Across Iberia, companies are being exposed to more and more risks from increasing regulation and scrutiny from regulators. Given the sanctions for non-compliance, including personal liability, Spanish and Portuguese law firms really need to start playing catch-up.

Las conclusiones en el informe anual sobre Regulación y Cumplimiento Normativo en la Península Ibérica indican que, en su mayoría, las compañías están muy expuestas a ser sancionadas a raíz del incremento de normativas y del escrutinio de los reguladores. La situación es aún más seria cuando en ciertos casos la sanción puede ser de carácter penal contra los administradores.

Compliance, worldwide, has increasingly become a must have for all companies, say lawyers. While in some jurisdictions, the US and UK for example, ‘compliance’ is very clear cut, in others, the concept is just taking off due to the pressures of increasing regulation and requirements with which businesses must comply.
Among law firms in Iberia, there are various methods of dealing with compliance, from dedicated departments to teams brought together as and when needed. What is clear is that there is currently no common approach, and that Portugal is currently a little further down the compliance road than Spain.
Sanctions have also changed recently across the Peninsular, meaning that the costs of non-compliance go further than before, even as far as imprisonment. However, lawyers agree that companies aren’t giving it the importance it deserves, particularly in the current climate, and that they may only be forced into action when they see others suffering the consequences of non-compliance.
As compliance touches on so many practice areas and sectors, it seems difficult to narrow down a single definition. But while the specifics of each industry are different, says João Teixeria Matos, Partner at Garrigues in Lisbon, there is a common approach to compliance among the sectors that can be shared throughout law firms, and those more dedicated to regulatory matters can share their methodology with others.

Where there is need
For companies, however, the compliance issues that affect them are much clearer, falling into two distinct categories. First are those related to the legal requirements to start a business activity or acquire companies carrying out highly regulated activities, explains Carlos Vázquez, Partner in charge of Public Law at Gómez-Acebo & Pombo in Madrid, and second are legislative changes that could affect the requirements to be met by companies already carrying out these activities.
Companies doing business in the regulated markets, such as energy, telecoms, financial markets and insurance face the most demanding compliance challenges, with a wider range of rules to contend with than others, say lawyers. Those activities with greater potential risks are those with the greater compliance needs.
For both Spain and Portugal, there is no doubt that the financial sector has the most coordinated approach to compliance given its extremely regulated nature, with other regulated sectors slowly catching up. And a consequence of the crisis is the marked increase in regulatory compliance pressures that they face, for example, the upcoming MiFID II, which increases the pressure on companies to ensure their compliance houses are in order. What’s worrying clients in this sector is how to approach the regulations, according to Paloma Fierro at Linklaters in Madrid. “They come to us wanting to know everything they need to do and to comply with.”
Other sectors increasingly on the compliance radar include the pharmaceutical and healthcare industry and business activities with an environmental impact. In Spain, new data protection laws also come into force later this year, while in Portugal, lawyers cite electronic communications, transportation and water as being high on the list.

Continually changing regulation
If companies have a better understanding of their compliance requirements, for many law firms, however, the situation is less than clear. One of the most relevant and complex challenges faced by internal and external compliance teams, says Casto González-Páramo, Counsel at Hogan Lovells International responsible for the EU & Competition Department in Madrid, is knowing which areas of activities of the client are subject to compliance at any moment.
One of the big challenges for any business developing its activities in regulated sectors, according to Marta Cruz de Almeida, Consultant at Linklaters in Lisbon, is to keep updated as to the relevant regulation it has to comply with and the specific regulator’s views on ambiguous issues.
What makes that so difficult, lawyers agree, is that over the past few years, regulations have been changing at a rather incredible pace. There is a regulatory frenzy all over the world and not only in the EU, trying to regulate everything and anything, says Teixeria Matos at Garrigues in Lisbon. Therefore, the main challenge clients are facing is to be able to rapidly adapt their business structures to new regulations that are being constantly approved, explains Gloria Hernández Aler, Financial Regulation Partner at Deloitte in Madrid.
Clients do, however, tend to be very pragmatic when it comes to regulatory changes, says Paulo Costa Martins, Associate at Cuatrecasas, Gonçalves Pereira in Lisbon. “The immediate advice required is how changes, even if still under discussion, will impact on their current business model.”
While major multinationals know in advance what regulations are likely on the horizon and have the capacity to prepare, it’s the medium sized companies that are worrying. “They want to do business fast and are much less concerned with compliance,” according to Gonçalo da Cunha, Partner at F Castelo Branco & Associados in Lisbon. However, big companies don’t always stop because of regulatory changes, says Filipe Faria Of Counsel at ABBC in Lisbon, more often they just move forward and adjust when important business strategies are at stake.
Companies want to know how far the regulatory reforms can go, says José Giménez, Partner at Linklaters in Madrid, and that’s where lawyers can add value. “Clients want us to be ahead of the regulations and so participation in the discussion forums with regulators leading up to implementation is crucial.”

