Spain: Corporate Compliance and the Criminal Code
During the course of the last year, Spain has overhauled its criminal law, which it could have a major impact on business. Under current law, a company is capable of committing a criminal act and as such is open to criminal sanctions.
Criminal liability can be attributed to a company through the actions of its directors and employees, such as when a director or representative commits an offence that benefits the company. However, the risk can also be generated from your rank and file workforce – so that criminal liability can be attached to a company where one or more employees committed an offence benefiting the company and the act was made possible because the company did not exercise due control over the employees and their activities.
Concern has been mounting regarding the exposure this creates, especially for large organizations and what standard of care is required to avoid criminal liability.
In July, Organic Law 1/2015 came into force which included a Code Reform that sets out exonerating circumstances that a company may rely upon to avoid liability due to the actions of their directors or employees. It is essentially a management model that ensures control and suitable levels of monitoring. The Code provides a list of actions that a company should take in order to prevent offences and provide a defence to criminal liabilities - including the following :
- The formal adoption of a organizational control model to include adequate surveillance and control measures to help prevent criminal activity
- The creation of an independent body within the company tasked with managing the control model and operating with independent powers;
- Effective due diligence – identify risk areas, patrol and make improvements
- Internal policies and protocols regarding the operation of company powers
- Tight and effective management of company finances
- Implementation of an effective breach alert process and whistle blowing process
- Implementation of an effective disciplinary system to punish offences
- Implementation of a regular review process to ensure that the control process continues to be fit for purpose
The extent to which a company implements the above measures will have a direct impact on the extent of its defense. Total exoneration for the actions of its directors and employees would be possible if all of the steps have been implemented. But where a company had only implemented a few of the actions, it is likely that criminal sanctions would still be applied at a reduced level. No defense would be available if the company has failed to implement any of the recommended measures.
Any business operating in Spain should therefore implement an internal code along the measures outlined above. Failure to do so will put both the company and its directors at risk of criminal liabilities. Our corporate governance team can provide additional guidance on how best to achieve the requirements of the Code.