Compliance Consulting for Companies and SMEs

Article 31 bis of the Spanish Criminal Code (introduced by LO 5/2010 and substantially reformed by LO 1/2015) sets out the criminal liability of legal entities in Spain. A company can be convicted of offences committed by its directors (in its name and for its benefit) or by employees where there has been a serious failure of supervision. The same article provides that the company can be exempted if, before the offence, it had an adequate prevention model that was effectively supervised by an autonomous compliance body, and if the offence was committed by fraudulently circumventing those controls.

Ley 2/2023, of 20 February, transposes European Directive 2019/1937 and requires every company with 50 or more employees to set up an internal reporting system. Companies with 50 to 249 employees may share resources. The AIPI, the Spanish independent authority for the protection of whistleblowers, has been operating since September 2025 and is already enforcing actively. Companies must notify the AIPI of the person responsible for the system. Fines for having no system range from €600,001 to €1,000,000 (very serious infringement), plus a ban on receiving public grants for 4 years and on contracting with public authorities for 3 years.

Art. 31 bis of the Spanish Criminal Code requires an autonomous body responsible for supervising the compliance programme. In micro-businesses that function can sit with the director. In companies with 50 or more employees, a dedicated compliance officer (internal or external) is strongly advisable and in practice necessary for the programme to be legally effective. Outsourcing the role to a firm such as Tecnocim gives you professional oversight, independence and regulatory monitoring without the cost of a full-time employee. External compliance officer services start at around €90 a month for smaller companies.

The CSRD (Corporate Sustainability Reporting Directive, 2022/2464) requires companies to publish annual sustainability reports under the European ESRS standards. The second wave applies to companies that meet two of three criteria: more than 250 employees, turnover of €50M or more, or total assets of €25M or more. Their first report covers the 2025 financial year and is published in 2026. One important update: the Omnibus I Directive (2026/470/EU, of 26 February 2026) narrows the scope of the CSRD significantly, excluding roughly 90% of the companies initially affected for financial years starting on 1 January 2027.

The exposure has several layers. Criminal (Art. 33.7 of the Criminal Code): fines of up to €20M or 4% of annual global turnover, dissolution of the company, a ban on contracting with public authorities and closure of premises. Whistleblowing channel (Ley 2/2023 and the AIPI): an administrative fine of up to €1,000,000, plus a ban on receiving public grants for 4 years and on public contracting for 3 years. Data protection (GDPR and the AEPD): up to €20M or 4% of global turnover for serious infringements; the AEPD imposed €40M in fines in Spain in 2025. Artificial intelligence (AI Act): up to €35M or 7% of global turnover from August 2026.