Crime prevention plan (criminal compliance): the shield of art. 31 bis of the Código Penal

Contents

• What is criminal compliance?
• Why can a company be criminally liable?
• What makes the plan a shield?
• Does it matter to an SME with fewer than 50 employees?
• How Tranquilia generates it
• Frequently asked questions
• Official sources

What is criminal compliance?

It is the way you organise yourself so that, inside your company, certain offences are not committed: fraud, corruption, money laundering, offences against the Hacienda (Spain's tax authorities), against the environment, and others that the Código Penal attributes to legal persons. The crime prevention plan brings together the rules, the controls and the people who make sure that does not happen.

It is not about distrusting your people: it is about having controls that make it hard for someone, acting in the company's name, to land it in criminal trouble.

Why can a company be criminally liable?

Since the 2010 reform, and with the wording given to it by LO 1/2015, art. 31 bis of the Código Penal establishes that legal persons can be criminally liable for certain offences committed by their directors or employees for the company's benefit. That is: it is not only the person who committed the offence who answers for it, the company as such can answer too, with penalties of a fine and even of dissolution or suspension of activity.

This liability exists regardless of size: it affects a large company just as much as a small one.

What makes the plan a shield?

This is the key, and it is why it is a shield and not a burden. Art. 31 bis provides that the company is exempt from liability (or has its penalty mitigated) if, before the offence, it had adopted and effectively implemented an organisation and management model suitable for preventing offences of that nature.

Put another way: not having the model is not in itself an infringement that the authorities penalise on their own initiative, but it leaves you with no defence the day someone in your company commits an offence. With the model, you have arguments for the company not to be liable; without it, you are exposed.

Does it matter to an SME with fewer than 50 employees?

Yes, though with nuances. The criminal liability in art. 31 bis does not distinguish by size, so the shield matters to any company. For small companies, the Código Penal itself allows the supervisory body to be taken on directly by the management body, which greatly simplifies the model.

Watch out for a common confusion: the whistleblowing channel under Ley 2/2023 is, as a general rule, obligatory from 50 workers upwards. Below that figure it is not usually obligatory (except in specific sectors), but it is still a highly advisable piece of compliance.

How Tranquilia generates it

Tranquilia starts from a questionnaire about your activity and helps you build the prevention model with its pieces connected: the criminal risk map, the code of ethics and the disciplinary rules. What you get is a coherent model tailored to you, not a generic template that does not protect. If you are a gestoría (a firm that handles other businesses' administrative paperwork), you prepare it for each client company.

Frequently asked questions

Is it obligatory to have a crime prevention plan?

It is not a document the authorities oblige you to file, nor one they fine you for not having. What happens is that, without it, your company loses the chance of being exempt from criminal liability if an offence is committed. That is why people talk about a shield, and not about a formality.

Is a template downloaded from the internet any use?

As a shield, no. Art. 31 bis requires a model that is suitable and effective, matched to the real risks of your activity. A generic document that is not genuinely applied exempts you from nothing: the courts assess whether the model works, not whether it exists in a drawer.

How often is it reviewed?

When your activity changes, new risks appear or a failure is detected. A living model, one that is updated and applied, is what gives it its value as a shield; a frozen one loses effectiveness over time.

Official sources

• BOE — Código Penal (LO 10/1995), article 31 bis (as worded by LO 1/2015).
• BOE — Ley 2/2023, regulating the protection of persons who report regulatory infringements.
• Fiscalía General del Estado.

---

General information about the rules. It does not replace a lawyer's advice or an analysis of your specific case. If you have any doubts, check with a criminal law or compliance professional.