Corporate compliance is the system of internal controls a company puts in place to prevent legal risks before they turn into sanctions. In Andorra, this obligation is built primarily around the Llei 14/2017 on the prevention of money laundering, the Llei 29/2021 on data protection (LQPD), and the oversight of bodies such as the UIFAND.
Its benefits include reduced legal liability, improved internal efficiency, and easier access to financing and international transactions.
This article explains the types of compliance that exist, which companies are required to implement it in the Principality, and how to set up an effective programme.
What is corporate compliance?
Compliance is the term used for this prevention system: a set of documented policies, procedures and controls, with a designated officer to oversee them and internal training so they are applied in practice, not just on paper.
It differs from simply “obeying the law” in that it is not a passive obligation but an active mechanism: it anticipates risk before it materialises, rather than reacting once an infraction has already occurred. This is precisely the distinction Andorran authorities (UIFAND, the Andorran Data Protection Agency) weigh when determining whether a company acted with due diligence in the event of an incident.
Benefits of compliance for your business
A well-designed compliance programme is not just a legal requirement: it is an investment that protects the company on several fronts at once, from the purely legal to its ability to operate normally within Andorra’s financial system. These are the most relevant benefits:
- Reduced legal and criminal liability. Documented prevention protocols allow a company to demonstrate due diligence to the authorities, which can mitigate or eliminate its liability if a third party commits an infraction within the organisation.
- Reputational protection and competitive advantage. Banks, investors and business partners view companies with active compliance as more trustworthy: a decisive factor in a financial system like Andorra’s, which depends on the transparency of the entities operating within it.
- Improved internal efficiency. Documenting decision-making processes and controls reduces errors and speeds up processes that, without written protocols, would depend on informal criteria.
- Greater trust from clients, partners and investors. A visible compliance system facilitates third-party audits and transactions with counterparties that require enhanced due diligence.
- Easier access to financing and international transactions. Banks and investment funds apply increasingly strict compliance criteria before doing business with a company; having compliance in place prevents blocks on credit, foreign investment or international expansion.
When does it make sense to hire a lawyer in house?
Discover what a lawyer in house is, their duties, cost and when it’s worth hiring one. Compare it with external counsel and an in-house employee.
Legal framework and types of compliance in Andorra
Compliance covers several distinct regulatory areas, each governed by its own law in the Principality. Unlike the UK or the US, where much of this framework is shaped by cross-border regulatory standards and case law, Andorra, not being an EU member state, regulates each area through its own domestic legislation, which requires a compliance approach specifically adapted to the Principality rather than a direct transposition of a foreign model.
Regulatory and legal compliance
This is the general framework requiring a company to operate in line with the regulations in force for its sector, structured across several laws. Implementing it requires an initial assessment to identify which regulations apply to each company’s specific activity. We cover this process in more detail in our article on internal regulatory compliance.
Data protection compliance. Llei 29/2021 (LQPD)
This governs the processing of personal data by companies operating in Andorra. It requires appointing a data protection officer where the activity warrants it, implementing adequate technical and organisational measures, and notifying security breaches to the Andorran Data Protection Agency. We detail the specific obligations in our article on data protection.
Anti-money laundering compliance. Llei 14/2017 and the UIFAND
This requires financial institutions and certain professionals (lawyers, company service providers, and certain commercial activities) to apply customer due diligence (KYC), classify the risk level of each transaction, and report suspicious activity. The UIFAND oversees compliance with this law and sanctions non-compliance. See the full breakdown in our article on anti-money laundering prevention.
Criminal compliance
Andorra’s Criminal Code (Codi Penal) recognises, as an exception to the general rule, the criminal liability of legal entities for a limited list of offences, a narrower approach than the UK’s “failure to prevent” model (such as the Bribery Act 2010 and the Criminal Finances Act 2017), which places a wider burden on companies to demonstrate adequate procedures, or the broad corporate liability doctrines applied in other jurisdictions. The Govern has announced a reform to expand this regime and criminalise corruption in the private sector, in line with the United Nations Convention against Corruption. Having prevention protocols in place is already advisable today, and will become even more decisive as this reform moves forward.
Employment and equality compliance. Llei 6/2022
Llei 6/2022, of 31 March, on the effective application of the right to equal treatment and opportunities, requires all Andorran companies (regardless of size) to maintain a gender pay gap register. Companies with 50 or more employees must also draft and implement an equality plan, and all companies must have a protocol in place to prevent sexual and gender-based harassment. Non-compliance is treated as a serious offence.
Tax compliance
This ensures a company meets its tax obligations in Andorra and complies with the international standards for automatic exchange of tax information (CRS), which the Principality has adhered to since 2016. It includes correct application of corporate income tax and the documentation needed to demonstrate compliance if requested by the Andorran tax authorities.
Which companies are required to have a compliance programme in the Principality?
This depends on the sector, turnover and type of transactions carried out. Financial institutions and entities subject to Llei 14/2017 have reinforced obligations. Other companies, while not always legally required to do so, still benefit from implementing it voluntarily as a protective measure.
How to implement a compliance programme in your Andorran business
- Risk assessment. Identify which regulations apply to the company’s specific activity and assess the risks particular to each area.
- Designing policies and internal protocols. Draft the documents that formalise the system: a compliance manual, an anti-money laundering protocol, a data protection policy, a code of conduct.
- Training and a culture of compliance. A protocol without training is not effective: the team needs to understand and apply the procedures so that compliance becomes part of the company’s culture, not just a filed document.
- Auditing and periodic review. The regulatory framework changes frequently; the system needs to be reviewed regularly to remain effective and defensible in the event of an inspection.
What does a Compliance Officer do and what is their role in the company?
A Compliance Officer designs, implements and oversees a company’s compliance system: identifying regulatory risks, drafting and updating protocols, training staff, acting as the point of contact with the authorities, and documenting the decisions taken.
Main responsibilities
Reviewing high-risk transactions, managing the register of data processing activities, overseeing customer due diligence (KYC), and preparing reports on the state of regulatory compliance.
Does my business need an in-house or an outsourced compliance officer?
This depends on the size and complexity of the organisation. A large company subject to intensive regulation may justify a full-time in-house role. For most Andorran SMEs, outsourcing this function to a specialised firm provides the same regulatory coverage without the fixed cost of an in-house position, backed by a team that already knows the applicable regulations in depth.
Compliance support for businesses: legal and tax advisory with Augé
At Augé Legal & Fiscal, we support companies in Andorra in designing and implementing their compliance programmes, from the initial assessment through to periodic auditing, with a multidisciplinary team combining legal, tax and local regulatory expertise. Through our Lawyer in House service, your company gets the equivalent of an in-house legal department specialised in compliance, without the need to build that structure on a permanent basis.
Frequently asked questions about corporate compliance
What is the difference between compliance and audit?
Compliance is a preventive system that operates on an ongoing basis. An audit is a one-off review, usually carried out by an independent third party, that checks whether those controls are working.
How long does it take to implement a compliance programme?
An initial assessment and the basic protocols are usually completed within a few weeks; the total timeframe depends on the size of the company and the number of regulatory areas that apply to it.
