Since 2010, a company can stand in the dock. The criminal liability of legal entities turned compliance into a defence question, not just one of good governance: an offence committed by a director or an employee can drag the company into a criminal case, with fines, judicial intervention or even dissolution. For international groups with a subsidiary or activity in Spain, understanding how this regime works — and how the most recent case law has changed it — is decisive. We advise and defend companies against corporate criminal liability, in the design of the compliance programme and in its defence once an offence is under investigation.
What Article 31 bis says
Article 31 bis makes the legal entity criminally liable for offences committed in its name and for its benefit by its representatives or directors, and also by employees where due control over them was lacking. It is not liability for another’s act pure and simple: the foundation is the company’s own defect of organisation. That is why the same provision allows exemption where the entity had adopted and effectively implemented an organisation and management model suitable to prevent offences of that nature, supervised by an autonomous body.
The compliance programme: what makes it effective
The difference between a programme that exonerates and one that is useless lies in its operational reality. An effective model starts from an analysis of the criminal risks specific to the activity, sets protocols to prevent them, resources an autonomous supervisory body, runs a whistleblowing channel and a disciplinary regime, and is reviewed periodically. A document adopted to tick the box, without real implementation, does not perform the exonerating function. The court assesses the living programme, not the paper.
The international dimension
Where the offence is committed in Spain, the Spanish regime applies even if the parent is foreign. German, Austrian or Swiss groups with compliance designed to their own standard must check that their model is effective before a Spanish court, which requires knowing both systems. Translation is not enough: the architecture of the programme must be adapted to the specific requirements of Article 31 bis.
Common mistakes
The most common mistake is confusing commercial or corporate-governance compliance with criminal compliance, which has its own requirements geared to the Article 31 bis exemption. It is also common to adopt a standard model without adapting it to the real risks of the activity, which makes it useless before a court. And once an offence is under investigation, producing or withholding the programme without a defined criminal strategy can harm the company’s position more than help it.
Frequently asked questions
Can my company be convicted of a crime committed by an executive?
Not automatically. Article 31 bis of the Spanish Criminal Code allows criminal liability of the legal entity where the offence is committed in its name and for its benefit by its directors or employees, but proving the individual’s offence is not enough. The Supreme Court has rejected strict liability: a defect of organisation specific to the company must be established. In judgment 768/2025 of 25 September, the Court acquitted a legal entity precisely because that structural defect was not proved, even though the executive’s offence was.
Who has to prove that my compliance programme was not working?
This is the most important shift in recent case law, and it favours the company. For a time it was understood that the defence had to show its prevention model was effective. Judgments 768/2025 of 25 September and 836/2025 of 14 October returned the burden of proof to the prosecution: it is for the public prosecutor to establish the serious breach of supervisory duties, because that structural defect is the foundation of corporate liability and the presumption of innocence applies. For the defence, this opens a clear line: if the prosecution does not prove the organisational defect, there is no conviction.
Does having a compliance programme guarantee my company will not be convicted?
It does not guarantee it, but it is the decisive element. Article 31 bis(2) exempts the legal entity from liability if it had an adequate organisation and management model, adopted and effectively implemented before the offence, with an autonomous supervisory body. The key is that it be real and operational, not a drawer document: with risk analysis, a whistleblowing channel, training and effective supervision. A cosmetic programme does not exonerate; a living, applied one can exclude liability or at least mitigate it significantly.
My company is German or has a foreign parent and operates in Spain. Which regime applies?
If the offence is committed in Spain, the Spanish regime of Article 31 bis applies, even if the parent is foreign. This poses a practical challenge: a group with compliance designed to the German standard — where the debate on Verbandsverantwortlichkeit and the Verbandssanktionengesetz has followed its own path — must check that its model also meets the Spanish Article 31 bis requirements. As a lawyer with dual training in Spain and Germany, I review that compatibility so the group’s programme is effective before a Spanish court, not only a German one.
If my company is investigated, should I produce the compliance programme or wait?
It is a strategic decision that depends on the case, best taken with criminal-law advice rather than automatically. After judgments 768/2025 and 836/2025, if the prosecution does not establish the organisational defect, the defence can argue that an element of culpability is missing without having to exhibit the whole model. In other situations, producing a solid, well-documented programme from the outset strengthens the company’s position. In the cases I run, that decision is weighed case by case, measuring what the prosecution has actually proved before showing one’s hand.
Recent trends in the courts
The case law most relevant to any company under investigation arrived in the autumn of 2025, and shifted the burden of proof in the defence’s favour. In judgment 768/2025 of 25 September (rapporteur Palomo Del Arco), and in judgment 836/2025 of 14 October, the Supreme Court expressly rejected strict liability of the legal entity: there is no presumption of an organisational defect simply because a director has committed an offence. The Court holds that, since that structural defect is the foundation of corporate liability, the presumption of innocence requires the prosecutor to establish the serious breach of supervisory duties. The practical consequence is of the first order: if the prosecution does not prove the organisational defect, the company cannot be convicted, and the defence can argue the absence of that element without being forced to exhibit its whole prevention model. It is worth bearing in mind that doctrine on this matter has swung in recent years, so each case requires checking the current state of the criterion.
Let’s discuss your company’s criminal exposure, in confidence
We design effective regulatory compliance programmes, with proven experience across many fields and sectors. If your company is under investigation, or you want to make sure your compliance programme truly protects against criminal liability in Spain, a technical review is worth having before the risk materialises. We review your situation with the confidentiality these matters demand and explain what fits your case.
Teléfono: +34 919 492 119 · Emergencias / WhatsApp: +34 626 804 157 · Email: [email protected]