Specialized legal advice on implementing and certifying UNE 19601:2025: a criminal compliance management system aligned with Art. 31 bis of the Criminal Code, designed to prevent offenses, mitigate or exempt the criminal liability of legal entities and strengthen an ethical culture.
Free UNE 19601 consultation
Reply within 24 h
Six areas of legal support to design, implement, maintain and certify your Criminal Compliance Management System under UNE 19601:2025.
Review of the current state of your prevention system against the 10 clauses of the standard and the requirements of Art. 31 bis of the Criminal Code: gap identification, prioritization and an implementation roadmap.
Crime prevention model: criminal risk matrix, control catalog, whistleblowing channel, investigation procedures and a complete documentation architecture.
Design of the compliance body (CCO/OCI), its charter, reporting to the board, independence, budget and access to information, as UNE 19601 requires.
Due diligence procedures for business partners, suppliers and key employees under Annex B of the standard, segmented by risk.
Segmented training plans (managers, operational staff, third parties), awareness actions and awareness metrics to strengthen the compliance culture.
Preparation for the certification audit by an ENAC-accredited body (AENOR, Bureau Veritas, DNV, TÜV SÜD, Intertek) and support throughout the whole cycle.
An effective Criminal Compliance Management System (CCMS) is not improvised with a manual: it combines real governance, risk management, operational controls and continuous evidence. This is what the standard requires and what a judge looks at when analyzing the exemption under Art. 31 bis of the Criminal Code.
“Senior management drives the criminal compliance policy, allocates resources to the compliance body and reports to the board. Without visible commitment, the system does not hold up in an audit.”
“Identification, analysis and assessment of the criminal risks associated with the actual business, using a documented methodology and periodic review. This is the core element the standard requires.”
“Procedures, segregation of duties, controls in sensitive processes (procurement, HR, tax, competition, data) and a whistleblowing channel under Law 2/2023.”
“Monitoring, internal audit, and review by the compliance body, senior management and the governing body. The system must evolve and be documented.”
The criminal liability of legal entities has existed since 2010 and took its current form in 2015. An effective prevention model can be a full exemption or a mitigating factor; a nonexistent or cosmetic one magnifies the damage if an offense occurs.
Autonomous criminal liability of the legal entity for offenses committed by representatives, managers or employees for the benefit of the entity (Art. 31 bis of the Criminal Code).
Full exemption or mitigation if you prove an effective prevention model, adopted and implemented before the offense, that meets the requirements of Art. 31 bis(2) of the Criminal Code.
Mandatory whistleblowing channel for companies with 50+ employees under Law 2/2023, which fits seamlessly into the UNE 19601 system.
Fines for corporate offenses, private-to-private corruption, tax fraud, money laundering or competition offenses, plus dissolution or suspension of activity.
Public tenders, dealings with multinationals and bank financing increasingly require accredited criminal compliance certification.
Since that date, UNE 19601 certificates without ENAC accreditation have lost their effective validity: certification must be issued by an accredited body.
We help you build a crime prevention model that is realistic, proportionate to your business and defensible before a judge and in a certification audit by an ENAC-accredited body.
UNE 19601 is the certifiable Spanish standard that sets out the requirements of a Criminal Compliance Management System. It was originally published in May 2017 by AENOR and updated by UNE 19601:2025, in force since April 23, 2025 (the 2017 version was withdrawn).
It is the technical reference companies use to structure their crime prevention model in line with Art. 31 bis of the Criminal Code.
The standard serves three functions: to prevent offenses within the organization, to detect and manage breaches, and to strengthen the company’s ethical culture. Its Annex A sets out the direct link between the clauses of the standard and the requirements of Art. 31 bis of the Criminal Code.
A certification is not, by itself, an automatic exemption from criminal liability: it is initial evidence whose weight is assessed case by case.
No. UNE 19601 is voluntary. What is required is to have an effective crime prevention model if you want to invoke the exemption under Art. 31 bis(2) of the Criminal Code, but the model does not have to be certified.
