Criminal compliance and whistleblowing channels for companies

Who we help

• Companies with fifty or more employees, which must have an internal information system or whistleblowing channel.
• Directors who want to reduce the risk of the company being held criminally liable.
• Companies dealing with public authorities or large customers that require proof of compliance measures.
• Companies about to be bought, or that want to bring in an investor, and prefer to arrive at the due diligence of an M&A transaction with their system in order.

What it is and when it makes sense

Criminal compliance is not a document but an organisation and management model that the company adopts and carries out effectively. Its legal basis is article 31 bis of the Spanish Criminal Code (Organic Law 10/1995):

• The company is liable for offences committed in its name or on its behalf, and for its benefit, by its legal representatives or by those authorised to take decisions, and by those under their authority where there has been a serious breach of the duty of supervision.
• It is exempt if, before the offence, its management body adopted and effectively carried out a suitable prevention model, supervision was entrusted to a body with autonomous powers and the perpetrator evaded the model fraudulently.
• The model must identify the risk activities, set decision-making protocols, manage financial resources, impose a duty to report risks and breaches, establish a disciplinary system and be verified periodically.
• In small companies, those that may file abbreviated profit and loss accounts, supervision may be taken on by the management body itself.

Separately, Law 2/2023, on the protection of people who report infringements, requires an internal information system, or whistleblowing channel, for companies with fifty or more employees and for those in certain sectors, such as financial services or the prevention of money laundering, whatever their headcount (article 10). The deadlines for putting it in place expired, at the latest, on 1 December 2023.

When it makes sense

• If the company has fifty or more employees: the whistleblowing channel is compulsory.
• If its activity involves significant criminal risks, such as contracting with public authorities or handling money.
• If a customer, a bank or an investor asks for proof of compliance measures.
• Before a corporate transaction, because an orderly system makes due diligence easier.

When it does not

• A model copied from a template, without analysing the real risks, is not normally enough: what counts is that it is suitable and carried out effectively. It should not be bought as a closed package.
• In a very small company, a proportionate and simple system is better than a complex one that nobody applies.

That is why, before proposing a model, we check what the company really needs and whether there is a simpler solution; if there is, we will tell you.

When it makes sense

• Your company has fifty or more employees and has no whistleblowing channel.
• You want a compliance programme adapted to your real risks and not a template.
• A customer or a tender requires you to show a crime-prevention model.
• The company’s activity or structure has changed and the existing system no longer matches it.
• You are going to sell the company or bring in an investor.

What the engagement can include

• Analysis of the company’s criminal risks and of the activities in which they could arise.
• Designing or reviewing the prevention model: protocols, controls, a code of conduct and a disciplinary system.
• Internal information system or whistleblowing channel: policy, channel, management procedure and appointment of the person responsible for the system.
• Training for managers and employees.
• Periodic review of the model and adaptation to changes in the company, which can be included in external legal counsel on a retainer.
• Coordination with data protection, because the channel processes personal data.

What the scope depends on

• The size of the company, the number of employees and its structure.
• The risks of its activity and sector.
• Whether protocols, codes or a channel already exist that must be adapted.
• Whether the company is part of a group or operates internationally.
• The level of training and follow-up needed.

Once we have studied the documents, we send you a quote tailored to your case.

How we work

1. Initial contact. You tell us about your situation and send us the documents.
2. Review of the documents and proposals. We review the activity, the structure and any existing protocols, and set out the model and the channel your company needs.
3. Quote and letter of engagement. We send you the quote and the letter of engagement in writing.
4. Implementation and follow-up. We prepare the documents, coordinate with senior management, the person responsible for the system and your tax adviser or accountants (gestoría), and see the process through to launch.

Who handles your matter

The system is designed directly by Sara González Domínguez, a practising lawyer (abogada) registered with the Málaga Bar Association (no. 8502), whose practice focuses on Spanish company and commercial law, always backed by the rest of the firm’s team, which includes a lawyer who specialises in criminal law and advises on criminal compliance.

The directors are the ones who adopt and carry out the model, as we explain on our page on directors’ liability.

Illustrative example: a construction company in Alhaurín de la Torre, with sixty employees, has no whistleblowing channel or protocols for contracting with public authorities. The activities with criminal risk are identified, the management body approves the model and the system’s policy, a person is appointed to be responsible, a channel is set up that allows reports in writing or verbally and a procedure is approved with acknowledgement of receipt and a response deadline.

Frequently asked questions