The Requirement of “Fraudulent Evasion” under Article 31 bis of the Criminal Code
Article 31 bis 2 (3) of the Spanish Criminal Code requires, as a condition for exempting a company from criminal liability, that the offense be committed by fraudulently evading the organization and management model. This phrasing is far from rhetorical: for genuine “evasion” to occur, there must be an actual system to evade. Furthermore, “fraudulent” implies that the offender had to deploy active maneuvers, deceit, or deliberate effort to bypass a control that otherwise would have been effective.
If a company’s only existing instrument is a standalone code of ethics lacking associated controls, effective oversight, verification channels, or real disciplinary consequences, there is nothing for the offender to “evade”. The individual simply operated in an environment where no actual monitoring took place.
A Practical Example: Real Controls vs. Paper Policies
Consider two companies sharing the exact same internal policy, which mandates verifying any intermediary or commercial agent prior to paying a commission.
Company A translates this policy into an operational procedure: the employee handling the payment must complete a due diligence questionnaire regarding the intermediary and obtain approval from an independent second reviewer before funds are released. If an employee intends to pay a fictitious agent to divert funds, they must forge the questionnaire or falsify that second signature. In doing so, they have fraudulently evaded a real control by deceiving the system.
Company B maintains the same policy on paper, but it is never enforced: there is no questionnaire, no dual authorization, and no review process. If an employee approves the exact same fraudulent payment here, no control has been evaded because no operational control existed in practice.
Only Company A can successfully invoke the liability exemption. Company B, despite having identical written policies, cannot.
What Separates a Document from a System
Jurisprudence and legal doctrine consistently agree that measures under Article 31 bis must be genuinely suitable to prevent or significantly reduce risk, rather than serving as mere behavioral guidelines. This requires, at minimum, four core elements that an isolated code of ethics cannot provide on its own:
Active, non-self-declarative verification: Compliance must be verified by designated personnel rather than relying on trust.
Traceability: Documented approvals, logs, and dated protocols that allow ex-post reconstruction of the specific controls in place when the event occurred.
Enforceable disciplinary consequences: An active, not merely written, disciplinary regime that attaches real consequences to non-compliance.
An empowered supervisory body: An internal oversight body with the authority and autonomy to act independently of those it supervises, rather than merely receiving reports.
Without these four components, arguing “fraudulent evasion” before a court becomes practically unsustainable: one cannot fraudulently evade a mechanism that never had the actual capacity to prevent anything in the first place.
Conclusion: Necessary, but Not Sufficient
In summary, a code of ethics serves a necessary but insufficient purpose: it establishes the expected standard of conduct, but cannot enforce it on its own. Without verifying controls, an autonomous supervisory body, and real consequences for breaches, a code remains mere paper rather than a preventive management model under Article 31 bis.
When evaluated before a tribunal, the determining factor will never be whether the company possessed a code of ethics, but whether that code ever functioned as a real operational control.
