Since 2010, a company in Spain can be charged with a crime in its own name, and a conviction can end with the court dissolving it. In practice, the only defense that holds up is a compliance model the company had already adopted, and was actually enforcing, when the offense happened.
Who can make the company liable?
A Spanish court can try a company for any listed offense that someone commits for its direct or indirect benefit. The rule goes back to Organic Law 5/2010, which wrote it into Article 31 bis of the Criminal Code. Courts have applied it since December 23, 2010.
The first thing a judge will want to know is who committed the offense, because the test is different for managers and for everyone else. If the offender was a legal representative, or anyone with the power to take decisions for the company or to organize and control it, the company is liable as soon as that person acted in its name or on its behalf. There is no further question to answer.
If the offender was an employee, or anyone else who answers to those managers, the prosecution has to show something more. It has to show that the managers seriously failed in their duty to supervise and control that person. That’s a higher bar, and in most of these cases it’s where the argument is.
Nobody has to convict the individual first, either. Under Article 31 ter, a court can convict the company even if it never finds out who the offender was. And if that person dies or flees the country, the case against the company carries on without them.
The closed list of offenses
Spain doesn’t let prosecutors charge a company with any crime they like. There is a closed list, and a company can only be charged where the article on that particular offense says so. The fine then depends on the prison term that an individual would face for the same offense. The longer that term, the higher the bracket the company ends up in.
| Offense and Criminal Code article | Top fine for the company |
| Fraud, Article 251 bis | Three to five times the amount defrauded |
| Tax or Social Security fraud, Article 310 bis | Two to four times the amount defrauded. The company also loses subsidies and tax incentives for three to six years |
| Money laundering, Article 302.2 | Two to five years of daily quotas |
| Bribery of public officials, Article 427 bis | Two to five years of daily quotas, or three to five times the benefit, whichever is higher |
| Private-sector corruption and foreign bribery, Article 288 | The same as for bribery of public officials |
| Environmental offenses, Article 328 | One to three years of daily quotas, or two to four times the harm, whichever is higher |
A word on daily quotas, since they appear in several of those rows. The court fixes a number of days and a rate per day, and the two are multiplied. Under Article 50 the rate for a company is anywhere between €30 and €5,000 a day, a year counts as 360 days, and the term can go up to five years. At the top of both scales, the fine comes to €9 million.
The list is not only about money. Computer intrusion is on it, and so is the illegal funding of political parties. The most recent addition is workplace harassment under Article 173.1, which has carried corporate liability since October 2022.
Penalties beyond the fine
A fine is the baseline penalty, and in many convictions it’s the only one. Everything else in Article 33.7 is reserved for cases where the court has worked through the criteria in Article 66 bis first. All of those penalties count as serious, and a couple of them can end the business altogether.
| Penalty under Article 33.7 | Maximum length or scale |
| Dissolution | Permanent. The company loses its legal personality and can’t carry on any activity, lawful or otherwise |
| Suspension of activities or closure of premises | Up to five years |
| Ban on the activity linked to the offense | Up to 15 years, or permanent |
| Exclusion from subsidies, public contracts and tax or Social Security incentives | Up to 15 years |
| A court-appointed supervisor to protect workers or creditors | Up to five years |
For most companies, the penalty that really hurts is the one on public contracting. A conviction for bribery or fraud, among other listed offenses, bars the company from public contracts under the Public Sector Contracts Act. Companies can usually get a contracting ban lifted through self-cleaning measures. Not this one.
The compliance defense under Article 31 bis
Companies have had a way out since Organic Law 1/2015 rewrote Article 31 bis, with effect from July 1, 2015. How much the company has to prove depends, once again, on who committed the offense.
If it was a manager, Article 31 bis 2 asks for four things, and the company needs all of them. The board must have adopted an effective prevention model before the offense and actually applied it. Supervision of that model must have been in the hands of a body with independent powers of initiative and control. The manager must have gotten around the model by fraud. And that supervisory body can’t have neglected its oversight.
If it was an employee, the test is lighter. Under Article 31 bis 4 it’s enough that the company adopted and applied an adequate model in advance. A company that can prove some of the conditions but not all of them isn’t left with nothing, either. It can still get a reduced penalty.
Minimum content of the model
Article 31 bis 5 lists the minimum content, and courts go through it element by element. The model has to identify the activities where a listed offense could be committed, which in practice means a risk map. It has to set out how the company takes and carries out decisions in those areas. And it needs financial controls that are good enough to prevent the offenses in question.
Staff must be under a duty to report risks and breaches to the body that oversees the model. Breaches of the model’s own rules have to carry adequate sanctions. The whole thing then has to be reviewed at regular intervals, and revised after any serious breach or whenever the organization or its business changes.
Courts test each of those elements against how the company actually operates. A written manual that nobody applies doesn’t count.
Circular 1/2016 and the Supreme Court
Prosecutors work from the Public Prosecutor’s Circular 1/2016. It’s generous on one point. If a company discovers a crime through its own controls and reports it, the prosecutor has to ask the court for an exemption. On the burden of proof it’s stricter, because it expects the company to prove that its model works.
The Supreme Court convicted a company for the first time in STS 154/2016, a plenary ruling of February 29, 2016. The majority found that there was no culture of respect for the law at the company. Seven judges dissented, and the quarrel was about who has to prove what.
Sixteen days later, in STS 221/2016, the Court came down on the opposite side from the Circular. It’s the prosecution that has to prove a structural defect in the company’s prevention measures. That position has held ever since. In 2025 the Court set aside a conviction where the lower court had treated liability as automatic, and it acquitted the company (ECLI:ES:TS:2025:1922).
Parent companies, subsidiaries and mergers
Circular 1/2016 tells prosecutors to treat the staff of a controlled subsidiary as people under the parent’s authority. A Spanish parent can therefore be liable under the employee test for a crime that happened inside one of its subsidiaries, and its model needs to reach them.
Nor does a merger end the matter. Under Article 130.2, liability passes to the absorbing company after a merger or any other restructuring, or to the new companies after a split. If the original firm is only one part of the successor, the court can scale the penalty down in proportion.
A company with its seat in Spain can also be tried here for corruption committed abroad. The jurisdiction comes from Article 23.4.n of the Judiciary Act, and it applies to the Spanish subsidiary of a foreign group just as it does to a Spanish-owned firm.