The criminal liability of company directors is one of the main concerns for anyone running a business in Spain. Being a director does not make anyone a criminal, but it does not protect them either: the Spanish Criminal Code can hold the director liable for offences committed within the company and, separately, the company itself. Understanding the difference between these two forms of liability is essential for any business owner, Spanish or foreign, who manages a company in Spain.
In short
- A director is liable for what they do, for what they know and for what they allow to happen when they have a duty to prevent it.
- Holding the office is not enough for a conviction: the director's participation must be proved and, where the offence requires it, intent.
- The company is liable separately (Article 31 bis), only for offences expressly provided for in the Criminal Code, and may be exempt if it has an effective compliance programme.
From «societas delinquere non potest» to the current system
Until 2010 Spain followed the principle societas delinquere non potest: companies cannot commit crimes, only natural persons can. Since the 2010 reform the Criminal Code accepts that a legal entity can be criminally liable, but only for the offences the Code expressly provides for.
Two levels that are often confused should be distinguished from the outset. The first is the liability of the natural person who manages the company, governed mainly by Article 31 of the Criminal Code. The second is the liability of the legal entity, governed by Article 31 bis. They are different forms of liability, with different requirements, which may arise separately or together.
Article 31 of the Criminal Code: whoever acts as director is liable
Article 31 of the Spanish Criminal Code makes it possible to punish a company director who commits an offence, even where the offence requires a status that only the company has. It reads:
“Anyone who acts as a de facto or de jure director of a legal entity, or in the name or legal or voluntary representation of another, shall be personally liable, even if the conditions, qualities or relationships required by the relevant offence for being its perpetrator are not present in them, provided that those circumstances are present in the entity or person on whose behalf or in whose representation they act.”
Special offences: why Article 31 exists
Its purpose becomes clear with special offences, those that only certain persons can commit. Prevarication, for example, can only be committed by someone holding a specific public office; theft, by contrast, can be committed by anyone. Many corporate offences (those related to debts, non-payment or fraud against creditors or the tax authorities) require a status, such as being the debtor or the taxpayer, that belongs to the company and not to the person deciding on its behalf.
Example: the director who strips the company
Imagine a limited company with debts to its suppliers. Its managing director, who is not a shareholder, decides to remove certain assets from the company so that creditors cannot seize them. Since the debtor is the company and not him, without Article 31 his conduct could go unpunished for purely formal reasons, under the principle of legality. Article 31 closes that gap: whoever commits the offence on behalf of the company is liable as if they had the status that only the entity has. This is the typical case of asset stripping and punishable insolvency.
De facto and de jure directors
The provision covers both the de jure director (formally appointed and registered as such) and the de facto director, meaning whoever actually gives the orders and takes the decisions without holding a formal position. What matters is not what appears in the Commercial Registry, but who really runs the company.
Moreover, Article 31 is not limited to companies. It is associated with them because legal entities always act through representatives, but it applies to anyone acting as a director or representing another person.
Office is not guilt: what Article 31 does not say
Article 31 does not presume the guilt of any director. Its only function is to solve the problem of special offences; it does not attribute liability merely for holding office. Being a director is not enough to be convicted: it must be proved that the person committed the offence.
The Spanish Supreme Court has confirmed this, among others in Judgment 496/2020 of 8 October: Article 31 does not establish strict liability by reason of office, but requires that the director personally took part, by act or omission, in the specific activity giving rise to the offence.
Take a hypothetical example. A company has three directors: one who barely takes part in management, another who proposes hiding money from the tax authorities and a third who, informed of the plan, tells him to do as he pleases. What matters for each of them is not the office, but what they did, what they knew and what they could have done. The first, if he knew nothing about it, is not liable simply for being listed as a director; someone who neither takes part in nor knows of the facts cannot simply be convicted. The position of the third, who knows and does nothing, is analysed below.
