Criminal Compliance

Criminal risk prevention programmes are an essential tool for avoiding regulatory non-compliance and criminal convictions. Furthermore, these programmes have become a fundamental part of business operations and are an essential requirement for contracting or securing public funds or financing.

Our specialist compliance lawyers support companies through every stage of implementation, ensuring that the programmes meet the legal requirements set by the legislator. Some of these requirements include:

• Analysis and identification of criminal risks and associated activities
• Policies and controls to mitigate the identified risks
• Financial resources
• Appointment of a compliance body
• Communication and training initiatives
• Channels for reporting irregularities
• Assessment and continuous improvement

• Implementation of crime prevention programmes
• Development of policies and/or procedures for the mitigation of crime risks
• Assessment of compliance status or performance
• Development of matrices for the identification, prioritisation and management of crime risks
• Collaboration with and provision of advice to the body responsible for compliance
• Implementation of the internal whistleblowing channel
• Technological support
• Continuous improvement initiatives
• Development of communication and awareness-raising initiatives within the business environment
• In-house training, both general and specific
• Assistance with certification to the UNE 19601, UNE 37001 and UNE 37301 standards
• Corporate defence
• Internal investigations

The whistleblowing channel is a tool that enables employees and third parties outside the organisation to report, in confidence, any potential irregular or criminal conduct.

In addition to the legal obligation set out in Article 31 bis of the Criminal Code, Directive (EU) 2019/1937 of the European Parliament and of the Council on the protection of persons who report breaches of Union law came into force in Spain and the rest of the European Union on 17 December 2021. Under this new legal framework, companies with more than 50 employees, whether public or private, are obliged to establish a reporting channel that complies with the strict requirements of the legislation.

CECA MAGÁN’s team of lawyers specialising in regulatory compliance helps companies tackle this legal challenge by providing them with specialist advice and technological tools tailored to the requirements of the new legislation. We also assist companies in managing any reports received, should this be necessary.

In the case of medium-sized companies, the risk of criminal liability is neither a remote possibility nor something exclusive to large corporations. Often, precisely because of the concentration of functions, the lack of an internal legal structure or the informal nature of certain processes, these organisations are more exposed to the risk that criminal liability will be attributed to the legal person for failing to exercise due control over its staff or directors.

Having a criminal compliance programme tailored to the size and activities of the company not only ensures compliance with the requirements of Article 31 bis of the Criminal Code, but also delivers real value: it protects directors, builds trust amongst customers and investors, facilitates access to public procurement and financing, and strengthens the company’s reputation. In the current climate, compliance is not merely a legal obligation, but a strategic decision and the key to ensuring the company’s sustainability.

The work of the Independent Whistleblower Protection Authority (AIPI) is beginning to intensify, and companies are starting to face their first proceedings relating to the management of their internal reporting channels.

The AIPI does not merely analyse the content of the reports received. It also examines how organisations respond to internal reports: response times, traceability, confidentiality, protection against retaliation, the independence of the system and the proper management of the procedure.

• Initial analysis of the request or procedure initiated by the AIPI.
• Review of the internal reporting channel and associated documentation.
• Preparation of submissions and responses to requests.
• Assessment of risks relating to sanctions, regulatory compliance and reputation.
• Preparing the company for meetings or proceedings before the AIPI.
• Expert assistance during such meetings.
• Review and strengthening of the internal reporting system and anti-retaliation protocols.
• Assessment of compliance with Law 2/2023 and improvement of internal procedures.