Criminal compliance at law firms: what Article 31 bis of the Criminal Code requires of a firm
A firm organised as a company is a legal entity and can be criminally liable for certain offences. The Criminal Code allows exemption if an effective organisation and management model exists, and sets six requirements for that model. We review them from a firm's perspective.
Firms design and review criminal compliance programmes for their clients. But a firm operating as a company is also a legal entity, and Article 31 bis of the Criminal Code applies to it like to any other. The consolidated text of the Code published by the BOE is shown as updated to 9 April 2026.
This guide reviews what the rule requires, from a firm's perspective.
When the legal entity is liable
Under Article 31 bis.1, in the cases provided for in the Code legal entities are criminally liable, among other cases, for offences committed in their name or on their behalf, and for their direct or indirect benefit, by the persons indicated in letter a) of that paragraph. Letter b) covers a second case, concerning other persons linked to the legal entity, which should be read in the text itself.
Article 31 ter.1 adds that the legal entity's liability is enforceable even if the responsible individual has not been identified or it has not been possible to bring proceedings against them.
The exemption: the organisation and management model
For offences by the persons in letter a), Article 31 bis.2 provides that the legal entity is exempt if four conditions are met:
- The governing body has adopted and effectively implemented, before the offence was committed, organisation and management models with suitable monitoring and control measures.
- Supervision of the model has been entrusted to a body with autonomous powers of initiative and control.
- The perpetrators committed the offence by fraudulently evading the models.
- There was no omission or insufficient exercise of the supervision, monitoring and control functions.
For offences by the persons in letter b), paragraph 4 provides exemption if, before the offence, a model suitable for preventing offences of that nature or significantly reducing the risk was adopted and effectively implemented.
The small firm
Article 31 bis.3 contains a rule relevant to medium-sized and small firms: in small legal entities, the supervisory functions may be assumed directly by the governing body.
The six requirements of the model
| Requirement (Art. 31 bis.5) | How it translates at a firm |
|---|---|
| 1. Identify the activities in which offences may be committed | The firm's risk map: handling of funds, client relations, hiring, suppliers |
| 2. Protocols for forming the will, decision and execution | Who approves what: accepting engagements, payments, contracts |
| 3. Appropriate financial resource management to prevent offences | Control of accounts, signatures and payments |
| 4. Duty to report risks and breaches to the oversight body | Internal reporting channel |
| 5. Disciplinary system | Internal sanctions for breaching the model |
| 6. Periodic verification and amendment when there are infringements or changes | Annual review and after each relevant change |
The fourth requirement connects directly with the whistleblowing channel, and the third with the separate management of client funds.
Mitigating circumstances
If the offence has already been committed, Article 31 quater only allows certain later actions by the legal entity, through its legal representatives, to be considered mitigating:
- Confessing the infringement to the authorities before knowing that proceedings are directed against it.
- Cooperating in the investigation by providing new and decisive evidence.
- Repairing or reducing the harm before the oral trial.
- Establishing, before the oral trial, effective measures to prevent and detect future offences.
The penalties
Article 33.7 lists the penalties applicable to legal entities, all classed as serious: fine by instalments or proportional; dissolution; suspension of activities and closure of premises for up to five years; prohibition of activities, temporary for up to fifteen years or permanent; disqualification from subsidies, public procurement and tax benefits for up to fifteen years; and judicial intervention for up to five years.
Why it matters to a firm
For a firm, prevention is not only a criminal-law question: it is reputational. Disqualification from contracting with the public sector, for example, would affect any firm working for public authorities. And money laundering prevention, which binds firms when they are obliged entities, shares tools with the criminal prevention model, as we explain in the guide to money laundering prevention at law firms.
Checklist
- Confirm the firm's legal form and whether it is a legal entity.
- Draw up the firm's own risk map.
- Appoint the supervisory body, or assign it to the governing body if the firm is small.
- Document protocols, financial controls and the disciplinary system.
- Review the model periodically and after any relevant change.
More analysis in Big law firms and lateral moves.
Fuentes
- Ley Orgánica 10/1995, de 23 de noviembre, del Código Penal (BOE-A-1995-25444, texto consolidado). Accessed 18 October 2026.
The specific data in this article come from the official sources cited.
