Risk map
Criminal risks specific to your sector. Not the ones from the manual.
CC-06 · Criminal compliance
Criminal compliance UNE 19601
Criminal risk map, code of ethics, whistleblowing channel compliant with Law 2/2023 and an operational compliance committee.
Since the 2015 Criminal Code reform, legal entities may face criminal liability for offences committed within them. A serious compliance programme — adopted, implemented and maintained — is the only real defence.
We work according to UNE 19601: identification and assessment of criminal risks relevant to your sector, code of ethics, whistleblowing channel compliant with Law 2/2023 (Whistleblowing Directive), compliance committee with real authority, training for managers and internal investigation procedures.
This is not a project that ends with a report: the programme is only valid if it is kept alive. That is why we offer monthly maintenance with periodic risk reviews, recurring training and drills.
PILLAR 01
Risk map
By sector, with probability and impact.
PILLAR 02
Code of ethics
Signed by management, communicated to staff.
PILLAR 03
Whistleblowing channel
Compliant with Law 2/2023, with confidentiality guarantees.
PILLAR 04
Compliance committee
With real authority, calendar, and minutes.
The Criminal compliance UNE 19601 process.
The process · four stagesCode of ethics
Values and expected behaviour document, signed by management.
Whistleblowing channel
Compliant with Law 2/2023, with confidentiality guarantees.
Committee
Compliance committee with real authority. Recurring training for executives.
What is included
What Criminal compliance UNE 19601 includes.
The operational detail: what we deliver as part of the engagement and what we keep active afterwards.
-
Criminal risk map
By sector, probability and impact, assignment to processes.
-
Code of ethics and procedures
Main document and derivatives (conflicts, gifts, procurement).
-
Active whistleblowing channel
Platform compliant with Law 2/2023.
-
Annual training plan
Mandatory for executives and employees in areas with criminal risk.
-
Active compliance committee
Real authority, resources, calendar, and minutes.
-
Internal investigation
Procedure with confidentiality and defence guarantees.
Regulatory framework
The regulatory framework.
Since the 2015 reform, legal entities are liable. A robust programme is the only defence.
UNE
19601
Applicable to this service
CP
art.31bis
Applicable to this service
EU
Directive
Applicable to this service
L
2/2023
Applicable to this service
Summum cluster
How it intersects with related services.
Intersects with GDPR (whistleblowing channel) and highly regulated sectors.
Frequently asked questions about Criminal compliance UNE 19601.
Is UNE 19601 certifiable?
Yes. It is a certifiable Spanish standard. AENOR and others issue certification.
What about ISO 37301?
International equivalent, broader in scope. UNE 19601 + ISO 37301 when operating outside Spain.
When is it mandatory?
Implementation is not mandatory, but a robust programme is the only way to exclude criminal liability.