Published January 3, 2025 · Updated May 29, 2026 · Fabio Castro Forero

Your company was the victim of a crime: how to act (internal fraud, embezzlement, deception)

Guide to Key Cases and Benefits of a Corporate Criminal Lawyer in Bogotá: key requirements, evidence, risks and when legal advice may be needed in Colombia.

Category Corporate Law Published January 3, 2025 Updated May 29, 2026 Author Fabio Castro Forero
Corporate Criminal DefenseCorporate Criminal Lawcriminal complaintcompany

Criminal risk

Do not improvise a defense or a complaint. Organize the facts, evidence and timeline before presenting a version that may be difficult to correct later.

Discovering that your company was the victim of a crime —an employee who was diverting funds, a partner who disposed of the company's assets, a supplier who billed with false invoices— produces a mixture of outrage and urgency. The natural reaction is to call in the person responsible and demand explanations. It is, almost always, the worst first move.

In Colombian criminal proceedings the company is not a bystander: it is a victim, with rights of its own to take part, to drive the investigation and to pursue the recovery of what was lost. But those rights are won or lost in the first hours, depending on how the evidence is handled, how the act is legally characterized and when the Fiscalía (Prosecutor's Office) is approached. A false move at the outset —a premature confrontation, a hasty dismissal, a badly worded email— weighs more than many hours of later work.

Do not improvise a criminal complaint. Put the facts, the evidence and the timeline in order before filing an account that will later be hard to correct. This guide explains, from the perspective of the company affected, what to do —and what not to do— once the harm has already occurred. If you want to understand what the conduct itself —how each offense is made out and what penalty it carries—, we deal with them separately in corporate financial crimes and in cybercrime; here we concentrate on the victim's own action.

The essentials

If you are short of time, these are the ideas that govern a good response:

  • Your company is a victim with rights of its own (art. 132 of the Código de Procedimiento Penal). It may take part in every stage, submit evidence and pursue reparation, even if the person responsible has not been arrested.
  • The first move is not to confront: it is to secure the evidence without giving warning. Confronting early is an invitation to have emails deleted and assets dispersed.
  • "Desfalco" —the everyday word for embezzlement— is not a criminal offense. The correct legal characterization —abuso de confianza (breach of trust), aggravated theft, administración desleal (disloyal management), estafa (fraud), forgery, corrupción privada (private-sector corruption)— determines the authority, the route and the deadline.
  • Many internal frauds are querellable —among them abuso de confianza— and the querella (the victim's formal complaint) lapses after six months (arts. 73 and 74). As a general rule that period runs from the commission of the offense; only where, through proven force majeure or a fortuitous event, you were unable to learn of it does it run from the moment that impediment ceases (art. 73). It is a narrow exception and it has to be proved.
  • Recovering the assets has tools of its own: precautionary measures over assets (art. 92), comiso (forfeiture) (art. 82) and the incidente de reparación integral (full-reparation proceeding) (arts. 102 and 106). They yield more if they are activated early.
  • In the offenses under the special abbreviated procedure, the company can take the reins as acusador privado (the victim who takes over the prosecution) (Ley 1826 de 2017): that catalog covers almost all corporate fraud.
  • Coordinate the criminal, civil and labor fronts with a single approach. A dismissal without support or a badly made "settlement" can cost you the criminal evidence.

Your company is a victim too: harm from the inside and harm from the outside

Colombian criminal law recognizes as victims both natural persons and legal persons. Your company, as a subject of rights that suffered harm as a result of the offense, has standing to act within the proceeding, regardless of whether the perpetrator has been identified or arrested. It does not need to "wait for the Fiscalía to call": it may —and it is in its interest to— appear from the outset.

Legal basis — Art. 132 of the Código de Procedimiento Penal (Ley 906 de 2004). Victims are understood to be the natural or legal persons and other subjects of rights who individually or collectively have suffered harm as a consequence of the wrong. The Corte Constitucional struck down the word "directo" ("direct") in that definition (Sentencia C-516 de 2007), so that the protection does not turn on how immediate the harm is. And that status is held regardless of whether the perpetrator is identified, apprehended, prosecuted or convicted.

