Compliance Agreement Spain (Acuerdo de Compliance)

A Compliance Agreement Spain (Acuerdo de Compliance) is a formal written document through which a company's employees, directors, officers, contractors, and business partners acknowledge their understanding of and commitment to the company's compliance programme — the conjunto de medidas de prevención, detección y reacción frente a conductas irregulares (prevention, detection, and response framework) designed to prevent criminal offences within the organisation. The agreement is grounded in Ley Orgánica 10/1995, de 23 de noviembre, del Código Penal (CP), as amended by Ley Orgánica 5/2010 and Ley Orgánica 1/2015, specifically Article 31 bis CP, which establishes the criminal liability of legal persons (personas jurídicas) in Spain and the conditions under which a company may be exonerated or have its criminal liability mitigated by demonstrating that it had an effective compliance model in place at the time the offence was committed by an employee or representative acting on its behalf.

Article 31 bis.2 CP establishes the conditions for full exoneration of corporate criminal liability: the organisation must have adopted and effectively implemented an organisational and management model (modelo de organización y gestión) prior to the commission of the offence; the model must include specific measures to prevent offences of the type that was committed; the supervision of the model must have been delegated to a compliance body (órgano de compliance) with autonomous powers; the individual who committed the offence must have fraudulently evaded the organisation's controls; and there must have been no omission or insufficient supervision by the compliance body. The Acuerdo de Compliance — signed acknowledgment by all personnel covered by the programme — is a practical implementation element of this model, demonstrating that the company communicated compliance obligations individually and personally to each member of the organisation.

The typology of offences for which Spanish legal persons can be criminally liable under Article 31 bis CP includes: corruption of public officials (cohecho activo — Articles 424-430 CP); commercial bribery (corrupción entre particulares — Article 286 bis CP); tax fraud (defraudación tributaria — Article 305 CP); money laundering (blanqueo de capitales — Articles 301-304 CP); financing of terrorism (financiación del terrorismo — Articles 576-580 CP); insider trading and market manipulation (abuso de mercado — Articles 284-286 CP); computer fraud (estafa informática — Article 248 CP); environmental offences (delitos medioambientales — Articles 325-331 CP); trafficking in human beings (trata de seres humanos — Article 177 bis CP); intellectual and industrial property offences (Articles 270-277 CP); and data protection violations when constituting criminal conduct under the CP. The compliance programme must address the specific risk profile of the company's activities, and the Acuerdo de Compliance must be tailored to the offence categories most relevant to the company's sector.

The compliance framework in Spain is further shaped by Ley 2/2023, de 20 de febrero, reguladora de la protección de las personas que informen sobre Infracciones Normativas y de Lucha contra la Corrupción (the Spanish Whistleblower Protection Law), which transposes EU Directive 2019/1937 and requires all organisations with 50 or more employees to establish an internal information channel (canal interno de información o canal de denuncias) by which personnel can report compliance violations confidentially and without fear of retaliation. The Acuerdo de Compliance must inform employees of the existence and operation of the canal de denuncias and their right to use it without suffering adverse employment consequences under Articles 33-37 Ley 2/2023.

Anti-bribery and anti-corruption obligations are central to corporate compliance programmes in Spain under Ley Orgánica 5/2010 reforms. Article 286 bis CP criminalises active and passive commercial bribery (corrupción entre particulares) — bribes, kickbacks, and improper payments offered to or accepted by employees or commercial agents of private companies. Article 424 CP covers bribes of public officials (cohecho activo). The Fiscalía Anticorrupción (Anti-Corruption Prosecutor) and the Juzgados Centrales de Instrucción of the Audiencia Nacional have jurisdiction over significant corruption cases, and the Circular 1/2016 de la Fiscalía General del Estado on the criminal responsibility of legal persons provides extensive guidance on compliance programme adequacy assessments used by prosecutors and courts.

The Reglamento General de Protección de Datos (RGPD — Reglamento UE 2016/679) and Ley Orgánica 3/2018 (LOPDGDD) constitute a parallel compliance obligation in Spain, with the Agencia Española de Protección de Datos (AEPD) enforcing data protection rules independently of the criminal compliance framework. The Acuerdo de Compliance typically includes a data protection module acknowledging the employee's obligations under the company's RGPD policies and the consequences of data breaches.

A Compliance Agreement Spain is required whenever a company wishes to document the personal acknowledgment of each employee, director, or third-party collaborator of their obligations under the corporate compliance programme — individual signed acknowledgments are a key element of the modelo de organización y gestión under Código Penal Article 31 bis.2 that can exonerate or mitigate the company's criminal liability.

The agreement is needed when a company constitutes or updates its compliance programme (programa de cumplimiento normativo or modelo de prevención de delitos) following a legal review, a change in ownership, a significant expansion of the company's activities, or entry into new sectors with elevated compliance risk — such as public contracting, financial services, healthcare, or real estate.

A formal Acuerdo de Compliance is required when a company establishes a compliance body (órgano de compliance or comité de compliance) — whether an internal compliance officer (compliance officer), an external compliance consultant, or a board-level compliance committee — under Article 31 bis.2.b CP, and needs to document the delegation of compliance supervision to this body and the obligations of all personnel to cooperate with it.

The agreement is needed when a company implements an internal information channel (canal de denuncias) under Ley 2/2023 de Protección de Informantes — employees must be individually informed of the channel's existence, operation, and the prohibition on retaliation under Articles 33-37 Ley 2/2023, and their signed acknowledgment creates an evidentiary record of this communication.

A Compliance Agreement is required when a company engages third parties — suppliers, distributors, agents, consultants, or joint venture partners — whose activities expose the company to criminal liability under the CP vicarious liability framework, and the company needs contractual documentation of the third party's compliance obligations as part of its third-party due diligence and monitoring programme.

