Criminal compliance for cannabis associations and CBD businesses
Crime prevention programmes (article 31 bis of the Spanish Criminal Code) for cannabis social clubs, CBD and hemp shops and companies, designed by criminal lawyers specialised in cannabis.
Our cannabis criminal compliance service helps cannabis associations and CBD businesses in Spain prevent offences and prove it if an investigation begins. The Spanish Criminal Code allows the legal person itself, including an association, to be convicted of drug trafficking offences (article 369 bis), and the way to be exempted or to reduce the penalty is to have implemented an effective prevention model beforehand (article 31 bis). We have spent 14 years defending the cannabis sector: we know where cases start and we design the programme to close those risks.
Quick summary
- A cannabis association is a legal person: it can be investigated and convicted as such, in addition to its directors.
- Article 369 bis of the Criminal Code provides for fines of up to five times the value of the drug for the legal person, and other penalties such as suspension of activities, closure of premises or dissolution.
- A prevention model adopted before the offence and effectively applied can exempt the entity from liability; if it is implemented afterwards, it can mitigate it.
- We tailor it to you: risk map, protocols for members, dispensing and stock, CBD product compliance, training, compliance officer and internal reporting channel.
What we do
What our criminal compliance programme includes
Criminal risk map
We analyse how your club or business really works and identify the activities in which an offence could be committed: drug trafficking, money laundering, public health, tax or labour offences.
Member, dispensing and stock protocols
For clubs: member admission, consumption forecasts, records of each withdrawal, control of cultivation and stock, cash management and an inspection protocol.
CBD product compliance
For CBD and hemp businesses: classification of each product, THC limits, labelling, novel foods, cosmetics, suppliers and certificates of analysis.
Training
We train the board, the people in charge of dispensing or of the shop and the staff so they know what they can do, what they cannot and how to act when an incident occurs.
Compliance officer and internal channel
We help you appoint the compliance officer or supervisory body and set up an internal reporting channel suited to your size.
Periodic review
We review the programme when the law, the activity or the structure changes, and when a relevant breach is detected, as the Criminal Code itself requires.
Criminal liability of cannabis associations and CBD businesses
Since 2010 the Spanish Criminal Code has recognised the criminal liability of legal persons. Under article 31 bis, an entity is liable for offences committed on its behalf and for its benefit by its directors or representatives, and also for those committed by its employees or collaborators when the entity has failed to exercise due control over them. Only public administrations and public entities are excluded (article 31 quinquies), so a non-profit cannabis association is also a legal person for these purposes, just like a limited company that sells CBD.
Not every offence gives rise to liability of the legal person, but the ones that worry the sector most do: article 369 bis provides for it in the drug trafficking offences of articles 368 and 369. The penalties are fines calculated in years or on the value of the drug, which can reach five times that value, and the judge may also order dissolution, suspension of activities, closure of premises or a ban on certain activities. The Spanish Supreme Court convicted companies for the first time in a drug trafficking case in judgment 154/2016 of 29 February, and since then it has stressed the importance of a culture of compliance within the entity.
What the law requires from a prevention model
Article 31 bis.5 sets out the minimum requirements of an organisation and management model. A valid compliance programme must:
- Identify the activities in which the offences to be prevented may be committed.
- Establish protocols or procedures on how decisions are taken and carried out.
- Have financial resource management models suitable for preventing offences.
- Impose the obligation to report risks and breaches to the body that supervises the model.
- Establish a disciplinary system that penalises failure to comply with the measures.
- Be checked periodically and amended when there are relevant breaches or changes in the organisation or the activity.
The Spanish Public Prosecutor’s Office explains how it assesses these models in its Circular 1/2016: what counts is that the programme is genuinely applied, not that it exists on paper.
Preventing criminal risks in a cannabis club
In a cannabis association, criminal compliance has a very specific purpose: to make sure the club operates within the shared consumption criteria set by the Spanish Supreme Court and can prove it with documents. A compliance programme does not make an unlawful activity lawful, but it organises day-to-day operations and leaves a record of every decision. The protocols we usually prepare are:
- Member admission: written criteria (legal age, being an existing consumer, access without recruitment or advertising) and documented checks.
- Consumption forecast and dispensing: expected quantities per member, a record of each withdrawal, consumption on the premises and measures for unusual withdrawals.
- Cultivation and stock: traceability from the plant to dispensing, periodic inventories and management of surpluses and losses.
- Money: fees, contributions and payments with receipts, limits on cash and accounts that reflect the absence of profit.
- Inspections and searches: what to do if the police or an inspector arrives, who to call and what documents to hand over.
- Disciplinary rules: internal sanctions, up to expulsion, for members who resell or take cannabis out of the club.
This work fits with our service of lawyers for cannabis social clubs and with monthly legal advice for cannabis associations, which keeps the programme up to date.