That nuance matters more than it seems. When the blow arrives through third parties or through intermediate structures, someone under investigation usually argues that "the company is not a direct victim" in order to keep it out. The law in force does not require that immediacy: harm derived from the wrong is enough. Your company comes in through the front door.

The blow can come from the inside —an employee, an officer, a partner— or from the outside —a customer, a supplier, a third party who deceives the organization—. The distinction is not academic. When the person responsible is on the inside, you will also have employment and corporate governance decisions to make, and a real and immediate risk: that this person, if they feel they have been found out, will destroy evidence or move assets within hours. The outsider rarely has access to your systems; the insider does.

Example. Suppose your head of purchasing had been steering orders to a company belonging to a relative of theirs, with markups agreed under the table. The financial harm is not suffered by you as an individual: it is suffered by the company. It is the company that appears as the victim, and its legal representative who acts on its behalf. And because the person responsible is on the inside and controls part of the purchasing information, the order of your moves —secure first, confront afterward— stops being a piece of advice and becomes the difference between a solid case and a lost one.

The first reflex: securing the evidence without alerting the person responsible

The costliest mistake is to act before securing the evidence. If you confront the person responsible immediately, you are giving them warning: they will delete emails, tamper with supporting documents, hide or transfer assets, align their story with third parties. The rule, with no useful exceptions, is preserve first, confront afterward, and to do it methodically.

Contain without alerting

Restrict access and privileges in a way that does not give the investigation away. A general change of credentials, a rotation of duties or a "routine" review of permissions achieve the objective without setting off alarms. Avoid conversations that would warn the person involved or that could be read as pressure to "give it back and nothing will happen": making the criminal complaint conditional on a payment not only weakens the case, it can expose you to a criminal charge of constreñimiento (unlawful coercion). Recovering is legitimate; extorting the return of the money is not.

Back up the digital evidence without contaminating it

Do not "check" the suspect's computer by turning it on and opening files. Every opening alters metadata —last-access dates, paths, logs— and hands the defense the argument that the evidence was tampered with. Order forensic copies (bit-by-bit images) of devices, email accounts and servers, made by qualified personnel who document how and when they were obtained. Preserve, before they are overwritten, the access records, the camera recordings, the system logs and the accounting records. What looks abundant today may, in two weeks, have been recycled by default.

Document from the first minute

For an item to be of use at trial, its authenticity must be capable of being proved: who collected it, how it was stored, who had access. The policía judicial (the investigative police) and the Fiscalía formalize the chain of custody, but what you preserve —and how you preserve it— in the first hours determines whether that evidence will be admissible or open to challenge. Keeping a plain record of every step from the outset protects the value of everything else.

Legal basis — Art. 254 of the Código de Procedimiento Penal (Ley 906 de 2004). To prove the authenticity of the evidentiary material and the physical evidence, the chain of custody records their identity, their original condition, the conditions of collection, preservation, packaging and dispatch; the places and dates where they were held; and the name and identification of everyone who was in contact with them.

Example. You discover that your treasurer had been dressing up the bank reconciliations. The impulse is to summon her to your office that same afternoon. If you do, that night emails and files will disappear, and perhaps a transfer as well. Instead, that afternoon you order —discreetly— a forensic image of her computer and her mailbox, you secure the statements and the supporting documents, and only then, with the evidence safe, do you decide the next step. The conversation with her does not disappear from the plan; it only changes place.

The common mistake. "Going in to take a look" at the suspect's computer to "confirm" before calling a lawyer. That do-it-yourself confirmation is exactly what later makes the case fragile.

Getting the characterization right: why "desfalco" is not enough

"Desfalco" is an everyday word, not a criminal offense. In Colombia, peculado —the appropriation of resources by the person who administers them— can be committed only by public officials, and only in respect of State assets; it does not apply to a private company. Calling what happened a "desfalco" does not point the way: what defines it is the correct legal characterization, because the competent authority, the route (ex officio or by querella) and the deadline all depend on it.

