Criminal Lawyers Spain 2026: Corporate Liability, LO 1/2026 Multirecidivism & Defence

Spain’s criminal landscape for companies and their directors shifted decisively in early 2026 with the entry into force of Organic Law 1/2026 (LO 1/2026), which overhauls the multirecidivism framework and raises sentencing exposure for repeat corporate offenders. Running in parallel, Royal Decree 316/2026 has tightened criminal-record check procedures, while updated anti-money-laundering measures administered by SEPBLAC impose fresh reporting obligations on regulated entities. For general counsel, compliance officers and board members of Spain-incorporated companies, the combined effect of these reforms is a material increase in corporate criminal liability, one that demands an immediate reassessment of defence readiness. Criminal lawyers in Spain are now advising clients to treat compliance remediation and pre-investigation planning not as optional enhancements but as frontline risk-management priorities.

Essential Points, What Every GC Needs to Know Right Now

The 2026 legislative package creates six areas of immediate risk for companies operating in Spain. Before diving into the detailed analysis below, general counsel should note the following action items:

• Retain specialist criminal counsel. LO 1/2026 changes sentencing mechanics for repeat offenders, including legal persons. Early engagement with experienced criminal lawyers in Spain is essential, delay narrows your tactical options.
• Preserve all potentially relevant data. Implement a litigation-hold protocol covering email servers, financial systems, messaging platforms and cloud repositories. Destruction of evidence, even through routine retention-policy cycles, can trigger obstruction charges.
• Freeze suspect transactions. Where internal indicators suggest money-laundering or fraud, place precautionary holds on outbound payments and notify your SEPBLAC compliance officer immediately.
• Commission a compliance audit. The existence of a pre-incident compliance programme remains the single most powerful mitigating factor under Spanish corporate criminal liability rules. If your programme has not been updated to reflect 2026 AML measures, schedule an independent audit within 30 days.
• Review D&O insurance coverage. Royal Decree 316/2026 expands procedural requirements that may affect directors personally. Confirm that your directors-and-officers policy covers criminal investigation costs, including proceedings before the Audiencia Nacional.
• Communicate risk internally. Brief the board, senior management and compliance teams on the new obligations. Document that briefing in formal board minutes.

What Changed in 2026, LO 1/2026, Royal Decree 316/2026 & AML Measures

Three interlocking reforms define the 2026 landscape for corporate criminal liability in Spain. Each carries distinct compliance triggers and defence implications. Below is a plain-language summary of the reforms, the timelines that apply and the practical consequences for companies and directors.

LO 1/2026 (Multirecidivism): Key Provisions and Sentencing Impact

Organic Law 1/2026 amends the Spanish Penal Code’s treatment of multirecidivism, the aggravating circumstance applied where an offender has prior convictions for the same category of crime. The reform broadens the definition of “related” prior convictions, meaning that a wider range of earlier sentences can now trigger the aggravation. For natural persons, the likely practical effect will be longer custodial sentences for persistent offenders. For legal persons, the reform carries a different but equally consequential risk: companies with prior corporate convictions, even relatively minor regulatory offences resolved by way of fine, may now face significantly heavier sanctions, including higher fines, operational restrictions and, in extreme cases, judicial dissolution.

Key aspects of the LO 1/2026 multirecidivism reform that corporate counsel should note include:

• Expanded temporal window. The period during which a prior conviction remains “relevant” for multirecidivism purposes has been extended, increasing the likelihood that historical offences will count.
• Broadened offence-category matching. Convictions need no longer be for precisely the same offence; related economic-crime categories (fraud, money laundering, bribery) may now be aggregated.
• Sentencing multiplier. Where multirecidivism is found, courts gain discretion to impose penalties in the upper half of the applicable range, a shift that can double the financial exposure for legal persons.

Royal Decree 316/2026: Criminal-Record Checks & Procedural Implementation

Royal Decree 316/2026 modernises the administrative framework for criminal-record checks in Spain. The decree clarifies data-sharing protocols between the Central Criminal Record (Registro Central de Penados) and both public and private-sector employers. For companies, the immediate impact falls on three operational areas:

• Director vetting. Companies appointing new directors or senior officers must now verify criminal records through updated procedural channels, with tighter turnaround expectations and mandatory disclosure to the nominating body.
• Employee onboarding. Certain regulated sectors (financial services, childcare, security) face expanded requirements for pre-employment criminal-record checks.
• Data-protection alignment. The decree contains specific provisions reconciling criminal-record data handling with GDPR and Spain’s Organic Law 3/2018 on data protection, imposing new documentation obligations on HR departments.

