Strengthen your crime prevention model with an outsourced compliance officer (an external compliance function): independent, specialized and with the autonomy required by Article 31 bis of the Spanish Criminal Code. We design, oversee and keep your Corporate Compliance program alive so that it is effective and defensible, not a model on paper.
"An outsourced compliance officer provides the independence and operational separation from the management body that the Attorney General’s Office recommends, avoiding conflicts of interest and strengthening the credibility of the crime prevention model."
"You put the compliance function in the hands of professionals with real experience in corporate criminal law, risk management and the UNE 19601 / ISO 37301 standards, without the cost of creating and maintaining an in-house department."
"An outsourced compliance officer keeps the model up to date: reviews the risk map, oversees controls, manages the whistleblowing channel, trains the organization and leaves evidence that the program really works."
"For SMEs and groups without their own department, outsourcing the compliance officer provides a professional compliance function, proportionate to the size of the company and far more affordable than a full in-house structure."
As a firm, we provide external support and reinforcement for the compliance function: oversight of the crime prevention model, liaison with the management body and ongoing technical and legal support for your compliance officer.
Drafting and implementing the Corporate Compliance program under Article 31 bis of the Criminal Code: identification of criminal risks, policies, procedures, controls and disciplinary system.
Preparing and updating your organization’s criminal risk map, with assigned owners, probability and impact assessment and periodic review so that the model stays alive and defensible.
Outsourcing the management of the whistleblowing channel and the investigation of reports, ensuring impartiality, confidentiality and the independence that the Attorney General’s Office itself recommends for these functions.
We align your compliance management system with UNE 19601 (criminal compliance) and ISO 37301 (compliance management systems), making certification easier and strengthening the evidentiary value of the model.
We design and deliver training for the management body, managers and employees, and keep documentary evidence of communication and awareness, an essential requirement for the model not to be a paper-only exercise.
Lack of independence: Art. 31 bis of the Criminal Code requires oversight of the model to be entrusted to a body with autonomous powers of initiative and control. The Attorney General’s Office (Circular 1/2016) warns about conflicts of interest when that function is taken on by someone too close to the management body.
Paper-only model: the Supreme Court has made it clear that a program that does not translate into effective training, real control and evidence does not comply with Art. 31 bis. Without someone keeping the model alive, the document does not exempt the company from criminal liability.
Lack of in-house expertise: many SMEs have no one on staff with solid knowledge of corporate criminal law, risk management and the UNE 19601 / ISO 37301 standards. Improvising the compliance function weakens the whole system.
Cost of an in-house structure: creating and maintaining your own compliance department is expensive and, for many organizations, disproportionate. Outsourcing or strengthening the function with external support offers a professional solution that scales with the actual size of the company.
Reputational and disciplinary risk: a poor choice of compliance officer, or poor management of the whistleblowing channel, does not only prevent the exemption from criminal liability: it also exposes the company to employees, customers, investors and public authorities.
The compliance officer (an individual officer or a compliance body) is the role responsible for overseeing the operation of the crime prevention model provided for in Article 31 bis of the Criminal Code. We speak of an outsourced compliance officer when that function is strengthened or supported by professionals who are not on the company’s staff.
An external firm brings independence, specialization and a perspective that rarely exists within an SME. The goal is for the model to be effective and defensible, not a document kept in a drawer.
It is the usual choice for companies that do not want to (or cannot) create a full in-house compliance department but need a professional compliance function.
There is an important nuance, and it is worth being honest about it. Art. 31 bis of the Criminal Code requires oversight of the model to be entrusted to a body of the legal entity with autonomous powers of initiative and control. Circular 1/2016 of the Attorney General’s Office recommends that the compliance officer be an internal body, to ensure day-to-day contact with the organization.
However, the Attorney General’s Office itself expressly accepts that some of the functions of the compliance officer may be outsourced, such as managing the whistleblowing channel or training, because outsourcing them strengthens independence and confidentiality. In companies that are allowed to file an abridged profit and loss account, Art. 31 bis(3) allows those functions to be taken on by the management body itself.
The safest approach is usually a hybrid model: an internal compliance body backed by an outsourced compliance officer who provides specialization, independence and ongoing support.
The scope is tailored to each company, but external support usually covers the tasks that require the most technical knowledge and the most independence.
All of this with documentary evidence, because case law requires the model to be genuinely applied, not merely to exist on paper.
Because the legal entity’s exemption from criminal liability depends, to a large extent, on the oversight body having real autonomy. If whoever oversees the model is constrained by the management body, the control loses credibility.
The Attorney General’s Office recommends operational separation between management and the oversight body, and that its members preferably not be directors. External support helps achieve that level of independence and avoid conflicts of interest.
Choosing a person who lacks sufficient competence or autonomy can render all the work invested in the compliance program ineffective.
When it needs a serious compliance function but has no in-house profile with knowledge of corporate criminal law, risk management and the UNE 19601 / ISO 37301 standards, and the cost of its own department is not justified.
Also when the company operates in a sector with high regulatory risk, when it is going to contract with public authorities, or when a customer, investor or partner requires it to demonstrate a robust compliance program.
In those cases, outsourcing or strengthening the function with external support is a proportionate, professional solution that is far more affordable than building a full in-house structure.
