Clifford Chance

Latest legislative initiatives in Spain still fail to provide legal framework for internal investigations.

Over recent years, following the introduction of criminal liability for legal entities in the Spanish Criminal Code in 2010, compliance programmes have become increasingly important as a mitigating and exonerating factor for potential criminal liabilities. Consequently, an ever-increasing number of companies are performing internal investigations on employees, managers or directors, whose alleged misconduct might have a negative impact on the company.

Overview of the internal investigations practice in Spain

Currently, internal investigations play a key role in ensuring compliance throughout companies. They are no longer an imported practice from the US or the UK, mostly applied in multinational companies. Recent trends show that there is an increasing number of small and medium sized companies across a wide range of business sectors which opt for conducting internal investigations, mainly for one of the following purposes:

• to look into misconducts and impose disciplinary measures upon alleged violations of the company's internal regulations, or the Code of Conduct where such violations have the potential to impact the company's reputation in a negative way (Reactive investigations);
• to improve the internal governance regulations (Preventive investigations);
• to cooperate with judicial or governmental authorities, aiming to reach an agreement for receiving a lower penalty (Cooperative investigations); or
• to prepare the defence strategy of the company or its managers (Defensive investigations).

Unfortunately, there is still little legal guidance on how to perform an internal investigation in Spain. The legal framework remains unclear up to date and this, certainly, generates concerns among legal practitioners. Normally, each company counts with internal policies regarding how and in which cases to conduct internal investigations, but legal practitioners in Spain are eager to gain more visibility on how internal investigations are integrated in the Spanish legal system and, most importantly, what value will the facts obtained within an internal investigation be granted by Spanish Courts.

The demanded regulation of internal investigations in Spain

White-collar crime and compliance specialists demand a meta-regulation for internal investigations at a state level or, at least, some clear guidelines as to how to conduct them bearing in mind constitutional rights and guarantees involved in the process.

A Preliminary draft of the Criminal Procedure Act published recently was expected to provide this guidance. However, it makes no reference to internal investigations at all, nor to their potential to be treated as an exonerating circumstance in criminal proceedings or possible benefits of self-reporting in reaching a DPA (deferred prosecution agreement) or and NPA (non-prosecution agreement) with the Public Prosecutor's office.

An example: self-reporting and cooperating with authorities in Spain

The lack of clear and specific regulation on potential incentives for self-reporting and cooperating with authorities still entails doubts as to the possibility of obtaining clear benefits for companies who self-report. In some cases, such uncertainty may lead to reluctancy to report violations.

The Spanish Criminal Code does not include self-reporting as an exonerating circumstance of criminal liability, which, in principle, generates serious practical difficulties for judges and tribunals in order to provide legal coverage for a possible exemption of criminal liability for legal entities. The exemption path has been a traditional claim in the Spanish doctrine, which generally considers that the reputational impact of being part of a criminal proceeding is one of the main levers on which the system of criminal liability of legal entities and crime prevention programs (or compliance programs) are based.

In effect, we can hardly find a better evidence of the existence of a true corporate ethical culture, as indicated by both the Criminal Chamber of the Spanish Supreme Court and the General Prosecutor's Office in Circular 1/2016, than a company that files a self-report to reveal that it has detected certain facts, and to fully cooperate with the authorities in the investigation.

According to the aforementioned Circular, "Prosecutors will grant special value to the discovery of crimes by the legal entity itself in such a way that, when a criminal conduct is detected by the legal entity and brought to the attention of the authority, they [Prosecutors] must request that the legal entity is exonerated from criminal liability, as it is evident not only the effectiveness of the model but also its consistency with a corporate compliance culture".

In addition, recently, members of the General Prosecutor's Office have claimed legislative formulas in order to offer "the acquittal, as the best reward" for those companies who self-report.

Therefore, nowadays it seems more than feasible for a company to seriously consider the possibility of reporting crimes detected within its organisation, and even to file a self-report. This would have a double objective: on one hand, to mitigate potential reputational damages deriving from a criminal prosecution of the company, and, on the other, to provide incentives for cooperating with the authorities. However, we still lack a clear legal path and guidelines in this respect.

For the time being, legal doubts persist not only regarding self- reporting, but also regarding other issues related to internal investigations such as problems arising from anonymous complaints, the value and effectiveness of legal privilege in internal investigations, what guarantees to apply in conducting interviews, etc.

For these, and more issues, please refer to the Internal investigations guide which our White-collar crime, Investigations and Compliance team from Madrid has published recently.