2026 AML Measures, SEPBLAC & Reporting Changes

Updated guidance from SEPBLAC (the Servicio Ejecutivo de la Comisión de Prevención del Blanqueo de Capitales e Infracciones Monetarias) introduces enhanced reporting requirements for obliged entities in 2026. Industry observers expect these AML measures to produce a sharp increase in suspicious-transaction reports (STRs), particularly in sectors with cross-border payment flows. Companies that fail to file timely STRs, or that maintain inadequate know-your-customer (KYC) procedures, face not only administrative sanctions from SEPBLAC but also potential criminal prosecution under the Penal Code’s money-laundering provisions, now amplified by the multirecidivism changes in LO 1/2026.

Corporate Criminal Liability in Spain, New Exposures and Triggers

Spain introduced corporate criminal liability for legal persons in the 2010 reform of the Penal Code (Organic Law 5/2010), later refined by Organic Law 1/2015. The 2026 reforms do not replace this architecture; instead, they raise the stakes within it. Understanding where liability sits, and how the new laws interact with existing compliance defences, is critical for every Spanish criminal lawyers engagement in the corporate space.

Where Liability Sits, Board, Managers, Compliance Officers

Under the existing framework, a legal person may be criminally liable where an offence is committed (a) by a person with authority to act on behalf of the company, or (b) by an employee whose conduct was possible because of a failure of supervision by such an authorised person. The 2026 changes sharpen both prongs. The multirecidivism expansion means that a company’s prior conviction, even one resulting from a supervisory failure rather than direct intent, now feeds into the aggravation calculus for any subsequent offence. Directors, managers and compliance officers face personal exposure where prosecutors can demonstrate that the individual either authorised the conduct or failed to implement adequate controls.

Sentencing Multipliers and Fines

Where multirecidivism aggravation applies to a legal person, courts can impose fines at the upper end of the statutory band. For economic crimes, this can translate into penalties of up to five times the value of the benefit obtained or the loss caused. Additionally, courts retain discretion to impose ancillary measures, temporary or permanent closure of business premises, judicial intervention in operations, prohibition from contracting with the public sector, and prohibition from receiving subsidies. Early indications suggest that prosecutors are likely to pursue multirecidivism aggravation more aggressively in the corporate context, given the legislative signal that repeat corporate offending warrants enhanced deterrence.

Pre-Investigation Readiness, Immediate Steps for Companies

The window between learning of a potential criminal issue and the commencement of a formal investigation is often decisive. Companies that act quickly and methodically during this period place themselves in a materially stronger defence position. The following seven-step checklist provides a practical framework that criminal defence lawyers in Spain routinely recommend to corporate clients.

Step 1: Preserve Evidence

Issue a written litigation-hold notice to all relevant custodians. Suspend automated deletion schedules for email, messaging and document-management systems. Ensure that backup tapes, access logs and CCTV footage are preserved. Document the chain of custody from the outset, any gap will be exploited by prosecutors.

Step 2: Controlled Suspension of Implicated Personnel

Where there are reasonable grounds to suspect individual involvement, consider precautionary suspension, but document the basis carefully. Suspensions must comply with Spanish employment law and the applicable collective bargaining agreement. Avoid characterising the suspension as disciplinary until the internal investigation concludes; premature action can expose the company to unfair-dismissal claims and prejudice the criminal defence.

Step 3: Retain Specialist Criminal Counsel

Engage external criminal lawyers with specific experience in corporate criminal liability in Spain, ideally counsel who regularly appear before the Audiencia Nacional if the matter involves serious economic crime. Internal legal departments should coordinate with outside counsel to establish privilege protocols and ensure that communications remain protected.

Step 4: Freeze Relevant Transactions

Where the suspected conduct involves financial transactions, transfers, invoicing, procurement payments, place precautionary holds pending review. For AML-obliged entities, the SEPBLAC reporting obligation runs in parallel: where a suspicious transaction is identified, the compliance officer must file a report without delay.

