Spain – Global Investigations Review

What are the relevant statutes and which government authorities are responsible for investigating and enforcing them?

In Spain, the main set of rules governing the functioning of the securities market and investment services is Royal Legislative Decree 4/2015 of 23 October 2015, approving the Consolidated Text of the Securities Market Act (LMV). ^{Because this area is, to a large extent, subject to European harmonisation, the LMV has been amended on various occasions to implement European directives on financial markets (e.g., the Markets in Financial Instruments Directives, the Transparency Directive and the Market Abuse Directive). In terms of its scope of application, the LMV applies to any financial instruments issued, traded or marketed in Spain, as well as any investment activities or services carried out by domestic or foreign companies in the Spanish market.}

In addition to the LMV, there are various sectoral rules on specific matters pertaining to the securities and financial markets, which are mainly implemented through: (1) royal decrees issued by the Spanish government; (2) orders issued by the Ministry of Economy and Competitiveness (the Ministry of Economy); and (3) circulars issued by the National Securities Exchange Commission (CNMV).

The following are examples of these sectoral rules:

• Royal Decree 2119/1993 of 3 December 1993 on the sanctioning procedure applicable to securities market operators;
• Royal Decree 948/2001 of 3 August 2001 on the compensation system for investors;
• Royal Decree 1310/2005 of 4 November 2005 on public securities offerings and admission to trading of securities on official secondary markets;
• Royal Decree 1066/2007 of 27 July 2007 on takeover bids;
• Royal Decree 1362/2007 of 19 October 2007 on transparency requirements;
• Royal Decree 217/2008 of 15 February 2008 on investment services companies;
• Circular 10/2008 of 30 December 2008 on financial advisory firms;
• Order EHA/1717/2010 of 11 June 2010 on the regulation and control of marketing activities involving investment services and products;
• Order ECC/461/2013 of 20 March 2013 on corporate governance information to be published by listed entities;
• Circular 1/2018 of 12 March 2018 on warnings relating to financial instruments;
• Royal Decree 739/2019 of 20 December 2019 on payment services and payment institutions; and
• Circular 1/2022 of 10 January 2022 on the advertising of cryptoassets for investment purposes.

Other sources of norms on securities and financial markets include the Spanish Corporation Act, consumer protection legislation (such as Law 22/2007 of 11 July 2007 on the distance marketing of financial services for consumers) and the Spanish Criminal Code (SCC).

The main supervisory body on matters pertaining to securities and financial markets is the CNMV, which is a public entity with independent legal personality. Its functions are to:

• ensure transparency of securities markets, the correctness of price formation and the protection of investors;
• monitor and oversee the functioning of securities markets, with the authority to punish any infringement committed by legal or natural persons operating in them;
• advise the Spanish government and the Ministry of Economy in connection with the exercise of their respective regulatory powers;
• issue circulars to elaborate on and enforce specific matters established in legislation (i.e., the CNMV is not itself entitled to create new duties or obligations but develops specific provisions approved by the Spanish government and the Ministry of Economy); and
• publish guidelines for market operators with the goal of promoting sufficient compliance with the rules and standards of conduct on securities and financial markets.

Notwithstanding the above, the following domestic institutions also participate in the enforcement of securities obligations: the Bank of Spain, which oversees the public debt market and activities carried out by credit institutions; the Ministry of Economy and the departments of economy of specific Spanish autonomous regions; and the Public Prosecutor’s Office and investigative courts, ^{which also play a decisive role in the prosecution and punishment of potentially criminal infringements.}

What conduct is most commonly the subject of securities enforcement?

Litigation related to the enforcement of securities laws has significantly increased over the past decade as a result of the challenges caused by the financial crisis of 2008–2012.

The types of conduct subject to securities enforcement depend on the specific area of law. The following are three different approaches from administrative, criminal and civil law perspectives.

Administrative liability

Any breach of regulations related to the organisation or control of securities markets may give rise to liability under administrative law. ^{This will involve not only infringements of the provisions of the LMV but also those of any other legal framework on the matter approved by the European Union, the Spanish government, the Ministry of Economy and the equivalent bodies of the Spanish autonomous regions, as well as circulars issued by the CNMV.}

Consequently, the range of conduct that is potentially punishable in the area of administrative law is exceedingly broad. For example, misconduct may relate to: breaches of registration and licensing duties; classification and evaluation of clients; implementation of proceedings on corporate governance; and disclosure obligations regarding relevant facts, periodic financial information, the acquisition of significant stakes and treasury stock.