Intent and negligence
Intent and negligence also matter. If an offence is only punishable when committed intentionally (that is, knowing what one is doing), as is the case with tax fraud, a director who simply did not find out what happened does not commit that offence, because there is no negligent form. Only where the offence can also be committed negligently, as with money laundering, can the liability of someone who failed to supervise properly be discussed.
Commission by omission: the director who knows and does nothing
A director can also be liable for failing to prevent an offence. Article 11 of the Criminal Code governs commission by omission for offences that consist of producing a result: they are only deemed committed by omission when failing to prevent the result, in breach of a special legal duty of the perpetrator, is equivalent to causing it. Omission is equated with action in two cases:
- Where there is a specific legal or contractual obligation to act. This is the typical case of directors, who are legally required to oversee the company.
- Where the person failing to act has created a risk to the protected legal interest through a prior act or omission.
This is known as the guarantor position. Under Spanish company law, directors have a duty to monitor and control the running of the company. A director who knows that an offence is being prepared in the company they manage and does nothing to prevent it may be held liable, provided the offence can be committed by omission and that knowledge is proved. And if the offence can be committed negligently, a breach of the duty of control may also be criminally relevant. In any event, each case must be analysed in detail by a criminal defence lawyer.
When the company itself is liable: Article 31 bis
The criminal liability of a legal entity only exists for offences expressly listed in the Criminal Code: a numerus clausus system. There is no general clause; each offence must provide that it gives rise to liability for the entity. We explain this in more detail in our article on corporate criminal liability in Spain.
Article 31 bis.1 sets out two ways in which an offence can be attributed to the legal entity:
- Offences committed by its legal representatives or managers, that is, by those who, acting individually or as a body of the entity, are authorised to take decisions on its behalf or hold powers of organisation and control, provided they act in the name or on behalf of the entity and for its direct or indirect benefit.
- Offences committed by its employees, in the course of the company's activities, on its behalf and for its direct or indirect benefit, where the offence was possible because the former seriously breached their duties of supervision, monitoring and control, in view of the circumstances of the case.
Three ideas help to understand the system. First, the benefit does not require the offender to have intended to favour the company: it is enough that the offence brings it a direct or indirect benefit. Second, in complex organisations it may be difficult to identify which specific person committed the offence; the law does not always require that detail to hold the legal entity liable. Third, this regime applies to legal entities, not to sole traders, who are only criminally liable for their own acts.
Compliance: how a company can avoid conviction
A legal entity may be exempt from liability if it proves that it had effective measures in place to prevent offences, commonly known as a criminal compliance programme. The requirements depend on who committed the offence.
If it was committed by a representative or manager (Art. 31 bis.2), exemption requires four cumulative conditions: that the board adopted and effectively implemented, before the offence, a suitable organisation and management model; that supervision of the model was entrusted to a body with autonomous powers of initiative and control; that the perpetrators fraudulently circumvented the model; and that this body did not fail to exercise, or insufficiently exercised, its supervisory functions.
If it was committed by an employee (Art. 31 bis.4), it is sufficient that, before the offence, a suitable model was adopted and effectively implemented to prevent offences of the same nature or to significantly reduce the risk of their commission. In both cases, if these circumstances can only be partially proved, they operate as a mitigating factor.
Small legal entities, those entitled to file an abridged profit and loss account, may entrust supervision of the model directly to the board, without a separate control body (Art. 31 bis.3).
To be considered suitable, the model must, under Article 31 bis.5:
- Identify the activities in which the offences to be prevented may be committed.
- Establish protocols or procedures specifying how the legal entity forms its will, takes decisions and implements them.
- Have financial resource management models suitable for preventing offences.
- Impose a duty to report possible risks and breaches to the body responsible for monitoring the model.
- Establish a disciplinary system that adequately sanctions breaches of the model.
- Carry out periodic reviews of the model and amend it when relevant breaches come to light or when there are changes in the organisation, the control structure or the activity carried out.
Penalties for legal entities
Article 33.7 of the Criminal Code lists the penalties applicable to legal entities, all of which are considered serious:
- A fine, calculated per day or proportionally.
- Dissolution of the legal entity.
