Compliance and Corporate Governance: Protect Your Company and Its Directors from Criminal Liability
Since the reform of the Criminal Code carried out by Organic Law 1/2015, legal entities can be held criminally liable for crimes committed by their directors or employees in their name, for their account, and for their benefit. The applicable penalties include fines, dissolution of the company, suspension of activities, closure of premises, and disqualification from obtaining public contracts or subsidies. The only way to exempt the company is to demonstrate that it had an effective criminal compliance program in place before the commission of the crime and that the act was committed by circumventing or fraudulently evading the controls of the program. At Nextica Law & Tax, we design and implement compliance programs tailored to the size, sector, and risk profile of each company.
WHISTLEBLOWER CHANNEL — MANDATORY SINCE MARCH 2023
Law 2/2023, of February 20, on the protection of persons who report regulatory infringements and the fight against corruption (transposition of EU Directive 2019/1937, known as the Whistleblowing Directive), requires companies with 50 or more workers to have an internal reporting channel operational from March 13, 2023. The channel must comply with these requirements:
Companies with 50+ employees without an operational reporting channel
penalty of up to €1,000,000 (art. 63 Law 2/2023). The violations that must be able to be reported include violations of labor, tax, competition, environmental, data protection, and financial regulations.
art. 63 Law 2/2023MOST COMMON CRIMES IN THE BUSINESS FIELD
| Crime | CP Precept | Sectors with the highest exposure |
|---|---|---|
| Crimes against the Public Treasury and Social Security | Art. 305-310 bis | All sectors |
| Money laundering | Art. 301-304 | Financial services, real estate, jewelry, casino |
| Corruption between individuals (bribery) | Art. 286 bis | Pharmaceutical, food, construction, distribution |
| Fraud and misappropriation | Art. 248-254 | Services, technology, finance |
| Crimes against worker safety | Art. 316-317 | Construction, industry, logistics |
| Environmental crimes | Art. 325-331 | Chemical industry, food, agriculture |
| Cyber crimes | Art. 197 bis et seq. | Technology, digital services, telecommunications |
Crimes against the Public Treasury and Social Security
Money laundering
Corruption between individuals (bribery)
Fraud and misappropriation
Crimes against worker safety
Environmental crimes
Cyber crimes
WHISTLEBLOWING CHANNEL — MANDATORY SINCE MARCH 2023
Confidentiality of the identity of the whistleblower (not of mandatory anonymity, but of confidentiality).
Acknowledgment of receipt of the complaint within 7 business days from its receipt.
Response or closure of the file within a maximum period of 3 months (extendable to 6 in complex cases).
Whistleblower protection against retaliation
the whistleblower cannot be dismissed, demoted, or subjected to any retaliatory measures.
Anonymous reporting option
although it is not mandatory, the company must accept it if the whistleblower requests it.
En detalle
THE CRIMINAL LIABILITY OF LEGAL ENTITIES — ART. 31 BIS CP
Article 31 bis of the Penal Code establishes that legal entities are criminally liable when: 1. Crimes by executives: when the crime is committed by their legal representatives or by those who, acting individually or as members of a body, are authorized to make decisions on behalf of the legal entity. 2. Crimes by employees: when the crime is committed by those who, being subject to the authority of the executives, have been able to commit it due to a serious breach of the duties of supervision, vigilance, and control.
OUR COMPLIANCE SERVICE AT NEXTICA
1. Criminal risk diagnosis and mapping: identification of the crimes with the highest likelihood of occurrence based on the sector, size, and structure of the company. 2. Compliance program design: code of conduct, specific policies by risk area, control procedures, and incident response protocols. 3. Compliance body: formation or advisory to the program's supervising body (compliance officer, compliance committee). Documentation of functions, independence, and resources. 4. Whistleblower channel: implementation of the whistleblower channel in accordance with Law 2/2023: platform, management procedure, confidentiality guarantees, and investigation protocols. 5. Training: training program for the management team and for all staff on the identified criminal risks and the obligations of the code of conduct. 6. Audit and update: annual review of the program to detect gaps, update the risk map, and adapt the program to regulatory or business changes.
Frequently asked questions
What is the difference between criminal compliance and regulatory compliance?
Criminal compliance specifically focuses on preventing the commission of crimes by executives and employees, with the aim of exonerating the legal entity from criminal liability according to Art. 31 bis CP. Regulatory compliance is broader: it includes compliance with all applicable regulations to the company (labor, tax, environmental, competition, etc.) even if it does not have direct criminal implications.
What penalties can a company receive for a crime?
The penalties applicable to legal entities (art. 33.7 CP) are: fine by quotas (from 2 to 5 years) or proportional to the benefit obtained (from double to quintuple), dissolution of the legal entity, suspension of activities (up to 5 years), closure of premises (up to 5 years), prohibition of carrying out the activity in which the crime was committed (up to 15 years), disqualification from obtaining public contracts (up to 15 years) and judicial intervention.
Does criminal compliance guarantee that the company will not be convicted?
It does not guarantee non-conviction, but it is the only legal mechanism that allows for the exoneration or mitigation of the company's criminal liability. For the model to be effective according to art. 31 bis.2 CP, it must be appropriate to the company's risk profile, be effectively implemented (not just on paper), and have a compliance body with real supervisory and initiative powers.
Let's talk about your case.
Tell us your situation and we'll reply within 24 working hours.