Criminal Compliance for Companies in Madrid: Compliance Programmes That Protect Your Directors

Criminal compliance for companies in Madrid is the implementation of the internal prevention and control programme required by Article 31 bis of the Spanish Criminal Code (Código Penal) to exempt or mitigate corporate criminal liability for offences committed by directors or employees acting on the company's behalf. Spain's Anticorruption Prosecutor's Office and the Economic Crime Prosecutor, both headquartered in Madrid with nationwide jurisdiction, actively prosecute corporate offences including corruption, money laundering, tax fraud, and market manipulation. Law 2/2023 on whistleblowing protection additionally requires companies with 50 or more employees to operate a fully compliant internal information channel — extending the compliance perimeter for Madrid-based businesses.

Why criminal compliance in Madrid is a genuine priority, not a formality

The Anticorruption Prosecutor’s Office is headquartered in Madrid. The National High Court — which tries the most significant economic crimes of national scope — is in Madrid. The Central Investigating Courts, before which the most serious corporate corruption cases are investigated, are in Madrid. This is not coincidental: Madrid is Spain’s principal centre of economic activity and, with it, the country’s main focal point for corporate criminal risk.

Since the 2015 Criminal Code reform, companies can be found directly criminally liable for offences committed on their behalf or for their account, with penalties ranging from multi-million-euro fines to activity suspension, premises closure, or judicial administration. The 2019 reform introduced certification of compliance programmes by accredited bodies, and the Supreme Court has issued case law clarifying what elements a programme must have to be recognised as an exemption or mitigating factor.

In this context, criminal compliance in Madrid is not an image document. It is a management system that needs to be designed, implemented, known across the organisation, periodically audited, and updated. When the tax investigation or criminal charge arrives, that system — or its absence — is decisive.

Our Madrid criminal compliance team: programmes that protect your directors

Our criminal compliance team in Madrid combines the legal perspective — Article 31 bis CP, Supreme Court case law, Prosecutor criteria — with practical implementation capacity in organisations of different sizes and sectors. We do not just design the programme: we accompany its implementation, train the teams, act as external compliance officer when needed, and if criminal proceedings are initiated, we defend.

For companies that are also obligated entities under anti-money laundering regulations, we coordinate both programmes into an integrated management system that avoids duplication and ensures comprehensive coverage. The same applies to the whistleblowing channel required by Law 2/2023: we integrate it into the criminal compliance programme as one of its components, not as a standalone addition.

For companies with multi-jurisdiction presence, we work with correspondents in the relevant countries to ensure the compliance programme is consistent with each jurisdiction’s requirements.

What the Supreme Court requires for a compliance programme to be effective

The Supreme Court case law — particularly Judgments 154/2016 and 221/2016 — has established the criteria a criminal compliance programme must meet to be recognised by the courts as an exemption or mitigating factor:

• Identification of specific criminal risks for the company’s activity — not a generic catalogue.
• Concrete action protocols for each identified risk, with designated responsible persons and defined timescales.
• Operational whistleblowing channel enabling any employee to report irregularities without retaliation.
• Compliance body with genuine autonomy, with full information access and direct board reporting capability.
• Documented effective training for employees with relevant exposure to identified risks.
• Periodic audit and update of the programme in response to regulatory or organisational changes.

A programme that does not meet these requirements is not an exemption: it is simply a document that the Prosecutor will use to demonstrate that the company attempted to appear compliant without genuinely complying.

What our criminal compliance programme for Madrid companies includes

Phase 1 — Diagnostic: identification of applicable offences from the Article 31 bis CP catalogue, exposure assessment by activity and employee profile, current compliance status analysis and gap identification.

Phase 2 — Design: documented criminal risk map, action protocols per risk, code of ethics, conflict of interest policy, gifts and hospitality policy, and whistleblowing channel management procedure.

Phase 3 — Implementation: training for directors, executives and key employees, whistleblowing channel deployment in line with Law 2/2023, compliance officer designation or assumption of the function, and audit plan establishment.

Phase 4 — Maintenance: annual programme audit, board report, regulatory update, and management of channel reports received.

Phase 5 — Defence: if a criminal investigation is initiated, we represent the company before the Prosecutor and the Investigating Courts in Madrid, with capacity to litigate through to the National High Court.

Request an initial diagnostic meeting with our Madrid criminal compliance team. We will assess your current programme’s status, identify the most urgent gaps, and propose a concrete action plan. The consultation is free and confidential. Contact us through our Madrid office.