Corporate compliance in Spain: Article 31 bis, whistleblowing, AML, costs and the effect on deal value

Corporate compliance in Spain rests on three regimes.

A crime prevention model under Article 31 bis of the Criminal Code can exempt a company from criminal penalties, an internal whistleblowing system is mandatory from 50 employees, and anti-money laundering rules apply to banks, real estate, advisers and some traders. In our example, a 200-employee company spends €54,000–77,000 a year.

Below: what Spanish law requires from a company, which penalties the company itself faces, not only its directors, what a compliance programme costs for a company with 50–500 employees, and how having one, or not, changes the price when a business is bought or sold.

Finetic are financial advisers, not lawyers: the model, the policies and any defence in court are prepared by a compliance lawyer. We show what it costs and how it feeds into the deal numbers.

What corporate compliance means in Spain

Compliance (cumplimiento normativo) is a set of rules, controls and people that keeps a company from breaking the law and, if a breach still happens, lets it detect the breach quickly and prove it did everything it could.

Spain has no single “compliance act”. For a mid-sized company three regimes matter, each with its own law, its own scope and its own sanctions.

On top of these three there is sector compliance: data protection, competition, tax, health and safety.

We do not cover them in detail here: for a financial assessment the three regimes in the table plus tax risks, discussed below, are usually enough.

Criminal compliance: Article 31 bis of the Spanish Criminal Code

Since 2010, a legal entity in Spain can be convicted in its own right.

A company is liable for offences committed for its benefit by its legal representatives and by people authorised to take decisions or exercise control, and for offences by their subordinates where management seriously failed in its duty of supervision (Art. 31 bis.1).

Liability applies even if the individual employee responsible has not been identified or cannot be prosecuted (Art. 31 ter).

A company is not liable for every offence, only for those listed in the Criminal Code.

For an ordinary business the main ones are tax offences, private-sector bribery, bribery of officials, fraud, money laundering, offences against workers’ rights, environmental and data offences. A lawyer maps the list against the company’s sector.

When the model exempts the company

The company is exempt if, before the offence, the governing body adopted and effectively implemented an organisation and management model, supervision of the model was entrusted to a body with autonomous powers, the offenders fraudulently circumvented the model, and the supervisory body did not fail in its duties.

If this can only be partly proven, the penalty is reduced (Art. 31 bis.2 and 4).

The model must contain six elements (Art. 31 bis.5): a map of the activities where offences may be committed; protocols for taking and executing decisions; financial resource management that prevents offences; a duty to report risks to the supervisory body; a disciplinary system; and periodic review and updating of the model.

For a finance professional the third element is the key one: the model must see where money goes, with signing limits, payment controls, and checks on entertainment expenses and intermediaries.

In a “small” company the governing body itself may act as the supervisory body.

A small company is one entitled to file an abbreviated profit and loss account: for two consecutive years it stays below two of three thresholds, namely total assets of €11.4 million, turnover of €22.8 million and 250 employees (Art. 31 bis.3 of the Criminal Code and Art. 258 of the Capital Companies Act).

A company with 200 employees, €40 million of turnover and assets above the threshold is no longer small: it needs a separate compliance body or officer.

UNE 19601 certification and the prosecutors’ view

UNE 19601 is the Spanish standard for criminal compliance management systems.

The Spanish standards body UNE published the new UNE 19601:2025 on 24 April 2025, replacing the 2017 version; a sister standard, UNE 19602, covers tax compliance.

A system built to the standard can be certified by an independent body.

A certificate helps but does not replace the work.

In Circular 1/2016 the Spanish Attorney General’s Office stated that a certificate is only an additional element and in no way proves the programme is effective; that is for the court to assess.

Investors and courts therefore look for evidence that the model works: training, reviews, investigations, disciplinary action.

Whistleblowing system under Ley 2/2023

An internal reporting system is mandatory for companies with 50 or more workers, and for companies in financial services and in the AML scope regardless of headcount, including foreign companies operating in Spain through a branch or agents (Art. 10).

Large companies had to set up the system by June 2023, and companies with up to 249 workers by 1 December 2023.

The governing body sets up the system after consulting workers’ representatives and appoints the system manager, who in the private sector must be an executive; the Independent Whistleblower Protection Authority must be notified within 10 working days.

Receiving reports can be outsourced to an external provider, a group can run a single system, and companies with 50–249 workers can share one.

Reports and investigations are logged in a register, and personal data are kept for no more than 10 years.

The Independent Whistleblower Protection Authority (A.A.I.) has been operating since 1 September 2025; in January 2026 it published recommendations on internal systems, and in February it opened the form for notifying the system manager. Supervision of reporting channels is no longer a formality.

For criminal compliance, the channel is the fourth element of the model under Art. 31 bis.5, the duty to report risks. One system therefore usually covers both requirements.

AML: Ley 10/2010 and the cash limit

Spain’s anti-money laundering and counter-terrorist financing law does not apply to everyone.

