How to Implement a Corporate Criminal Compliance Programme in Spain, Step‑by‑step (2026 Update)

Understanding how to implement a corporate criminal compliance programme in Spain in 2026 is now a front‑of‑mind priority for compliance officers, general counsel and business owners operating through Spanish legal entities. Under Article 31 bis of the Código Penal, legal persons face criminal liability for a catalogue of offences committed on their behalf, but a properly designed, documented and tested compliance programme can mitigate or even fully exempt the entity from that liability. Heightened enforcement expectations from the Fiscalía General del Estado, the operational arrival of NIS2 cybersecurity obligations and reinforced AML supervision by SEPBLAC and the Banco de España have all raised the evidentiary bar for what prosecutors and regulators regard as “effective.

” This guide walks through every procedural step, the documents needed for a compliance programme, costs and the 2026‑specific changes that affect the timeline to implement a compliance programme in Spain.

Overview of the Process and Who It Applies To

A corporate criminal compliance programme, known in Spanish practice as a modelo de organización y gestión, is an integrated set of policies, controls, governance structures and monitoring mechanisms designed to prevent, detect and respond to criminal conduct attributable to the company. Its principal legal objective is to satisfy the mitigation and exemption conditions set out in Article 31 bis of the Código Penal, as amended by Ley Orgánica 1/2015.

The corporate criminal liability regime applies to all legal persons incorporated or operating in Spain, sociedades anónimas, sociedades limitadas, branches of foreign companies and, with certain exceptions, public‑sector entities engaged in commercial activity. While the law draws no explicit size threshold, the practical reality is that prosecutors and courts assess proportionality: a multinational with 5,000 employees in Spain is expected to maintain a substantially more granular programme than a 20‑person start‑up. Industry observers expect that, following the 2024–2026 cycle of heightened scrutiny, even smaller entities will find it difficult to argue that a light‑touch approach suffices.

Certain sectors face additional, overlapping compliance programme requirements. Financial institutions, payment service providers and insurance companies fall under SEPBLAC AML/CTF supervision. Entities designated as essential or important under Spain’s transposition of the NIS2 Directive (Directive (EU) 2022/2555) must demonstrate cybersecurity risk‑management measures and incident‑reporting capabilities. Companies processing personal data, particularly those operating whistleblowing channels, must align with AEPD guidance on data protection impact assessments and retention.

The critical point is that a compliance programme in Spain is not a one‑off policy exercise. It must be a living system: risk‑mapped, resourced, tested, updated and, above all, documented so that each element can be evidenced to a prosecutor, judge or regulator at any point.

Eligibility and Compliance Programme Requirements

Before drafting a single policy, the organisation must confirm its perimeter and prerequisites. Failing to scope correctly is one of the most common reasons programmes are later found to be ineffective.

Scoping the perimeter

The programme must cover every Spanish legal entity through which the group operates. For multinational groups, this means identifying each sociedad, branch or joint venture with a Spanish nexus. The scoping exercise should also capture business lines, geographic territories served from Spain and any regulated activities (AML‑obliged services, critical‑infrastructure operations under NIS2, public procurement participation).

• Legal entities. List all Spanish‑incorporated entities and registered branches of foreign companies.
• Regulated activities. Flag entities subject to SEPBLAC, Banco de España, CNMV or NIS2 supervision.
• Third‑party exposure. Identify agents, distributors and subcontractors whose conduct may be attributed to the company.
• Data processing. Map personal‑data flows that will be generated by the compliance programme itself (e.g., whistleblowing reports, investigation files).

Governance decision, Board approval and resource allocation

Under the Penal Code framework, the programme must be adopted and supervised by the governing body. This means a formal Board resolution (or equivalent corporate organ decision) that authorises the programme, allocates budget and appoints a compliance lead with sufficient autonomy and access. Without a documented governance mandate, every subsequent step lacks the foundational authority that prosecutors examine first.

The compliance programme requirements under Article 31 bis include, at a minimum: identification of risk activities; establishment of protocols and decision‑making processes; management of financial resources to prevent offences; an obligation to report possible risks and non‑compliance through an appropriate channel; establishment of a disciplinary system; and periodic verification and updating of the model. These elements, often grouped as seven core pillars, form the structural blueprint for the step‑by‑step procedure that follows.

