This report was prepared by Pulchra’s Compliance team to analyze the new regulatory framework for anticorruption and due diligence at both the European and national levels, and its direct impact on companies’ prevention and regulatory compliance systems. The following sections outline the main legislative and case law developments, along with their practical implications for corporate governing bodies.
Recent regulatory developments at the European and national levels—the Anticorruption Directive (EU 2026/1021), the Due Diligence Directive (EU 2024/1760), and the Preliminary Draft Organic Law on Public Integrity—mark a turning point for the compliance systems of all companies operating in Europe. It can be said that the era of formal, cosmetic compliance has ended: the new requirement is substantive, preventive, demonstrable compliance with full traceability.
The recent Spanish Supreme Court Judgment No. 418/26 of June 22, 2026 (the “face masks” case), clearly reflecting the principles of the Anticorruption Directive, has underscored existing concerns about corruption and the need to take appropriate measures to address this serious problem, as discussed below.
The starting point for any analysis must be the framework established by Article 31 bis of the Spanish Criminal Code—which governs the criminal liability of legal entities—and Article 225 and related provisions of the Spanish Companies Act, together with the established case law of the Spanish Supreme Court and the National Court.
It is precisely the interaction between the obligations arising from these two provisions that gives a distinct scope to the interpretation of the rest of the legal framework (the new Anticorruption Directive and the Draft Organic Law on Integrity in Public Administration) and gives compliance systems particular significance under the standards of good governance that corporate governing bodies are responsible for establishing.
The International Trend: Convergence of Standards and European Directives
Alongside the national framework, the shift among leading international organizations toward stronger compliance controls, particularly for corruption and fraud, is a decisive factor. The most relevant benchmarks are:
DOJ/SEC 2026 (United States): The formal existence of a compliance model will no longer suffice. Companies will be required to demonstrate its actual effectiveness, continuous operation, and ability to respond swiftly to unlawful conduct.
OECD — Good Practice Guidance: The OECD article of April 30, 2026 (“Why strong anti-bribery enforcement and smart compliance are becoming business assets”) is one of the clearest expressions of the new global vision of compliance, aligning DOJ guidance, OECD recommendations, and the European Anticorruption Directive. Programs must be measurable, effective, and capable of demonstrating a genuine culture of corporate integrity.
SFO (United Kingdom): A model focused on analyzing specific risks: the assessment considers whether the company properly identified its particular bribery, fraud, or corruption risks and designed proportionate controls to mitigate them.
World Bank Group — Integrity Compliance Guidelines: These require compliance programs to be proportionate, tailored to risk, demonstrably implemented, and capable of preventing, detecting, and investigating irregularities, with an emphasis on evidence of effective operation.
Taken together, these international regulations, the European directives on the subject, and the proposed national legislation create a landscape that the business sector cannot disregard under any circumstances. Doing so would expose corporate governing bodies to breaches of the obligations arising from Article 225 and related provisions of the Spanish Companies Act, with the serious consequences that entails.
The Anticorruption Directive (EU 2026/1021) frames corporate regulatory compliance as a heightened duty of organization and diligence, treating corruption as a systemic risk with criminal, administrative, corporate law, and reputational implications.
The legislation increases penalties, strengthens criminal enforcement, defines criminal offenses more precisely, introduces new offenses (including illicit enrichment), and reinforces the preventive measures that Member States must incorporate.
The Directive expressly recognizes the exculpatory value of compliance and identifies two particularly relevant circumstances:
- Prior or subsequent internal controls: Having implemented effective internal controls, awareness measures, and compliance programs to prevent corruption, either before or after the offense was committed (provided this does not already constitute grounds for exemption from liability).
- Voluntary disclosure: Having promptly and voluntarily notified the authorities after discovering the offense, and having taken remedial measures.
The Directive expressly warns that cosmetic or merely formal compliance programs will have no effect for these purposes.
The potential extraterritorial reach permitted by the Directive must be taken into account. Article 18 allows states to establish such jurisdiction under certain conditions. Thus, for example, bribery committed outside the EU may be prosecuted in Europe or Spain if it generates a benefit for a subsidiary as part of an activity carried out within the Union. This will require multinational companies and their European subsidiaries to restructure their compliance systems appropriately.
Furthermore, depending on how each Member State transposes the calculation criteria, a violation committed by a Spanish subsidiary could result in penalties calculated on the basis of the group’s consolidated revenue (between 3% and 5% of annual worldwide revenue), rather than solely on the revenue of the Spanish entity. This makes it essential to review corporate liability insurance policies as well and assess the effective coverage of the compliance program.
The Due Diligence Directive (EU 2024/1760) extends compliance obligations beyond large companies, reaching the entire business community through large companies’ duty to oversee their value chains—including customers and suppliers. Smaller companies will need to demonstrate adequate compliance in order to maintain their position in those supply chains.
