Global Investigations Review – The Guide to International Enforcement of the Securities Laws

• Royal Decree 2119/1993 of 3 December on the sanctioning procedure applicable to securities-market operators;
• Royal Decree 948/2001 of 3 August on the compensation system for investors;
• Royal Decree 1310/2005 of 4 November on public securities offerings and admission to trading of securities on official secondary markets;
• Royal Decree 1066/2007 of 27 July on takeover bids;
• Royal Decree 1362/2007 of 19 October on transparency requirements;
• Royal Decree 217/2008 of 15 February on investment services companies;
• Circular 10/2008 of 30 December on financial advisory firms;
• Order EHA/1717/2010 of 11 June on the regulation and control of marketing activities involving investment services and products;
• Order ECC/461/2013 of 20 March on corporate governance information to be published by listed entities;
• Circular 1/2018 of 12 March on warnings relating to financial instruments; and
• Royal Decree 739/2019 of 20 December on payment services and payment institutions.

Other sources of norms on securities and financial markets include the Spanish Corporation Act, consumer protection legislation (such as Law 22/2007 of 11 July on the distance marketing of financial services for consumers) and the Spanish Criminal Code (SCC).

The main supervisory body on matters pertaining to securities and financial markets is the CNMV, which is a public entity with independent legal personality. Its functions are to:

• ensure transparency of securities markets, the correctness of price formation and the protection of investors;
• monitor and oversee the functioning of securities markets, with the authority to punish any infringement committed by legal or natural persons operating in them;
• advise the Spanish government and the Ministry of Economy in connection with the exercise of their respective regulatory powers;
• issue circulars to elaborate on and enforce specific matters established in legislation (i.e., the CNMV is not itself entitled to create new duties or obligations but develops specific provisions approved by the Spanish government and the Ministry of Economy); and
• publish guidelines for market operators with the goal of promoting sufficient compliance with the rules and standards of conduct on securities and financial markets.

What conduct is most commonly the subject of securities enforcement?

Litigation related to the enforcement of securities laws has significantly increased over the past decade as a result of the challenges caused by the financial crisis of 2008–2012.

The types of conduct subject to securities enforcement depend on the specific area of law. The following are three different approaches from administrative, criminal and civil law perspectives.

Administrative liability

Any breach of regulations related to the organisation or control of securities markets may give rise to liability under administrative law (Article 271 LMV). This will involve not only infringements of the provisions of the LMV but also those of any other legal framework on the matter approved by the European Union, the Spanish government, the Ministry of Economy and the equivalent bodies of the Spanish autonomous regions, as well as circulars issued by the CNMV.

Consequently, the range of conduct that is potentially punishable in the area of administrative law is exceedingly broad. For example, misconduct may relate to breaches of registration and licensing duties; classification and evaluation of clients; implementation of proceedings on corporate governance; and disclosure obligations regarding relevant facts, periodic financial information, the acquisition of significant stakes and treasury stock, etc.

Depending on the specific circumstances of the case, misconduct may qualify as a minor, serious or very serious infringement (Articles 277 to 300 LMV) and there is a corresponding range of sanctions (see ‘What remedies and sanctions are available to government authorities?’).

Administrative actions are time-barred five years (for serious and very serious infringements) or two years (for minor infringements) from the day on which the punishable act was committed.

Criminal liability

Although a broad range of criminal offences can potentially be committed in connection with listed companies and financial markets (such as public and private corruption, money laundering, fraud, false accounting and negligent insolvency), the main securities-related offences are the following.

• Investment fraud (Article 282 bis SCC): directors of an issuer of securities who forge the economic-financial information contained in a prospectus or any other information that the company must make public pursuant to securities regulations with the goal of attracting investors or obtaining financing by any means. The mere possibility of causing damage is punishable under this criminal offence (i.e., it is not necessary to prove actual damage for a conviction).

Although only company directors can commit the criminal offence of investment fraud as perpetrators, third parties that contribute to the misconduct can also be held criminally liable as necessary collaborators or accomplices.

• Market manipulation (Article 284 SCC): whoever alter prices (1) by means of violence, intimidation or deceit, (2) through the spread of rumours that provide false or misleading economic information about securities issuers or natural persons linked to them, or (3) by means of carrying out transactions or issuing trading orders that provide false or misleading information about the supply, demand or price of a financial instrument.

The actions described in points (2) and (3) will be punishable under criminal law if any of the following circumstances exist: the profit earned or the damage caused exceeds €250,000; the value of the funds used exceeds €2 million; or the integrity of the market was significantly impacted.