Legal basis — Art. 397 of the Código Penal (Ley 599 de 2000). Peculado por apropiación requires a qualified perpetrator: the public official who appropriates State assets —or assets of private parties whose administration was entrusted to them by reason of their functions—. That is why, in a private company, what is called "desfalco" in everyday speech is not peculado.

In the business context, the facts usually fit one of these categories. We name them so that you can recognize the ground; their development —elements, penalties, defenses— is in the sibling pieces, so as not to repeat it here:

  • Breach of trust: the appropriation of assets handed over to the person under a title that did not transfer ownership (money to manage, goods on consignment, a vehicle from the fleet).
  • Theft of the company's assets, frequently aggravated when committed by someone who abuses the trust placed in them.
  • Breach of fiduciary duty: the officer, partner, director or adviser who fraudulently disposes of the company's assets for their own benefit or that of a third party.
  • Fraud: where the harm comes from a deception that induced the company to hand over money or assets.
  • Private-Sector Corruption: anyone who bribes a director, employee or adviser of the company —or the employee who accepts the bribe— in order to favor a third party to the detriment of the organization.
  • Document forgery: invoices, contracts, minutes or vouchers fabricated or altered and then used.
Legal basis — Art. 249 of the Código Penal (Ley 599 de 2000). Abuso de confianza punishes anyone who appropriates, for their own benefit or that of a third party, movable property belonging to another that was entrusted or handed over to them under a title that does not transfer ownership. It is the typical case of the employee or agent who keeps for themselves what they were only supposed to manage or safeguard.
Legal basis — Art. 250B of the Código Penal (Ley 599 de 2000). Administración desleal —added by art. 17 of Ley 1474 de 2011— punishes the de facto or de jure officer, partner, director, employee or adviser who, for their own benefit or that of a third party and abusing the functions inherent in their position, fraudulently disposes of the company's assets or takes on obligations chargeable to it, causing economically assessable harm to its partners.

Getting the characterization right is not a lawyers' technicality: it is what determines whether the offense is investigated ex officio or requires a querella, which authority to approach and within what period it prescribes or lapses. That is why it is best to settle it with your lawyer before filing, not afterward. If the alleged wrongdoer is a board member or an officer, their liability has facets of its own —officers' duties, the acción social (the company's claim against its own officers)— that we address in criminal liability of company directors.

From suspicion to the statutory offense: a table to guide you

The following table translates what you observe into the probable characterization and into the first sensible action. It guides the conversation with your lawyer; it does not replace it, because the final characterization depends on the specific facts and on the evidence.

What you observeProbable offenseEx officio or querellable?First action
An employee keeps or diverts money or assets that they only managed or safeguardedAbuso de confianza (art. 249); in certain cases, in its qualified formQuerellable (simple form): the 6-month clock is runningForensic copy and inventory of what is missing; decide on the querella without delay
An officer, partner or director disposes of the company's assets for their own benefitAdministración desleal (art. 250B)Ex officioReconstruct decisions, signatures and minutes; report to the board; file a criminal complaint
Removal of assets by someone who abuses the company's trustAggravated theft (arts. 239 and 241, no. 2)Ex officio (aggravated)Secure cameras, access records, inventories and stock records (kardex)
A supplier or third party uses deception to overcharge or to bill for services never providedEstafa (art. 246)Ex officio if it exceeds 150 SMLMV (monthly minimum wages); querellable if notPreserve contracts, emails and payment orders; estimate the amount
Invoices, minutes or supporting documents fabricated or altered and then usedForgery in a private document (art. 289)Ex officioKeep the originals; forensic document examination
A third party bribes one of your employees in order to be favored to the detriment of the companyCorrupción privada (art. 250A)Ex officioTrace the payment and the favor granted; segregate duties
Manipulation of systems, access credentials, accounts or dataComputer crimes (see the sibling piece)Ex officioPreserve logs and traces; forensic copy before touching anything

Two useful readings jump out of the table. The first: abuso de confianza, which is the most frequent internal fraud, is querellable, so its deadline presses. The second: the more serious forms —administración desleal, forgery, aggravated theft, corrupción privada— are investigated ex officio, which does not relieve you of the need to bring a well-built noticia criminal (the report that starts the case).