Depending on the specific circumstances of the case, misconduct may qualify as a minor, serious or very serious infringement, ^{with each having a corresponding range of sanctions (see ‘What remedies and sanctions are available to government authorities?’, below).}

Pursuant to Article 271 of the LMV, administrative sanctioning proceedings may target the specific companies ^{that infringed the regulations on securities markets and, in cases of serious and very serious infringements, natural persons holding (de jure or de facto) the positions of director, chief executive and any other similar position entailing the highest management functions in the legal person. Nevertheless, those legal persons will only be held liable when it is proven that the infringement was caused as a result of their wilful misconduct or negligence.}

The CNMV has the authority to initiate sanctioning proceedings, conduct investigations and impose sanctions whenever it considers it appropriate to do so. ^{The CNMV is vested with expansive powers of inspection, including the right to:}

• access and copy documents in any format;
• request information and hold hearings of natural persons;
• perform inspections of any offices or premises;
• request the freezing of assets or order the temporary closure of businesses; and
• monitor the implementation of remediation measures.

Administrative actions are time-barred for five years (for serious and very serious infringements) or two years (for minor infringements) from the day on which the punishable act was committed.

Criminal liability

Although a broad range of criminal offences can potentially be committed in connection with listed companies and financial markets (such as public and private corruption, money laundering, fraud, false accounting and negligent insolvency), the main securities-related offences are the following.

• Investment fraud: forgery of the financial and economic information contained in a prospectus or any other information that the company must make public pursuant to securities regulations with the goal of attracting investors or obtaining financing by any means. The mere possibility of causing damage is punishable under this criminal offence (i.e., it is not necessary to prove actual damage for a conviction). Although only company directors can commit the criminal offence of investment fraud as perpetrators, third parties that contribute to the misconduct can also be held criminally liable as necessary collaborators or accomplices.
• Market manipulation: altering prices: (1) by means of violence, intimidation or deceit; (2) through spreading rumours that provide false or misleading economic information about securities issuers or natural persons linked to them; or (3) by means of carrying out transactions or issuing trading orders that provide false or misleading information about the supply, demand or price of a financial instrument. The actions described in points (2) and (3) will be punishable under criminal law if any of the following circumstances exist:
  • the profit earned or the damage caused exceeds €250,000;
  • the value of the funds used exceeds €2 million; or
  • the integrity of the market was significantly impacted.
• Insider trading: a natural person, directly or through an intermediary: (1) acquiring, transferring or assigning a financial instrument, or cancelling or modifying a securities order by means of using inside information; or (2) recommending that a third party use the inside information to carry out any of the above acts, subject to the condition that at least one of the following circumstances occurs:
  • the profit earned or the damage caused exceeds €500,000;
  • the value of the funds used exceeds €2 million; or
  • the integrity of the market was significantly impacted.
• Unlawful disclosure of inside information: a natural person with legitimate access to inside information disclosing it outside the normal course of their functions, endangering the market’s integrity or investors’ trust.

All the above criminal offences require intent – or at least knowledge – to meet the requirement of mens rea; a mere lack of diligence in the context of these crimes is not penalised under Spanish criminal law.

In recent years, various high-profile criminal proceedings concerning breaches of securities laws were initiated in connection with major Spanish financial institutions, their directors and executives. The Bankia case, which concerned alleged securities fraud related to Bankia’s initial public offering in 2011, was one of the most widely covered by the press. A judgment was given in 2020, which resulted in the acquittal of all the defendants. ^{Another high-profile ongoing criminal proceeding is the Banco Popular case, which, at the time of writing, is still in the investigation stage and concerns allegations of investment fraud and market manipulation.}

Generally, these types of criminal proceedings target corporate directors, top executives and any other collaborators who significantly contributed to the commission of the crime. However, pursuant to the principle of culpability, individuals may only be held criminally liable for their own acts or omissions – the SCC does not recognise vicarious or strict criminal liability. As such, in practice, the actual defendants would depend on the specific circumstances of the case.