• Insider trading (Article 285 SCC): whoever, directly or through an intermediary, (1) acquires, transfers or assigns a financial instrument, or cancels or modifies a securities order by means of using inside information, or (2) recommends that a third party use the inside information to carry out any of the above acts, subject to the condition that at least one of the following circumstances occurs: the profit earned or the damage caused exceeds €500,000; the value of the funds used exceeds €2 million; or the integrity of the market was significantly impacted.
• Unlawful disclosure of inside information (Article 285 bis SCC): whoever has legitimate access to inside information and discloses it outside the normal course of his or her functions, endangering the market’s integrity or investors’ trust.

All the above criminal offences require intent – or at least knowledge – to meet the requirement of mens rea; a mere lack of diligence is not penalised under Spanish criminal law.

Generally, these types of criminal proceedings generally target corporate directors, top executives and any other collaborators who significantly contributed to the commission of the crime. However, pursuant to the principle of culpability, individuals may only be held criminally liable for their own acts or omissions – the SCC does not recognise vicarious or strict criminal liability. As such, in practice, the actual defendants would depend on the specific circumstances of the case.

In the Bankia case, top officials in the CNMV and the Bank of Spain were also investigated in the preliminary stage of the criminal proceedings (they were alleged to have authorised Bankia’s initial public offer despite being aware that the prospectus was factually misleading). However, the judge decided to dismiss the proceedings against them and they were ultimately not charged with any crime.

Companies can be held liable for the securities-related offences indicated above if it is proven that the misconduct was committed on their behalf – and for their direct or indirect benefit – by their directors, executives, employees or collaborators (Articles 288 and 31 bis SCC). It is important to take into consideration that corporate criminal liability is not alternative to (but is instead cumulative with) that of the natural persons who committed the criminal offence.

The limitation period for the criminal offences of market manipulation and insider trading is 10 years and for the criminal offence of investment fraud it is five years (although potential aggravating circumstances could lead to a lengthier limitation period).

• cryptocurrencies are unregulated instruments and are therefore not backed by any public authority and do not benefit from the legal guarantees and safeguards associated with regulated financial instruments (e.g., customer-protection mechanisms);
• loss of capital investment is highly likely as cryptocurrencies lack intrinsic value and are not fiat money – they are highly speculative investments subject to extreme volatility;
• most fundraising schemes (initial coin offerings) are based on unaudited and biased information, which make minimal references to the risks and may hamper investors’ decision-making processes; and
• resolution of conflicts and prosecution of offences related to cryptocurrencies may be difficult to handle in practice given that the issuance, custody and marketing of cryptocurrencies usually occur in multiple jurisdictions.

As an example of the risks related to the lack of administrative control over cryptocurrencies, Spain’s National Court is currently investigating various apparent pyramid schemes that ostensibly affected thousands of investors.

The LMV was amended on 12 March 2021 to grant the CNMV the authority to oversee the advertising of cryptocurrencies for investment purposes (including warnings on the corresponding risks and characteristics), despite them not being assets covered by the scope of the LMV. The CNMV is currently drafting a circular aimed at developing the standards, principles and criteria applicable to advertising activities related to cryptoassets.

Civil liability

Any investor or third party injured as a result of a breach of securities regulations has standing to bring a civil action to recover its losses on the basis of general civil law rules. That being said, the LMV establishes two specific civil actions.

The first relates to offerings in the primary securities market. In particular, the LMV states that civil liability will arise as a result of any damage caused to investors whose investment decision was made having relied on false information in – or material omissions from – the prospectus or any other document that the guarantor prepares. With regard to addressing the parties that may be potentially liable, Article 38 of the LMV refers to (1) the issuer, offeror or natural person who requests the securities’ admission to trading, (2) the directors or board members of the legal person, (3) any other legal or natural person that has accepted liability for all or part of the prospectus and that circumstance is stated in the prospectus, (4) the guarantor of the securities and (5) the leading entity

The second civil action relates to the secondary securities market and, particularly, to the financial information that issuers must periodically report (i.e., annual and half-yearly financial reports). According to Article 124 of the LMV, issuers and their directors are liable for any damage caused to holders of the securities as a result of information that failed to provide an accurate, fair assessment of the issuer.

The damages awarded to holders of securities would be for actual losses suffered, given that punitive damages are not generally recognised under Spanish law.

These two civil actions would be time-barred three years after the date that the investor became aware – or should have become aware of – the inaccuracy of the prospectus or the periodical financial information published by the issuer, respectively.

What legal issues commonly arise in enforcement investigations?

There are several issues that may arise in the framework of securities law enforcement investigations depending on the nature and characteristics of the concrete investigation at stake. We analyse below some aspects that, in our view, are particularly relevant when dealing with these types of investigations, namely (1) management of potential conflicts of interest between legal and natural persons being investigated in criminal proceedings, (2) the duty to cooperate with authorities and the right against self-incrimination, and (3) the scope of legal privilege in Spain and its suitability to shield the information produced within the context of internal investigations.