Step‑by‑Step Procedure to Implement a Corporate Criminal Compliance Programme in Spain

The following nine‑step sequence covers the complete project lifecycle. Each step identifies who is responsible, the typical duration and the evidence to keep, because in Spanish criminal proceedings, the burden of proving programme effectiveness falls on the company.

Step 1: Board Scoping and Mandate (Weeks 0–2)

The Board or governing body defines the programme’s objectives, territorial and entity perimeter and acceptance criteria. It formally resolves to adopt the compliance programme, appoints a compliance lead and approves an initial budget allocation. The resolution should reference Article 31 bis of the Código Penal explicitly to anchor the programme in the statutory framework.

Evidence to keep: Signed Board resolution or written mandate (PDF with electronic signatures); project brief document; formal record of compliance‑lead appointment. Store permanently, minimum 10 years.

Step 2: Criminal Risk Mapping and Assessment (Weeks 2–6)

Conduct a structured criminal risk assessment aligned to the Penal Code offence catalogue. This means mapping each business process to the specific offences that could arise, including fraud, bribery and corruption, money laundering, computer crimes, environmental offences, offences against workers’ rights and data‑protection breaches. For entities in NIS2 scope, include cyber‑intrusion and critical‑infrastructure disruption scenarios.

The output is a prioritised risk register scoring likelihood and impact, with a control‑gap analysis for each high‑risk area. Prosecutors and the Fiscalía General del Estado evaluate whether the risk map is comprehensive, proportionate and periodically updated, a static, generic matrix will not suffice.

Evidence to keep: Risk map document with methodology disclosure; process flowcharts; risk register with scoring and control gaps; interview logs and data‑source records; GC or compliance officer sign‑off. Retain for a minimum of 7–10 years in versioned format.

Step 3: Design Controls and Policies (Weeks 4–10)

Draft the policy suite and operational protocols that address each risk identified in Step 2. At a minimum, the suite should include a code of conduct, an anti‑bribery and corruption policy, an AML/KYC policy (for obliged entities), procurement and third‑party controls, IT and cybersecurity controls (mapped to NIS2 where applicable) and a whistleblowing policy compliant with Spain’s transposition of the EU Whistleblower Directive.

Each policy must include version control, approval authority, distribution records and a review schedule. Decision trees and escalation protocols translate high‑level policies into day‑to‑day operational guidance, these are what prosecutors look at to determine whether the programme was genuinely embedded.

Evidence to keep: All policy documents with version history; Board or committee approval records; distribution and acknowledgement logs. Retain current versions plus historical versions for at least 7 years.

Step 4: Governance, Roles and Delegated Powers (Weeks 4–8)

Formally appoint the compliance officer or compliance committee. The Penal Code requires the body with supervisory powers over the programme to have autonomous initiative and control powers. Define clear reporting lines (the compliance officer should report directly to the Board or a designated Board committee), a committee charter and a disciplinary regime for non‑compliance.

Evidence to keep: Compliance officer appointment letter and job description; compliance committee charter and minutes of inaugural meeting; delegation matrix showing authority limits. Retain throughout the officer’s tenure and for 7 years thereafter.

Step 5: Whistleblowing Channel and Internal Reporting (Weeks 6–10)

Implement a secure, confidential reporting channel that allows employees and third parties to report potential criminal conduct and compliance breaches. The channel must offer the option of anonymous reporting and comply with AEPD guidance on processing whistleblower personal data, including a data protection impact assessment. Appoint a designated receiver, define handling timescales and establish an internal investigation protocol.

Evidence to keep: Whistleblowing policy (signed); channel provider contract and technical specifications; AEPD data protection impact assessment; anonymised case logs and handling SLA records. Retain per AEPD retention guidance and internal rules.

Step 6: Training and Communication (Weeks 8–14)

Roll out mandatory training segmented by risk level. Board members and senior management receive governance‑focused sessions. High‑risk teams (procurement, finance, sales, IT) receive deep‑dive training on the specific Penal Code compliance steps relevant to their functions. All employees receive code‑of‑conduct induction and annual refresher training. For NIS2‑scope entities, add cybersecurity awareness modules.