Auditors and audit firms are often involved in the most high-profile proceedings pertaining to investment fraud (e.g., the Bankia, Banco Popular and Banco de Valencia cases, ^{in which the allegedly false information had been subject to – and not flagged by – an external audit prior to public disclosure). In this regard, criminal judges emphasise that financial audits are essential for the functioning of the economy and consider that audited documents are those that are most likely to deceive investors given that investors invariably rely on the accuracy and truthfulness of the financial information they contain. As a result, there is a risk that auditors may be deemed as necessary collaborators of the perpetrator of the offence in these situations.}

In the Bankia case, top officials in the CNMV and the Bank of Spain were also investigated in the preliminary stage of the criminal proceedings (they were alleged to have authorised Bankia’s initial public offering despite being aware that the prospectus was factually misleading). However, the judge decided to dismiss the proceedings against them and they were ultimately not charged with any crime.

Companies can be held liable for the securities-related offences discussed above if it is proven that the misconduct was committed on their behalf – and for their direct or indirect benefit – by their directors, executives, employees or collaborators. ^{Corporate criminal liability is not alternative to (but is cumulative with) that of the natural persons who committed the criminal offence.}

The limitation period for the criminal offences of market manipulation and insider trading is 10 years, and for investment fraud it is five years (although potential aggravating circumstances could lead to lengthier limitation periods).

The CNMV and the Bank of Spain have published two joint press statements warning about the risks resulting from investor fundraising initiatives based on virtual currencies. ^{These specifically highlighted that:}

• cryptocurrencies are unregulated instruments and are therefore not backed by any public authority and do not benefit from the legal guarantees and safeguards associated with regulated financial instruments (e.g., customer protection mechanisms);
• loss of capital investment is highly likely as cryptocurrencies lack intrinsic value and are not fiat money – they are highly speculative investments subject to extreme volatility;
• most fundraising schemes (initial coin offerings) are based on unaudited and biased information, which make minimal references to the risks and may hamper investors’ decision-making processes; and
• resolution of conflicts and prosecution of offences related to cryptocurrencies may be difficult to handle in practice given that the issuance, custody and marketing of cryptocurrencies usually occur in multiple jurisdictions.

As an example of the risks related to the lack of administrative control over cryptocurrencies, Spain’s National Court is currently investigating various apparent pyramid schemes that ostensibly affected thousands of investors.

The LMV was amended on 12 March 2021 to grant the CNMV the authority to oversee the advertising of cryptocurrencies for investment purposes (including warnings on the corresponding risks and characteristics), despite them being assets that are not covered by the scope of the LMV.

In this regard, the CNMV has recently issued Circular 1/2022 of 10 January 2022, which develops the standards, principles and criteria applicable to any advertising of cryptoassets for investment purposes – either explicit or tacit – addressed to potential investors located in Spain. Among other matters, the Circular sets the minimum requirements (both from formal and substantial standpoints) that advertising activities should meet, including the duty to warn about the risks associated with this kind of investment. The CNMV’s control powers over cryptocurrency advertising have also been clarified; for example, mass marketing campaigns (i.e., those targeting more than 100,000 investors) should be notified to the CNMV at least 10 working days prior to their execution.

Civil liability

Any investor or third party injured as a result of a breach of securities regulations has standing to bring a civil action to recover its losses on the basis of general civil law rules. The LMV establishes two specific civil actions.

The first relates to offerings in the primary securities market. In particular, the LMV states that civil liability will arise as a result of any damage caused to investors whose investment decision was made based on false information in – or material omissions from – the prospectus or any other document provided by the guarantor.

With regard to addressing the parties that may be potentially liable, Article 38 of the LMV refers to:

• the issuer, offeror or natural person who requests the securities’ admission to trading;
• the directors or board members of the legal person;
• any other legal or natural person that has accepted liability for all or part of the prospectus (whose name and acceptance of liability is stated in the prospectus);
• the guarantor of the securities; and
• the leading entity.