Filing a criminal complaint: a duty in ex officio offenses, an option in querellable ones

With the evidence safe, next comes the noticia criminal. It is worth separating two ideas that are often confused: the duty to file a criminal complaint and the option of lodging a querella. In offenses investigated ex officio, filing a criminal complaint is a citizen's duty; in querellable ones, setting the action in motion is a power of the holder of the right, who may exercise it or not —and may also conciliate or withdraw—.

Legal basis — Art. 67 of the Código de Procedimiento Penal (Ley 906 de 2004). Every person must report to the authorities the offenses of whose commission they are aware and which must be investigated ex officio. The duty attaches to ex officio offenses; in querellable ones, filing a complaint —lodging a querella— is an option of the holder of the querella.

Who files the complaint or lodges the querella on the company's behalf? The company acts through its legal representative, or through an attorney-in-fact holding sufficient authority. This, which seems obvious, has practical consequences: if the alleged wrongdoer is precisely the person who holds the representation —a general manager, an officer—, the corporate governance problem must be settled first (who is empowered to act for the company) before filing, so that the complaint is not flawed from birth.

Legal basis — Art. 71 of the Código de Procedimiento Penal (Ley 906 de 2004). The querella may be lodged only by the victim of the conduct. If the victim is a legal person, it is filed by their legal representative. That same holder is, moreover, the only one empowered to bring the private prosecution afterward.

Example. The fraud was committed by the general manager, who is also the company's legal representative. The complaint cannot depend on him. The right course is to convene the competent body —the board of directors or the shareholders' meeting, depending on the bylaws—, appoint an ad hoc representative or an attorney-in-fact, and file on the strength of that standing. Putting the corporate front in order is not a detour from the criminal case: it is what makes the case possible.

Criminal complaint or querella, and why the clock is running

The law separates two routes according to the offense, and the route determines a deadline that can close. It is worth understanding this properly, because cases are lost here by the calendar, not for want of a good claim.

  • Ex officio offenses: the Fiscalía must investigate as soon as it learns of the act, and a criminal complaint is enough. This is where the serious forms of corporate fraud belong —administración desleal, corrupción privada, forgery, aggravated theft, higher-value estafa, money laundering—.
  • Querellable offenses: they are investigated only if the holder of the right lodges a querella, and that right lapses. That is the case of simple theft and of estafa where the amount does not exceed 150 monthly minimum wages, and —a decisive fact for internal fraud— of abuso de confianza.
Legal basis — Art. 74 of the Código de Procedimiento Penal (Ley 906 de 2004). A querella is required, among other conduct, for simple theft where the amount does not exceed 150 monthly minimum wages (art. 239, paragraph 2), estafa not exceeding 150 monthly minimum wages (art. 246, paragraph 3) and abuso de confianza (art. 249), the last with no ceiling on the amount. No querella is required where the act is flagrant, or where the victim is a minor or lacks criminal capacity, or where the conduct is violence against women.
Legal basis — Art. 73 of the Código de Procedimiento Penal (Ley 906 de 2004). The querella must be lodged within the six (6) months following the commission of the conduct. Only where, through proven force majeure or a fortuitous event, the holder of the right did not learn of the act does the term run from the moment that impediment disappears, without exceeding a further six months.

Hence the real urgency. Abuso de confianza —the employee who keeps what they were managing, the cashier who "borrows", the agent who does not hand over— is the internal fraud par excellence, and it is querellable. If your case fits there and you let the six-month deadline expire, you lose the criminal door, however much evidence you have. The deadline does not wait for you to be "ready".

A well-built criminal complaint or querella is not an outpouring: it is an orderly, chronological account, with the estimated amount, the identification of those involved and an inventory of the evidence you have already secured. The better it arrives, the more solid and the faster the investigation will be —and the less room it leaves for the case to be shelved for "lack of grounds".

