What Spain's Organic Law 1/2026 Means for Companies and Executives

The penal reform Spain has awaited for years is now law. Organic Law 1/2026 (Ley Orgánica 1/2026), published in the Boletín Oficial del Estado (BOE) in April 2026, restructures core elements of the Spanish Penal Code, from the introduction of a statutory multirecidivism framework and recalibrated aggravating factors to strengthened corporate criminal liability provisions and tighter connections between criminal enforcement and anti-money-laundering obligations. For general counsel, compliance officers, CFOs and board members, the reform demands an immediate reassessment of internal controls, investigation-readiness protocols and reporting workflows. This guide maps the key statutory changes, quantifies the increased exposure for companies and their directors, and delivers a practical, step-by-step playbook for the compliance decisions that must be made now.

Why This Matters Now: An Executive Summary of Organic Law 1/2026

Organic Law 1/2026 is not a narrow technical amendment. It is a structural overhaul of sentencing, corporate accountability and enforcement practice that touches every company operating in Spain. The reform is the most significant revision of the Penal Code since the landmark 2015 amendment that first codified corporate criminal liability under Article 31 bis. Industry observers expect the practical impact on boardrooms to be felt within months as prosecutors and regulators adapt their enforcement posture to match the new statutory tools.

Boards and compliance teams should focus on four headline consequences:

• Multirecidivism is now codified. A new statutory framework allows courts to impose enhanced penalties, including higher fines and extended disqualification periods, on repeat offenders, including legal persons. This is the first time Spanish law provides a structured mechanism for stacking prior convictions into aggravated sentencing.
• Corporate criminal liability provisions are tightened. Amendments to Article 31 bis and related articles clarify the scope of “responsible bodies” within organisations, expand the circumstances under which a company can be held liable for acts of employees and agents, and increase the maximum corporate fine.
• AML and penal enforcement converge. The reform explicitly links certain money-laundering offences to enhanced corporate penalties and creates a legislative basis for forthcoming Royal Decrees that will update reporting obligations under the supervision of SEPBLAC (Servicio Ejecutivo de la Comisión de Prevención del Blanqueo de Capitales).
• Delegated Royal Decrees are coming. The law mandates the Government to publish implementing regulations within a specified window after entry into force. Companies cannot wait for those decrees before acting, the criminal liability provisions are already in effect.

The central question for every in-house team is straightforward: What immediate compliance choices must my company make to reduce criminal exposure under the new penal reform in Spain?

Key Changes in LO 1/2026: Statutory Highlights of the Penal Reform Spain

Understanding what Organic Law 1/2026 actually changes requires precision. The law amends multiple articles of the Penal Code (Código Penal, as codified in Organic Law 10/1995), introduces new provisions, and repeals or modifies transitional arrangements from previous reforms. The headline changes fall into three clusters: multirecidivism and sentencing, aggravating factors and penalties, and procedural-administrative links.

Timeline of Legislative Steps

Multirecidivism: The Core Innovation

The concept of multirecidivism (multirreincidencia) has existed in Spanish legal scholarship and judicial practice, but LO 1/2026 gives it a statutory footing for the first time. The reform introduces a graduated escalation mechanism: where a defendant, natural or legal person, has two or more prior convictions for offences of the same nature or within the same Title of the Penal Code, the court may impose penalties in the upper half of the statutory range and, for corporate offenders, may order dissolution, suspension of activities, or judicial intervention in addition to fines. Early indications suggest that prosecutors will use the multirecidivism provisions aggressively in white-collar crime Spain cases, particularly those involving repeated regulatory breaches that previously attracted only administrative sanctions.

Retroactivity and Transitional Provisions

Spain’s Constitution (Article 9.3) and Penal Code (Article 2) establish a firm prohibition against retroactive application of harsher criminal penalties. LO 1/2026 includes a specific transitional provision (disposición transitoria) confirming that the multirecidivism framework applies only to offences committed after the law’s entry into force, and that prior convictions used to establish the repeat-offence threshold must themselves have become final (firme) before the triggering offence was committed. For ongoing cases, the general principle of ley penal más favorable (most favourable criminal law) continues to apply, meaning that where any provision of LO 1/2026 reduces a penalty or decriminalises conduct, defendants in pending proceedings can invoke the new law.