The regulators
Across Iberia, lawyers agree, regulators are adopting a much more intrusive approach. They are intensifying enforcement and cross-border cooperation between authorities, and increasing the number of actions being brought. “There are also an ever expanding number of authorities actively seeking to bring prosecutions with ever broadening powers to investigate and gather information,” according to Cecilia Pastor, Partner and Head of Compliance at Baker & McKenzie in Madrid.
In Portugal, the number of regulatory bodies is also on the rise, while many are more visible and active in monitoring compliance issues, says Ricardo Costa Macedo, Partner and Head of IP at Caiado Guerreiro in Lisbon, including, among others, Autoridade da Concorrência (Competition) and CMVM (securities and exchange).
A critical aspect, therefore, is maintaining good relations with regulators, he says, to get more responsiveness that makes a difference for their clients. And to provide a really good compliance service, you need to be respected by the regulator, says Magda Cocco, Partner at Vieira de Almeida & Associados in Lisbon, and to gain this respect you need to know your sector.

A criminal act
A particular area of specialisation that is currently very much in demand is criminal law, as everything to do with compliance is linked to it, explains Pedro Duro, former member of the Ministry of Justice’s Legal Policy and Planning Office and now at Sérvulo & Associados in Lisbon. In fact, the introduction in 2012 of regulation of corporate criminal liability for the first time in Spain has been the biggest compliance challenge of the past few years, says Adriana de Buerba, Partner at Pérez-Llorca in Madrid.
Companies now have to adapt any control and compliance measures they had in place to the new criminal law framework, says David Velázquez, Partner at Cuatrecasas, Gonçalves Pereira in Barcelona, and considering the heavy sentences under the reform and the need to prove compliance to the courts, companies require assessments that cover the new criminal risks, and the implementation of effective compliance measures.
For Bernardo del Rosal, Of Counsel at Clifford Chance in Madrid, because of the nature of our ‘information society’, where news travels everywhere so quickly, the damage in terms of reputation that a criminal charge can cause to any corporation is huge.

A risky approach
The problem lawyers are having is that it is sometimes difficult to convince clients of the fact that the cost of a regulatory breach is much more expensive in terms of legal, economical and reputational damages than the cost of investing in preventative legal advice, says Antonio García Muñoz, Head of the Public, Regulatory, Environmental and Competition Law Department at Lener in Madrid.
At a time when companies cannot afford a loss in reputation or revenue, it is possible that these risks, coupled with the potential criminal liability of each and every employee, will prompt companies to pay more attention to compliance, say lawyers.
Legal risks have also significantly increased over the past years as a consequence of the crisis, says Pablo García Montañés, Manager of Regulatory Compliance at Deloitte in Madrid, plus the fact that law firms haven’t been giving the compliance issues the weight they deserve. “Compliance is not just a back-office function as it plays a relevant role in terms of advance impacts on business, which can result in saving millions for the business.”
Prevention, therefore, is key, lawyers stress. A comprehensive risk management system is the basis of any

good compliance programme, and lawyers must impress on clients the importance of preventative advice to avoid or mitigate the risks of non-compliance.
For de Buerba at Pérez-Llorca in Madrid, it is also important that risk analysis is as tailor-made as possible, allowing the client to implement the appropriate measures to eliminate or at least minimise the risks specifically associated with its activity.