The common mistake. Taking for granted that "since it is a crime, the Fiscalía has to investigate it ex officio". With abuso de confianza that is not so: you have to lodge a querella, and the six-month clock is already running while you gather the courage to decide.

Appearing as a victim in the proceedings

Filing the complaint does not exhaust your role; it barely opens it. As a victim, the company has the right to take part in every stage of the proceedings, submit evidence, be heard, challenge and pursue reparation. Relying solely on the Fiscalía's own momentum —given its workload— is usually the slowest route and the one that least protects your financial interests.

Legal basis — Art. 137 of the Código de Procedimiento Penal (Ley 906 de 2004). Victims have the right to take part in every stage of the criminal proceedings, as a guarantee of truth, justice and reparation. For the mere exercise of their rights a lawyer is not mandatory, but from the preparatory hearing onward they must act assisted by one; and they may bring the incidente de reparación integral once the liability of the imputado (the person formally charged) has been established.

In practice this means appointing your own representation and making it present from the outset: a company that appears with its lawyer contributes lines of investigation, helps to sustain the amount claimed, watches the deadlines and arrives prepared for the reparation stage. The company that "waits for news" often learns too late of the decisions that affect it.

Example. Your company filed a complaint for administración desleal. With its own representation, your lawyer suggests specific investigative measures to the Fiscalía —requesting bank records, interviewing suppliers, cross-checking minutes—, challenges an attempt at preclusión (dismissal of the case) and requests in time the precautionary measures over the imputado's assets. Without that presence, every one of those steps would have depended on someone else remembering them.

Taking the reins: the acusador privado option (Ley 1826 de 2017)

There is, in addition, a little-known tool that is especially useful for a company. In the offenses that follow the special abbreviated procedure, the victim may request the conversion of the criminal action from public to private and act as acusador privado (the victim who takes over the prosecution): in practice, taking the investigation and the prosecution into its own hands, with its own lawyer, when it wants to set a pace that the Fiscalía's workload does not always allow.

Legal basis — Art. 549 of the Código de Procedimiento Penal (added by Ley 1826 de 2017). The acusador privado is the victim of the punishable conduct empowered to exercise the criminal action, represented by their lawyer. They must meet the same conditions as the querellante legítimo (the person entitled to lodge the querella) and in no case may they act without a lawyer of their own choosing.

What makes it so pertinent for the corporate world is its scope. It is not limited to minor offenses: the catalog of the abbreviated procedure covers precisely the conduct that harms companies.

Legal basis — Art. 534 of the Código de Procedimiento Penal (added by Ley 1826 de 2017). The special abbreviated procedure —the acusador privado's point of entry— covers, in addition to querellable offenses, theft and its aggravated forms, estafa, abuso de confianza, corrupción privada (art. 250A), administración desleal (art. 250B), forgery in a private document and computer crimes, among others. It is, in practice, almost the entire catalog of corporate fraud.

The mechanics have clear rules. The conversion is requested in writing from the prosecutor handling the case, establishing summarily the status of victim, and it may be requested only up until the written accusation is served; the prosecutor has one month to decide. It is not available in certain situations —where there is a collective interest or reasons of criminal policy, where the person under investigation belongs to a criminal organization, where there are several victims with no agreement among them, among others— and the Fiscal General, who exercises the action on a preferential basis, may reverse it. Nor does it turn the acusador privado into an all-powerful investigator: complex measures —wiretaps, searches, surveillance— still require the involvement of the Fiscalía and of the policía judicial.

Example. Your company was the victim of abuso de confianza and of document forgery by an accountant whose assets, moreover, have already been identified as available to answer for the harm. The Fiscalía is moving forward, but slowly. Before the accusation is served, your lawyer requests the conversion: from then on, your team sets the pace, files the accusation and maintains the reparation claim within the same proceeding. It is a decision assessed case by case —it is not always advisable—, but when it is, it completely changes the speed of the proceedings.

Recovering the assets: comiso, precautionary measures and the prohibition on disposal

The conviction matters, but the company cares just as much or more about recovering what was lost. The criminal proceedings offer several levers, and almost all of them yield more if they are activated early, before the assets are dissipated or change hands.