Conflicts of interest among legal and natural persons

Since 23 December 2010, legal persons may be held criminally liable for specific offences, provided that the following requirements are met:

• one of the company’s directors, executives, employees or collaborators is convicted in connection with the facts under investigation;
• the convicted director, executive, employee or collaborator acted on behalf of the company (i.e., the act or omission was connected to his or her corporate duties);
• the offence was committed for the company’s direct or indirect benefit (i.e., if the offence harms the corporate interest, the entity would not be deemed criminally liable); or
• the company lacked a culture upholding business ethics. In this regard, the company could be exempt from criminal liability if it had in place an effective compliance programme prior to the commission of the criminal offence

Taking the above into account, if a company is deemed to be a suspect in criminal proceedings, it may, as in the case of natural persons, exercise its right of defence in various ways. The path of defence the legal and natural persons choose would determine whether or not a conflict of interest exists among them.

By way of example, the company could attempt to prove that no criminal offence was committed or that the natural person acting on its behalf did not participate in the commission of the crime (with the goal of excluding the first requirement listed above). In that scenario, it is highly likely that no conflict of interest would arise between the natural and legal persons under investigation, except if the natural person’s defence strategy was to confess the facts to authorities in order to reduce his or her sentence.

By contrast, in certain cases the best defence for the legal person could be to argue that the natural person did not commit the offence in the course of his or her corporate functions but in his or her personal capacity (with the goal of excluding the second requirement); that the offence caused damage to the corporate net worth (to exclude the third requirement); or that the natural person circumvented the internal rules and controls implemented in the company to prevent such offences (to exclude the fourth requirement). In those cases, a conflict of interest would likely arise between the legal and natural persons under investigation.

As a result of the above, the Spanish Supreme Court’s case law has carved out two main caveats to prevent conflicts of interest between legal and natural persons in the course of criminal proceedings:

Should those situations occur and criminal courts consider that the defendants’ fundamental right to defence was breached, they may declare a mistrial and order to retry the case.

Cooperation with authorities and the right against self-incrimination

Article 118 of the Spanish Constitution establishes a general obligation to collaborate with judicial authorities in the course of judicial proceedings. However, Article 24 of the Constitution grants citizens the fundamental right against self-incrimination, meaning that no one can be compelled to testify against oneself or confess guilt. Likewise, the Spanish Criminal Procedural Act states that defendants have the right to remain silent and not answer any or all questions asked by authorities. Since legal persons may also be held criminally liable in Spain, companies under investigation in criminal proceedings are afforded the same right against self-incrimination as natural persons (Article 786 bis of the Spanish Criminal Procedural Act).

In this context, when companies are under investigation in criminal or administrative proceedings, a historical (and not entirely resolved) debate in Spain has been whether legal persons are obliged to answer information requests issued by authorities (a typical investigation method used in sanctioning proceedings) or may assert the right against self-incrimination on the grounds that the delivery of documentation could hinder the legal defence of the company in those proceedings.

In the administrative arena (and particularly in connection with tax issues), the scale generally leans in favour of the obligation to cooperate with authorities. Article 236 of the LMV states that legal entities and individuals that fall under its scope of supervision are obliged to provide the CNMV with any books, records or documents requested, regardless of their format. Failure to comply with that duty would be considered a (minor) infringement under the LMV.

In the area of criminal law, courts typically took greater efforts to reconcile the right against self-incrimination with their legal right to subpoena information, although highly disparate approaches are taken in case law. One of the most supported approaches is that the phrase ‘irrespective of the suspect’s will’ means that authorities can subpoena documents that are required by law (e.g., annual accounts) but cannot request documents that had been voluntarily drafted by the company (i.e., those that are not created as a result of a legal obligation).

By way of example, the recent decision of the Criminal Chamber of the National High Court 391/2021 dated 1 July 2021 partially reversed a decision at first instance on the grounds on this stance. On the one hand, it upheld the request of certain documents considered mandatory in light of corporate and securities laws (specifically the minutes of the meetings held by internal governing bodies and disclosure of relevant facts to the CNMV). On the other hand, the National High Court rejected the possibility of requesting from the defendant a copy of its compliance programme since, in Spain, the non-existence or ineffectiveness of a crime-prevention programme does not itself constitute a criminal offence or administrative infraction (with the National High Court therefore holding that it falls within the investigated companies’ defence strategy to decide on ‘their voluntary delivery in order to achieve an exemption from – or mitigation of – criminal liability’ under Article 31 bis SCC).

