Groundbreaking measures hit Compliance Code

From a ‘nice to have’ to a ‘must have’, compliance programmes are now to become a mandatory part of statutory law

For the first time in history, compliance is being incorporated into statutory law in Spain. Proposed reforms to its 2010 Criminal Code mean companies – with the exception of state-owned entities – will not only be held criminally liable for certain crimes committed by their directors or employees, but also for failing to adopt the due controls necessary to avoid those crimes.
Originally, the Code was considered a significant step up for Spain, finally assigning criminal liability to a company and bringing the country into line with other EU countries. However, the wording failed either to clearly define the situations where a company could be considered as criminally liable, or to clarify the concept of due control and its effect.
“The reason why the 2010 law was so controversial is that there was disagreement not as to the scope of the criminal liability legacy itself but as to the scope of what exactly could be done by a legal entity in order to make this criminal liability disappear,” explains Cecilia Pastor, Head of Compliance at Baker McKenzie in Madrid
The Code refers to ‘a model of organisation and management that must include supervision and control measures capable of preventing such crimes, prior to the commission of crimes’.  “While the term ‘compliance’ is not directly written in, the notion of it as a programme to avoid risk is,” says Pastor.
Furthermore, this corporate compliance programme must be efficiently executed by a ‘legal entity with independent powers of initiative and control’ – work that David Velázquez, Partner at Cuatrecasas, Gonçalves Pereira believes must be done by law firms.
Set to come into force by the end of 2013, the Code introduces two important amendments. First, section 31 defines the situations where a legal entity is considered as criminally liable. Second, section 268/7 introduces a new criminal offence for directors of a legal entity who fail to adopt the necessary compliance measures.
“Until now we’ve not had this tradition in Spain, as criminal liability for companies was introduced in 2010 and compliance programmes were only considered as a circumstance that may mitigate the penalties,” says Velázquez. “With the upcoming reform, companies are going to be aware of the necessity of implementing them.”
This new liability for directors creates a specific new crime that involves the choice not to adopt surveillance or control measures that could avoid criminal offences.“It’s not just that we’re incorporating for the first time the notion of a compliance programme into the law, we’re incorporating for the first time the consequences of omitting to actually implement a compliance programme in your company,” explains Pastor.  
However, she stresses that this increase in liability can be offset by a good compliance programme. What these reforms have confirmed is that, firstly, a compliance programme should work, and secondly, a compliance programme should work in order not to mitigate liability but to exempt liability.
It is widely believed that Spanish companies will just build the Criminal Code reforms into their existing culture, say lawyers, just as they have done with other policies. In terms of how a company goes about introducing the changes, Pastor has a clear idea of what the process might involve.
“We expect a first assessment as to what is the scope of the actual law, followed by a preliminary general assessment, then a more customised one for a specific company.” An audit review of their existing compliance programme would follow, with any subsequent changes incorporated into their compliance programme. Finally, a sign-off by a specialised law firm as to whether they believe the compliance programme meets all the requirements in order to exempt and not just mitigate liability.
However, Pastor believes that a good compliance programme is only as good as its implementation, to the extent that if management doesn’t use it as a way of doing business, it’s a waste of time; “The worst thing is to is have a compliance programme you do not implement, because you yourself have incremented the expectations of performance and not complied.”
Meeting all the requirements of the reform will be a challenge, and law firms will not only have to adapt their workforce to meet the demands, but practice compliance within the overall context of corporate criminal liability. “While you have to practice in accordance with a corporate compliance programme, the question of what constitutes due control continues to be discussed in forums all over Spain,” Velázquez explains, “looking at exactly what the specific measures are that are suitable to prepare for this responsibility.”
And for the first time in Spain’s history, the reform stipulates some company duties related to criminal compliance. A big step in catch up with other more advanced jurisdictions, say lawyers, meaning a shift in the way companies and law firms do business across Spain.