That said, certifying the system under UNE 19601 provides objectivity, traceability and recognition before public authorities, clients and courts.
UNE 19601 follows the High Level Structure (HLS) and is organized as follows: 1) Purpose and scope; 2) Normative references; 3) Terms and definitions; 4) Context of the organization; 5) Leadership; 6) Planning; 7) Support; 8) Operation (due diligence and controls); 9) Performance evaluation; 10) Improvement, plus six annexes (A–F).
Annex A links the standard to the Criminal Code; Annex B details third-party due diligence; Annex C sets the minimum documentation; Annex D covers implementation in subsidiaries.
UNE 19601 covers criminal compliance; UNE 19602 covers tax compliance; ISO 37301 is the generic compliance management system standard and ISO 37001 focuses on anti-bribery. They share the HLS structure and fit together in a single integrated system.
A mature organization usually builds on UNE 19601 (the criminal axis) and adds ISO 37001 or UNE 19602 depending on its risk profile.
Law 2/2023 of February 20, regulating the protection of persons who report regulatory breaches and the fight against corruption, requires companies with 50+ employees to have an Internal Information System (whistleblowing channel).
UNE 19601 includes the channel as a central element of the CCMS, so both requirements can be implemented together, efficiently.
For an SME, between 3 and 6 months until the audit phase; for a multinational, between 9 and 15 months, with phased rollout by subsidiary. Timelines depend on the starting point, the risk profile and the availability of the internal team.
Certification by an ENAC-accredited body usually adds 1–2 months to the schedule.
Certifying bodies today include, among others, AENOR, Bureau Veritas, DNV, TÜV SÜD and Intertek, all ENAC-accredited. Since April 2023, ENAC accreditation is required for the certification to be fully valid in the market.
Compare sector experience, audit criteria and cost before choosing a body.
A solid UNE 19601 system is not a set of well-drafted documents: it is an architecture of traceable decisions. The standard is the roadmap; the real work is turning it into a living system that survives both an audit and a criminal proceeding.
UNE 19601:2025 (replaces UNE 19601:2017, withdrawn on April 23, 2025); Art. 31 bis of the Criminal Code; Organic Law 1/2015 reforming the Criminal Code; Law 2/2023 on whistleblowing channels; ISO 37301, ISO 37001 and UNE 19602 as complementary standards.
The new UNE 19601:2025 emphasizes control of due diligence, explicitly introduces governance in criminal compliance and segments training and awareness, in line with international best practices.
A system proportionate to the organization’s real profile, with operational controls in sensitive processes (procurement, finance, HR, sales, data), documentary traceability and an independent, properly resourced compliance body.
In regulated sectors, the CCMS interacts with other specific obligations: AML/CFT (Law 10/2010) and the FATF list for country risk, MiCA EMT issuers and participants in the financial sandbox in fintech and crypto, or SGIIC and independent directors of investment firms (ESI) in the securities market.
UNE 19601 is not implemented with templates: it requires an architecture of processes, decisions and evidence. This is the working framework we go through in every criminal compliance project.
1) GovernanceApproval of the policy by the governing body, appointment of the compliance body with effective independence, and allocation of sufficient, verifiable resources.
2) RisksIdentification of the applicable offenses under Art. 31 bis of the Criminal Code, probability/impact analysis, mapping to processes and owners, and documented assessment.
3) ControlsA battery of preventive and detective controls: segregation of duties, approvals, limits, reconciliations, reviews and monitoring with system KPIs.
4) Channel and investigationsWhistleblowing channel compliant with Law 2/2023, internal investigation protocol, whistleblower protection, conflict-of-interest management and custody of evidence.
Full cycleContext, policy, risks, objectives, roles and resources.
Controls, due diligence, ethics channel, training and documentation.
Internal audit, management reviews and continuous improvement.
Formal policy approved by the governing body, communicated and built into the strategy.