Scope of legal privilege in internal investigations

Internal investigations, which lack specific regulation in Spain, have not traditionally played an important role in the Spanish legal system as compared with other jurisdictions. However, there has been a change in this tendency following Spain’s recognition of corporate criminal liability, and it is increasingly common for companies to conduct internal investigations as a means to carry out a thorough assessment of risks and outline the best defence strategy in the context of potential sanctioning proceedings.

This new scenario has given rise to concomitant new legal issues, such as the necessity of defining the exact scope of legal privilege in the context of internal investigations (whether it includes all work-product documents drafted exclusively for internal purposes, such as notes of the meetings and minutes of interviews, or if it only protects the final deliverable document with the outcome of the investigation).

Spanish courts have tended to limit the scope of legal privilege to that enshrined in Article 22 of the Anti-Money Laundering Law (the AML Law), which exempts lawyers from reporting obligations under certain circumstances. Specifically, according to the AML Law, legal privilege would protect any information known by lawyers with the purpose of (1) ascertaining the legal position of a client and (2) providing advice to a client with regard to ongoing or prospective legal proceedings.

What remedies and sanctions are available to government authorities?

From the perspective of public enforcement, Spanish authorities may decide to pursue administrative sanctioning proceedings against those who have committed an infringement or, in the event the infringement potentially constitutes a criminal offence, report them to the Public Prosecutor or criminal courts to carry out a criminal investigation of those facts.

The following are descriptions of potential sanctions that could apply in either administrative or criminal proceedings.

Sanctions under administrative law

As explained above, the violation of securities laws may qualify as a very serious, serious or minor infringement, which in turn leads to different degrees of sanctions. All administrative sanctions are published on the CNMV’s website and, in the case of serious and very serious infringements, also in the Spanish Official Gazette.

Very serious infringements

According to Article 302 of the LMV, very serious infringements incur a fine of up to the highest of the following amounts:

Other sanctions may also be imposed, such as:

• suspension or limitation of the type or volume of transactions that may be undertaken by the offender in the securities market for up to five years;
• suspension from membership of an official secondary market or multilateral trading facility for up to five years;
• removal of a financial instrument from trading;
• withdrawal of trade authorisations;
• removal of directors and executives for up to five years;
• professional debarment for up to 10 years, or permanently in the event of repeat infringements;
• restitution of profits; and
• suspension of the right to exercise voting rights.

Serious infringements

According to Article 303 of the LMV, serious infringements incur a fine of up to the highest of the following amounts:

Other sanctions may also be imposed, such as:

• suspension or limitation of the type or volume of transactions that may be undertaken by the offender in the securities market for up to one year;
• suspension from membership of an official secondary market or multilateral trading facility for up to one year;
• withdrawal of authorisations to trade for up to five years;
• suspension of directors and executives for up to one year;
• professional debarment from office for up to seven years or 10 years in the event of repeat infringements; and
• restitution of profits.

Minor infringements

According to Article 305 of the LMV, minor infringements incur a fine of up to €30,000.

Sanctions under criminal law

• Investment fraud is punishable by imprisonment of up to four years. If the damage caused is serious, the offence can be punishable by one to six years of imprisonment and a fine of up to €144,000.
• Market manipulation is punishable by imprisonment of up to six years, fines of up to €720,000 or three times the profit earned if the resulting amount is higher, as well as debarment from trading on the financial market as a principal, agent or broker, or analyst for up to five years.
• Insider trading is punishable by imprisonment of up to six years, fines of up to €720,000 or three times the profit earned if the resulting amount is higher, as well as debarment from the exercise of a profession or activity for up to five years.
• Unlawful disclosure of insider information is punishable by imprisonment of up to four years, fines of up to €288,000 and debarment from the exercise of a profession or activity for up to three years.

For legal persons, the penalty would be a fine of between €21,600 and €9 million or, if the resulting amount is higher, a fine ranging from three to five times the profit earned (the final amount would depend on the company’s economic capacity).

In addition to the general penalties outlined above, companies could face additional penalties established in Article 33.7 (b) to (g) of the SCC, including:

• the winding up of the legal person;
• suspension of its activities for up to five years;
• closure of the business premises and establishments for up to five years;
• temporary or permanent debarment from carrying out the activity that aided or concealed the criminal offence;
• prohibition from receiving public subsidies, contracting with Spanish public authorities or obtaining Spanish tax or social security benefits and incentives for up to 15 years; and
• the judicial intervention of the company to safeguard employees’ and creditors’ rights for up to five years.

However, pursuant to Spanish case law, the harshest of such penalties (such as winding up the legal person) is generally restricted to exceptional cases, primarily those concerning criminal organisations.

Footnotes