Statute of Limitations and Enforcement Implications

The reform does not fundamentally alter the limitation periods (plazos de prescripción) in the Penal Code, which range from one year for minor offences (delitos leves) to twenty years for offences carrying imprisonment of fifteen years or more. However, the practical effect of the multirecidivism framework on enforcement priorities is significant. The likely practical effect is that prosecutors will be incentivised to pursue cases that establish a conviction record, knowing that each final conviction increases future sentencing leverage. For companies, this changes the cost-benefit calculation around early settlement, voluntary disclosure and cooperation with investigators.

What the Reform Means for Corporate Criminal Liability in Spain

Corporate criminal liability Spain has operated under the framework introduced by Organic Law 5/2010 and expanded by Organic Law 1/2015, which embedded the liability model in Article 31 bis of the Penal Code. LO 1/2026 builds on this architecture rather than replacing it, but the amendments are far from cosmetic.

How the Multirecidivism Change Increases Exposure for Companies and Executives

Under the existing Article 31 bis framework, a company can be held criminally liable where an offence is committed: (a) by persons with authority to bind the company or to make decisions on its behalf (representantes legales or senior management), or (b) by employees or agents where the offence was made possible by a failure of supervision attributable to the persons described in category (a). LO 1/2026 refines the concept of “responsible bodies” to capture compliance officers, risk committee members and external consultants who exercise supervisory functions, extending potential personal exposure beyond the traditional C-suite.

The multirecidivism provisions apply to legal persons. In practical terms, this means that a company with one prior conviction for, say, a tax fraud offence under Article 305, which subsequently faces prosecution for money laundering under Article 301, could find itself within the multirecidivism framework if the two offences fall within the same Title or are deemed offences “of the same nature.” The enhanced penalties available to the court include fines in the upper half of the statutory band, temporary or permanent closure of business premises, prohibition from contracting with the public sector, and, in the most extreme cases, judicial dissolution of the entity.

Penalties and Directors’ Personal Exposure

For natural persons in directorial or senior management roles, the reform adjusts the ancillary penalties (penas accesorias) available upon conviction. Directors can face extended disqualification from holding corporate office, prohibition from acting as administrators of companies in regulated sectors, and personal fines calculated as a multiple of the benefit obtained or damage caused. The reform clarifies that these penalties are cumulative with any imprisonment term and are not subject to suspension (suspensión de la pena) where the multirecidivism threshold is met.

Consider a hypothetical: a mid-sized Spanish real estate company was convicted in 2023 of facilitating money laundering through opaque transaction structures. Following LO 1/2026, if the same company (or a successor entity controlled by the same individuals) faces prosecution for a further money-laundering offence committed after April 2026, the court could invoke multirecidivism to impose penalties at the upper end of the statutory range, including potential judicial intervention in the company’s management. The directors personally involved could face disqualification from all corporate offices for up to fifteen years.

AML, Money Laundering and the Enforcement Landscape in Spain

The intersection between criminal law reform and anti-money-laundering regulation is one of the most consequential features of Organic Law 1/2026. Money laundering Spain enforcement has historically operated on two parallel tracks: administrative supervision by SEPBLAC under Law 10/2010 (Ley de Prevención del Blanqueo de Capitales y de la Financiación del Terrorismo), and criminal prosecution under Articles 301–304 of the Penal Code. LO 1/2026 tightens the connection between these tracks by introducing provisions that allow administrative findings by SEPBLAC to be used as evidence in criminal proceedings and by expanding the predicate offences for money-laundering charges.

Practical Red Flags and High-Risk Sectors

The reform increases criminal exposure for entities in sectors already identified as high-risk by SEPBLAC and the Financial Action Task Force (FATF). Finance, real estate, gaming and cross-border mergers and acquisitions are the sectors most likely to face enhanced scrutiny. Specific red flags that compliance teams should reassess in light of LO 1/2026 include:

• Complex multi-jurisdictional transaction chains designed to obscure beneficial ownership, now more likely to attract criminal rather than merely administrative scrutiny.
• Failure to file or late filing of Suspicious Transaction Reports (STRs) with SEPBLAC, the reform strengthens the evidentiary weight of non-filing in subsequent criminal proceedings.
• Politically Exposed Persons (PEPs), enhanced due diligence requirements for PEPs are now explicitly linked to the criminal framework, meaning that deficient PEP screening can form part of the evidential basis for a corporate criminal liability charge.
• Third-party intermediaries and agents, the broadened definition of “responsible bodies” means that companies can face liability for the acts of external compliance consultants, auditors and agents who fail to flag suspicious activity.