Internal versus external
Compliance, however, is not at the top of the agenda for business given the current climate. So it´s up to their lawyers to step in and take the lead. However, this can be difficult, they say, because of an imbalance between client knowledge and that of their external advisers.
Lawyers agree that they cannot know more than their clients. However, there isn’t such a great imbalance these days, says Cocco at VdA in Lisbon. “If you know the technical and economic aspects of your clients’ businesses, and keep up to date with any changes, this will go some way towards reducing it.”
One way of doing this is by gaining firsthand experience in-house, something that Iberian law firms agree brings an important addition to their skill set and value to the client. When faced with compliance issues, clients come to lawyers not just to prevent liabilities but to know how complying with regulations, or not doing so, could affect the value of their businesses, explains Faria at ABBC in Lisbon. It is therefore essential to have deep knowledge of the clients’ business and incorporated value in order to meet these needs.
Placing lawyers within a client organisation can be very advantageous. Law firms should regard secondments not as a loss, but rather as a gain, according to Hugo Rosa Ferreira, Partner at PLMJ in Lisbon, as this brings back invaluable knowledge of the clients’ business, internal workings and culture. Firms may also benefit from lateral hires from regulators, to bring them regulatory insight.
So, while acknowledging that they can never be on an even applying field with an in-house legal department, lawyers are very aware of where they can add value. Every big business has an internal compliance department and in-house team dealing with the day-to-day, we cannot compete, says Giménez at Linklaters in Madrid. “However, when it comes to specialised knowledge, such as court proceedings, this is where we can provide value-add through our experience.”

Legal ‘fine tuning’
In heavily regulated sectors, however, in-house lawyers tend to have the same knowledge as external on what concerns the applicable regulations – in a few cases more so. “What we do in these cases is the ‘fine tuning’,” explains Bruno Azevedo Rodrigues, Partner at ABBC in Lisbon, “providing them with specific specialised advice and training”.
The fundamental thing, lawyers agree, is to develop and implement compliance plans and protocols, including, among others, internal reviews and audits, identifying and assessing industry specific risks, prioritising compliance obligations and training employees on their responsibilities and potential liabilities. One key issue above all, is that compliance needs to be instilled throughout the client’s business, as the only way to implement an efficient compliance programme, says Sofia Enrique, Partner at Raposo Bernardo in Lisbon, is to have the entire structure of the company involved, from top to bottom.
A big topic, particularly in Portugal, is the use of compliance manuals. These typically cover all areas and give instructions on how to monitor situations as they arise and implement a reporting structure to ensure the appropriate action is taken by those who are responsible, explains Miguel Bermudez de Castro, Partner at Jones Day in Madrid. A manual defines the possible risks and puts into action a number of recommendations to the Board of Directors, and, once in  place is regularly reviewed by a firm on a periodic basis to ensure that compliance is taking place.
While lawyers agree on the need and the benefits, they warn about relying on a compliance manual as the sole form of protection.
For Rosa Ferreira at PLMJ in Lisbon “compliance manuals should exist, and it is our job to make them as complete as possible. When it comes to practical application, however, there is always something that isn’t covered.”
And while compliance manuals can certainly be a helpful risk management tool for clients, says Ana Sá Couto, Counsel at Uría Menéndez -Proença de Carvalho in Lisbon, each issue still has to be looked at on a case-by-case basis. You have to assume that what is on paper is not exactly what happens in real life.
However, compliance manuals are merely the ‘kick off’ to pro-active involvement. Clients need to apply comprehensive compliance programmes and to implement procedural controls, says Armando Martins Ferreira, Partner at Abreu Advogados, to make sure that they have done everything reasonably required in advance to reduce the future exposure of the company as a whole, and also that of the respective leaders and directors as potentially liable decision makers.