Step 5: Commence a Controlled Internal Investigation

Structure the internal inquiry to maximise its evidentiary value while protecting privilege. Key steps include:

• Appoint an investigation lead, typically external counsel or, for larger matters, a forensic-accounting firm supervised by counsel.
• Define the scope in writing, including the offences under review, the time period and the data sources to be examined.
• Conduct witness interviews under caution where individuals may be personally implicated, ensuring GDPR-compliant data processing and respecting the right to obtain independent legal advice.
• Produce an interim findings memo for the board within 14 days, followed by a full report within 60 days.

Step 6: Update Compliance Policies

The internal investigation may reveal gaps in existing compliance programmes. Address these immediately, before any regulator or prosecutor examines them. Priority areas in 2026 include AML measures (SEPBLAC reporting flows), criminal-record checks for new directors (Royal Decree 316/2026), anti-bribery due diligence for third-party intermediaries, and whistleblowing-channel adequacy under EU Directive 2019/1937 as transposed into Spanish law.

Step 7: Board Reporting and Risk Communication

Report findings to the board or audit committee as soon as a preliminary assessment is available. Document the board’s response, resolution to cooperate with authorities, allocation of resources for remediation, appointment of external counsel, in formal minutes. This record will be critical if the company later needs to demonstrate good faith and active remediation as mitigating factors.

Defence Strategies Before the Audiencia Nacional & Criminal Courts

White-collar defence in Spain increasingly plays out before the Audiencia Nacional, the court with jurisdiction over major economic crimes with national or cross-border dimensions. Developing effective Audiencia Nacional defence strategies requires a combination of procedural knowledge, evidentiary discipline and pragmatic negotiation skills.

Managing Concurrent Regulatory & Criminal Processes

Corporate defendants often face parallel proceedings: a criminal investigation alongside administrative proceedings by SEPBLAC, the CNMV (securities regulator) or sectoral supervisors. The key challenge is information flow. Statements made in an administrative proceeding may be used in the criminal case, and vice versa. Experienced criminal lawyers in Spain advise clients to coordinate their responses across both tracks, ensuring consistency while exercising the right against self-incrimination in the criminal proceeding. Where an administrative sanction has already been imposed, the ne bis in idem principle, reinforced by European Court of Human Rights case law, may provide a partial or full defence against criminal prosecution for the same facts.

Evidentiary Strategy and the Compliance-Programme Defence

The compliance-programme defence remains the centrepiece of corporate criminal strategy in Spain. To be effective, the programme must satisfy the criteria established by Spanish courts: it must be genuinely implemented (not a paper exercise), regularly updated, independently supervised by a compliance officer with adequate authority and resources, and subject to periodic external audit. In practice, courts examine whether the company detected the offence through its own compliance mechanisms, whether it reported the issue promptly, and whether it took meaningful remedial action.

Practitioners should prepare a comprehensive compliance dossier for submission early in proceedings. This dossier should include the compliance manual, training records, internal audit reports, whistleblowing-channel logs, and evidence of board-level oversight. Industry observers expect that in the post-LO 1/2026 environment, courts will scrutinise compliance programmes more rigorously, given that multirecidivism aggravation raises the cost of non-compliance substantially.

When to Seek Injunctive Relief

In certain cases, companies may need to challenge precautionary measures, asset freezes, bank-account seizures, or operational restrictions, imposed during the investigation phase. Spanish criminal procedure allows the defence to petition for modification or lifting of these measures where they are disproportionate or where the company can demonstrate that lesser alternatives (e.g., a bank guarantee or periodic reporting) would adequately secure the court’s objectives. Timely action is essential; delayed applications are viewed sceptically.

Plea Strategies and Cooperation

Where the evidence of corporate liability is strong, early cooperation with prosecutors can yield significant sentencing reductions. The conformidad (plea agreement) mechanism allows for negotiated outcomes, but companies must weigh the reputational consequences against the litigation risk. A structured cooperation strategy, voluntary disclosure, remediation evidence, internal-investigation findings shared under controlled conditions, gives the defence maximum leverage in negotiations. Defence counsel should also consider whether individual directors can be ring-fenced through separate plea arrangements that limit the company’s overall exposure.

