SMEs often reach criminal law without compliance: off-books collection, a partner signing alone, an employee taking commissions outside cash, an inspection uncovering invoice chains. A criminal programme is not marketing; it is documentary order and traceable decisions. This analysis proposes the minimum viable we use with Madrid clients: risk map, three protocols and what to do the day police or the tax authority calls.
Why it matters for SMEs
Less separation between owner and cash: offence often hits director and company together.
Suppliers and clients import risk: invoices, subcontractors, international commissions.
Legal entity criminal liability exists; “we did not know” defence requires having tried to prevent.
One criminal incident freezes accounts, licences and financing.
Minimum risk map
Treasury: who signs, limits, dual control on material transfers.
Invoicing and suppliers: verification of atypical operations.
Labour and social security: contribution and hours fraud.
Data and commercial bribery: gifts, intermediaries, tenders.
Three protocols that work
Internal alert channel with documented response —not a decorative mailbox.
Gifts and conflicts policy signed by decision-makers.
Checklist for hiring and paying third parties in sensitive deals.
Brief annual review with counsel: update the map, do not archive PDFs.
If there is an investigation
Designate one interlocutor; ban panic-driven destruction of documents and messages.
Counsel before statements at administrative or police premises.
Sober internal communication: rumours leak and contaminate.
Assess self-reporting only with judgement; it is not automatic.
What we ask to start
Activity, corporate structure, volume and client sectors.
Prior incidents: inspections, reports, litigation.
Who signs banking and invoicing today.
With that we deliver a proportional map and protocols —implementable in weeks, not a year.