Expected Regulatory Guidance and Royal Decrees

LO 1/2026 delegates to the Government the power to issue Royal Decrees updating SEPBLAC’s operational framework, adjusting STR thresholds and modernising the technical standards for transaction monitoring. Early indications from the Ministerio de Justicia suggest that these decrees will be published in the second quarter of 2026. Companies should not wait for the decrees before updating their compliance frameworks, the criminal liability provisions are already in force, and prosecutors are not required to demonstrate compliance with implementing regulations that have not yet been published. The prudent approach is to adopt a “comply now, refine later” posture: implement the most protective interpretation of the law’s requirements and adjust downward only once the Royal Decrees provide specific operational detail.

Practical Steps Companies Should Take Now Under the Penal Reform Spain Framework

The compliance response to LO 1/2026 must be structured, documented and time-stamped. A company’s ability to demonstrate that it took prompt, good-faith steps to comply with the new law is itself a defence factor under the corporate criminal liability framework, Article 31 bis allows a company to be exempt from liability where it can show that it had an effective compliance programme in place before the offence was committed.

Pre-Investigation Planning

Pre-investigation planning is the discipline of preparing for a criminal investigation before one materialises. In the context of criminal investigations Spain, this means having the following elements in place:

• Privilege protocol. Define in advance which communications are covered by legal professional privilege (secreto profesional) and ensure that internal investigation files are structured to preserve privilege. Instruct employees that all communications about potential compliance issues must be routed through designated legal counsel.
• Notification chain. Establish a documented escalation protocol: who is notified first when a potential offence is detected, in what order, and through which secure communication channel. The chain should run from the compliance officer to the general counsel, to the board’s audit committee chair, and, where necessary, to external criminal defence counsel.
• Data preservation. Implement automatic preservation holds on electronic data (emails, messaging platforms, financial systems) that can be activated within hours of a trigger event. Failure to preserve data after becoming aware of a potential investigation can itself constitute an obstruction offence.
• External counsel retainer. Identify and retain experienced criminal defence counsel before an investigation begins. The relationship should be documented, the scope of engagement defined, and a conflict-check completed in advance.

Compliance Programme Upgrades

LO 1/2026 raises the bar for what constitutes an “effective” compliance programme under Article 31 bis. Companies should review and, where necessary, upgrade the following elements:

• Risk assessment. Conduct a fresh criminal risk assessment that maps the company’s activities against the revised offence catalogue in the Penal Code, including the expanded multirecidivism provisions. The assessment should be documented, board-approved and dated.
• Reporting lines. Ensure that the compliance function reports directly to the board (or a board-level committee), not to the CEO or CFO. The reform’s expanded definition of “responsible bodies” means that a compliance officer who reports to management rather than the board may lack the independence required to satisfy the Article 31 bis defence.
• AML controls. Update transaction monitoring systems, STR filing workflows and customer due diligence protocols in anticipation of the forthcoming Royal Decrees. Particular attention should be paid to PEP screening, beneficial ownership verification and enhanced due diligence for cross-border transactions.
• Training. Deliver mandatory compliance training to all employees, directors and relevant third-party agents within 90 days of the law’s entry into force. Training should cover the multirecidivism framework, revised penalties and the company’s updated reporting obligations. Document attendance and comprehension testing.

Incident Response: The 72-Hour Playbook

When a compliance team discovers credible evidence of potential criminal conduct, the first 72 hours are critical. The following checklist should be treated as a minimum standard:

• Hour 0–4: Preserve and isolate. Activate data preservation holds. Isolate affected systems and accounts. Do not delete, modify or move any electronic records.
• Hour 4–12: Notify counsel. Contact designated internal legal counsel and, where necessary, external criminal defence counsel. Invoke privilege over all subsequent communications relating to the incident.
• Hour 12–24: Board escalation. Notify the audit committee chair and, where the incident involves senior management, the full board. Prepare a confidential written briefing note summarising what is known, what is not known, and what steps have been taken.
• Hour 24–48: Preliminary fact-finding. Commission a rapid, privilege-protected internal investigation to establish the scope of the potential offence, identify affected persons and quantify potential exposure. Do not interview suspected persons without criminal defence counsel present.
• Hour 48–72: External communications. Prepare a holding statement for regulators, counterparties and (if the company is listed) market disclosure purposes. Assess whether a voluntary disclosure to SEPBLAC or the Fiscalía (Public Prosecutor’s Office) is appropriate.
• Hour 72+: Strategic decision. Decide on the investigation strategy, full internal investigation, voluntary disclosure, cooperation with authorities, or defensive posture, based on the facts gathered and legal advice received.