Evidence to keep: Training attendance logs; online LMS completion records and assessment scores; employee attestation forms (electronic signatures accepted). Retain for 5–7 years.

Step 7: Monitoring, Internal Audit and Continuous Testing (Month 3 Onwards)

Design a monitoring framework with quantified KPIs, for example, number of whistleblowing reports received and resolved, percentage of high‑risk staff trained, completion rate of third‑party due diligence and number of control exceptions identified. Conduct periodic controls testing: transaction sampling, process walk‑throughs, scenario simulations and, for cyber controls, red‑team exercises. Document every test, its findings and any corrective action taken.

Evidence to keep: Test reports with methodology and sample details; remediation logs signed off by control owners; KPI dashboards reported to the Board; follow‑up evidence of corrective action completion. Retain 5–7 years.

Step 8: External Assurance and Periodic Review (Months 6–12)

Commission an external independent review or audit of the programme’s effectiveness. The likely practical effect of recent prosecutorial guidance is that companies seeking full exemption from corporate criminal liability in Spain will need to demonstrate that the programme has been validated by an independent third party, not merely self‑assessed. Update the programme based on findings, close remediation items and present a summary to the Board.

Evidence to keep: External audit report and management letter; Board summary and minutes evidencing discussion of findings; corrective action completion certificates. Retain permanently.

Step 9: Incident Response and Reporting to Authorities (As Required)

Establish an incident‑handling workflow that includes immediate evidence preservation, legal privilege management, internal escalation and, where legally required, timely reporting to authorities. AML‑obliged entities must report suspicious transactions to SEPBLAC without delay. NIS2 essential and important entities must notify the competent authority of significant incidents within the timeframes set by Spain’s national transposition. Criminal complaints must be filed promptly where the company identifies offending conduct.

Evidence to keep: Incident logs; evidence chain‑of‑custody records; copies of notifications sent to SEPBLAC, the NIS2 competent authority or law enforcement. Retain per statutory requirements and legal hold obligations.

Required Documents and Compliance Programme Checklist

Prosecutors evaluating whether a compliance programme is effective focus heavily on documentary evidence. The following table lists the core documents needed for a compliance programme in Spain, together with format, issuing authority and recommended retention periods. Maintaining this evidence in a centralised, version‑controlled repository, whether on‑premise or in an encrypted cloud environment, is essential for demonstrating the programme’s integrity over time.

Maintaining this evidence trail is not optional. The documents and tests that prove a compliance programme is effective for criminal‑liability mitigation are precisely the items that a court will request if the company is charged. A programme that exists on paper but cannot produce contemporaneous records of risk mapping, testing and remediation will almost certainly fail the effectiveness assessment.

Timeline and Key Deadlines for Implementing a Compliance Programme in Spain

The timeline to implement a compliance programme depends on the organisation’s size, sector complexity and existing control maturity. A realistic end‑to‑end implementation for a mid‑sized Spanish company typically spans 9–18 months from Board mandate to first external review. The following phased approach reflects industry practice.

Certain external deadlines may compress this timeline. NIS2 essential and important entities must already be capable of notifying significant incidents to the competent authority. SEPBLAC‑obliged entities must maintain ongoing AML reporting readiness, including the ability to file suspicious transaction reports without delay. AEPD enforcement of whistleblowing data‑protection requirements is active; any entity operating a reporting channel must have a compliant data protection impact assessment in place now.

Organisations facing imminent regulatory review, M&A due diligence or a known investigation should consider fast‑tracking Phase A to 4–6 weeks and commissioning an external assurance review in parallel with Phase B.

Compliance Programme Costs in Spain

Budgeting for a compliance programme involves both internal resource allocation and external professional fees. The table below provides indicative cost ranges for a mid‑sized Spanish company. Actual amounts vary significantly with company size, sector complexity, number of entities and level of existing control maturity.

Professional service fees are generally subject to Spanish VAT at the standard rate. Internal salary costs are employment expenses deductible against corporate income tax. Companies should budget for ongoing annual costs, platform licences, periodic training refreshers and the external review cycle, in addition to the initial implementation investment.