The second civil action relates to the secondary securities market and, particularly, to the financial information that issuers must periodically report (i.e., annual and half-yearly financial reports). According to Article 124 of the LMV, issuers and their directors are liable for any damage caused to securities holders as a result of information that failed to provide an accurate or fair assessment of the issuer.

The damages awarded to securities holders would be for actual losses suffered, given that punitive damages are not generally recognised under Spanish law.

These two civil actions would be time-barred for three years after the investor became aware – or should have become aware – of the inaccuracy of the prospectus or the periodical financial information published by the issuer.

What legal issues commonly arise in enforcement investigations?

There are several issues that may arise in the framework of securities law enforcement investigations depending on the nature and characteristics of the concrete investigation at stake, including: management of potential conflicts of interest between legal and natural persons being investigated in criminal proceedings; the duty to cooperate with authorities and the right against self-incrimination; and the scope of legal privilege in Spain and its suitability to shield the information produced within the context of internal investigations.

Conflicts of interest among legal and natural persons

Since 23 December 2010, legal persons may be held criminally liable for specific offences, provided that the following requirements are met:

1. one of the company’s directors, executives, employees or collaborators is convicted in connection with the facts under investigation;
2. the convicted director, executive, employee or collaborator acted on behalf of the company (i.e., the act or omission was connected to their corporate duties);
3. the offence was committed for the company’s direct or indirect benefit (i.e., if the offence harms the corporate interest, the entity would not be deemed criminally liable); or
4. the company lacked a culture upholding business ethics. In this regard, the company could be exempt from criminal liability if it had in place an effective compliance programme prior to the commission of the criminal offence.

Taking the above into account, if a company is deemed to be a suspect in criminal proceedings, it may, as in the case of natural persons, exercise its right of defence in various ways. The path of defence that the legal and natural persons choose would determine whether or not a conflict of interest exists among them.

By way of example, the company could attempt to prove that no criminal offence was committed or that the natural person acting on its behalf did not participate in the commission of the crime (with the goal of excluding the requirement listed in point (1)). In that scenario, it is highly likely that no conflict of interest would arise between the natural and legal persons under investigation, unless the natural person’s defence strategy was to confess the facts to authorities to reduce their sentence. By contrast, in certain cases the best defence for the legal person could be to argue that:

• the natural person did not commit the offence in the course of their corporate functions but, rather, in a personal capacity (with the goal of excluding the requirement listed in point (2));
• the offence caused damage to the corporate net worth (to exclude the requirement listed in point (3)); or
• the natural person circumvented the internal rules and controls implemented in the company to prevent the offences (to exclude the requirement listed in point (4)).

In those cases, a conflict of interest would likely arise between the legal and natural persons under investigation.

As a result of the above, the Spanish Supreme Court’s case law has carved out two main caveats to prevent conflicts of interest between legal and natural persons in the course of criminal proceedings:

• the specially designated representative of the legal entity (i.e., the specific individual who gives deposition on behalf of the company in the criminal proceedings) cannot be the person who allegedly committed the crime, with the purpose of ensuring that the defence strategy taken by the company truly pursues its best interest; ^and
• when conflicts of interest exist between legal and natural persons, they should not be defended by the same lawyer or represented by the same court representative in criminal proceedings.

Should the above situations occur, and criminal courts consider that the defendants’ fundamental right to defence was breached, the courts may declare a mistrial and order a retrial.

Cooperation with authorities and the right against self-incrimination

Article 118 of the Spanish Constitution establishes a general obligation to collaborate with judicial authorities in the course of judicial proceedings. However, Article 24 of the Constitution grants citizens the fundamental right against self-incrimination, meaning that no one can be compelled to testify against oneself or confess guilt. Likewise, the Spanish Criminal Procedural Act states that defendants have the right to remain silent and not answer any or all questions asked by authorities. Because legal persons may also be held criminally liable in Spain, companies under investigation in criminal proceedings are afforded the same right against self-incrimination as natural persons.

In this context, when companies are under investigation in criminal or administrative proceedings, a historical (and not entirely resolved) debate in Spain has been whether legal persons are obliged to answer information requests issued by authorities (a typical investigation method used in sanctioning proceedings) or may assert the right against self-incrimination on the grounds that the delivery of documentation could hinder the legal defence of the company in those proceedings.