Reporting Obligations by Entity Type

Defence Strategy: Criminal Investigations, Audiencia Nacional and ECHR Considerations

When an investigation materialises, whether triggered by a SEPBLAC referral, a denuncia, or a self-initiated inquiry by the Fiscalía, the defence strategy must be calibrated to the specific procedural phase and the court with jurisdiction.

Investigation Phases: Diligencias Preliminares vs. Instrucción

Spanish criminal procedure distinguishes between the preliminary inquiry phase (diligencias preliminares or diligencias previas), conducted by the investigating judge (Juez de Instrucción), and the trial phase. During diligencias previas, the investigating judge has broad powers to order searches, seize documents, freeze assets and take witness statements. For companies, the most dangerous moment is often the initial search of business premises, if data preservation protocols are not already in place, critical evidence (both incriminating and exculpatory) can be lost or compromised.

Evidence Preservation and Privilege

Internal investigations conducted by in-house or external counsel must be structured to preserve legal professional privilege. In Spain, the scope of privilege (secreto profesional) is narrower than in common-law jurisdictions, it protects communications between lawyer and client for the purpose of legal advice, but does not automatically extend to documents created by non-lawyers during an internal investigation. Practical best practice includes routing all investigation-related communications through qualified Abogados (not merely in-house business advisors), maintaining a contemporaneous privilege log, and segregating privileged and non-privileged material from the outset.

Audiencia Nacional Defence and ECHR Remedies

The Audiencia Nacional has exclusive jurisdiction over certain categories of national-level crime, including large-scale financial fraud, cross-border money laundering and terrorism financing. For companies facing investigation before the Audiencia Nacional, the procedural dynamics differ materially from cases before provincial courts: investigations tend to be longer, more complex and more resource-intensive; judicial decisions on provisional measures (asset freezes, travel bans) are harder to challenge; and media attention is typically greater. Defence strategy in Audiencia Nacional cases must account for these factors from the outset, including the possibility that provisional measures will be imposed ex parte before the company has an opportunity to be heard.

Where fundamental rights violations occur during the investigation, such as unlawful searches, failure to respect privilege or disproportionate asset freezing, the European Court of Human Rights (ECHR) remains an available remedy after domestic avenues have been exhausted. Industry observers expect that the first wave of ECHR challenges to the multirecidivism provisions will test whether the enhanced penalties are compatible with the principle of proportionality under Article 7 of the European Convention on Human Rights and the ne bis in idem principle.

Conclusion: Immediate Actions for Boards and Next Steps Under Spain’s Penal Reform

Organic Law 1/2026 is now in force. The window for reactive compliance is already closing. Boards and executive teams should treat the following five actions as immediate priorities:

• Commission a criminal risk assessment mapping the company’s activities against the revised offence catalogue and multirecidivism framework within 30 days.
• Review and upgrade the compliance programme to meet the heightened standard under the amended Article 31 bis, with particular attention to reporting lines, AML controls and training.
• Establish a pre-investigation protocol covering privilege preservation, data holds, notification chains and external counsel retainers before an investigation begins.
• Monitor forthcoming Royal Decrees on AML enforcement and SEPBLAC reporting, assign a responsible person or team to track BOE publications and adjust compliance workflows accordingly.
• Brief the board on the personal exposure of directors and senior officers under the reform, including the expanded disqualification and ancillary penalty provisions.

The penal reform Spain enacted through LO 1/2026 represents a step change in corporate criminal exposure. Companies that act decisively now, documenting their compliance efforts, retaining experienced counsel and building investigation-ready infrastructure, will be in the strongest possible position if enforcement attention arrives. Those that wait risk facing enhanced penalties under a framework explicitly designed to punish repeat and systemic non-compliance. To explore how these changes affect your organisation specifically, consider consulting a white-collar criminal defence specialist in Spain or searching the Global Law Experts lawyer directory for qualified practitioners.

Sources

1. Ministerio de Justicia, Official Government Guidance on LO 1/2026
2. Penal Reform International, Spain Factsheet
3. Probatia, Spain Modernizes Its Penal System
4. Poder Judicial, Audiencia Nacional Case Law Database (CENDOJ)
5. SEPBLAC, Servicio Ejecutivo de la Comisión de Prevención del Blanqueo de Capitales
6. Fiscalía General del Estado
7. United Nations Office on Drugs and Crime (UNODC)