The company that has taken over the management of Australia’s offshore immigration detention regime has been warned by international law experts that its employees could be liable for crimes against humanity.

Spanish infrastructure corporation Ferrovial, which is owned by one of the world’s richest families and the major stakeholder in Heathrow airport, has been warned by professors at Stanford Law School that its directors and employees risk prosecution under international law for supplying services to Australia’s camps on Nauru and Manus Island in Papua New Guinea.

“Based on our examination of the facts, it is possible that individual officers at Ferrovial might be exposed to criminal liability for crimes against humanity under the Rome Statute,” said Diala Shamas, a clinical supervising attorney at the International Human Rights and Conflict Resolution Clinic at Stanford Law School.

“We have raised our concerns with Ferrovial in a private communication to their officers and directors detailing our findings. We have yet to hear back.”

Shamas said her colleagues’ findings should be a warning to any company or country seeking to replicate Australia’s refugee policies elsewhere. “One of the things that we and our partners are concerned about is the timing of all of this,” said Shamas, who also worked in conjunction with the Global Legal Action Network.

“As states move to tackle increasing migration flows, and amid reports that Australia’s offshore model is something that other states in Europe might look to replicate, and the possibility that other companies will be enlisted in those efforts – we set out to examine the potential serious consequences of that kind of involvement.”

Ferrovial acquired responsibility for the offshore detention contract in May after buying more than 90% of Broadspectrum, the company managing the camps. Ferrovial has said it will not bid for a new contract after the current one expires in February 2017.

But campaigners accuse Ferrovial of acting too slowly to end its relationship with the camps.

Shamas’s legal warning came as a new report released on Monday by rights advocacy group No Business In Abuse (NBIA) and the Melbourne-based Human Rights Law Centre said: “Even one day of business in gross human rights abuse is too much.”

Shared in advance with the Guardian, the report advises Ferrovial to immediately cease all operations at the two camps, and urges its financiers and shareholders to withdraw their support for the Spanish company if it refused to do so.

The report accuses dozens of European and North American banks and investors of complicity in Australia’s offshore detention regime because of their financial backing for Ferrovial.

“Ferrovial’s investors and financiers must uphold international business and human rights standards by rejecting their current association with the gross human rights abuses,” NBIA’s report said.

In response to queries from the Guardian, Ferrovial said: “Respectfully, but strongly, we rejected the factual and juridic allegations contained in it.”

Ferrovial also said it would not be renewing its contract with the Australian government next year; noted that it was a signatory to various human rights commitments; and pointed out that many of the alleged abuses at the camps predated Broadspectrum’s involvement.

The company also argued it does not “run” the camps, but merely provides a considerable number of services, and highlighted how the Australian high court has upheld the government’s right to detain asylum seekers in offshore sites.

Australia’s offshore detention centres have attracted widespread and consistent criticism since the country re-introduced its policy of “offshore processing” in 2012.

Currently, people who arrive in Australia by boat without a visa seeking asylum are sent to either Nauru or Manus Island, where most are held in indefinite, arbitrary detention. They are told they will “not, under any circumstances, be settling in Australia”, but there are no other viable resettlement options for them.

At present, there are 843 men held on Manus Island, and 466 people, including 50 children, in the Nauru detention centre. Most have been held on the islands for nearly three years.

The United Nations has found that Australia’s immigration detention regime breaches international law, amounting to arbitrary and indefinite detention, and that men, women and children are held in violent and dangerous conditions.

One asylum seeker was murdered by guards on Manus Island, while another died because there were no appropriate antibiotics to treat infection.

On Nauru, asylum seekers and refugees are regularly physically and sexually assaulted, and say they are frightened to complain because of a culture of impunity on the island. At least 29 cases of rape and sexual assault – including against children – have been reported to Nauru police, but there have been no arrests or charges laid.

Several arms of the UN have repeatedly condemned Australia’s offshore regime, including the UN high commissioner for human rights, the UN committee against torture, the UN special rapporteur on torture, the UN special rapporteur on the human rights of migrants, and the UN high commissioner for refugees.

An Australian Senate inquiry found that a “culture of abuse” exists in offshore detention, and former staff have condemned the camps. A traumatologist described conditions on Nauru and Manus as the “worst atrocity” he had ever seen, while the former chief psychiatrist on the islands said the camps were “inherently toxic” and akin to torture.

The NBIA executive director, Shen Narayanasamy, told the Guardian that Ferrovial’s complicity in the abuses on Nauru and Manus was “incredibly cut-and-dried under international law”.

“There is no shadow of a doubt that gross human rights violations are occurring, no shadow of a doubt that Ferrovial is complicit,” she said.

“The risk to Ferrovial is essentially the annihilation of its reputation. As a company that relies upon contracting with governments for service provision, they put at risk all of their contracts, and all of the future contracts they hope to win. They put at risk all of their ratings, all of their client relationships – people will assess that they are too controversial, too unethical to have a relationship with, and they could see large institutional investors divesting.”

NBIA links the Pacific Ocean camps to the 22 mainly European banks that fund Ferrovial’s activities, and six European and American investment funds that own shares in the company.

Twenty-two mainly European banks – many of them household names – have jointly provided Ferrovial with a €1.25bn (£1bn) loan for general corporate purposes.

The banks include Barclays, RBS, Santander, HSBC, Goldman Sachs, BNP Paribas, Citigroup, JP Morgan Chase – as well as Instituto de Crédito Oficial, a bank owned by the Spanish state. The other banks are Banca IMI (Intesa Sanpaolo), Banco Sabadell, Banco Popular Español, Bank of America, Bankinter, BBVA, Crédit Agricole, Deutsche, Mediobanca, Mizuho, Morgan Stanley, Société Générale, and the Royal Bank of Canada.

Contacted by the Guardian, most of the 22 banks were guarded in their response to concerns over their connection to Ferrovial. Four said they played no role in the Broadspectrum takeover: Citigroup, Société Générale, Banco Sabadell, and Instituto de Crédito.

Twelve banks would not comment publicly on the specifics of their loan to Ferrovial. Of those, three said they played no role in the Broadspectrum takeover, but would not make this claim publicly.

But other banks did not attempt to distance themselves from the transaction, with HSBC, RBS and RBC all responding with general statements that nevertheless stressed their banks’ commitment to human rights.

BNP Paribas has received an email from Ferrovial promising to improve the situation at the camps, in response to concerns raised by BNP Paribas with Ferrovial’s management.

Representatives from NBIA have been meeting with Ferrovial’s investors and financiers since December. Narayanasamy said there was widespread concern across Europe’s financial sector over Ferrovial’s involvement in offshore processing.

“I think there is a genuine acknowledgement from most financial institutions that not only is involvement in gross human rights abuses ethically and morally unjustifiable, it is bad for business.

“We received comments like ‘the company is facing commercial suicide’. Another company told us: ‘All of us saw you and immediately got on the phone to the company’,” she said.

Ferrovial’s biggest shareholders include six European and North American corporate investors – Blackrock, Vanguard, Columbia Threadneedle, Deutsche Asset Management, Cohen & Steers, and Norges, the Norwegian central bank which manages the state pension fund.

Norges has acknowledged the potential for an ethical problem, and has referred the issue to Norway’s Council on Ethics for an independent judgment. Columbia Threadneedle said it discussed its concerns over the camps with Ferrovial, and was reassured that the contract with the Australian government would not be renewed.