  • Provisional remedies over assets: to request the attachment and seizure of the imputado's assets, in a sufficient amount, so that there are assets to answer for the future compensation.
  • Comiso: the forfeiture of assets that are the direct or indirect proceeds of the offense or that were used as its instrument; if the proceeds can no longer be found, it may fall on assets of equivalent value.
  • Prohibition on disposal: during the six months following the imputación (the formal notice of charges), the imputado may not sell registrable assets without first securing the compensation, and sales made in breach of that prohibition are void.
  • Return of what is recovered: the prosecutor may order the immediate return to the victim of the assets that were the object of the offense and have been recovered.
Legal basis — Art. 92 of the Código de Procedimiento Penal (Ley 906 de 2004). From the formulación de la imputación onward, the juez de control de garantías (the judge who oversees constitutional guarantees at the pre-trial stage) may order, at the request of the prosecutor or of the victim, the attachment and seizure of the imputado's assets in order to protect the right to compensation. The victim establishes summarily their status, the nature of the harm suffered and the amount of their claim. (The Corte Constitucional struck down the requirement that the victim be "directa" ("direct") in this article, Sentencia C-516 de 2007, broadening who may request the measure.)
Legal basis — Art. 82 of the Código de Procedimiento Penal (Ley 906 de 2004). Comiso applies to assets that derive from or are the direct or indirect proceeds of the offense, or that were used as its means or instrument; and, where those assets cannot be located, to other assets of the person responsible up to an equivalent value, without prejudice to the rights of victims and of third parties acting in good faith.

To the criminal toolbox is added extinción de dominio (Ley 1708 de 2014): a standalone action, distinct from the criminal proceedings, directed against assets of unlawful origin or intended for unlawful use. It does not seek to convict a person but to "pursue the asset"; it can run in parallel and, in certain scenarios of fraud with hidden assets, be the most effective route. It is worth assessing it with your lawyer according to the case.

Example. You detect that the diverted money was turned into an apartment held in the name of a third party close to the person responsible. Requesting the attachment in time (art. 92) and exploring comiso by equivalent value (art. 82) prevents that property from being sold while the proceedings advance. If you wait for the conviction to "start thinking about recovery", there will probably be nothing left to pursue.

The incidente de reparación integral and its relationship with the civil route

Reparation for the harm is quantified, within the criminal proceedings, in a procedure of its own: the incidente de reparación integral (full-reparation proceeding), which opens once there is a final conviction and at the express request of the victim. There the damages are quantified and awarded.

Legal basis — Art. 102 of the Código de Procedimiento Penal (as amended by art. 86 of Ley 1395 de 2010). Once the judgment of conviction is final and upon the victim's express request, the judge convenes the hearing that opens the incidente de reparación integral for the harm caused by the conduct.
Legal basis — Art. 106 of the Código de Procedimiento Penal (as amended by art. 89 of Ley 1395 de 2010). The request for full reparation through this procedure lapses thirty (30) days after the judgment of conviction becomes final. That short deadline means the claim and its evidence must be ready beforehand, not improvised afterward.

The criminal route is not the only one for obtaining reparation. The company may pursue compensation through the civil route —without collecting twice for the same harm— and, if the person responsible was an employee, activate the labor front. Coordinating the three fronts with a single approach avoids contradictions: a civil claim out of line with the criminal one, or a badly drafted settlement, can weaken the whole.

Legal basis — Art. 78A of the Código de Procedimiento Penal. In proceedings for offenses against property —except theft aggravated by violence and extortion— the criminal action is extinguished when any of the imputados fully repairs the harm. It is a lever for recovery, but also an outcome worth anticipating with judgment.

That last point deserves a strategic warning. In offenses against property, full reparation can extinguish the criminal action. For many companies, recovering the money is precisely what they are after and that way out is a good result; for others, which also want a ruling on liability, accepting early payment closes the case. There is no single answer: you have to decide, with your eyes open, what your company is pursuing in each case.