What Changes in 2026: Implementing a Corporate Criminal Compliance Programme Under New Expectations

Several regulatory and enforcement developments in the 2024–2026 cycle directly affect the Penal Code compliance steps that companies must follow. The practical impact is that programmes designed before these shifts may no longer meet the effectiveness standard.

• Heightened prosecutorial focus on documented effectiveness. Guidance from the Fiscalía General del Estado increasingly emphasises that prosecutors should examine not just whether a programme exists on paper, but whether it has been tested, updated and enforced. Early indications suggest that companies unable to produce external audit reports and contemporaneous remediation records face a significantly weaker defence.
• NIS2 operational obligations. Spain’s transposition of Directive (EU) 2022/2555 requires essential and important entities to implement cybersecurity risk‑management measures and incident‑notification processes. For compliance programmes, this means integrating cyber‑risk controls, IT‑incident logs and NIS2 notification evidence into the overall compliance evidence pack.
• Strengthened AML/CTF supervision. SEPBLAC and the Banco de España have reinforced expectations around KYC/KYB documentation, suspicious transaction monitoring and the integration of AML controls into broader compliance frameworks. Entities that treat AML compliance as a separate silo, disconnected from their criminal compliance programme, risk a gap that prosecutors can exploit.
• AEPD enforcement on whistleblowing data. The AEPD continues to enforce data‑protection obligations specific to internal reporting channels, including mandatory data protection impact assessments, proportionate retention periods and data‑minimisation principles. Programmes that collect excessive personal data or retain reports indefinitely are exposed to both regulatory sanctions and evidentiary challenges.

The 2026 update checklist for existing programmes is straightforward:

• Schedule or accelerate an external independent effectiveness review.
• Update the risk map to include NIS2 cyber scenarios and current AML typologies.
• Ensure the whistleblowing channel has a current, AEPD‑compliant data protection impact assessment.
• Integrate AML/SEPBLAC evidence files into the centralised compliance document repository.
• Report programme effectiveness metrics to the Board at least annually, with documented minutes.

Common Pitfalls and How to Avoid Them

• Token policies with no operational embedding. Policies that exist in a shared drive but have never been communicated, trained on or enforced. Remedy: require signed attestations, conduct announced and unannounced spot‑checks, and document distribution logs.
• No Board‑level sign‑off on record. A programme launched by the compliance team without a formal Board resolution. Remedy: pass a written Board resolution before any other step; minute it and file it permanently.
• Risk map copied from a template without tailoring. Generic risk matrices that do not reflect the company’s actual business lines, geographies or sector‑specific exposures. Remedy: conduct interviews, review transaction data and map risks to specific Penal Code offences relevant to the entity.
• Whistleblowing channel without data‑protection safeguards. Operating a reporting channel without an AEPD‑compliant DPIA or with indefinite data retention. Remedy: complete the DPIA before launching the channel and enforce defined retention and deletion schedules.
• Failure to test controls. Implementing policies but never verifying whether they work in practice. Remedy: build a testing calendar into the compliance plan from day one; document all test results and remediation actions.
• No external validation. Relying entirely on internal self‑assessment. Remedy: commission an independent review within the first 12 months and repeat on a 12–24‑month cycle thereafter.
• Weak third‑party due diligence. Onboarding suppliers, distributors or agents without anti‑bribery or AML screening. Remedy: implement risk‑based KYC/KYB procedures and retain screening records for 7–10 years.
• Disciplinary regime not applied consistently. Having a disciplinary code on paper but no records of enforcement. Remedy: document every compliance‑related disciplinary decision; inconsistent application undermines the entire programme’s credibility.

Sources

1. Official State Gazette (BOE), Código Penal (Ley Orgánica 10/1995)
2. Fiscalía General del Estado, Spanish Public Prosecutor
3. SEPBLAC, Spanish Financial Intelligence Unit
4. Banco de España
5. EUR‑Lex, Directive (EU) 2022/2555 (NIS2 Directive)
6. Agencia Española de Protección de Datos (AEPD)