Criminal Compliance for Law Firms: Art. 31 bis Spanish Penal Code and Corporate Criminal Liability

# Criminal Compliance for Law Firms: Art. 31 bis Penal Code

Corporate criminal liability in Spain (introduced by LO 5/2010, reformed by LO 1/2015) is now an established reality. In 2026, law firms and professional partnerships can no longer ignore this regime.

Art. 31 bis CP: when is a legal entity criminally liable?

A legal entity is criminally liable when crimes are committed in its name and for its benefit: (1) by legal representatives or de facto directors, or (2) by employees under the control of those persons where due control was not exercised.

Most relevant crimes for law firms: money laundering (Art. 301 CP), tax fraud (Arts. 305-310 bis CP), corruption between private parties (Art. 286 bis CP), disclosure of secrets (Arts. 197-201 CP).

The compliance program: exculpatory or mitigating factor

Art. 31 bis.2 CP exempts the legal entity from liability if the board adopted and effectively implemented a prevention model including: risk identification, prevention protocols, financial controls, a whistleblowing channel, a disciplinary system, and periodic verification.

Law 2/2023: mandatory whistleblowing channel

The Whistleblowing Act (Ley 2/2023) requires a confidential internal reporting channel for organisations with 50+ employees. Retaliation against whistleblowers is sanctionable with fines up to €300,000.

Minimum compliance program content for a mid-sized law firm

1. Code of ethics and conduct
2. Criminal risk map
3. Anti-money laundering manual (if obligated entity under SEPBLAC)
4. Client acceptance policy (KYC)
5. Whistleblowing channel (internal or external provider)
6. Annual training with attendance records
7. Biennial review and update

Research criminal compliance case law with Lexiel →