The European Court of Human Rights has taken the position that the right against self-incrimination does not protect documents that exist ‘irrespective of the suspect’s will’ that are subject to a request by the corresponding authorities. ^{Nevertheless, it is unclear how that phrase should be interpreted in practice, and Spanish courts have not yet developed a unanimous stance on this matter. As such, there is a lot of legal uncertainty.}

In the administrative arena (and particularly in connection with tax issues), the scale generally leans in favour of the obligation to cooperate with authorities. Article 236 of the LMV states that legal entities and individuals that fall under its scope of supervision are obliged to provide the CNMV with any books, records or documents requested, regardless of their format. Failure to comply with that duty would be considered a (minor) infringement under the LMV.

In the area of criminal law, courts typically take greater efforts to reconcile the right against self-incrimination with their legal right to subpoena information, although highly disparate approaches are taken in case law. One of the most supported approaches is that the phrase ‘irrespective of the suspect’s will’ means that authorities can subpoena documents that are required by law (e.g., annual accounts) but cannot request documents that had been voluntarily drafted by the company (i.e., those that are not created as a result of a legal obligation).

By way of example, a recent decision of the Criminal Chamber of the National High Court partially reversed a decision at first instance on these grounds. ^{On the one hand, it upheld the request of certain documents considered mandatory in light of corporate and securities laws (specifically the minutes of the meetings held by internal governing bodies and disclosure of relevant facts to the CNMV). On the other hand, the Court rejected the possibility of requesting a copy of the defendant’s compliance programme because, in Spain, the non-existence or ineffectiveness of a crime prevention programme does not itself constitute a criminal offence or administrative infraction (with the Court therefore holding that it falls within the investigated companies’ defence strategy to decide on ‘their voluntary delivery in order to achieve an exemption from – or mitigation of – criminal liability’ under Article 31 bis of the SCC).}

Scope of legal privilege in internal investigations

Internal investigations, which lack specific regulation in Spain, have not traditionally played an important role in the Spanish legal system as compared with other jurisdictions. However, there has been a change in this tendency following Spain’s recognition of corporate criminal liability, and it is increasingly common for companies to conduct internal investigations as a means to carry out a thorough assessment of risks and outline the best defence strategy in the context of potential sanctioning proceedings.

This new scenario has given rise to concomitant new legal issues, such as the necessity of defining the exact scope of legal privilege in the context of internal investigations (whether it includes all work-product documents drafted exclusively for internal purposes, such as notes of the meetings and minutes of interviews, or if it only protects the final deliverable document with the outcome of the investigation).

In Spain, legal privilege (known as professional secrecy) is conceived of as both a right and a duty of lawyers to guarantee the client’s right of defence, and the scope of its definition is quite broad. Article 542.3 of the Basic Law on the Judiciary refers to ‘all facts and news’ known as a result of the lawyer’s professional activities. Likewise, Article 22.1 of the Lawyers’ General Statute of 2 March 2021 states that legal privilege encompasses ‘all facts, communications, data, information, documents and proposals’ known, issued or received in lawyers’ professional practice. Lastly, Article 5 of the Lawyers’ Deontological Code of 6 March 2019 ^{clarifies that legal privilege specifically protects any confidential information received not only from clients but also from counterparties and other colleagues, as well as any communication exchanged between lawyers (whether written or oral).}

Spanish courts have tended to limit the scope of legal privilege to that enshrined in Article 22 of the Anti-Money Laundering Law (the AML Law), which exempts lawyers from reporting obligations under certain circumstances. Specifically, according to the AML Law, legal privilege would protect any information known by lawyers for the purpose of: ascertaining the legal position of a client; and providing advice to a client with regard to ongoing or prospective legal proceedings.

Another historical grey area is whether in-house lawyers benefit from privilege. In the past, the European Court of Justice ^{ruled against recognition of legal privilege for in-house lawyers on the basis of their lack of independence given their direct tie to their client (i.e., the company) through a labour relationship. However, this restrictive approach by the European Court of Justice always referred to antitrust cases and it is therefore unclear whether it would apply to other areas. In addition, the Lawyers’ General Statute, which entered into force in 2021, expressly acknowledges the right (and professional duty) of legal privilege in favour of in-house lawyers. Although this new regulation represents an important step towards achieving legal clarity on the issue, it remains to be seen how Spanish courts will interpret the provision in practice.}

What remedies and sanctions are available to government authorities?

