Corporate Compliance

Corporate compliance is the set of policies, procedures and controls an organization implements to prevent, detect and respond to breaches of law, sector regulation and internal ethical standards. In Chile, its regulatory core is Law 20.393 on corporate criminal liability, expanded by Law 21.595 on economic crimes, which widened the catalogue of predicate offenses and changed the logic of attribution.

A crime-prevention model (MPD) is the governance, control and oversight system Law 20.393 requires legal entities to maintain in order to be exempt from or mitigate criminal liability. Its minimum elements are: a prevention officer with autonomy and independence; a risk matrix per offense; documented policies and procedures; confidential reporting channels; regular training; and a periodic review mechanism backed by the board.

Law 20.393 (2009) established corporate criminal liability and the prevention model as an exempting defense. Law 21.595 (2023) reformed it: it broadened the predicate-offense catalogue beyond the original money-laundering, terrorism-financing and bribery scope; it incorporated economic, environmental, tax and market offenses; and it modified penalties and attribution rules. In practice, the universe of companies that need a substantive prevention model expanded significantly, and pre-existing models must be reviewed to cover the new predicate offenses.

No. The Law 21.595 reform eliminated the certification regime for prevention models. What the law now contemplates is periodic evaluation of the model by an independent third party, under Article 4 of Law 20.393. This external evaluation is not a certification with a validity period or a seal: it is an objective review of the model's adequacy and effective operation, supporting the due diligence of the board and management.

An internal investigation has four phases: intake and triage of the report; planning with safeguards for confidentiality and due process; evidence collection (interviews, document review, digital forensics when applicable); and a final report with findings, recommendations and, where appropriate, disciplinary action or referral to the authority. Independent conduct, chain of custody and respect for the rights of the person under investigation are critical for the findings to be usable before the Public Prosecutor or a court.

Regulatory compliance focuses on respecting specific obligations imposed by sector regulation (CMF, ANCI, SII, Labor Directorate, etc.). Corporate compliance is broader: it covers the crime-prevention model, business ethics, internal governance, conflict-of-interest management, anti-money-laundering and incident response. In practice, a mature compliance programme integrates both layers under a single corporate-governance framework.