How to Defend a White‑collar Criminal Investigation in Spain: a Step‑by‑step Playbook

Understanding how to defend a white‑collar criminal investigation in Spain is critical for any company or executive who receives notice of a probe, faces a dawn raid, or learns that the Fiscalía General del Estado has opened a preliminary file. Spanish economic‑crime enforcement has intensified: early indications suggest that cross‑border cooperation between EU prosecutors and Spanish investigative units is accelerating, compressing the window in which a target can secure evidence, assert privilege and shape the defence narrative. This guide sets out every corporate criminal investigation step, from the first 24 hours through trial, in the sequential, practical format that general counsels, compliance officers and CFOs need when time is short.

Overview of the White‑Collar Investigation Process and Who It Applies To

White‑collar criminal defence in Spain encompasses the investigation, prosecution and defence of economic offences, fraud, bribery, money laundering, tax crimes, accounting manipulation, market abuse and related regulatory breaches. These cases are governed principally by the Código Penal (Ley Orgánica 10/1995, as amended) and the Ley de Enjuiciamiento Criminal (LECrim), which together define the substantive offences and the procedural rules that investigators, prosecutors and courts must follow.

Who Investigates

Several actors may be involved in a white‑collar investigation in Spain. The Fiscalía General del Estado, through its specialised anti‑corruption unit (Fiscalía Anticorrupción) or its economic‑crime sections, initiates and directs many investigations. Law‑enforcement agencies, principally the Guardia Civil (via its Unidad Central Operativa, UCO) and the Policía Nacional (via its economic‑crime division, UDEF), execute search warrants, gather evidence and conduct arrests.

When the Audiencia Nacional Applies

For high‑value cases with nation‑wide impact, organised‑crime elements, or offences committed across multiple provinces, the Audiencia Nacional assumes jurisdiction. Proceedings before this court typically involve greater complexity, larger volumes of evidence and longer timelines. Defence strategy for Audiencia Nacional cases requires specialist counsel experienced in its procedures.

Key Legal Framework

The Código Penal sets out the offences, including fraud (Articles 248–251 bis), bribery (Articles 419–427 bis), money laundering (Article 301) and corporate criminal liability (Article 31 bis). The LECrim governs investigation procedure, rights of the accused, judicial instruction and trial. Every suspect, individual or corporate, is protected by the constitutional presumption of innocence; the burden of proof rests entirely on the prosecution.

Industry observers expect that the 2026 enforcement environment will feature faster evidence requests, more coordinated EU information‑sharing and larger resourcing of Fiscalía economic‑crime units, making early preparation even more important.

Eligibility and Prerequisites: Who This Guide Applies To

This playbook is designed for companies (including their boards and officers), directors, employees and professional advisers who face, or anticipate, a criminal investigation relating to economic offences in Spain. It applies whether the entity is a Spanish‑incorporated company, a local subsidiary of a multinational, or an individual personally named as an investigado (suspect).

Under Spanish law, any suspect has the right to legal representation. While individuals may technically attend initial police questioning alone, doing so in a white‑collar matter is strongly inadvisable. Companies cannot represent themselves: they must act through counsel and a designated corporate representative. Engaging specialised external criminal defence counsel before any formal interview or document handover is a prerequisite, not a luxury.

Before proceeding, confirm the following immediate contacts are in place:

• Internal legal counsel. Notify your in‑house legal team or general counsel immediately upon learning of the investigation.
• External criminal defence counsel. Instruct specialist white‑collar defence lawyers with experience in LECrim procedure and, where relevant, Audiencia Nacional proceedings.
• Board escalation. Inform the board or audit committee so that governance and disclosure obligations can be assessed.
• Insurers. Check D&O and professional‑indemnity policy notification windows, many require notice within days of becoming aware of a claim or investigation.
• Data‑privacy counsel. If cross‑border data transfers or employee monitoring are involved, involve privacy specialists early.

Step‑by‑Step Defence: How to Defend a White‑Collar Criminal Investigation in Spain

The following numbered steps trace the typical trajectory of a corporate criminal investigation in Spain. Where an investigation involves a dawn raid, the sequence compresses; where it begins with a written request or voluntary disclosure, early steps may overlap. Throughout, the overarching principle is the same: act early, preserve evidence, protect privilege and control the narrative.

Step 1, Immediate Triage: First Contact and the 24‑Hour Checklist

The first 24 hours after learning of an investigation set the tone for every subsequent phase. Delay or disorganisation at this stage routinely damages defence positions that are later impossible to recover.