From the perspective of public enforcement, Spanish authorities may decide to pursue administrative sanctioning proceedings against those who have committed an infringement or, in the event the infringement potentially constitutes a criminal offence, report them to the Public Prosecutor or criminal courts to carry out a criminal investigation of those facts. The following potential sanctions could apply in either administrative or criminal proceedings.

Sanctions under administrative law

The violation of securities laws may qualify as a very serious, serious or minor infringement, which in turn leads to different degrees of sanctions. All administrative sanctions are published on the CNMV’s website and, in the case of serious and very serious infringements, also in the Spanish Official Gazette.

Very serious infringements

According to Article 302 of the LMV, very serious infringements incur a fine of up to the highest of the following amounts:

• five times the gross profit earned as a result of the infringement;
• 5 per cent of the infringer’s shareholder equity;
• 5 per cent of total funds, whether owned or borrowed, used in furtherance of the infringement;
• 10 per cent of the total annual turnover of the infringer, as calculated based on the most recently available accounts; ^or
• €5 million.

Other sanctions may also be imposed, such as:

• suspension or limitation of the type or volume of transactions that may be undertaken by the offender in the securities market for up to five years;
• suspension from membership of an official secondary market or multilateral trading facility for up to five years;
• removal of a financial instrument from trading;
• withdrawal of trade authorisations;
• removal of directors and executives for up to five years;
• professional debarment for up to 10 years, or permanently in the event of repeat infringements;
• restitution of profits; and
• suspension of the right to exercise voting rights.

Serious infringements

According to Article 303 of the LMV, serious infringements incur a fine of up to the highest of the following amounts:

• three times the gross profit earned as a result of the infringement;
• 2 per cent of the infringer’s shareholder equity;
• 2 per cent of total funds, whether owned or borrowed, used in furtherance of the infringement; or
• €300,000.

Other sanctions may also be imposed, such as:

• suspension or limitation of the type or volume of transactions that may be undertaken by the offender in the securities market for up to one year;
• suspension from membership of an official secondary market or multilateral trading facility for up to one year;
• withdrawal of authorisations to trade for up to five years;
• suspension of directors and executives for up to one year;
• professional debarment from office for up to seven years or 10 years in the event of repeat infringements; and
• restitution of profits.

Minor infringements

According to Article 305 of the LMV, minor infringements incur a fine of up to €30,000.

Sanctions under criminal law

Investment fraud is punishable by imprisonment of up to four years. If the damage caused is serious, the offence can be punishable by one to six years of imprisonment and a fine of up to €144,000.

Market manipulation is punishable by imprisonment of up to six years, fines of up to €720,000 or three times the profit earned if the resulting amount is higher, and debarment from trading on the financial market as a principal, agent, broker or analyst for up to five years.

Insider trading is punishable by imprisonment of up to six years, fines of up to €720,000 or three times the profit earned if the resulting amount is higher, and debarment from the exercise of a profession or activity for up to five years.

Unlawful disclosure of inside information is punishable by imprisonment of up to four years, fines of up to €288,000 and debarment from the exercise of a profession or activity for up to three years.

For legal persons, the penalty would be a fine of between €21,600 and €9 million or, if the resulting amount is higher, a fine ranging from three to five times the profit earned (the final amount would depend on the company’s economic capacity).

In addition to the general penalties outlined above, companies could face additional penalties established in Article 33.7(b) to (g) of the SCC, including:

• the winding up of the legal person;
• suspension of the company’s activities for up to five years;
• closure of the business premises and establishments for up to five years;
• temporary or permanent debarment from carrying out the activity that aided or concealed the criminal offence;
• prohibition from receiving public subsidies, contracting with Spanish public authorities or obtaining Spanish tax or social security benefits and incentives for up to 15 years; and
• the judicial intervention of the company to safeguard employees’ and creditors’ rights for up to five years.

However, pursuant to Spanish case law, the harshest of these penalties (such as winding up the legal person) is generally restricted to exceptional cases, primarily those concerning criminal organisations.

Footnotes