The agreement is needed when a company undergoes a criminal investigation or prosecution, and needs to demonstrate to the Fiscalía or the court that it had an effective compliance programme in place at the time of the alleged offence — individually signed compliance acknowledgments are among the evidentiary documents courts consider when assessing the adequacy of the company's compliance model under Circular 1/2016 de la Fiscalía General del Estado.

A formal agreement is required when a company is implementing an anti-bribery and anti-corruption training programme — typically annually — and requires evidence of completion and acknowledgment of the anti-bribery policy by all personnel whose roles carry corruption risk, as recommended by the Spanish standard UNE 19601:2017 on criminal compliance management systems.

Under the Ley de Sociedades de Capital (LSC) RDL 1/2010, the Registro Mercantil maintains the register of Spanish companies. The Código de Comercio 1885 governs commercial obligations. The Agencia Estatal de Administración Tributaria (AEAT) administers Impuesto sobre Sociedades (IS) under Ley 27/2014. The Comisión Nacional de los Mercados y la Competencia (CNMC) enforces competition law. The Código Civil governs general contractual obligations under Article 1255.

A valid Compliance Agreement Spain under Ley Orgánica 10/1995 del Código Penal Article 31 bis must contain the following essential elements to support the company's criminal exoneration defence under Article 31 bis.2 CP and satisfy the requirements of Ley 2/2023 de Protección de Informantes.

Identification of the Signatory: Full name, DNI/NIE, job title, department, and employment or collaboration start date of the person signing the agreement. For directors and senior executives, include the nature of their role (consejero ejecutivo, administrador, director general) since the standard for corporate exoneration under Article 31 bis.4 CP is stricter for offences committed by those with authority to represent and manage the company than for offences by subordinate employees.

Acknowledgment of Compliance Programme: Express confirmation that the signatory has received, read, and understood the company's compliance programme — identified by its version number and approval date — and the key policies it contains, including the code of conduct (código de conducta), anti-bribery policy (política anticorrupción), gifts and entertainment policy (política de obsequios y atenciones), conflict of interest policy (política de conflictos de interés), and data protection policy (política de protección de datos). This acknowledgment is central to the Article 31 bis.2 demonstration that the organisation communicated its compliance standards to individual personnel.

Anti-Bribery and Anti-Corruption Obligations: Specific acknowledgment of the signatory's obligations under Articles 286 bis and 424 CP — the prohibition on offering, promising, or accepting bribes or improper advantages in commercial transactions or in dealings with public officials; the obligation to refuse third-party requests for improper payments; and the obligation to immediately report any actual or suspected bribery attempt to the compliance officer or through the canal de denuncias. Reference to the Spanish standard UNE 19601:2017 on criminal compliance management systems is recommended for companies seeking certification.

Conflicts of Interest: Disclosure obligations for personal, financial, or commercial interests that may create actual or perceived conflicts with the signatory's duties to the company, under the código de conducta. The signatory must agree to disclose any conflict promptly and to abstain from participating in decisions where a conflict exists.

Confidentiality and Information Security: The signatory's obligation to protect confidential company information, trade secrets, and personal data — under Ley 1/2019 de Secretos Empresariales and RGPD (Reglamento UE 2016/679) — and to comply with the company's information security policies. Include specific obligations regarding personal data processing, data minimisation, and reporting of personal data breaches to the compliance officer and the Delegado de Protección de Datos (DPO) where applicable.

Canal de Denuncias (Whistleblowing Channel): Acknowledgment of the existence and operation of the company's internal information channel under Ley 2/2023, de 20 de febrero, reguladora de la protección de las personas que informen sobre Infracciones Normativas. The signatory must be informed of: how to use the channel; the guarantees of confidentiality and anonymity (where offered); the prohibition on retaliation (represalias) against good-faith reporters under Articles 33-37 Ley 2/2023; and the availability of external reporting to the Autoridad Independiente de Protección del Informante (A-I) established by Ley 2/2023 or the relevant sector regulator.

Cooperation with Compliance Investigations: The signatory's obligation to cooperate fully with internal compliance investigations, provide truthful information to the compliance officer, and refrain from destroying, concealing, or altering documents relevant to any investigation. The Spanish criminal procedure framework under Ley de Enjuiciamiento Criminal allows courts to draw adverse inferences from obstruction of internal compliance investigations when assessing corporate liability.

Consequences of Non-Compliance: An express statement of the consequences of breaching compliance obligations — disciplinary action under the employment contract and applicable convenio colectivo, up to and including dismissal (despido disciplinario) for serious violations under ET Article 54; potential personal criminal liability under the Código Penal for individual employees who commit offences; and civil liability for damages caused to the company or third parties under Código Civil Article 1902.

Training Obligation: Acknowledgment that the signatory will participate in mandatory compliance training sessions, including annual anti-bribery training, data protection training, and any sector-specific training required by the compliance programme.

Forms-legal.com provides this Compliance Agreement Spain template as a practical starting point. A thorough compliance programme under Código Penal Article 31 bis requires design and implementation by a qualified abogado penalista or compliance consultant with specific expertise in corporate criminal law, UNE 19601:2017 certification, and the Circular 1/2016 de la Fiscalía General del Estado guidelines on compliance programme adequacy.

Under the Ley de Sociedades de Capital (LSC) RDL 1/2010, the Registro Mercantil maintains the register of Spanish companies. The Código de Comercio 1885 governs commercial obligations. The Agencia Estatal de Administración Tributaria (AEAT) administers Impuesto sobre Sociedades (IS) under Ley 27/2014. The Comisión Nacional de los Mercados y la Competencia (CNMC) enforces competition law. The Código Civil governs general contractual obligations under Article 1255.