3. National Regulations.
At the national level, the Preliminary Draft Organic Law on Integrity in Public Administrations incorporates the obligations arising from the Anticorruption Directive and entails amendments to as many as eighteen laws (six of them organic laws), organized around five key areas:
- Risk prevention and stronger internal controls.
- Investigation and punishment of unlawful conduct.
- Public awareness and institutional integrity.
- Recovery of assets derived from unlawful activity.
- Enhanced protection for whistleblowers.
The planned amendments will affect the Criminal Code, the Organic Law on the Judiciary, the regulations governing the National Commission on Markets and Competition (CNMC), and other sector-specific provisions, with major operational and commercial consequences for companies: exclusion from public procurement, effects on M&A transactions, inadequate insurance coverage, and liability for group activities.
The new procedural model envisaged under the reform of the Procedural Law represents a paradigm shift: the relevant question will no longer be solely whether a crime was committed, but whether the company took the necessary measures to prevent it. In this context, evidence that sensitive decisions—tax, financial, and corporate transactions—were analyzed using heightened diligence standards takes on particular importance.
The key to liability will be not only what was decided, but how it was decided and what evidence remains of that process.
Consequences.
The consequences of the forthcoming regulations will be concentrated particularly among companies that deal with public administration, receive significant subsidies, or operate in areas with greater exposure to integrity risks. In practice, this will affect a substantial proportion of companies that interact with the public sector. Nevertheless, the Draft Integrity Law incorporates the principle of proportionality as a criterion for applying compliance requirements. In this context, small companies that maintain relationships with the public sector should have certain basic internal controls in place.
Foreign companies and international groups. The considerations above apply fully—and with particular force—to companies from environments commonly classified as high risk. Their entry into the European market must be supported by compliance systems that pay particular attention to overseeing the regulations and practices specific to those environments.
Added to this is the extraterritorial reach provided for in the Anticorruption Directive, which requires a comprehensive review of the compliance models of any multinational company with a presence in Europe.
As a practical summary, compliance systems will now need to address, among other things:
- Substantive, preventive, and demonstrable operation; compliance cannot be merely a document.
- Clear evidence of sound governance and traceable decision-making.
- An approach that treats compliance as a duty of organization and heightened due diligence.
- Review and updating of risk maps, including the newly harmonized offenses (illicit enrichment).
- Specific analyses of fraud, corruption, and conflicts of interest, with risk matrices broken down by country.
- A qualitative improvement in third-party due diligence: a multilevel approach (country, sector, role, transaction).
- Reconfiguration of financial and nonfinancial internal controls.
- An anticorruption policy extending across the entire supply chain.
- Stronger reporting channels in line with more demanding standards.
- Enhanced oversight of dealings with public administrations and access to funds or subsidies.
- Transparency in public-sector implementation procedures and stricter grounds for exclusion.
- Review of corporate liability insurance policies in light of the new bases for calculating penalties.
Conclusions
The Board of Directors’ duty to oversee the crime prevention model and the company’s controls is not contingent on the timetable for transposing the Anticorruption Directive: it is enforceable today under the diligence standard in Article 225 of the Spanish Companies Act and Article 31 bis of the Criminal Code itself. This requires a preliminary assessment of the existing compliance system so that it can be brought into line with the requirements, or the implementation of a system if none yet exists.
The substantive content of the Compliance program—as opposed to its mere formal existence—is the decisive criterion both in established Spanish case law and in the new regulatory framework, which expressly warns against compliance programs that are merely a façade. It is imperative to update risk maps, third-party controls, and conflict-of-interest arrangements, and to strengthen anticorruption controls.
Compliance programs will need to demonstrate not only that policies and procedures exist, but that they can identify risks, detect violations, investigate incidents, take corrective action, and drive continuous organizational improvement. Ultimately:
Compliance and anticorruption systems must be substantive, predictable, tested, effective, and adequately traceable.
Anyone who fails to ensure this assumes regulatory, criminal, reputational, and commercial risks that no responsible organization can afford to ignore.
A clear and rigorous assessment of existing compliance systems is therefore necessary, along with urgent implementation where no system exists.
In this new regulatory landscape, the question is no longer whether companies should have a compliance system, but whether that system will be able to demonstrate, when the time comes, that the Board of Directors and senior management exercised the required diligence. At Pulchra and Estudio de Abogados Martín Villa & Asociados, we support organizations in designing, implementing, reviewing, and updating effective compliance models tailored to each company’s circumstances, integrating risk prevention into strategic decision-making and corporate culture. Because today, protecting a company’s value also requires protecting those who lead it through compliance systems that are substantive, proportionate, and fully verifiable.