Approved document with date, signature and a record of internal and external distribution.
Documented methodology, scope (offenses under Art. 31 bis of the Criminal Code) and periodic review.
Risk matrix with probability, impact, controls and owners by process.
Independence, resources, access to information and direct reporting to the governing body.
Charter, budget, reporting minutes and appointments of the responsible body or person.
Internal information system compliant with Law 2/2023, with whistleblower protection.
Accessible tool, policies, investigation protocol, records and statistics.
Procedures for business partners, suppliers and key personnel (Annex B).
Screening files, questionnaires, contracts with compliance clauses, monitoring.
Training and awareness plans segmented by profile and risk.
Content, attendance records, assessments and measurement of ethical culture.
Warning signs that auditors spot and, in a criminal proceeding, that the private prosecution’s experts look for.
If you are going to implement, maintain or certify a UNE 19601 system, these terms appear in the standard, in the Criminal Code and in audits by ENAC-accredited bodies.
Integrated set of policies, processes, controls and resources designed to prevent and detect offenses within the legal entity’s sphere of responsibility.
Article regulating the criminal liability of legal entities and the conditions for mitigating or exempting it through effective prevention models.
Structured set of oversight and control measures designed to prevent offenses, whose existence and effectiveness can exempt or mitigate criminal liability.
An independent person or body with autonomy, resources and direct reporting to the governing body, responsible for overseeing the system.
Whistleblowing channel mandatory for companies with 50+ employees, with whistleblower protection and an investigation protocol.
Procedures for assessing business partners and key personnel, segmented by risk level and with ongoing monitoring.
The body that accredits certification bodies. Since April 2023, UNE 19601 certification requires a body accredited by ENAC.
High-level structure common to ISO/UNE management standards, which makes it easier to integrate the CCMS with ISO 37301, ISO 37001 and UNE 19602.
Sister standard focused on preventing, detecting and managing tax risks, fully integrable with UNE 19601.
Tell us where your criminal compliance stands today and we will explain how to bring your organization to a UNE 19601 system that is defensible in any audit or proceeding.
UNE 19601 is the technical response of the Spanish standardization ecosystem to the regime of criminal liability of legal entities introduced by the 2010 reform and given concrete shape by Organic Law 1/2015 of March 30, which amended the Criminal Code. Its purpose is practical: to turn the requirements of Art. 31 bis of the Criminal Code into an auditable management system.
The standard was originally published in May 2017 (UNE 19601:2017), developed by the AENOR Technical Committee on compliance and good governance. On April 23, 2025, that version was withdrawn and replaced by UNE 19601:2025, which strengthens due diligence control, explicitly introduces governance in criminal compliance and segments training and awareness.
Annex A of UNE 19601 sets out the correspondence between the clauses of the standard and the requirements of Art. 31 bis of the Criminal Code. This makes the standard a navigation map for demonstrating the existence and effectiveness of the prevention model the law requires as an exemption or mitigating factor.
UNE 19601 adopts the High Level Structure (HLS) common to ISO management system standards, which makes it easier to integrate with ISO 37301 (general compliance), ISO 37001 (anti-bribery) and UNE 19602 (tax compliance). Its content is organized into 10 clauses and 6 annexes (A to F).
Law 2/2023 of February 20 requires companies with 50+ employees to have an Internal Information System. UNE 19601 includes this channel as a central piece of the CCMS, allowing integrated and efficient compliance with both requirements.
On April 28, 2023, the period of effective validity for UNE 19601 certificates issued without ENAC accreditation ended. Today, full certification is obtained through accredited bodies (AENOR, Bureau Veritas, DNV, TÜV SÜD, Intertek, among others).
Supreme Court case law and the State Attorney General’s Office (FGE Circular 1/2016) make clear that certification does not automatically produce the exemption: it is initial evidence that the court must examine. A well-designed, implemented and operated system is, however, the best possible defense.
Key legislation, linked to the official text:
Legislation and links reviewed in .