Spain steps up its anti-corruption framework: What companies can expect

Several institutional, procedural, and policy initiatives have reshaped the anti-corruption landscape in Spain over the last year, including the launch of the Independent Whistleblower Protection Authority (IWPA), the planned reform of the criminal procedure model, and the adoption of a State Anti-Corruption Plan.

While these developments arise from different regulatory and institutional contexts, they collectively indicate a potentially stronger enforcement environment in Spain with increased expectations for corporate compliance systems going forward.

In this article, discuss key considerations for companies.

The IWPA: Powers and obligations for companies

The IWPA began operating on September 1, 2025 as the administrative body responsible for supervising Spain’s whistleblower protection framework under Act 2/2023, the Spanish Whistleblower Protection Act (SWPA).

The SWPA introduced a key requirement for obliged entities[1] to notify the IWPA of the appointment or removal of the individual or body responsible for their internal reporting system within ten working days.

Although this obligation already existed, it remained suspended in practice until February 10, 2026, when the IWPA issued the official notification form allowing entities to comply. The IWPA has clarified that, at national level, this notification obligation applies only to companies that:

• Have establishments in more than one Spanish autonomous region (Comunidades Autónomas), or
  
  
• Operate in an autonomous region that has not created a regional whistleblower protection authority with powers over private entities.

Companies may also be subject to notification requirements before regional authorities, where they exist. As a result, determining the competent authority may require a case-by-case assessment depending on the company’s territorial presence in Spain.

Beyond these formal notification obligations, the IWPA is expected to play a central role in the enforcement of the whistleblower protection regime. Among other functions, the IWPA will:

• Handle reports submitted through the external reporting channel available to individuals who choose not to use internal corporate channels, and
  
  
• Exercise sanctioning powers for breaches of the SWPA (i.e., not implementing mandatory reporting systems, breaching confidentiality obligations, or retaliating against reporting individuals).

For companies, the creation of the IWPA marks the transition from a primarily formal compliance requirement to a framework with an active supervisory authority. In practical terms, this increases the importance of ensuring that whistleblowing systems are not only formally adopted, but also operational, accessible, and properly documented.

In addition, governance decisions (such as the designation of the reporting-system manager, the definition of reporting protocols, and the structure of internal investigation procedures) are becoming increasingly relevant from both a compliance and enforcement perspective.

In this context, on January 14, 2026, the IWPA published a set of guidelines aimed at addressing interpretative questions regarding the implementation of internal reporting systems. Although these guidelines are not mandatory, they provide practical direction to organizations subject to the SWPA and are likely to serve as a reference point in future supervisory and inspection activities carried out by the IWPA.

In practical terms, the guidelines highlight several key considerations for companies, including:

• Formally appointing a reporting system manager or collegiate body and notifying the appointment to the competent authority (international groups with establishments in Spain may centralize this role at a group level, but each Spanish entity must formally designate the manager and ensure compliance with the SWPA)
  
  
• Adopting a formal whistleblowing policy and investigation procedure, clearly defining how reports are received, acknowledged, investigated, and resolved
  
  
• Ensuring that the whistleblowing policy is accessible and properly communicated to employees and other individuals with a professional relationship with the organization
  
  
• Implementing a secure reporting channel through an end-to-end encrypted platform, capable of receiving reports without allowing the direct or indirect identification of the reporting individual and ensuring traceability of actions taken
  
  
• Allowing reports to be submitted both in writing and verbally (e.g., through a secure platform, email, telephone, voice message, or in-person meeting)
  
  
• Integrating all internal reporting channels under a single governance framework and system manager, even where multiple complaint channels exist within the organization (e.g., human resources or harassment reporting channels)
  
  
• Maintaining a communications and investigations register, recording at least the date of receipt, subject matter of the report, status of the investigation, and closing date
  
  
• Providing training to employees on the existence and use of the reporting system and ensuring the channel is visible and easily accessible on the company’s website
  
  
• Consulting employee representatives before implementing the system, where applicable

Reform of the Spanish Criminal Procedure model

Spain is preparing a major reform of its criminal procedure framework that would reshape how criminal investigations are conducted.

