code of conduct and of an effective whistleblowing channel (which, since Law 2/2023 of 20 February, is mandatory as an “internal reporting system” (Sistema interno de información) for companies with fifty or more employees and for certain other entities), as well as the involvement of all departments and staff of the company in its observance.

For it to fulfil that evidential function, a plan individually tailored to the company in question is essential, since its criminal risks depend not only on the sector in which it operates but also on its internal structure and the way it operates. In short, it must be a “made-to-measure suit”: a generic or merely formal programme or plan does not fulfil that evidential function.

Although it is nominally said, for example, that a company may commit fraud or money laundering, the basis of its criminal punishment lies in an organisational defect that has allowed the offence to be committed within it. The company is not criminally liable because it “defrauds” or “launders money”, but because defective organisation has allowed an individual within the company to commit those offences.

The basis of the company’s criminal liability, therefore, is that it has not implemented a policy of respect for the law, thereby making it possible for offences to be committed within it.

A criminal compliance programme, by contrast, evidences the opposite: that everything possible has been done to implement such a policy of respect for the law, and that any offence committed within the company is the result of a breach of the effective policies implemented to prevent it.

A rigorous, serious, comprehensive, tailored, up-to-date and properly and regularly supervised criminal risk prevention plan exempts the company from criminal liability, provided that it was adopted and effectively implemented before the offence was committed; that is, it prevents the imposition of any penalty.

A criminal risk prevention plan implemented after the offence (in any event, before the trial begins), or one that does not fully meet the above requirements, may mitigate the penalty imposed on the company.

Not having such a plan, or having one that is merely formal or ineffective, neither exempts the company nor mitigates its penalty (without prejudice to the other mitigating circumstances the law provides for legal persons: confessing the offence, cooperating with the investigation or repairing the harm).

Yes, if they wish to benefit from exemption from penalty or, as the case may be, mitigation, should criminal proceedings be brought against them. The only distinction the criminal law draws in this respect is that, in small companies (those authorised to file an abridged profit and loss account), supervision of compliance with the plan may be undertaken directly by the management body.

In addition, the Spanish Supreme Court (judgment STS 747/2022 of 27 July 2022) has held that the individual and the legal person cannot both be convicted in single-member companies where the sole director and the sole shareholder are the same person, since there is no minimum separateness (alteridad) between the company and the individual, and a double conviction would infringe the ne bis in idem principle; the specific circumstances of each case must, however, be considered.

No. For the company’s criminal liability to arise, it is essential:

• That the offence is committed in the name or on behalf of the company and for its direct or indirect benefit, by its legal representatives or by those authorised to take decisions on its behalf or holding powers of organisation and control within it.
• Or that the offence is committed by employees or subordinates, in the course of the company’s activities, on its behalf and for its direct or indirect benefit, where their conduct was possible because their superiors seriously breached their duties of supervision, monitoring and control.

No. Although the basis of the company’s criminal punishment is the organisational defect that allowed an offence to be committed within it, the list of offences a company can commit is limited and closed (numerus clausus).

The offences for which a company can be held criminally liable are as follows (under the Spanish Criminal Code currently in force, following the last reform that extended the list, Organic Law 3/2023 of 28 March on animal abuse):

• Illegal trafficking in human organs (Article 156 bis(7) of the Criminal Code)
• Offences against moral integrity, including repeatedly concealing the whereabouts of a person’s body from his or her family (Article 173(1))
• Trafficking in human beings (Article 177 bis(7))
• Sexual harassment (Article 184(5))
• Prostitution, sexual exploitation and corruption of minors (Article 189 ter)
• Discovery and disclosure of secrets and unlawful access to computer systems (Article 197 quinquies)
• Fraud (Article 251 bis)
• Frustration of enforcement (Article 258 ter)
• Punishable insolvency (Article 261 bis)
• Computer damage (Article 264 quater)
• Offences against intellectual and industrial property, disclosure of trade secrets, offences against the market and consumers, and corruption in business (Article 288)
• Money laundering (Article 302(2))
• Illegal financing of political parties (Article 304 bis(5))
• Offences against the Public Treasury and the Social Security system (Article 310 bis)
• Offences against the rights of foreign nationals (Article 318 bis(5))
• Town-planning offences (Article 319(4))
• Offences against natural resources and the environment (Article 328)
• Offences against animals (Article 340 quater)
• Offences relating to nuclear energy and ionising radiation (Article 343(3))
• Offences of endangerment involving explosives and other agents (Article 348(3))
• Offences against public health (Article 366; drug trafficking, Article 369 bis)
• Counterfeiting currency (Article 386(5))
• Forgery of credit and debit cards, traveller’s cheques and other non-cash payment instruments (Article 399 bis(1))
• Bribery (Article 427 bis)
• Influence peddling (Article 430)
• Misappropriation of public funds (malversación) (Article 435(5))
• Hate crimes and glorification (Article 510 bis)
• Offences relating to terrorist organisations and groups, and terrorism, including its financing (Article 580 bis)
• Smuggling (Article 2(6) of Organic Law 12/1995 of 12 December on the Suppression of Smuggling; penalties in Article 3(3))

The penalties applicable to legal persons, all of which are classed as serious (graves), are as follows (Article 33(7) of the Criminal Code):

1. A fine, calculated on a daily-rate basis or in proportion to the benefit or harm.

2. Dissolution of the legal person. Dissolution entails the definitive loss of its legal personality and of its capacity to act in any way in legal transactions or to carry out any kind of activity, even a lawful one.

3. Suspension of its activities for a period not exceeding five years.

4. Closure of its premises and establishments for a period not exceeding five years.

5. Prohibition from carrying out in future the activities in the course of which the offence was committed, facilitated or concealed. The prohibition may be temporary or permanent; if temporary, it may not exceed fifteen years.

6. Disqualification from obtaining public subsidies and aid, from contracting with the public sector and from enjoying tax or Social Security benefits and incentives, for a period not exceeding fifteen years.

7. Judicial administration (intervención judicial) to safeguard the rights of employees or creditors for as long as is deemed necessary, not exceeding five years.

The company’s criminal liability may be enforced whenever it is established that an offence has been committed which must have been committed by someone holding the positions or functions described above, even if the specific individual responsible has not been identified or it has not been possible to bring proceedings against him or her.

It may also be enforced where the individual has been identified but cannot be held criminally liable because he or she has died, has evaded justice, or is affected by a circumstance bearing on his or her culpability.