Compliance Upgrades That Materially Reduce Criminal Exposure

The 2026 reforms make compliance upgrades not merely advisable but, in many cases, legally determinative. A company that can demonstrate a robust, up-to-date compliance programme, one that addresses AML measures 2026, criminal-record checks under Royal Decree 316/2026 and the multirecidivism risks introduced by LO 1/2026, stands in a fundamentally different position from one that cannot. Below is a 90-day quick mitigation plan.

Each item should be documented with written evidence, updated policies, signed training attendance sheets, audit reports, and stored in a dedicated compliance archive. This documentation becomes evidence in any future criminal proceeding and must be readily accessible to defence counsel.

Director & Executive Risks, D&O Considerations and Crisis Communications

The personal exposure of directors and senior executives is a dimension that boards frequently underestimate until an investigation is announced. Under Spanish law, directors who authorise or fail to prevent corporate criminal conduct can face individual prosecution, and the multirecidivism changes in LO 1/2026 mean that the sentencing consequences for individuals associated with repeat corporate offenders are now more severe.

Immediate steps for boards and executives include:

• Review D&O policy terms. Confirm coverage for criminal investigation costs, including legal fees for Audiencia Nacional proceedings. Check for exclusions related to wilful misconduct or regulatory fines, which may leave gaps in coverage.
• Separate personal counsel from company counsel. Where a director faces potential individual liability, conflicts of interest require independent legal representation. Budget for this from the outset.
• Document decision-making. Board minutes should reflect that directors considered and acted upon compliance advice. A contemporaneous record of due diligence is far more persuasive than retrospective assertions of good faith.
• Prepare crisis communications. Coordinate with PR advisors to develop holding statements and media-response protocols. In Spain, criminal investigations can generate significant press coverage, particularly where the Audiencia Nacional is involved, and undisciplined public statements can prejudice the defence.
• Internal disclosure protocols. Establish clear rules for when and how directors must notify the board of matters that could give rise to personal criminal exposure, including potential conflicts of interest in related transactions.

Suggested board-minute language for the initial response to a suspected criminal issue: “The Board has been informed of [brief factual description]. The Board resolves to (a) retain independent criminal counsel to advise on the company’s and directors’ positions; (b) instruct management to preserve all relevant documentation; (c) authorise the compliance officer to commission an independent investigation; and (d) schedule a follow-up session within [14] days to receive a preliminary findings report.”

Why Criminal Lawyers in Spain Matter More Than Ever in 2026

The convergence of LO 1/2026, Royal Decree 316/2026 and the 2026 AML measures represents the most significant expansion of corporate criminal exposure in Spain since the introduction of legal-person liability in 2010. Companies that fail to adapt face a compounding risk: each unaddressed compliance gap becomes a potential aggravating factor in future proceedings, particularly under the broadened multirecidivism framework.

The role of experienced criminal lawyers in Spain has evolved accordingly. Defence in the corporate space is no longer confined to courtroom advocacy; it begins with compliance architecture, continues through pre-investigation planning and internal inquiries, and extends to coordinated multi-jurisdictional defence strategies where cross-border elements are present. For general counsel and compliance officers, the practical takeaway is clear: invest in specialist counsel now, before the investigation begins.

Practical Next Steps & Checklist for Counsel

1. Conduct a rapid gap analysis of your compliance programme against 2026 requirements (LO 1/2026, Royal Decree 316/2026, SEPBLAC guidance).
2. Retain experienced criminal defence counsel with Audiencia Nacional and white-collar defence experience.
3. Implement a litigation-hold protocol and evidence-preservation plan.
4. Brief the board and obtain a formal resolution authorising compliance remediation.
5. Update D&O insurance coverage and confirm criminal-investigation cost provisions.
6. Schedule an independent compliance audit within 60 days.
7. Prepare crisis-communication protocols and designate a single spokesperson.

For guidance tailored to your company’s specific risk profile, find a criminal lawyer through the Global Law Experts directory.

Sources

1. BOE (Boletín Oficial del Estado), Official texts and Royal Decrees
2. La Moncloa, Government of Spain press releases and legislative summaries
3. SEPBLAC, Spanish AML authority guidance and reporting requirements
4. Poder Judicial / Audiencia Nacional, Practice notes and consolidated case law
5. Ecija, Legal analysis and commentary on Spanish criminal law reforms
6. Chambers & Partners, Practice guides for Spain
7. Morales Penal, White-collar defence and compliance commentary
8. Global Law Experts, Who are the best criminal defence lawyers in Spain?