‘Proactive’ versus ‘reactive’
Reducing future exposure, means taking a very ‘proactive’ approach to compliance, for both companies and their external advisers, ensuring they stay one step ahead of the game.
However, in Spain for example, the feeling among lawyers is that companies outside the financial sector are not used to dealing with compliance. Businesses are reluctant to implement measures, whether in the form of risk management or compliance programmes, and this is  mainly due to cost.
This puts the onus squarely on the law firms to impress on their clients the importance of compliance, and they are beginning to adopt, albeit slowly, a more dynamic approach to compliance rather than to be asked.
For Natalia Martí Picó, Partner at Roca Junyent in Barcelona, this also means being ahead of their clients, rather than waiting for the clients to come to them. This means a monitoring of the European, Spanish and Autonomous legislation in order to offer the best services possible. And always staying on top of any matters subject to regulatory compliance, says Dulce Franco, Partner at AAA Advogados in Lisbon.
This approach is now taking its first steps in Portugal, say lawyers, although clients are not always willing to invest in compliance. There is only so much a law firm can do if their clients are unwilling to take their advice.
In particular, the current economic environment frequently brings additional pressure to do business quickly, which inevitably leads to law firms adopting a more reactive approach, explains Sá Couto at Uría Menéndez-Proença de Carvalho.
However, one has to be cautious in how proactive you are with clients, warns Giménez at Linklaters in Madrid.  Lawyers don’t want to be seen as researchers but instead as advisers capable of identifying the key regulatory issues that may impact their clients´ business, adds Montañés at Deloitte in Madrid.
At the end of the day, however, it is only when a business is concerned about compliance that they are more open to accept a proactive strategy from their lawyers, says José Luís Esquível, Partner at Esquível Advogados in Lisbon.

Prevention is key
Iberian companies and law firms are clearly catching up with other jurisdictions on matters of compliance, which has been accelerated by the wave of new regulations and reforms brought on by the crisis.
There is no doubt that it is rising to the top of the agenda in all sectors. But with legal budgets being very tight at present, lawyers agree that businesses are leaving compliance to last. Clients are only passing out work that they see as absolutely essential, says de Castro at Jones Day in Madrid, and as a result, compliance issues are left at the bottom of in-house lawyers’ to-do lists.
Prevention and anticipation are key to any compliance programme. Law firms need to show clients that compliance, if introduced early in the investment and production chain, can bring competitive advantages, says Martins Ferreira at Abreu Advogados in Lisbon.
With the current difficult business climate, companies need all the advantages they can get. But more importantly they need to face the very real fact that non-compliance no longer leads to just fines and penalties. The possibility of anyone within the company facing a potential prison term is no joke, and, say lawyers, the potential to do so may be just what the market needs to wake up to the importance of compliance.

Approaching compliance from within

Risk management practices have spread from the financial sector to other areas, says Carlos Alberto Sáiz, Partner at Ecix Group in Madrid, therefore companies must now evaluate and minimise their legal, reputational, information security and/or globalisation risks.
Across Iberia, however, while law firms agree on the importance of compliance in today’s market, they approach it in three ways. Some have a dedicated compliance department or team within the firm, several bring together a team or task force as and when needed, while others deal with it by practice area or industry sector. For example:

Groups or departments
• Linklaters in Spain coordinates financial regulation at a European level through their Financial Regulation Group covering regulatory compliance, says Fierro at Linklaters, with a representative in each Linklaters office, so it’s a coordinated effort across the whole firm;
• At Baker & McKenzie, they approach compliance from a global perspective, forming multijurisdictional teams with experts from the relevant client jurisdictions to help the client to do a proper risk assessment, says Rafael Jiménez-Gusi, Partner and Head of Compliance at Baker & McKenzie in Barcelona;
• Deloitte in Madrid has a dedicated team in charge of Corporate Defence projects, says Hernández Aler at Deloitte, assisting clients to establish compliance programmes in order to prevent any criminal liability that they may face;
• And Cuatrecasas, Gonçalves Pereira has a Corporate Compliance Practice covering all areas of business activities and unlawful acts related to corruption, says Velázquez at Cuatrecasas, Gonçalves Pereira in Barcelona.

Task forces
• Clifford Chance brings together an expert in the criminal law, with others in corporate, banking & finance, taxes, public law, and labour & employment, as a multidisciplinary task force to assist clients, says del Rosal at Clifford Chance in Madrid.
• At PLMJ, if there is a new regulation or public consolation, they bring together a multi-practice team to respond to such  a consultation, says Rosa Ferreira at PLMJ in Lisbon, sometimes in a joint effort with a client, to advise the client as soon as possible on how to be compliant.

Industry and sector specific
• The Department of Public Law at Gómez-Acebo is responsible for advising the firm’s clients in matters of a regulatory nature that could arise in the course of their business activities, says Vázquez at Gómez-Acebo & Pombo in Madrid.
• In terms of assistance with legal compliance, Vieira de Almeida is structured by industry practice, with sector-specific teams working closely with their clients’ compliance departments, says Cocco at VdA in Lisbon.