It is important not to confuse the roles. The compliance officer under Art. 31 bis of the Criminal Code oversees the crime prevention model; in anti-money laundering (Law 10/2010) there are specific roles such as the SEPBLAC representative and the internal control body.
They are separate but complementary areas. Many companies need to put both in order at the same time, and a single firm can coordinate the criminal compliance function and the AML function so that they fit together without overlaps or gaps.
If your company is an AML obliged entity, the logical step is to review both areas together from the outset.
The first step is an assessment of the current state of your compliance: whether you already have a model, whether it is up to date, which criminal risks are relevant in your sector and which functions should be outsourced.
From there, the scope is set in proportion to the size and activity of the company, usually through a periodic fee covering oversight, reviews, the whistleblowing channel and training. It is not a single fixed cost: it depends on each organization.
A good compliance program always costs a fraction of the potential cost of a criminal conviction or a penalty. Write to us and we will guide you, with no commitment.
The outsourced compliance officer function relies on other areas of compliance, crime prevention and internal control. Discover the services that complement your Corporate Compliance program.
Corporate compliance programs, internal control and legal structuring for companies with regulatory and criminal exposure.
Design and implementation of the organization and management model under Criminal Code Art. 31 bis to prevent the company’s criminal liability.
Identification and assessment of criminal risks with assigned owners, the foundation of any effective prevention model.
Impartial handling of reports and internal investigations with guarantees of confidentiality and independence.
Criminal compliance management systems under the benchmark standard in Spain, the basis for certification.
Compliance management systems under the international standard, to strengthen and certify your compliance program.
A risk governance model in which compliance acts as the second line, coordinated with internal control and audit.
A role specific to anti-money laundering (Law 10/2010), complementary to criminal compliance for obliged entities.
Check the scenarios that apply to your company. The more that match, the greater the need to strengthen or outsource your compliance function.
0 of 10 scenarios
Check the scenarios that apply to your company.
Everything you need to know about the compliance officer role, outsourcing it, the framework of Criminal Code Art. 31 bis, the functions you can delegate and the most common mistakes to avoid.
The compliance officer is the role responsible for overseeing the operation of the company’s crime prevention model. It originates in the 2015 reform of the Criminal Code, which introduced into Article 31 bis the possibility for a legal entity to be exempt from criminal liability if it has an effective organization and management model, overseen by a body with autonomous powers.
It can be a single-person body (compliance officer) or a collective body (compliance committee). In smaller organizations, Art. 31 bis(3) allows those functions to be taken on by the management body when the company is allowed to file an abridged profit and loss account.
Art. 31 bis of the Criminal Code requires oversight to be entrusted to a body of the legal entity, and Circular 1/2016 of the Attorney General’s Office recommends that the compliance officer be internal, to ensure day-to-day contact with the organization. That is why it is worth being clear: fully outsourcing the role is not the most prudent reading of the law.
However, the Attorney General’s Office itself accepts that some functions may be outsourced (whistleblowing channel, training, advice), because this strengthens independence and confidentiality. The most common and safest approach is the hybrid one: an internal compliance body backed by a specialized outsourced compliance officer.
For the model to be effective, the responsible body must meet several requirements: autonomous powers of initiative and control, operational separation from the management body to avoid conflicts of interest, and solid knowledge of compliance, risk management and corporate criminal law.
Choosing a person who lacks sufficient competence or autonomy can prevent the company from being exempted from criminal liability, making the work and resources invested in prevention useless. This is where external support makes the difference.
The tasks that practice and the Attorney General’s Office consider most suitable for outsourcing are managing the whistleblowing channel and investigating reports impartially, training the organization and technical and legal advice on the model.
Added to these are designing and updating the criminal risk map, periodically reviewing the model and aligning it with standards such as UNE 19601 (criminal compliance) and ISO 37301 (compliance management systems), which provide structure and evidentiary value.
The compliance officer under Art. 31 bis of the Criminal Code oversees the crime prevention model. Anti-money laundering (Law 10/2010) has its own roles: the SEPBLAC representative and the internal control body, with specific obligations for obliged entities.
They are separate but complementary areas. Coordinating both from a single firm avoids overlaps, gaps and duplication, and gives a comprehensive view of the organization’s compliance.
The most common mistake is having a paper-only model: a well-drafted document that is never applied, with no training, no effective controls and no evidence. The Supreme Court has made it clear that such a model does not exempt the company from criminal liability.
Another frequent failure is appointing a compliance officer without real independence from the management body, which weakens the autonomy required by Art. 31 bis and jeopardizes the exemption.
And finally, confusing outsourcing with walking away: external support strengthens the function, but the company remains responsible for keeping the model alive. What matters is building a real, proportionate system that is maintained over time.
If you are looking into this subject, these pages can help you better understand the regulatory context, reduce risk and make decisions with more confidence.
Compliance programs, internal control and legal structuring for companies with regulatory and criminal exposure.
See the service CriminalOrganization and management model under Criminal Code Art. 31 bis to prevent the criminal liability of the legal entity.
See the service InvestigationsImpartial handling of reports and internal investigations with guarantees of confidentiality and independence.
See the serviceKey legislation, linked to the official text:
Legislation and links reviewed in .