The reform would transfer responsibility for leading investigations from investigating judges to public prosecutors, while courts would retain a supervisory role focused on protecting procedural rights and authorizing intrusive investigative measures.

If adopted, this reform would represent one of the most significant structural changes to Spain’s criminal justice system in decades and would align the Spanish investigative model more closely to other European jurisdictions.

For companies, this reform may have several practical implications for corporate investigations, including:

• Closer interaction with prosecutors during the investigative stage of the proceeding
  
  
• Increased strategic relevance of internal investigations and early cooperation decisions, and
  
  
• Broader and more frequent use of interim measures (such as asset freezes) that may affect business operations at an early stage of the proceedings.

The reform is still pending parliamentary approval and its final timeline remains uncertain. Nevertheless, if adopted, companies operating in Spain are encouraged to anticipate a more prosecution-driven investigative environment in the medium term, particularly in complex economic crime and corruption cases.

Spain’s Anti-Corruption Plan and the Draft Public Integrity Act: Increased compliance pressure for companies

In July 2025, the Spanish government approved a State Anti-Corruption Plan aimed at strengthening prevention, detection, investigation, and sanctioning mechanisms across both the public and private sectors.

The plan responds to recommendations from international bodies – such as the Organization for Economic Co-operation and Development (OECD), the Group of States against Corruption (GRECO), and the European Commission – and is intended to create a more coordinated national integrity framework.

In late February 2026, the Spanish government approved the Draft Organic Public Integrity Act (DOPIA), one of the main legislative pillars of the State Anti-Corruption Plan.

The DOPIA introduces a broad package of institutional, criminal-law, and public-procurement reforms aimed at strengthening corruption prevention, detection, and enforcement across the public sector, with relevant effects for private companies (particularly those interacting with public administrations).

From a corporate compliance and risk-management perspective, the draft law points to several developments that may be worth monitoring:

• Stronger criminal consequences for corruption-related conduct: The draft proposes amendments to the Criminal Code – including longer limitation periods for corruption offenses (from five to seven years), longer disqualification periods (up to 20 years), and increased penalties for legal entities – and new aggravated obstruction-of-justice provisions in corruption cases.
  
  
• Expanded asset-recovery tools: The reform introduces mechanisms aligned with European Union asset-recovery legislation, including non-conviction-based confiscation mechanisms, confiscation of unexplained wealth, and strengthened powers for the Asset Recovery and Management Office (ORGA).
  
  
• Greater scrutiny in public procurement and subsidies: The draft law includes several measures aimed at increasing transparency and control in public spending, including 1) public access to the register of companies prohibited from contracting with public administrations, 2) broader use of conflict-of-interest declarations (DACI), 3) expansion of data-analysis tools in public procurement and subsidy controls, and 4) increased coordination between oversight bodies.
  
  
• Use of technology in anti-fraud detection: The reform promotes the use of data analytics, interoperability tools, and artificial intelligence to detect irregular patterns in public contracting and subsidies.
  
  
• Creation of a new Public Integrity Agency: The draft law provides for the creation of a Public Integrity Agency, which would integrate the Office of Conflicts of Interest, the Independent Whistleblower Protection Authority, and the National Anti-Fraud Coordination Service.
  
  
• Stronger whistleblower protection framework: The draft reinforces the whistleblower protection regime by strengthening protections against retaliation, expanding recognition of protected people, and linking reporting systems to broader integrity and compliance structures within public entities.

The DOPIA supports Spain’s policy direction toward stronger anti-corruption enforcement, enhanced institutional coordination, and greater transparency for public–private interactions.

For companies operating in Spain, monitoring the legislative process and preparing for potential implementation will be key in the coming years.

Moving forward

The above developments reflect a gradual but clear strengthening of Spain’s anti-corruption enforcement ecosystem. The creation of a supervisory whistleblowing authority, the likely transition to a prosecutor-led investigative model with higher opportunities for collaboration and early agreements, and the policy direction set by the State Anti-Corruption Plan reinforce the importance of robust compliance frameworks and well-defined internal investigation processes.

For more information, please contact the authors.

 

^{[1] Companies with more than 50 employees, together with entities operating in certain regulated sectors (regardless of the number of employees) such as financial institutions, insurance companies, and entities subject to anti-money laundering regulations}