Corporate Criminal Liability in Spain: Rethinking Article 31 bis of the Spanish Penal Code

Abstract The introduction of corporate criminal liability into Spanish law through Organic Law 5/2010 and its substantial reform by Organic Law 1/2015 marked a decisive departure from the traditional maxim societas delinquere non potest. Article 31 bis of the Spanish Penal Code now permits criminal liability of legal persons in specified circumstances and gives compliance systems an expressly exonerating function. Yet the architecture remains conceptually unsettled. The statutory language combines attribution through senior persons with liability arising from serious failures of supervision, while the Supreme Court has insisted that corporate liability cannot become a form of strict or purely vicarious responsibility. This article critically examines Article 31 bis as a model of organisational criminal responsibility. It argues that the provision should be interpreted through a coherent concept of corporate culpability centred on organisational failure, rather than through an undifferentiated theory of transfer from the natural person to the corporation. The article analyses the two attribution routes in Article 31 bis(1), the exonerating conditions for effective organisation and management models, the relationship between compliance and culpability, the allocation of the burden of proof, the special position of small and shell companies, the independence of corporate and individual liability, and the procedural rights of legal persons. It engages particularly with Supreme Court judgments 154/2016, 221/2016, 123/2019 and 534/2020 and Circular 1/2016 of the State Attorney General’s Office. It contends that Spanish law would be strengthened by a clearer distinction between the predicate offence and the corporation’s own organisational fault; a structured, evidence-based test of compliance effectiveness; stronger protection against reverse burdens that undermine the presumption of innocence; and a more precise treatment of corporate entities lacking meaningful organisational autonomy. Article 31 bis should ultimately be understood not as a mechanism for punishing a corporation merely because an employee or director committed a crime, but as a framework for attributing blame to an organisation whose structures, culture, controls or governance materially permitted the criminal risk to become reality.