Corporate Risk and Compliance Management: The Supreme Court’s Leading Cases

======================================================

In recent years, Spain has seen a surge in cases involving corporate risk and compliance management failures. With the introduction of legal entities’ criminal responsibility in 2010, companies have been held accountable for their actions, leading to increased scrutiny on the part of the courts.

The Corporate Compliance Defence

Under Spanish law, legal persons can be exempt from liability if they demonstrate that they had adopted and effectively implemented an organisational and management body to prevent criminal offences or reduce the risk of their perpetration before the fact. Additionally, there are certain circumstances where criminal liability can be mitigated after the commission of the offence.

To take advantage of this mitigation, legal persons must:
- Confess the criminal offence to the authorities before knowledge of the initiation of judicial proceedings
- Collaborate with the investigation by providing decisive evidence
- Endeavour to repair or decrease the damage caused or establish measures to prevent and discover the commission of crimes in the future

Recent Cases

The Supreme Court has issued several notable judgments regarding corporate risk and compliance management failures. One of the most significant is the case dating back to September 2015, which held that any conviction of a company must comply with the basic principles of criminal law.

In February 2016, the Supreme Court ruled that constitutional rights and guarantees also apply to legal persons, stating that the nature of criminal liability for companies is self-responsibility.
The same month, another judgment highlighted the importance of making the same prosecutorial effort against legal persons as against natural persons.
In October 2018, the Supreme Court ruled that companies have a faculty of control over their employees regarding the commission of criminal offences, citing the doctrine of the European Court of Human Rights on the control of electronic communications at work.
In March 2019, the court established the vicarious nature of the criminal liability of legal persons, stating that they are not charged with an offence comprising omission-type behaviour.

Government Obligations

Are there risk and compliance management obligations for government, government agencies, and state-owned enterprises? According to article 31-quinquies of the Criminal Code:

Criminal liability of legal persons cannot be applied to territorial and institutional public administrations, regulatory bodies, public agencies, international organisations under public law, or others that exercise public powers of sovereignty or administration.
State mercantile companies that implement public policies or provide services of general economic interest can only be subject to fines or judicial intervention.

Digital Transformation

As Spain continues to undergo digital transformation, it remains to be seen how these developments will impact the corporate risk and compliance management landscape. One thing is certain: companies must adapt to changing circumstances and take proactive steps to ensure they are in compliance with all relevant regulations and standards.