1. Implementing a Robust Compliance Programme
An effective compliance programme is the cornerstone of avoiding criminal risks. It should include:
- A clear and up-to-date code of conduct.
- Internal action protocols for crime prevention.
- Control and monitoring mechanisms.
- Appointment of a compliance officer with sufficient independence and resources.
2. Risk Assessment and Risk Management
Companies should identify and assess risks specific to their sector and operations, including:
- Conducting regular compliance audits.
- Identifying potential vulnerabilities in internal processes.
- Implementing corrective and continuous improvement measures.
3. Employee Awareness and Training
A well-informed team is essential to prevent breaches. To this end, companies should:
- Provide regular training on compliance and corporate ethics.
- Promote a culture of compliance from the top management.
- Establish anonymous and secure whistleblowing channels to report irregularities.
4. Internal Controls and Regular Audits
Early detection of irregularities is key to avoid legal liabilities. To this end, it is recommended to:
- Conduct regular internal and external audits.
- Implement effective financial and operational controls.
- Use automation technologies for process monitoring.
5. Constantly Review and Update the Regulatory Framework
Laws and regulations are constantly changing, so companies need to keep up to date and adapt their compliance to new legislation. Some key actions include:
- Monitoring changes in criminal and compliance regulations.
- Adjust internal protocols and regulations according to new requirements.
- Having specialised legal advice to prevent risks.
Corporate criminal liability is not a minor issue and non-compliance can lead to serious sanctions, reputational damage and financial problems. In 2025, companies must commit to a comprehensive compliance strategy, with effective compliance programmes, rigorous internal controls and an organisational culture based on ethics and transparency. Investing in prevention is the best guarantee to operate safely and within the current legal framework.
Legislation:
Penal Code, specifically in its article 31 bis, introduced by Organic Law 5/2010, of 22 June. This provision establishes that legal persons may be criminally liable for offences committed in their name or on their behalf, and for their direct or indirect benefit, by their legal representatives or employees.
Organic Law 1/2015 of 30 March 2015 amended and extended the regime of criminal liability of legal persons, detailing the conditions under which a company can be held criminally liable and the possible exemptions if effective crime prevention and control models are implemented.
In addition, Circular 1/2016 of the State Attorney General's Office offers guidelines on the interpretation and application of the criminal liability of legal persons, providing criteria for assessing the effectiveness of the prevention models implemented by companies.
European Regulation:
Directive (EU) 2017/1371: Known as the PFI (Protection of Financial Interests) Directive, this directive establishes minimum rules concerning the definition of criminal offences and sanctions in the area of fraud affecting the Union's financial interests. It includes provisions on the criminal liability of legal persons and requires Member States to take measures to ensure that companies can be held liable for offences such as fraud, corruption or money laundering that harm theEU's financial interests.
Directive 2014/95/EU: This directive amends Directive 2013/34/EU as regards disclosure of non-financial information and diversity information by certain large companies and groups. It requires companies with more than 500 employees to include in their management reports information on environmental, social, human rights and anti-corruption policies, risks and performance. Although it focuses on transparency and corporate social responsibility, non-compliance can result in sanctions and legal liabilities for companies.
Directive (EU) 2019/1937: Known as the Whistleblower Protection Directive, it establishes a common framework for the protection of persons who report breaches of EU law. It obliges companies to implement internal whistleblowing channels and protects whistleblowers against retaliation, thus contributing to the detection and prevention of illegal activities within organisations.
