Well, first the demand-legal action has to take place (it is about to happen).
Then, they have to be found guilty.
According to this lawyer, and the Spanish Supreme Court precedent, for that it has to be proven that:
--There was "promising", "offering", "granting", "receiving", "requesting" or "accepting" benefits or advantages of any nature, not justified and in breach of their obligations.
--It happened with the purpose of deliberately and fraudulently predetermining or altering the result of a test, meeting or sports competition.
If this is proven then the possible penalties are:
To the involved people: between 2 years and 3 months and 5 years in prison.
To the club: the prohibition of continuing activities from 1 to 5 years, closing of facilities, dissolution of the club, or a fine of thrice the benefits that they got from it.
UEFA's sanctions (if there were any, they haven't started any investigation yet) could include a ban from European competitions, like the one to Anderlecht.
FIFA's can give harder sanctions like relegation to a lower division or expulsion from a competition in progress or from future competitions, but they haven't even started any investigation yet)