Get in touch
Whether you are taking a project to its next stage, working through a question, or exploring a new collaboration, we would be glad to hear from you.
Torre Empresarial Fabré I, Piso 6B, Distrito Nacional
Send us a message
Santo Domingo, National District, September 5, 2026
Re: Corporate Criminal Liability Regime — Effective November 5, 2026
Dear Sir or Madam:
Effective November 5, 2026, the Corporate Criminal Liability Regime will come into force.
As this significant legal development approaches, ten questions have consistently arisen in nearly every conversation we have had with companies and their leadership teams.
If any of these questions reflect concerns you may also have, then they are already part of the conversation we should be having.
We already have a Code of Ethics, Policies, and a Compliance Department. Surely we're covered!
That is what companies such as Binance, TD Bank, Glencore, and Ericsson thought. Together, their resolutions and penalties exceeded nine billion dollars. And viewed through our Triangle, each case shows a different failure: Binance in ethics, TD Bank in governance, Glencore in compliance, and Ericsson in verification. It is not enough for the program to exist; it has to operate. Having controls is not the same as exercising control. The question is not what you have on file, but what you can demonstrate actually worked before the event.
This is a Legal Department thing, right? We can just call our usual lawyer.
Your usual lawyer can defend you afterward. This, however, is decided before then, and it is not decided in a brief. Law No. 44-26, dated July 27, 2026, speaks of duties of direction, control, and supervision: read that slowly, because this is not just a legal obligation; it is the definition of good corporate governance. The day you have to prove it, the best lawyer in the country cannot manufacture minutes documenting a decision the board never made.
How much can this really cost us? Where is the fine print?
Start with what has no price tag. When Enron collapsed in 2001, it took Arthur Andersen, one of the world's Big Five accounting firms, down with it. The Supreme Court unanimously overturned its conviction in 2005, but by then its audit practice had already disappeared. The fine ranges from RD$0.5 to RD$15.0 million, but forfeiture, closure, revocation of licenses, and dissolution put something else at stake: the very ability to continue operating. You can provision for the fine. You can fight for the license. Reputation cannot be priced.
Nothing ever happens. Why should we worry now?
Because the regime does not look only at the event: it also looks at what shape your house was in on the day it happened. And the record is built backward: who hired, who knew, who could have stopped it, who decided, and what was put in writing beforehand. By the time someone starts reconstructing that chain, there is no room left to improve it. Everything that had to be done before will have to be demonstrated afterward.
If I sell the company someday or reorganize it, does the risk stay behind?
No. The criminal liability of a legal entity survives its dissolution and any actions involving the cessation of operations or the universal transfer of its assets. In addition, where there is a corporate group or a plurality of companies, liability may extend to the legal entity that exercises legal or de facto control, in accordance with the criteria established by the regime itself. In deal terms: criminal risk has to be part of the due diligence in any sale, merger, or reorganization. A diligent buyer will ask.
We are a family business. Isn't this for multinationals?
This is precisely where you need to pay attention. In a family business, three systems coexist: the family, ownership, and the business, and many conflicts arise from resolving in one what belonged in another. That overlap does not by itself create criminal liability; the risk arises when it prevents the company from demonstrating who directed, who controlled, who supervised, and how decisions were made. If the same last name is deciding, executing, and supervising, the question is not whether that is prohibited; it is whether the company can demonstrate that real controls existed and worked.
Does this mean we need to get certified?
It will help, and it certainly will not hurt. But a certification attests to conformity with a standard within the scope and at the time assessed; it does not replace evidence of how the program operated when an event occurred. When something happens, the certification does not close the question: you still have to demonstrate who learned of it, which controls worked, and what was done. A certification can support the system. Proving that it worked is a different exercise.
Why does everyone keep talking about risk?
Because it is the starting point for everything else. Before the control comes the map: the areas of criminal risk specific to your activity, not the ones in a generic manual. Without that map, no one can say whether your program is well designed, because there is nothing to test it against. It is no coincidence that identifying those risks is among the first elements on which the program must be built.
So now we're in the movies... what is a whistleblower?
Not the movie version. It is your best employee, the one who saw something and still does not know what to do with it. A company does not learn what is happening inside from its organizational chart: it learns when someone is willing to say it and finds somewhere to do so. And anyone with something to report weighs one thing before putting it in writing: whether what they say can reach the person who can harm them. If the hotline is run by the same department that reports to the person named, that doubt alone is enough to keep the report from ever being made.
How do we know whether our program actually works?
With three questions. Is it well designed, that is, does it respond to this company's actual risks, or is it an off-the-rack suit? Is it actually implemented, with resources, authority, and independence? And does it work in practice, producing results and leaving evidence? The first can begin to be answered by reading. The other two require looking at how it operates: controls, data, investigations, decisions, resources, and discipline over time. A program does not prove it works because it exists. It proves it when it can show what it did when it actually had to work.
None of these answers replaces a review of the specific circumstances of each case. Their purpose is to help you identify the questions that should be asked within your own organization before those same questions are raised from outside.
We remain at your disposal.
Yours sincerely,
Legal Director
DCLAW | Dominican Center for Legal Assistance, S.R.L.