Must companies mandatorily have a Criminal Compliance System implemented?

By Alejandro Ferreiro

After the reform of the Criminal Code operated in 2015, the term compliance has become extremely popular in our country and is very commonly used within the business scope. However, companies mostly ignore its particular implications, the benefits they may take advantage of and particularly the risks at which they are exposed if they do not have a compliance system implemented. In this regard, after the first court decisions on this issue, a recurrent doubt arises in companies: is it mandatory for companies to have a criminal compliance system implemented?

Firstly, we must say that the Criminal Code, after its reform in 2015, does not expressly oblige companies to implement a criminal compliance system. This means that in no event a company may be punished for not having a compliance system if, to such date, no crime has been committed within the company. However, although there is not a legal obligation for companies to have a criminal compliance system, the consequences of not having it may be devastating for the organization. In other words, until no crime is committed within the company, the company may not be punished for not having implemented a criminal compliance system, but if any crime is committed by employees, directors or any other persons belonging to the company and the company does not have such compliance system in force, the company shall lack any remedy to defend itself in possible criminal proceedings, with the serious consequences that may result from being convicted in such proceedings, as we will explain below.

The establishment of a compliance system in a company consists of establishing certain action and procedural frameworks and the appropriate and effective mechanisms to ensure that the company, including all its officers and workers, (and even third parties with which it may have business relationships), fulfil the regulatory framework in force, understanding such regulatory framework as broadly as possible according to the broadness to be given to the compliance system.

If we reduce the compliance system framework to the criminal scope, we must say that one of the main reasons why companies implement compliance systems within their organisations is the possible liability exemption of the legal person in criminal proceedings in which the company may be convicted pursuant to that set forth in the Criminal Code, provided that the company has adopted and executed, prior to the crime commission, the appropriate surveillance and control measures to prevent crimes of the same nature or significantly reduce the risk of such crimes being committed (that is, to have effectively implemented a criminal compliance system). Such system shall clearly identify the activities carried out by the company which may lead to any of the crimes categorised by the Criminal Code. That is, the risks inherent to the activity of the company shall be identified and the prevention, detection and mitigation protocols and mechanisms shall be determined to prevent the materialisation of such risks.

As stated above, after the last reform of the Criminal Code, the commission of crimes by certain individuals in the development of the company activity may imply that the liability for such crime committed also extends to the legal person, for understanding that the company is liable, by direct action or omission, for the duty to prevent the act constituting the crime. But, which are the specific risks associated to a criminal conviction for the legal person?
Sentences to the legal person for any of the crimes categorised in the Criminal Code are mainly economic, although, depending on the seriousness of the crime committed, the company could be even dissolved.

The consequences of considering the existence of criminal liability of legal persons are established in article 33.7 of the Criminal Code, in which all related crimes are considered as serious. Particularly, we may find the following related penalties:

(i) Fines based on a time scale or proportional fines, which may reach 10 times the alleged profit made.
(ii) Dissolution of the legal person. Dissolution shall cause the definitive loss of its legal personality, as well as its capacity to act in the legal business or to carry out any kind of activity, even legal ones.
(iii) Suspension of the activities for a term of up to five years.
(iv) Closing of the working premises and establishments for a term of up to five years.
(v) Temporary prohibition of up to 15 years or definitive prohibition to carry out in the future activities in the exercise of which the crime has been committed, favoured or concealed.
(vi) Disqualification to obtain subsidies and public aids, contract in the public sector and benefit from tax allowances and incentives or from the Social Security within a term of up to 15 years.
(vii) Legal supervision for a term of up to 15 years.

As we can observe, the possible related punishment implies in all cases serious financial or operating damages for the company. Moreover, we must consider the possible collateral damage in the event that the company is criminally convicted. In this regard, the reputation damages associated to such conviction may be irreparable for the company, even leading to the impossibility to obtain external funds, a loss of confidence by suppliers, customers and related third parties and great damages to the trademark or reputation of the company.

Additionally to mitigating the risk of the company being punished, we must remind the other related benefits arisen from implementing a compliance system within the organisation, such as, among others, the improvement of the reputation and corporate image of the company before the society, which will increase the loyalty of customers and other target groups, the creation of a solid organisational culture that defines the values of the company and enhances the sense of security of third-party collaborators or, internally, the assistance to the personnel and business partners in knowing how they must act in different situations by defining clear action parameters.

By virtue of the foregoing, and answering the question posed in the title, we can state that having a criminal compliance system has become an obligation more than an option for companies, since, although there is not a mandatory legal obligation to implement such compliance system, the fact of not having it means too severe risk exposure for companies, considering the great risk mitigation and benefits associated to have successfully established a compliance system within the organisation.