Criminal Risk
Prevention in the Spanish
Cannabis Sector
In Spain, the cannabis sector operates without express regulation, but with real criminal risk. Lawyer Gabriela Sierra Fontecilla, member of ICAB and Certified Compliance Officer by CESCOM (Spanish Compliance Certification, 2026), specializes in criminal risk prevention in the cannabis sector with national and international accreditation in regulatory frameworks such as ISO 37301, ISO 31000, and UNE 19601.
Operating in the cannabis sector
without protocols means operating with real criminal risk
Criminal risk prevention in the cannabis sector is not bureaucracy. It is the set of protocols, documents, and procedures that determine whether the activity of your club, company, or project has real legal backing when an inspection, complaint, or judicial investigation arrives.
What is criminal risk prevention in cannabis and what is it not?
Criminal risk prevention in the cannabis sector is the set of preventive measures, operational protocols, and documentation that allows an entity in the sector to demonstrate that it operates within the margins of the current legal framework.
It is not simply registering. It is not having correct bylaws. It is not having an activity license. It is everything that happens after opening the doors: how members are admitted, how the product is managed, how accounting is kept, how teams are trained, what happens when there is an inspection.
In a sector without express regulation, these protocols are the only available tool to build real legal certainty, not formal.
The Supreme Court sets the limits, not the legislator
In Spain, there is no law that expressly authorizes organized cannabis activity. The criteria for legality have been established by case law. Prevention protocols are the operational response to that case law.
Responsibility falls on the directors
In a CSC, a CBD company, or a hemp project, it is the entity’s managers who assume the criminal consequences of non-compliance. A prevention system protects people, not just the entity.
Inspections do not give notice
A complaint, an investigation initiated in another context, or a routine inspection can be triggered at any time. Documentation and protocols in order are the club’s or company’s defense when that happens.
The most serious problems are not seen coming
Most entities that end up in criminal proceedings were apparently functioning well. The deterioration of compliance is gradual and silent. A periodic review detects it before it is too late.
Without express law, preventing
criminal risks is not
optional: it is real protection
In regulated sectors, risk prevention consists of complying with the rules established by law. In the Spanish cannabis sector, those rules do not exist expressly. What exists is Supreme Court case law, administrative regulations dispersed across autonomous communities, and growing institutional pressure.
This makes risk prevention in the cannabis sector more demanding than in any other regulated sector. Instead of following a pre-established manual, protocols must be built on the basis of what the courts have said is acceptable and what is not. And that requires very specific specialization.
Each sector has its own risks, its own obligations, and its own case law framework. That is why Lawyer Sierra’s services are designed specifically for each of them.
Without protocols, there is no documented defense
When an inspection arrives or an investigation is opened, what protects the directors is documentation. Without protocols in order, there is nothing to present.
Case law changes and protocols must adapt
What was sufficient two years ago may not be today. Risk prevention is not a document that is signed once: it is a system that is reviewed and updated.
Each sector has different criminal risks
The risks of a CSC are not the same as those of a CBD store or a hemp farmer. Protocols must be designed for the specific risk of each activity.
Formal compliance does not guarantee real security
Being registered, having bylaws, or having licenses does not equate to operating correctly. Real legal certainty depends on how the entity functions day to day.
Each sector, its own protocols
Criminal risks and compliance obligations differ according to activity. The prevention protocols of a cannabis social club are not the same as those of a CBD company or a hemp farmer. That is why each service is designed specifically for the sector and its specific risks.
Criminal risk prevention for cannabis social clubs
The directors of a cannabis social club are personally responsible for compliance with Supreme Court criteria. A failure in admission, management, or accounting protocols can lead to criminal proceedings.
- Review of member admission protocol.
- Audit of internal documentation.
- Analysis of accounting structure.
- Protocol for action during inspections.
Criminal risk prevention for CBD companies and stores
The CBD market in Spain operates under dispersed and constantly evolving regulations. Companies that do not have their labeling, advertising, and distribution protocols in order are exposed to administrative and criminal sanctions.
- Review of commercialization framework.
- Labeling and legal claims protocol.
- Advertising and marketing compliance.
- Distribution risk management.
Criminal risk prevention for industrial hemp farmers
Industrial hemp cultivation is subject to specific regulations on authorized varieties, maximum THC content, traceability, and CAP obligations. Compliance requires documented protocols from planting to harvest.
- Verification of certified varieties.
- Cultivation traceability protocols.
- Compliance with maximum THC regulations.
- Documentation for the CAP.
Gabriela Sierra Fontecilla:
lawyer specialized in cannabis
criminal risk prevention
Lawyer Gabriela Sierra has spent more than ten years working exclusively in the Spanish cannabis sector. She has advised cannabis social clubs, CBD companies, hemp farmers, and medicinal cannabis projects, participated in institutional debates and international forums on cannabis policy. She has recently obtained the CESCOM Certification (Certified Compliance Officer, 2026), the only specific Spanish accreditation in criminal risk prevention for the cannabis sector, with regulatory frameworks ISO 37301, ISO 31000, and UNE 19601.
Does your entity operate with
real legal certainty?
Most serious problems in the cannabis sector do not occur at opening: they occur later, when controls are relaxed and no one has reviewed whether the entity continues to comply. A consultation with Gabriela can identify exactly what needs attention before it becomes a problem.