Companies carry out their activity in an environment in which certain conduct committed within the organisation can give rise to criminal consequences both for the individuals involved and, in the cases provided for by law, for the legal entity itself.

Vox Legis integrates Corporate Compliance within its White-Collar Criminal Law and corporate practice, connecting risk prevention with practical experience in criminal proceedings.

The implementation, review and maintenance of specialised compliance systems is carried out through Éthica Consultoría Empresarial, the Vox Legis ecosystem's specialised firm for corporate risk prevention and management.

Corporate criminal liability

The Spanish Criminal Code provides for legal entities to be held criminally liable for certain offences committed in their name, on their behalf or for their direct or indirect benefit, where the legally established requirements are met.

The company's liability must be analysed separately from any potential personal liability of directors, officers, employees or other individuals linked to the organisation.

When a company is under investigation, or there is a risk that it may be brought into criminal proceedings, the strategy must jointly assess the facts, the corporate organisation, the existing control mechanisms and the decisions taken before and after the incident became known.

CRIMINAL LIABILITY OF LEGAL ENTITIES →

Preventing before criminal proceedings arise

The purpose of a compliance system is not merely to have documents or internal policies in place.

A prevention model must start from the company's actual risks, its activity, size, structure, decision-making processes and the way it relates to customers, suppliers, employees and third parties.

Based on that analysis, prevention, detection, reporting and response mechanisms can be established that are tailored to the organisation.

Organisation and management models

Criminal legislation sets out certain requirements for organisation and management models intended to prevent offences or significantly reduce the risk of them being committed.

Among other elements, these systems may comprise risk identification and assessment, decision-making protocols, financial controls, internal reporting mechanisms, disciplinary measures, supervision and periodic review.

The implementation and development of these systems is carried out through Éthica Consultoría Empresarial's specialised area.

COMPLIANCE PROGRAMME IMPLEMENTATION — ÉTHICA →

A compliance system must work in practice

The effectiveness of a model does not depend solely on its formal existence.

The system must be adapted to the organisation's activity and risks, be known to the people who must apply it, have genuine supervision mechanisms in place, and be updated whenever changes occur within the company or deficiencies are detected.

Prevention requires integrating compliance into the organisation's ordinary decision-making processes.

Directors, officers and management bodies

The management of corporate risks also affects those who hold management, decision-making, supervisory and control functions within a company.

When an incident arises, a distinction must be drawn between the company's potential liability and any liability that may individually correspond to the persons who took part in the events.

Vox Legis analyses these situations from a White-Collar Criminal Law perspective and, where appropriate, in coordination with the organisation's corporate legal advisors.

Internal reporting systems

Certain companies and organisations are required to have internal systems in place enabling potential breaches to be reported with confidentiality guarantees and protection for the individuals who report them, in accordance with Law 2/2023.

These systems must be designed taking into account the structure of the organisation and the obligations set out in the applicable regulations.

Éthica Consultoría Empresarial advises on the implementation and management of internal reporting channels and systems.

INTERNAL REPORTING CHANNELS — ÉTHICA →

Internal investigations and forensic reports

When a possible irregularity arises within a company, it may be necessary to determine what has happened, preserve information, identify the processes affected and assess the measures that should be adopted.

Internal investigations require particular care when the facts may have criminal relevance.

In these situations, coordination between the compliance team and the lawyers responsible for the criminal defence strategy makes it possible to jointly address the internal investigation and its potential legal consequences.

Compliance in corporate transactions

Compliance analysis can also be relevant in certain corporate transactions.

The acquisition of a company, the entry of investors, a restructuring or certain due diligence processes may require identifying regulatory, criminal or compliance risks that could affect the value or liability associated with the transaction.

Where the matter requires it, Vox Legis coordinates the corporate, criminal and compliance analysis.

CORPORATE LAW →

Éthica Consultoría Empresarial

Éthica Consultoría Empresarial is the specialised firm within the Vox Legis ecosystem dedicated to preventive advice and the implementation of management and compliance systems within organisations.

Its activity covers, among other areas, Corporate Compliance, criminal risk prevention, internal reporting systems, training, data protection, anti-money laundering, information security, and internal or forensic investigations where appropriate.

This specialisation makes it possible to maintain a clear division between the prevention and organisation of the compliance system and legal defence when criminal proceedings arise.

VISIT ÉTHICA CONSULTORÍA EMPRESARIAL →

When the problem already exists

If a company, director or officer is under criminal investigation, the analysis ceases to be purely preventive.

The strategy must assess the facts under investigation, the existing documentation, the control measures previously in place, the actions taken since the incident became known, and the procedural position of each individual or legal entity affected.

These matters are handled by Vox Legis's White-Collar Criminal Law area.

CRIMINAL DEFENCE OF COMPANIES AND EXECUTIVES →

Prevention and defence: two phases of the same corporate reality

Understanding how companies operate internally helps prevent risks. Experience before the courts provides insight into what happens when those mechanisms fail.

Coordination between Vox Legis and Éthica makes it possible to address both dimensions in a differentiated but connected way: corporate prevention and legal defence.

A team at the intersection of business, compliance and White-Collar Criminal Law

This page does not present the whole team as compliance specialists: the following profiles have genuine, demonstrated practice at the intersection of business, management and White-Collar Criminal Law.

MEET THE TEAM →

Frequently asked questions

What is a criminal compliance programme?
It is a system of organisation, prevention, detection and response to certain non-compliance risks, and in particular risks that could give rise to criminal consequences for the organisation or the individuals linked to it.
Can a company be held criminally liable?
Yes, in the cases and for the offences for which the Criminal Code provides for liability of the legal entity, where the legally required conditions are met.
Does having a compliance programme automatically avoid criminal liability?
No. The formal existence of documents does not by itself guarantee an exemption. The design, adequacy, implementation, supervision and actual functioning of the system must be analysed in relation to the specific facts.
What should a criminal prevention model include?
It must be adapted to the entity's risks and structure and address the legally relevant elements, including risk identification, protocols, controls, internal reporting, discipline, supervision and review.
Are all companies required to have an internal reporting channel?
No. Law 2/2023 establishes an obligation for certain entities, including private companies with 50 or more employees and certain other parties by reason of their activity, among other cases.
What happens when an internal report is filed?
Its content must be reviewed, relevant information preserved, the rights of the individuals involved protected, and a decision made as to whether an internal investigation or other action is warranted. If there are indications of criminal relevance, the legal strategy should be coordinated from the outset.
What is the difference between compliance and a company's criminal defence?
Compliance is primarily aimed at preventing and managing risks. Criminal defence comes into play once there is an actual investigation, proceeding or procedural risk. Vox Legis and Éthica cover these functions in a differentiated and coordinated manner.
Does the model need to be updated periodically?
Yes. An effective system must be reviewed whenever the company's activity, organisation or risks change, and also when significant failures or incidents are detected.
Can compliance be reviewed before acquiring a company?
Yes. In certain investment or acquisition transactions it can be useful to include, as part of due diligence, a review of compliance risks, open proceedings, internal channels, investigations and criminal or regulatory exposure.
What happens if the company is already under investigation?
The priority shifts to the criminal defence strategy, without prejudice to analysing the existing control model and the measures adopted by the company. The matter should be coordinated with the White-Collar Criminal Law team.
DISCUSS MY SITUATION →