Compliance for CBD and hemp businesses
In a CBD shop, brand or distributor, the most serious criminal risk arises when a product is considered a narcotic or a controlled substance. That is why compliance for CBD businesses combines criminal prevention with product compliance:
- THC limits: the 0.3% threshold refers to growing certified hemp varieties; foods made from hemp seed have their own limits in Regulation (EU) 2023/915, and flowers are the highest-risk product.
- Novel foods: CBD for ingestion is still not authorised as a novel food in the EU (Regulation (EU) 2015/2283).
- Cosmetics: notification in the CPNP portal, a responsible person, a safety file and CBD from an accepted source (Regulation (EC) 1223/2009).
- Labelling and advertising: labels in Spanish adapted to the product category and without health claims.
- Banned substances: checks on formulas and suppliers so you do not sell HHC or other cannabinoids controlled by Order SND/380/2025.
- Suppliers: contracts and batch certificates of analysis from an accredited laboratory.
For the full map of rules that affect the sector, see our guide on regulatory compliance in cannabis and CBD. If you are just starting out, also read how to open a CBD shop in Spain.
Internal reporting channel: is it mandatory?
Spain’s Law 2/2023 on the protection of whistleblowers requires private entities with 50 or more workers, and some entities in regulated sectors regardless of their headcount, to have an internal reporting system. Most clubs and CBD shops are below that threshold, so the law does not oblige them, although they may set up a channel voluntarily as long as it meets the law’s requirements. Even so, article 31 bis requires the prevention model to impose an obligation to report risks and breaches, so a simple, confidential channel is advisable for any entity that wants a solid programme. If your business is obliged, we help you appoint the system manager and comply with the deadlines and safeguards of the law.
How compliance helps if there is an investigation
If criminal proceedings are opened, a programme implemented before the events and effectively applied is the basis for asking that the legal person be exempted from liability (article 31 bis, sections 2 and 4). If it is implemented afterwards, but before the trial, it can act as a mitigating circumstance (article 31 quater). In addition, the records of members, dispensing, stock and products are the documentary evidence the defence needs to show how the entity really operated. When there is an investigation we coordinate the programme with our cannabis criminal defence service.
How we work
- Assessment: interviews with the board or management and review of statutes, records, contracts and product range.
- Risk map: a report with the risks identified and the priorities.
- Protocols and code of conduct: drafted for the way you actually operate, not generic templates.
- Implementation and training: sessions with directors and staff, with attendance records.
- Supervision and channel: appointment of the compliance officer and launch of the internal channel.
- Review: periodic updates and updates whenever the law or the activity changes.
We have been working with cannabis associations and businesses in the sector for 14 years. We assist you in Spanish, English, German, Italian, French, Dutch and Portuguese, we travel anywhere in Spain and we also work by video call.
You may also be interested in: Requirements to set up a cannabis association · Lawyers for CBD businesses · Regulatory compliance in cannabis and CBD
Do you want to implement a criminal compliance programme?
Tell us how your association or business works and we will explain what you need. Call us on +34 919 532 802 or send us your online consultation.
What our clients say
I cannot recommend this law firm highly enough! From the very first consultation, their team demonstrated an exceptional level of professionalism, knowledge, and genuine care. They were not only incredibly thorough in their approach, but also made sure I felt supported and informed every step of the way. Their expertise is truly unmatched, and they go above and beyond to deliver results. If you're looking for a firm that treats you like a priority and fights relentlessly on your behalf, look no further. Absolutely outstanding service from start to finish!Solo tengo palabras de agradecimiento para esta empresa, me acompañaron todo el proceso de manera muy cercana, siempre disponibles. Al final del proceso el resultado fue muy positivo para mí. Silvia fue la letrada que me llevó todo y el trato no pudo ser mejor. Muchísimas graciasMuy buena experiencia. Trato cercano y profesional desde el primer momento, resolvieron todas mis dudas con claridad y me hicieron sentir acompañada durante todo el proceso. Se nota que saben lo que hacen. Totalmente recomendables.Frequently asked questions
Frequently asked questions about cannabis criminal compliance
Can a cannabis association be criminally liable?
Yes. It is a legal person, and article 369 bis of the Spanish Criminal Code provides for penalties for legal persons for drug trafficking, in addition to the liability of the directors involved.
Is a criminal compliance programme mandatory?
The Criminal Code does not impose it in general, but it is the way for the entity to be exempted or to have its liability reduced. The internal channel under Law 2/2023 is mandatory from 50 workers.
What is the difference between criminal compliance and product compliance?
Criminal compliance prevents offences by the entity; product compliance ensures that each CBD item meets its food, cosmetics or hemp rules. A CBD business should work on both at the same time.
Does compliance guarantee that the club will not be closed?
No. No programme guarantees an outcome or legalises an activity that goes beyond shared consumption. It reduces the risk and provides documentary evidence that the entity operated under control.
How often should the programme be reviewed?
Periodically, and whenever a relevant breach is detected or the organisation, controls or activity change, as article 31 bis.5 of the Criminal Code requires.