Corporate Compliance

Corporate compliance is the set of policies, procedures and controls an organization implements to prevent, detect and respond to breaches of law, sector regulation and internal ethical standards. In Chile, its regulatory core is Law 20.393 on corporate criminal liability, expanded by Law 21.595 on economic crimes, which widened the catalogue of predicate offenses and changed the logic of attribution.

A crime-prevention model (MPD) is the governance, control and oversight system Law 20.393 requires legal entities to maintain in order to be exempt from or mitigate criminal liability. Its minimum elements are: a prevention officer with autonomy and independence; a risk matrix per offense; documented policies and procedures; confidential reporting channels; regular training; and a periodic review mechanism backed by the board.

Law 20.393 (2009) established corporate criminal liability and the prevention model as an exempting defense. Law 21.595 (2023) reformed it: it broadened the predicate-offense catalogue beyond the original money-laundering, terrorism-financing and bribery scope; it incorporated economic, environmental, tax and market offenses; and it modified penalties and attribution rules. In practice, the universe of companies that need a substantive prevention model expanded significantly, and pre-existing models must be reviewed to cover the new predicate offenses.

Certification of the prevention model is not mandatory, but highly advisable. It is issued by entities authorized by the Financial Market Commission (CMF), with validity of up to two years. Certification provides evidentiary value before the Public Prosecutor and the courts in case of indictment, and operates as documented evidence of due diligence by the board and senior management.

An internal investigation has four phases: intake and triage of the report; planning with safeguards for confidentiality and due process; evidence collection (interviews, document review, digital forensics when applicable); and a final report with findings, recommendations and, where appropriate, disciplinary action or referral to the authority. Independent conduct, chain of custody and respect for the rights of the person under investigation are critical for the findings to be usable before the Public Prosecutor or a court.

Regulatory compliance focuses on respecting specific obligations imposed by sector regulation (CMF, ANCI, SII, Labor Directorate, etc.). Corporate compliance is broader: it covers the crime-prevention model, business ethics, internal governance, conflict-of-interest management, anti-money-laundering and incident response. In practice, a mature compliance programme integrates both layers under a single corporate-governance framework.