Criminal Compliance for Law Firms: Art. 31 bis Penal Code
Corporate criminal liability in Spain (introduced by LO 5/2010, reformed by LO 1/2015) is now an established reality. In 2026, law firms and professional partnerships can no longer ignore this regime.
Art. 31 bis CP: when is a legal entity criminally liable?
A legal entity is criminally liable when crimes are committed in its name and for its benefit: (1) by legal representatives or de facto directors, or (2) by employees under the control of those persons where due control was not exercised.
Most relevant crimes for law firms: money laundering (Art. 301 CP), tax fraud (Arts. 305-310 bis CP), corruption between private parties (Art. 286 bis CP), disclosure of secrets (Arts. 197-201 CP).
The compliance program: exculpatory or mitigating factor
Art. 31 bis.2 CP exempts the legal entity from liability if the board adopted and effectively implemented a prevention model including: risk identification, prevention protocols, financial controls, a whistleblowing channel, a disciplinary system, and periodic verification.
Law 2/2023: mandatory whistleblowing channel
The Whistleblowing Act (Ley 2/2023) requires a confidential internal reporting channel for organisations with 50+ employees. Retaliation against whistleblowers is sanctionable with fines up to €300,000.
Minimum compliance program content for a mid-sized law firm
- Code of ethics and conduct
- Criminal risk map
- Anti-money laundering manual (if obligated entity under SEPBLAC)
- Client acceptance policy (KYC)
- Whistleblowing channel (internal or external provider)
- Annual training with attendance records
- Biennial review and update
Research criminal compliance case law with Lexiel →