Obliged entities include banks, life insurers, investment firms, fund and venture capital managers, payment institutions, credit intermediaries, property developers and estate agents, auditors, external accountants, tax advisers, notaries, lawyers in transactions, company formation service providers, casinos and dealers in jewellery and art. Any trader in goods is subject to part of the obligations for transactions where a non-resident individual pays more than €10,000 in cash.

An obliged entity needs customer and beneficial owner checks, a risk assessment, internal procedures, training and suspicious transaction reporting.

Internal controls are reviewed every year by an external expert; in the following two years the full report can be replaced by a follow-up report on the recommendations.

Art. 26 bis requires an internal channel, including anonymous reports, for AML breaches.

From 10 July 2027, EU Regulation 2024/1624 on AML will apply, with uniform rules across the EU; the budget for updating procedures belongs in the 2027 plan already.

Even a company that is not an obliged entity is subject to the cash limit.

Where at least one party acts as a business or professional, payments of €1,000 or more cannot be made in cash (€10,000 for a non-resident individual not acting as a business).

The fine is 25% of the amount, and payer and recipient are jointly liable (Art. 7, Ley 7/2012).

Penalties for companies: how much is at stake

Criminal fines for a company are set in days: up to 5 years, at a daily rate of €30 to €5,000, with a year counted as 360 days.

The court sets the daily rate according to the company’s financial position (Art. 50). For some offences the fine is proportional to the damage or the benefit.

The fine is not the biggest loss.

A court can suspend activities or close premises for up to 5 years and bar the company from subsidies, public contracts and tax incentives for up to 15 years.

A company convicted of private-sector bribery, bribery, fraud, a tax offence or money laundering cannot be awarded public contracts; the period is set in the judgment, or up to 5 years if it is not.

For very serious breaches of Ley 2/2023 the ban can be lifted by “self-cleaning”, paying the fine and adopting organisational measures, but there is no such route after a criminal conviction (Arts. 71–72 of the Public Sector Contracts Act).

For a company that earns a third of its revenue from public contracts, this is a matter of survival.

Penalties are reduced for confessing before learning of the proceedings, cooperating with decisive new evidence, repairing the damage and, importantly for a buyer, putting effective prevention measures in place before the trial starts (Art. 31 quater).

How much a compliance programme costs for a company with 50–500 employees

There are no official price statistics: advisers quote after a risk assessment, and a programme for a logistics company differs from one for a property developer.

Below is an illustrative budget built line by line. The figures are our assumptions, not a price list; market benchmarks are given separately.

Illustrative company: a Spanish SL, 200 employees, €40 million of revenue, €5 million of EBITDA, operating in Spain, not an AML-obliged entity, with part of its revenue from public contracts.

That is 0.19% of revenue and 1.5% of EBITDA in the first year, then 0.14% and 1.1%.

UNE 19601 certification adds, on our assumption, about €12,000 in the first year and €6,000 a year for surveillance audits, for totals of €89,000 and €60,200.

Benchmarks to test the assumptions: the base salary of an experienced compliance officer in Spain is about €54,000 a year and of a compliance manager about €75,000 (Payscale, 2026); whistleblowing channels as a service start from about €25 a month for companies with up to 200 staff.

A company with 50–100 employees usually manages without a full-time hire: the CFO or in-house lawyer takes on the role, and the channel is shared with other companies.

A 500-employee company with a complex supply chain, on the other hand, runs a team of 2–3 people, and the budget grows several times over.

Compare this with the risk in the same example: a single tax shortfall of €700,000 exposes the company to a fine of €1.4–2.8 million, and bribery to up to €9 million at the maximum daily rate.

Both the compliance budget and the risk belong in the financial model as separate lines: an operating cost and a risk provision.

Compliance in due diligence and company valuation

When you buy a company, the risk passes to you together with the shares.

A merger, absorption, transformation or demerger does not extinguish a company’s criminal liability: it passes to the successor.

A sham dissolution, where the business continues with substantially the same customers, suppliers and employees, does not end it either (Art. 130.2 of the Criminal Code).

A share purchase also carries over tax risks: the tax authority can reassess tax for 4 years.

What investors and buyers check

• Whether there is a model under Art. 31 bis and whether it works: risk map, protocols, decisions of the supervisory body, reports, training, disciplinary cases.
• The whistleblowing system: whether it exists, whether the system manager was notified, whether the register is kept, how many reports came in and what was done about them.
• High-risk payments: commissions to intermediaries and agents, entertainment expenses, donations, cash payments, counterparties in tax havens.
• Public contracts and subsidies: the share of revenue that would disappear under a ban.
• AML, if the company is an obliged entity: the external expert’s reports and follow-up.
• Ongoing inspections, lawsuits, investigations and tax disputes.

The compliance block is part of the target review run by lawyers alongside financial and tax due diligence.

The financial part is described on the due diligence in Spain page, and the whole deal path in Buying a company in Spain.

How a risk found in due diligence turns into price

An illustrative example, the same company: EBITDA of €5 million, a multiple of 7, an enterprise value of €35 million.

