On 24 April 2025, the revised version of UNE 19601 Standard on Management System for Criminal Compliance (“UNE 19601“) was published, replacing the previous version from 2017. UNE 19601 is the reference standard in Spain for implementing a criminal compliance management system and it covers the requirements of the Spanish Penal Code as well as international standards in the field.
The general approach of the initial version is maintained, although modifications have been introduced to adapt it to regulatory changes (primarily, those in the Spanish Penal Code and whistleblowing management standards) and international standards of recent years (such as ISO 37301:2021 or ISO 37002:2021). Notable changes include:
- Leadership: Responsibilities of the criminal compliance body are defined and clarified, differentiating between activities that fall under its direct responsibility and those for which it should only exercise oversight.
- Training and awareness: Training activities are specifically targeted at members of the organization with prominent roles in processes exposed to greater than low risk (i.e., for the performance of their functions). In contrast, awareness activities, with a broader focus, are aimed at other members of the organization and business partners.
- Financial investments in other entities: Controls are rationalized to exclude them when the relationship is purely that of a shareholder without control capacity.
- Communication of non-compliance and irregularities: The possibility for whistleblowers to be legal entities is expressly introduced. Additionally, the prohibition of retaliation is expanded to include any “detrimental conduct”, a broader concept, that now covers both the whistleblower and related subjects. Furthermore, investigations are to be conducted not only when communications are received but also when there are indications of non-compliance or irregularities through other means.
- Criminal compliance culture: A new way of recognizing criminal compliance culture is defined and developed, which now also takes into account the opinions of interested parties.
- General terms: It takes into consideration the Harmonized Structure (HS) of ISO for management systems, to facilitate the integration of criminal compliance management systems with other ISO management systems.
In short, while the essential structure and content of UNE 19601 are maintained, this new version of the standard presents an excellent opportunity for entities that already have a criminal compliance management system adapted to the standard to review and update it, and for those that do not yet have such a model, this is an encouraging time to implement it. Among many other benefits, organizations that effectively implement a criminal compliance management system can see their criminal liability mitigated or even exempted.
