The amendment to the Criminal Code introduced in 2010 brought as its main innovation the possibility for legal entities to be held criminally liable. This regulation was further developed and clarified by Organic Law 1/2015 amending the Criminal Code.

Under these Criminal Code reforms, a legal entity can now be held criminally liable for certain offenses committed in its name or on its behalf and for its benefit, by its legal representatives or by individuals authorized to make decisions on behalf of the entity or who hold organizational and control powers within it. Likewise, the legal entity may also be criminally liable for certain offenses committed by individuals under the authority of the aforementioned persons, if the latter have seriously failed in their duties of supervision, oversight, and control of their activities.

In such cases, the Criminal Code provides for various types of penalties that may be imposed on legal entities: fines, dissolution of the legal entity, suspension of its activities, closure of its premises, prohibition from carrying out activities in which the offense was committed, facilitated, or concealed, disqualification from receiving public subsidies and aid, from contracting with the public sector, and from enjoying tax or Social Security benefits and incentives, or judicial intervention. According to the Criminal Code, in order to avoid the imposition of such penalties, the legal entity must have implemented a Criminal Risk Prevention Program, that is, an organizational and management model that includes effective monitoring and control measures to prevent the commission of crimes within the organization.