The review finds no model, a channel that exists only on paper, and a disputed tax arrangement with a possible shortfall of €700,000. The buyer reasons as follows:

1. Expected loss. The maximum fine for the company is €2.8 million, four times the shortfall. At a 10% probability, the expected loss is €280,000.
2. Implementation cost. €77,000 for the programme in the first year. With the expected loss, the buyer asks for a price cut of €357,000, about 1% of the price.
3. EBITDA normalisation. If the company has never run a programme, the buyer adds its recurring cost: €54,200 × 7 = €379,400 off the price. The seller bears this in any scenario, so it matters more to remove the other two items.
4. Escrow or indemnity. Instead of a price cut, buyers often ask for an escrow, part of the price held in a separate account until the risk period ends, or a specific indemnity from the seller. Covering the maximum tax fine means €2.8 million, 8% of the price, locked up for years.

The lesson for a seller: putting a programme in place a year or two before the sale costs less than giving up 1% of the price and locking 8% in escrow.

And if a breach has already happened, prevention measures adopted before the trial reduce the penalty.

How to prepare a company for a deal is covered on Preparing a business for sale; how risks affect the multiple, in How to value a business for sale and on the business valuation page.

What to check and common mistakes

• A model on paper only. Downloaded templates with no company-specific risk map, no training and no reviews. Prosecutors and courts assess whether the model works, not whether documents exist.
• Copying the parent company’s model. Policies of a foreign group not adapted to the Spanish list of offences and to Art. 31 bis.5.
• A channel without a manager. There is a form on the website, but the governing body never appointed a system manager or the A.A.I. was not notified.
• Money flows outside the model. No signing limits, no four-eyes control on payments, no checks on intermediaries and entertainment expenses, although this is the third mandatory element of the model.
• No budget. The programme is launched but its cost is not in the budget or the financial model, so a year later the reviews stop and the model stops working.
• Public contracts not stress-tested. A company with a large share of public contracts never estimated how much revenue a ban would remove.
• Selling unprepared. The buyer finds the problem, and it becomes the argument for a price cut and an escrow.

Frequently asked questions

What is corporate compliance in simple terms?

It is a system of rules, controls and responsible people that keeps a company from breaking the law and, if a breach happens, helps find it quickly and prove the company took measures. In Spain the main elements are a model under Article 31 bis of the Criminal Code, a whistleblowing system and, for obliged entities, AML rules.

Is a compliance programme mandatory in Spain?

The law does not expressly require a model under Article 31 bis, but without one the company cannot be exempted from criminal liability. A whistleblowing system is mandatory for companies with 50 or more workers, and AML rules apply to obliged entities under Ley 10/2010.

What is a compliance officer and is one needed?

It is the person or body that supervises how the model works. In a small company entitled to file an abbreviated profit and loss account, the governing body can take on this role; other companies need a separate officer with autonomous powers.

What is the fine for not having a whistleblowing channel in Spain?

Having no system is a very serious breach of Ley 2/2023: the company faces a fine of €600,001 to €1,000,000, plus a ban on subsidies for up to 4 years and on public contracts for up to 3 years.

How much does a compliance programme cost?

There are no official prices. In our illustrative example for a company with 200 employees, it is about €77,000 in the first year and €54,200 in later years; with UNE 19601 certification, €89,000 and €60,200.

What does UNE 19601 certification give a company?

It confirms the system is built to the standard and helps in talks with banks, large customers and investors. But prosecutors treat a certificate only as an additional element: the court decides whether the model is effective.

Does criminal liability pass to the buyer of a company?

Yes. In a share purchase the company stays the same, and in a merger, absorption or transformation liability passes to the successor under Article 130.2 of the Criminal Code. That is why compliance risks are checked in due diligence and priced in, or covered by an escrow or indemnities.

Key points about corporate compliance in Spain

• The company itself is liable: a model under Article 31 bis with six elements can exempt it if it was working before the offence.
• A whistleblowing system is mandatory from 50 workers; not having one costs up to €1 million plus bans on subsidies and public contracts.
• AML rules apply to obliged entities, while the €1,000 cash limit applies to every company.
• Criminal fines for a company reach €9 million in daily fines or four times the tax evaded, plus exclusion from public contracts.
• In our example, a programme for a 200-employee company costs €54,000–77,000 a year, roughly 1–1.5% of EBITDA.
• In a sale, having no programme costs more than setting one up: a price cut, EBITDA normalisation and an escrow.

Sources

• Código Penal (Organic Law 10/1995), Arts. 31 bis–31 quater, 33.7, 50, 52, 130, 286 bis, 288, 302, 305, 305 bis, 310 bis, 427 bis — BOE.
• Ley 2/2023 on whistleblower protection — BOE.
• Ley 10/2010 on the prevention of money laundering — BOE; Regulation (EU) 2024/1624 — EUR-Lex.
• Ley 7/2012, Art. 7 (cash limit) — BOE; Ley 9/2017 on public sector contracts, Arts. 71–72 — BOE; Capital Companies Act, Art. 258 — BOE; Ley 58/2003 General Tributaria, Art. 66 — BOE.
• Circular 1/2016 of the Fiscalía General del Estado — BOE.
• UNE 19601:2025 — UNE press note, 23.04.2025.
• Salary benchmarks — Payscale, Spain; example calculations — Finetic, November 2026, on illustrative data.