Criminal compliance in financial services: the layer that prudential regulation does not cover

Criminal compliance in financial services: the missing layer

Financial institutions invest enormous resources in prudential regulatory compliance: regulators such as the ECB, the Bank of Spain, and the CNMV require levels of internal control and governance that few other industries match. But prudential regulatory compliance and criminal compliance are not the same thing, and financial institutions do not always have the latter sufficiently developed.

Criminal compliance has a specific objective: to prevent employees or directors from committing offences in the exercise of their activities — money laundering, market abuse, distribution fraud, corruption — and, if they occur, to enable the institution to demonstrate to the criminal court that it had adopted appropriate preventive measures. The difference between an institution with a robust criminal compliance programme and one without may be the difference between an exemption from liability and a conviction with devastating consequences.

Anti-money laundering: the core of financial compliance

Financial institutions are obliged entities under Act 10/2010 on the prevention of money laundering, with extensive obligations regarding client identification, risk assessment, and the reporting of suspicious transactions. Compliance with Act 10/2010 is, moreover, a necessary — though not sufficient — condition for the criminal compliance programme to be effective as an exemption from criminal liability.

We review and update existing anti-money laundering systems to ensure they comply with current regulatory requirements — including the fourth and fifth generation European AML Directives — and that they are correctly integrated into the criminal compliance programme.

Market abuse: the risk that comes from within

Insider trading and market manipulation are offences typically committed from within financial institutions by persons with access to inside information. Information barriers, restricted securities lists, and monitoring of staff’s own trading are essential controls in any institution operating in capital markets. The Market Abuse Regulation (MAR) establishes specific prevention and reporting obligations that must be integrated into the compliance programme.

Whistleblowing channel: the first line of detection

Employees are often the first to detect irregular conduct within the institution. An effective whistleblowing channel — confidential, accessible, and providing genuine whistleblower protection in accordance with Act 2/2023 — is the first line of detection for compliance risks. Financial institutions have a legal obligation to have this channel, and its inadequate management can itself be a ground for liability.

The 2024 EU AML package: what financial institutions must prepare for

The EU adopted a comprehensive AML reform package in 2024, including Regulation (EU) 2024/1620 (the Single Rulebook AML Regulation) and Directive (EU) 2024/1640, which establish the new Anti-Money Laundering Authority (AMLA) with direct supervisory powers over high-risk entities from 2026. For Spanish financial institutions, the key developments are:

AMLA direct supervision. From 2026, AMLA will directly supervise the most high-risk financial entities across the EU — banks with significant cross-border business, crypto-asset service providers, and entities with high AML risk scores. SEPBLAC retains supervision of lower-risk entities. The transition from SEPBLAC supervision to AMLA supervision for qualifying entities will require updating internal AML systems to AMLA standards.

Harmonised KYC standards. The Single Rulebook replaces existing national AML regulations with directly applicable EU rules on customer due diligence, beneficial ownership, PEP screening, and high-risk third countries. Spanish financial institutions will need to update their KYC procedures to comply with the directly applicable regulation rather than the national Law 10/2010 framework.

Crypto-asset service providers (CASPs). Under MiCA (Markets in Crypto-Assets Regulation, fully applicable from December 2024), CASPs are included as obliged entities under the AML framework. Banks and investment firms offering crypto services must now extend their AML procedures to cover crypto transactions.

BMC advises financial institutions on preparing for the 2024 AML package — assessing gaps against the new directly applicable standards, updating KYC documentation, and engaging with AMLA’s preparatory guidelines for the 2026 supervisory transition.

Corporate criminal liability in financial institutions: key offences and defences

The specific criminal offences most relevant to financial institutions since the 2010 Penal Code reform include:

Money laundering (Arts. 301-304 PC). The primary criminal risk for banks and financial intermediaries — a financial institution can be convicted as a principal or as an accessory (by means of) to money laundering if its controls were so deficient that it facilitated laundering that a properly run institution would have detected and reported. The standard is not negligence but a degree of disregard for the obvious that amounts to wilful blindness.

Market abuse (Arts. 284-286 PC). Insider trading, tipping off, and market manipulation are specific criminal offences for which both the individual employee and the institution can face liability. The Spanish criminal courts have convicted financial institution employees for insider trading based on the same facts as administrative sanction proceedings before the CNMV.

Distribution fraud (Art. 282 bis PC). Fraudulent product distribution — selling financial products with false information about their characteristics or risks — can constitute this offence where the distribution was carried out with knowledge of the misleading nature of the information. The Supreme Court’s case law on preference shares distribution to retail clients illustrates how this offence applies in practice.

Tax offences (Arts. 305-310 PC). Large financial institutions have been the subject of criminal tax investigations arising from collective investment vehicle structures, withholding obligations, and VAT on financial services classification disputes. The criminal threshold for corporate tax fraud is €120,000 per tax period.

Ongoing compliance monitoring: the role of internal audit and the Compliance Body

A criminal compliance programme that satisfies the Article 31 bis CP exemption requirements must be monitored by a genuinely independent Compliance Body. For a financial institution, where the regulatory compliance function (CNMV, BdE) is well-established, the criminal compliance Compliance Body must be distinct from the regulatory compliance function — its mandate is the prevention of criminal offences, not the satisfaction of prudential regulators.

The Compliance Body’s annual activities should include: a review of the criminal risk map for changes in business activities or structure, testing of control effectiveness (sampling of high-risk transactions, review of whistleblowing channel activity, spot-checks on KYC documentation), annual compliance training attendance records, and a formal report to the Board on programme status and any incidents. BMC acts as external Compliance Body for financial institutions that prefer to outsource this function to specialists with independence from the management team.