Spain's Draft Organic Law on Public Integrity marks a significant regulatory shift for companies involved with the public sector. Compliance officers should use this draft as a preparation guide, rather than waiting for its final passage. The proposed measures, mandatory criminal compliance models for public contractors, extended statutes of limitations from five to seven years, and compulsory integration of whistleblowing channels with compliance systems, require an immediate evaluation of your current controls.
This checklist outlines the steps needed to align your organization with the draft's core requirements, focusing on areas where non-compliance could lead to disqualification from public contracts and increased financial penalties.
Prerequisites
Before using this checklist, ensure you have:
- Access to your current criminal compliance documentation, including your organization and management model for crime prevention and any existing public procurement compliance protocols.
- Visibility into your shareholding structure and Commercial Registry filings.
- Documentation of your internal reporting system (whistleblowing channel) and associated policies.
- Authority to request information from procurement, legal, compliance, and finance functions.
- Understanding of your public sector exposure, including current contracts, pending bids, and grant applications.
Compliance Checklist
1. Criminal Compliance Model Assessment
Determine if your organization has implemented an appropriate organization and management model for integrity and the prevention of criminal offenses, with effective supervision.
Action: Document the existence, scope, and supervisory mechanisms of your criminal compliance model. For public sector contracts, this is mandatory under the draft.
What good looks like: A written compliance model addressing corruption risks, with designated supervisory authority and active monitoring through documented reviews, training records, and control testing results.
2. Shareholding Registration Verification
Check if your shareholdings are registered with the Commercial Registry, as the draft mandates registration.
Action: Audit your current Commercial Registry filings. Identify any unregistered shareholdings and prepare documentation for registration if the law passes.
What good looks like: Complete Commercial Registry records showing all material shareholdings, with a documented process for updating filings when ownership changes occur.
3. Conflict-of-Interest Declaration Process
Establish procedures for executing conflict-of-interest declarations for all participants in public procurement procedures.
Action: Draft template declarations. Map all roles involved in bid preparation, submission, and contract execution. Create a sign-off workflow for declarations before procurement participation.
What good looks like: A documented protocol requiring written conflict-of-interest declarations from every employee, consultant, or third party involved in public procurement activities, with declarations retained for the extended seven-year statute of limitations period.
4. Whistleblowing-Compliance Integration
Evaluate whether your internal reporting system (whistleblowing channel) is integrated with a broader compliance or integrity system, as the draft proposes amending the Whistleblower Protection Act to require this linkage.
Action: Review your whistleblowing policy. Verify it references your compliance system and that both systems share governance oversight. Develop an integration plan if they operate independently.
What good looks like: A published policy stating that your internal reporting system is part of your organization's compliance framework, with the same governance body overseeing both functions and documented coordination between whistleblowing investigations and compliance risk assessments.
5. Public Sector Exposure Inventory
Catalogue all current and anticipated interactions with public entities, including contracts, grants, subsidies, and tax incentives.
Action: Request from procurement and finance a complete list of public sector contracts, pending bids, active grants, and claimed incentives. Classify by value and strategic importance.
What good looks like: A maintained register showing each public sector relationship, contract value, renewal dates, and compliance model applicability, updated quarterly and reviewed by compliance leadership.
6. Penalty Exposure Calculation
Assess your potential exposure under the draft's enhanced penalty framework, which allows fines based on annual turnover or unlawful benefit obtained.
Action: Model potential penalties using both your annual turnover and a reasonable estimate of benefit that could be challenged in a corruption scenario. Assess whether your insurance or reserves account for this exposure.
What good looks like: A documented risk assessment showing potential penalty ranges under the new framework, presented to senior management and the board, with mitigation strategies identified for high-exposure areas.
7. Statute of Limitations Record Retention
Adjust your document retention policies to reflect the proposed extension from five to seven years for corruption-related offenses.
Action: Review and revise retention schedules for procurement records, compliance investigations, conflict-of-interest declarations, and related communications.
What good looks like: Updated retention policies explicitly referencing the seven-year period for corruption-relevant documents, with automated retention rules in your document management system and legal hold procedures that account for the extended timeframe.
8. Political Donation Control Review
If your organization makes political donations, assess your controls against the draft's stricter oversight requirements.
Action: Document your current approval process, due diligence, and reporting for political donations. Identify gaps relative to heightened regulatory scrutiny.
What good looks like: A board-approved policy limiting or prohibiting political donations, or if donations continue, a documented approval process requiring legal and compliance review, conflict checks, and public disclosure where required.
Common Mistakes
- Treating the draft as speculative: Organizations that wait for final passage lose months of preparation time. The regulatory direction is clear even if specific provisions change.
- Separating whistleblowing from compliance: The draft explicitly requires integration. Maintaining parallel systems creates policy gaps and confuses employees about reporting channels.
- Applying criminal compliance models only to new contracts: If you hold existing public sector contracts, assess whether you can demonstrate an adequate compliance model today. Renewal or extension may trigger the new requirements.
- Underestimating the mandatory disqualification impact: Unlike discretionary sanctions, mandatory blacklisting from public contracts, grants, and incentives can be existential for organizations with significant public sector revenue.
- Ignoring the extended statute of limitations in investigation protocols: When corruption allegations arise, your investigation must preserve evidence and testimony for seven years, not five. Incomplete early investigations become liabilities.
Next Steps
- Brief senior management and the board on the draft's implications for your organization's public sector strategy and compliance investment requirements.
- Assign ownership for each checklist item to specific roles (procurement lead, compliance officer, legal counsel) with completion deadlines.
- Engage external counsel if your criminal compliance model needs substantial development or if you're unclear whether your current program satisfies the "appropriate organization and management model" standard.
- Monitor the legislative process through your industry association or legal advisors. The draft may be amended, but early preparation positions you to adapt quickly.
- Conduct a tabletop exercise simulating a corruption investigation under the new framework. Test whether your documentation, retention, and response protocols align with extended statutes of limitations and heightened penalties.
The Draft Organic Law on Public Integrity shifts Spain's anti-corruption posture from reactive to preventive. Your compliance readiness today determines whether you can pursue public sector opportunities tomorrow or face mandatory disqualification when the law takes effect.
