Corporate Criminal Liability and Compliance for Spanish Subsidiaries: A Guide for General Counsel

1. When the subsidiary is criminally liable

The subsidiary is liable for offences committed in its name or on its behalf, and for its direct or indirect benefit, by its legal representatives or by those authorised to take decisions on its behalf or holding powers of organisation and control. It is also liable for offences by its employees where they were made possible because those persons seriously breached their duties of supervision, monitoring and control (article 31 bis.1 of the Criminal Code). It can only be liable for the offences the Code expressly provides for companies: the list and the penalties are on our criminal compliance page.

Two requirements are decisive for the defence:

• The benefit must derive from the specific offence. It is not enough for the company to have gained from related or simultaneous transactions. The Supreme Court acquitted three companies because the tax fraud being tried brought them no benefit: that benefit “must be tied to the specific offence” (STS 298/2024, of 8 April).
• The organisational defect must be proved. It is not presumed simply because a manager or employee committed an offence. The prosecution must prove a structural defect in the company’s own prevention mechanisms (STS 372/2025, of 11 April).

2. Is the parent company liable for the subsidiary’s offence?

Not automatically. Each group company is a separate legal person. Belonging to a group does not in itself transfer liability to the parent, but corporate separateness is not a defence in itself either. The parent’s actual involvement must be examined: its instructions, its managers’ powers, approval workflows, the benefit obtained and the controls it really exercised over the subsidiary.

3. What a valid compliance programme requires in Spain

A translated code of ethics, a policy approved at headquarters or a certificate is not enough. The model must have been adopted and effectively implemented before the offence and meet six requirements (article 31 bis.5 of the Criminal Code): 1. Identify the activities in which the offences to be prevented may be committed. 2. Set protocols on how the company’s will is formed, how decisions are taken and how they are implemented. 3. Have financial resource management models capable of preventing those offences. 4. Require reporting of risks and breaches to the body that monitors the model. 5. Establish a disciplinary system that sanctions breaches. 6. Be reviewed periodically and amended when there are significant breaches or changes in the organisation, control structure or activity.

If the offence is committed by a manager or director, exemption also requires that supervision of the model be entrusted to a body with autonomous powers of initiative and control, that the perpetrator fraudulently circumvented the model and that this body did not fail to exercise, or insufficiently exercised, its functions (article 31 bis.2). If the offence is committed by an employee, an adequate model adopted and effectively implemented before the offence is enough (article 31 bis.4). In both cases, if the requirements are only partly proved, the programme mitigates the penalty.

The group dimension. Three points that often fail:

• A Spanish risk map. The global programme must be adapted to the subsidiary’s actual business and to the offences in the Spanish Criminal Code.
• A body of the subsidiary itself. The law refers to “a body of the legal person”, that is, of the subsidiary. The group compliance officer can support it, but the subsidiary should have its own body or officer with documented autonomous powers. In small subsidiaries (those entitled to file an abridged profit and loss account), the management body may take on that function (article 31 bis.3).
• The whistleblowing channel. It is mandatory for companies with fifty or more employees (article 10 of Law 2/2023). In a group, the parent company approves a general policy and ensures it is applied in all group companies, and the internal reporting system may be a single one for the whole group (article 11 of Law 2/2023).

4. What to do if the subsidiary is investigated

Preserve information. Emails, contracts, accounts, internal approvals, audit reports, communications with the parent and evidence of training and controls. Without altering documents or starting communications that could harm the investigation.

Its own representative and defence. The subsidiary appears in the proceedings through a specially designated representative, with a lawyer and a procurador (article 119 of the Criminal Procedure Act). Should it agree to a plea agreement, that representative needs a special power of attorney (article 785.11). Its interests may not coincide with those of the managers under investigation: the Supreme Court has stressed that the legal person must have a defence not assumed by “the same professional who is responsible for protecting the interests of the individual” (STS 372/2025). If this is your situation, see My company is facing a criminal complaint.

Internal investigation. Reconstruct who approved each transaction, what information each body received, what controls existed, whether they were used and when the facts became known. An internal investigation helps to allocate responsibility and take corrective action, but it does not turn a non-existent programme into a model in place before the offence.

Mitigating circumstances. After the offence, only four kinds of conduct mitigate the company’s liability: confessing before knowing that proceedings are directed against it; providing new and decisive evidence; repairing or reducing the harm before trial; and implementing, before trial, effective measures to prevent and detect future offences (article 31 quater). Deciding whether to adopt them requires weighing the interests of the subsidiary, the parent and the individuals under investigation.

To understand the stages of the procedure, read our guide to criminal proceedings in Spain. On directors’ position, read our guide to the criminal liability of company directors.

5. Checklist for general counsel

• Does the subsidiary have its own criminal risk map, based on the Spanish Criminal Code?
• Is there a compliance body of the subsidiary with autonomous powers and minutes of its activity?
• Are financial and approval controls documented in Spain?
• Does the whistleblowing channel work and are reports handled?
• Are key people trained, with evidence kept?
• Is the model reviewed after each incident or relevant change?
• Has it been decided who will represent and defend the subsidiary if it is investigated?

Spanish legal terms you will come across

Does this guide apply to you?

Frequently asked questions

Are you the company’s lawyer, accountant or adviser? See how we work with professionals →