Criminal law
Published on 17 September 2026
When a criminal investigation reaches the management of a Spanish company, the first question is usually whether it is aimed at the person or at the business. The answer is uncomfortable: normally both, and not in the same way.
Spanish law provides for the criminal liability of legal persons. The company can be a defendant in its own right, with its own defence, its own representation in the proceedings and its own interests. For anyone running the Spanish subsidiary of a foreign group, that is a configuration with no exact equivalent at home.
This is where most of the early mistakes happen.
The interests of the company and those of its director run in parallel only for as long as nobody sees an advantage in separating them. The moment the company has an interest in presenting the conduct as the act of an individual who exceeded their powers, it has a defence that points at the person running it.
So the first thing to settle is who represents whom. Joint representation is possible while there is no conflict of interest; it becomes a problem when one arises, and by then changing can be late. For the individual, the rest applies as in any case: what being an investigado means.
Not for every failure inside the company, and that matters more than it sounds. Criminal responsibility attaches to your own conduct: a decision, an instruction, or failing to exercise a control you were required to exercise.
In practice it turns on three questions. Did the person know? Were they responsible, or had the task been effectively delegated? And is the decision at issue recognisable as a business decision, on the information available at the time?
The third is where these cases usually end up, and it is not answered with hindsight. It is answered from what the contemporaneous documents show.
Article 31 bis of the Criminal Code allows a legal person to be exempt where its management body has "adopted and effectively implemented, before the commission of the offence, models of organisation and management" that include appropriate measures to prevent it. Depending on how it is framed, it can exclude liability or reduce it.
The operative word is actually. A compliance manual nobody has read, on which nobody was trained and whose controls never took place, is worthless in the proceedings or worse: it shows the risk was identified and nothing was done. What counts is the evidence that the model was lived.
These proceedings are documentary, slow and technical. They are not won on witness testimony. They are won on whether it can be reconstructed who knew what, and when, and who decided.
Concretely: board and management minutes, powers of attorney and signing authorities, delegation resolutions, internal reports, the email traffic around the decision, the records of the controls. That material is preserved early or not at all. Retention schedules keep running while the case sits still.
In group situations there is a third layer: what the parent company learns, what it has to learn, and what the D&O insurer requires before it will fund the defence.
That coordination is not a side issue. What gets reported upstairs can end up in the case file, and a defence position that does not match the report to the parent is one you will have to explain twice.
I start by establishing the configuration: who is under investigation, the individual, the company or both, and whether a conflict of interest already exists. That determines whom I can act for.
Then it is the documents, before retention periods destroy them: corporate resolutions, delegations, evidence of controls, correspondence. Only with that material can anyone assess whether the decision is defensible as a business decision. I work with you in English and with the court in Spanish, and I coordinate with the parent company and the insurer where that is needed. This is the part of my practice that overlaps with business crime; you can also read how I work.
Editorial responsibility: Carles Jiménez, attorney-at-law (Barcelona Bar No. 34.946). This note was prepared with the assistance of artificial-intelligence tools and reviewed and approved by the author before publication.
Tell me about your situation and I will tell you, frankly, how I can help.
Get in touch