First‑48‑hours checklist:

• Confirm the nature and source of the contact. Identify whether you have received a police visit, a written request from the Fiscalía, a court order (auto judicial), a whistleblower report, or media enquiry. Record the exact time, the individuals involved, the documents presented and the stated legal basis.
• Instruct external criminal counsel within hours. Do not wait for internal assessment to conclude. Counsel must be on record before any substantive interaction with investigators.
• Issue a litigation‑hold notice. Immediately direct IT, HR, finance and all relevant custodians to preserve all electronically stored information (ESI), emails, messaging records, access logs and physical documents. Destruction, even routine, becomes obstruction once an investigation is known.
• Secure physical premises. Restrict access to sensitive areas, lock server rooms and preserve CCTV footage.
• Brief senior management and the board. Use a short factual summary only, avoid speculation. All communications should be routed through counsel to preserve privilege.
• Assess regulatory notification obligations. Determine whether securities regulators, data‑protection authorities or sectoral supervisors must be notified.
• Do not speak to the press. Agree a holding statement only with counsel’s approval.

Step 2, Launch the Internal Investigation

Once the immediate triage is complete, launch a structured internal investigation in Spain to establish the facts before the prosecution defines the narrative. This step is pivotal for an effective defence.

Scope the investigation carefully. Define the subject matter, custodians, time period and data sources. Engage independent investigators, typically a separate law firm or forensic consultancy, to avoid conflicts of interest. The investigation must be conducted under the direction of external counsel to maximise the likelihood that its work product is protected by legal professional privilege.

Forensic preservation is non‑negotiable. IT forensic specialists should create forensic images of relevant devices, email servers and cloud accounts. Maintain a chain‑of‑custody log for every item collected. Preserve metadata: date stamps, sender/recipient data and file‑access records are often as important as the content itself.

Privilege strategy must be established from day one. In Spain, communications between a company and its external criminal defence counsel attract stronger privilege protection than communications with in‑house counsel. Mark all privileged documents clearly, restrict distribution, and document the legal‑advice purpose of each communication.

Step 3, Manage Dawn Raids, Interviews and Police Custody

If police or the Guardia Civil execute a search warrant (auto de entrada y registro), the response must be calm, structured and legally informed. Insist on seeing the judicial authorisation and confirm it specifies the correct address and scope. External counsel should attend the premises as soon as possible, if counsel cannot arrive before the raid begins, a senior employee should observe and log every item seized.

During the raid, cooperate with lawful requests but do not volunteer information beyond what the warrant requires. Prepare a contemporaneous seizure log: for each item or device taken, record a description, serial number, location from which it was taken and the officer responsible. Request a copy of the seizure receipt (acta de registro) issued by the police.

For employee interviews, every individual questioned has the right to counsel and the right to remain silent. Directors and officers should not attend voluntary interviews without prior legal advice. If an employee is detained (detenido), the police must inform them of their rights, including the right to a lawyer of their choice, and detention must comply with strict constitutional time limits.

Step 4, Interaction with the Fiscalía and Pre‑Trial Phase

After the initial investigative phase, interaction shifts to the Fiscalía and the investigating judge (Juzgado de Instrucción). The prosecutor may issue formal requests for documents, summon witnesses, or seek further judicial orders. Defence counsel’s role is to manage these requests strategically: supply what is legally required, assert privilege where it applies, and challenge the scope of requests that exceed the investigation’s legitimate boundaries.

Voluntary statements (declaraciones voluntarias) can be tactically valuable, or catastrophic, depending on timing and preparation. Never permit a client to make a voluntary statement without thorough factual preparation and legal advice. Where privilege and disclosure in Spain is uncertain, err on the side of caution and seek judicial clarification before handing over documents.

During the instrucción (judicial investigation phase), the defence has the right to propose evidence, request the judge to order specific investigative steps, and challenge the legality of evidence obtained. This is the phase where procedural challenges, unlawful searches, improperly obtained confessions, chain‑of‑custody failures, must be raised.

Step 5, Litigation, Settlement Options and Compliance Remediation

If the case proceeds to trial, the defence team presents its case before the court, either the Juzgado de lo Penal (for offences carrying sentences below a certain threshold) or the Audiencia Provincial or Audiencia Nacional (for more serious matters). Trial preparation involves witness preparation, expert evidence, documentary exhibits and legal argument.

Settlement and mitigation options should be evaluated throughout. Spain’s criminal system does not have a formal plea‑bargaining regime equivalent to the US model, but the conformidad mechanism allows the accused to accept the charges and proposed sentence before or at the start of trial, often resulting in a reduced penalty. Voluntary disclosure Spain options, cooperating with investigators and disclosing facts proactively, may constitute a mitigating circumstance under Article 21 of the Código Penal.

For companies, demonstrating a robust compliance programme can operate as a defence or mitigating factor under Article 31 bis of the Código Penal. Post‑offence remediation, strengthening controls, dismissing culpable individuals, compensating victims, may reduce corporate penalties.

