Back in December 2010, the legal concept of the criminal liability of legal persons or corporate criminal liability entered into force for the first time in the Spanish legal system, even though its regulation in article 31 bis of the Spanish Criminal Code was quite summary.

From that moment on, and according to such regulation, legal persons, as well as natural persons who are responsible for the commission of a criminal offence, could be sentenced by criminal Courts in Spain.

After that, both Organic Law 1/2015 on the reform of the Criminal Code and the Circular 1/2016 of the Prosecutor General Office, tried to regulate more thoroughly this legal concept, including (through the modification of article 31 bis and the incorporation of articles 31 ter, 31 quarter and 31 quinquies), and for the purposes of this article, the possibility of exempting the legal person from or attenuating its criminal liability provided that:

1. The management body (board of directors or others) has effectively adopted and executed, before the commission of the offence, organization and management systems that include appropriate supervision and control measures to prevent similar criminal offences or to significantly reduce their commission; what is commonly known as the establishment of “Criminal Compliance” systems.
2. The control of the functioning and the fulfillment of the Compliance system has been entrusted to a body with autonomous initiative and controlling powers or to a body that has the legal duty of supervising the efficacy of internal controls; what is known as the “Compliance Controller”.
3. The perpetrator of the offence has fraudulently evaded the established Compliance system.
4. An omission or insufficient exercise of the supervising, monitoring and controlling functions by the Compliance Controller has not been produced.  

From that moment on, Spanish companies have begun to worry about the creation and implementation of supervision, prevention and control systems through Compliance Plans so that, in case of commission of a criminal offence, they may be exempted from criminal liability, provided that the above-mentioned requirements are met.

These Compliance and offence-prevention plans encompass almost all business activities and a wide range of criminal offences, from tax crimes, fraud, bribery, fraudulent disposal of assets, crimes against worker’s rights, corporate offences, technological crimes, crimes against the market and against consumers, crimes against intellectual property, planning breaches, crimes against the environment/health and commercial bribery, among others. In any case, those plans must always comply with the following requirements:

1. Identifying the activities in which the crimes to be prevented are more prone to be committed.
2. Establishing protocols and procedures describing the mechanism of formation of corporate will, decision making processes and execution.
3. Having management systems of financial resources aimed at preventing the commission of such offences.
4. Imposing the obligation of informing of possible infringements to the Compliance Controller.
5. Establishing a disciplinary system that appropriately sanctions the infringements of the measures established in the Compliance system.  
6. Carrying out a regular verification of the Compliance system and its eventual modification when substantial infractions have been committed, or when there are changes in the organization structure or in the activity developed by the Company.  

With the implementation of this Compliance Plans, when facing an irregularity of criminal significance, the Company should be in a position to find out how the harmful decision was made and who made it so its directors will not be held accountable for not having defined the procedures required by the Law.

It should be noted that Compliance systems are intended to exempt or limit the Company’s liability, but not the liability of its directors. Since the management body is in charge of establishing the Compliance system, failure to implement it may result in civil liability of the director towards the company or even third parties, apart from the criminal liability of the Company.

For example, let’s consider a situation where a company with a Compliance system becomes involved in a criminal procedure as a result of a crime against intellectual property (e.g. a trademark issue). If the company has adequately established the Compliance system, it would normally be exempted from criminal liability. However, if the company has not implemented such system, it can be sanctioned by the criminal court. Let’s say that such sanction amounts to EUR 1,000,0000. In that case, the company’s shareholders might claim such amount to the director through a civil suit for not having implemented the Compliance system.

In light of the foregoing, it is not surprising that some people think that we are moving towards the reversion of the burden of proof, since, in the event of a criminal harmful business conduct, the absence of a criminal Compliance system establishing valid protocols will prevent exemption from liability of the legal person.  That is why, against an accusation, the company will strive for proving the existence of a complete criminal prevention model, since not doing so can significantly condition its defense and even make its directors incur personal liability, due to the interaction between commercial and criminal law.