- Suspension of its activities for up to five years.
- Closure of its premises and establishments for up to five years.
- A ban on carrying out in the future the activities in which the offence was committed, facilitated or concealed. It may be temporary, up to fifteen years, or permanent.
- Disqualification from receiving public grants and aid, from contracting with the public sector and from tax or Social Security benefits and incentives, for up to fifteen years.
- Judicial intervention to safeguard the rights of employees or creditors, for as long as necessary and up to five years.
Corporate offences for which a company can be liable
In practice, the offences that most often affect companies and directors are fraud, punishable insolvency, offences against the tax authorities, money laundering, bribery and embezzlement. In addition, unfair administration is a typical director's offence, although it does not give rise to liability for the company.
Following Organic Law 1/2019 of 20 February, the catalogue of offences giving rise to criminal liability for legal entities includes the following (it may have changed with later reforms and should be checked against the current text of the Criminal Code):
- Illegal trafficking in human organs.
- Offences against moral integrity.
- Concealment of a corpse.
- Human trafficking.
- Sexual harassment.
- Prostitution, sexual exploitation and corruption of minors.
- Discovery and disclosure of secrets and computer intrusion.
- Fraud: ordinary, specific and improper fraud.
- Frustration of enforcement.
- Punishable insolvency.
- Computer damage.
- Offences relating to intellectual and industrial property, the market and consumers: intellectual property, industrial property, disclosure of trade secrets, consumer rights, market offences and corruption in business.
- Money laundering.
- Illegal financing of political parties.
- Offences against the Treasury and Social Security: tax fraud, Social Security fraud and subsidy fraud.
- Offences against the rights of foreign citizens.
- Unauthorised urban development, construction and building.
- Offences against natural resources and the environment.
- Offences against animals.
- Offences relating to ionising radiation.
- Risks caused by explosives and other agents.
- Offences against public health, including drug trafficking.
- Counterfeiting currency.
- Counterfeiting credit and debit cards and traveller's cheques.
- Bribery.
- Influence peddling.
- Embezzlement.
- Hate offences and glorification.
- Terrorist organisations and groups.
- Terrorism.
- Smuggling.
Entities without legal personality: Article 129
Where these same offences are committed within, with the collaboration of, through or by means of companies, organisations, groups or associations that lack legal personality and are therefore not covered by Article 31 bis, the ancillary consequences of Article 129 of the Criminal Code apply. Further offences are added to the list: genetic manipulation, price rigging in public tenders and auctions, obstruction of inspection or supervision, offences against workers' rights, counterfeiting currency, unlawful association, criminal and terrorist organisations and groups, and terrorism.
Frequently asked questions
Can a director go to prison for the company's debts?
Not for the debts themselves. Company debts are not a crime. A director may, however, be criminally liable if, for example, they hide or remove assets so that creditors cannot collect, which may amount to asset stripping or punishable insolvency.
Is a director liable if they did not know about the facts?
As a rule, no. The office is not enough: participation and, for intentional offences, knowledge must be proved. Only for offences that can be committed negligently may liability for failing to supervise properly be discussed.
What is the difference between a de facto and a de jure director?
A de jure director is formally appointed; a de facto director actually runs the company without a formal position. For criminal law purposes, both can be held liable in the same way.
Does a compliance programme also protect the director?
Compliance can exempt the legal entity from liability. It helps the director indirectly: a well documented control system shows that they fulfilled their supervisory duties and makes it harder to attribute an omission to them.
Conclusion
A director is liable for what they do, for what they know and for what they allow to happen when they have a duty to prevent it; they are not liable merely for holding the office. The company, in turn, is only liable for the offences in the catalogue and may be exempt if it has an effective prevention model. A well designed and regularly reviewed compliance programme protects both the company and those who run it.
If you manage a company in Spain and have doubts about your position, or have received a summons or request, it is advisable to consult a criminal defence lawyer as soon as possible. Our economic criminal law team was named White Collar Crime Team of the Year by Iberian Lawyer.