Required Documents and Information to Preserve

Effective defence in a white‑collar investigation in Spain depends on controlling and preserving the documentary record. The documents listed below should be identified, preserved and, where appropriate, reviewed for privilege before any disclosure to investigators. Failure to preserve documents to preserve in a dawn raid scenario can constitute an obstruction offence and will undermine any subsequent defence.

Privilege and Disclosure Rules in Spain

Understanding privilege and disclosure in Spain is essential for preserving the defence position. Communications with external criminal defence counsel for the purpose of seeking or providing legal advice are protected by professional secrecy (secreto profesional). Communications with in‑house counsel receive weaker protection, Spanish courts have not recognised in‑house legal privilege to the same degree as many common‑law jurisdictions. The practical consequence is that companies should route sensitive legal advice through external counsel and should not assume that internal legal memos are immune from disclosure.

To maximise privilege protection: label all privileged documents clearly; restrict circulation to those who need the advice to act on it; and document the legal‑advice purpose of each communication at the time it is created. Where an internal investigation in Spain produces a final report, prepare it under external counsel’s direction and keep it within counsel’s files until a deliberate decision is made about whether, when and to whom it should be disclosed.

Timeline for a Criminal Investigation in Spain: Key Deadlines

The timeline for a criminal investigation in Spain varies significantly depending on the complexity of the case, the number of suspects, the volume of evidence and the court’s workload. The table below provides a practical reference; all durations are indicative and should be verified against the applicable provisions of the LECrim for the specific case.

The likely practical effect of increased EU cross‑border cooperation in 2026 is that evidence requests from other member states, via European Investigation Orders or mutual legal assistance, will arrive faster and cover broader data sets. Defence teams should prepare for compressed response timelines and early engagement with data‑privacy counsel to manage international evidence transfers.

Costs, Fees and Tax Considerations

The costs of defending a white‑collar criminal investigation in Spain vary enormously depending on scope, duration and the court involved. The estimates below are indicative and should not be treated as fixed quotations. Verify current rates with counsel.

Common Pitfalls in White‑Collar Defence and How to Avoid Them

The difference between a defensible position and an irretrievable one often comes down to avoidable errors in the first days and weeks. The following pitfalls recur across corporate criminal investigations in Spain.

• Failing to secure ESI immediately. Routine data‑deletion cycles, auto‑purging email archives or employee device resets can destroy critical evidence. Fix: issue a litigation hold within hours and engage IT forensics to write‑protect all relevant media before any review begins.
• Running an internal investigation without counsel‑led privilege protection. If the internal review is conducted by management or in‑house counsel without external direction, its findings may be disclosable to prosecutors. Fix: engage external criminal counsel to direct the investigation and mark all work product as privileged from inception.
• Informal employee interviews without legal advice. Unstructured conversations with employees can produce inconsistent statements that prosecutors later exploit. Fix: conduct interviews only with defence counsel present, using a structured script and contemporaneous notes.
• Inadvertent waiver of privilege through wide circulation. Distributing privileged legal advice memos to operational staff, board observers or third parties can destroy the privilege. Fix: restrict distribution to named recipients, label each document and maintain a privilege log.
• Underestimating cross‑border data obligations. Transferring employee data, customer records or financial documents across borders without assessing GDPR and local data‑protection rules can create additional liability. Fix: involve data‑privacy counsel early and consider whether MLATs or European Investigation Orders apply to inbound or outbound evidence requests.
• Delaying engagement of defence counsel. Waiting until formal charges are filed before instructing specialised counsel wastes the most valuable phase of the defence, the investigative stage when facts can still be marshalled and strategic options remain open.

Next Steps: Defending Your Position

Knowing how to defend a white‑collar criminal investigation in Spain is the first step; executing the defence correctly under pressure is what determines the outcome. The procedural framework under the Código Penal and the LECrim provides meaningful rights and opportunities, but only for those who act early, preserve evidence systematically, protect privilege deliberately and engage experienced criminal defence counsel before the prosecution sets the terms. For companies and executives facing an investigation, the time to prepare is now, not after charges are filed. Find a criminal defence lawyer in Spain with the specialist experience your case requires.

Sources

1. BOE, Código Penal (consolidated)
2. BOE, Ley de Enjuiciamiento Criminal (consolidated)
3. Fiscalía General del Estado
4. Consejo General del Poder Judicial, Audiencia Nacional
5. Pérez‑Llorca, White Collar Crime and Investigations
6. ECBA, Country Report: Spain (Anti‑Corruption)
7. Chambers, Corporate Crime, Spain
8. Mondaq, White Collar Crime, Spain