The labor front: just cause for dismissing the employee involved (without rushing)

When the person responsible is an employee, the impulse to dismiss them "right away" is understandable. But the labor front has its own logic and its own risks, and rushing usually proves costly twice over: criminal evidence is lost and the door is opened to a claim for dismissal without just cause.

Legal basis — Art. 62 of the Código Sustantivo del Trabajo. The employer may terminate the contract with just cause for serious misconduct by the employee —including the commission of an offense against the company or a serious breach of their obligations—. It is a route distinct from the criminal one, with its own requirements of evidence and procedure; the exact subsection that applies and the proper disciplinary process must be assessed with your employment lawyer.

Two ideas govern this front. The first: just cause requires supporting evidence. A dismissal resting only on a suspicion, without the evidence you should have secured at the start, can end in a labor judgment that aggravates the harm instead of repairing it. The second: timing matters, but so does the order. Confronting the employee with the disciplinary hearing before the digital evidence has been secured is, once again, giving them warning. Often the prudent course is to preserve first, build the supporting evidence, and only then move ahead with the disciplinary process and, where appropriate, the dismissal.

The common mistake. Dismissing on the very day of the discovery "to set an example", with no minutes, no disciplinary hearing and no consolidated evidence. The internal message is paid for later in two courts: the labor court, which may declare the dismissal to be without just cause, and the criminal court, which was left without the evidence that was contaminated in the rush.

Coordination with the Fiscalía and with the UIAF

It is worth placing each actor correctly, because one frequent confusion wastes time. The criminal complaint is filed with the Fiscalía —directly or through the policía judicial—; it is the channel for setting the criminal investigation in motion. The UIAF is not a complaints office: it is the State's financial intelligence unit.

Legal basis — Ley 526 de 1999 (art. 3, as amended by Ley 1762 de 2015). The Unidad de Información y Análisis Financiero (UIAF) prevents and detects money laundering and the financing of terrorism by centralizing and analyzing reports from the financial system and from other entities. It is not the place where a criminal complaint is filed; its analysis feeds the Fiscalía and the competent authorities.

When does the UIAF enter the story of a company that is a victim? Indirectly, when the fraud touches money laundering. If the diverted funds moved through the financial system, the suspicious transaction reports from banks and other reporting entities feed the UIAF, which produces intelligence and shares it with the Fiscalía in order to trace the money. And there is a second layer that is sometimes overlooked: if your own company is a sujeto obligado (an entity required to report) because of its sector or its size, under the money-laundering risk management systems, the fraud may trigger reporting duties of its own, and failing to meet them has consequences.

The practical reading is simple: to file a criminal complaint, the Fiscalía; to trace assets where there are indications of money laundering, financial intelligence operates in the background, channeled through the financial system and through the Fiscalía. Your lawyer will know when and how to knock on each door, and whether your company also has obligations of its own to attend to.

After the blow: closing the crack that allowed it

Every internal fraud reveals a control that failed: a duty that was never segregated, a payment without a second signature, an access that was never revoked, a reconciliation nobody reviewed. Resolving the particular case without correcting that crack is leaving the door open to the next one —sometimes the same person, sometimes another who learned from the gap—. The reactive response, filing a complaint and recovering, must be closed off with a preventive one.

It is not about buying technology or drafting a manual nobody reads, but about redesigning the points where money and information change hands: segregation of duties, limits and approvals, independent reconciliations, access management, internal reporting channels. How to structure those controls and a compliance program that genuinely reduces the organization's criminal risk is the subject of corporate criminal compliance, which we deal with separately.

What NOT to do

As important as the list of right steps is the list of moves that ruin cases. Avoid them:

  • Confronting the person responsible without a plan and before securing the evidence. It is warning them to delete and hide.
  • "Going in to check" the suspect's computer by turning it on and opening files. It contaminates metadata and weakens the evidence.
  • Destroying, altering or "reordering" supporting documents so that they "read better". Any manipulation turns against you.
  • Making the criminal complaint conditional on "give it back and nothing will happen". It can be read as constreñimiento and leave you exposed.
  • Dismissing without evidentiary support or a proper disciplinary process. It risks a labor judgment that aggravates the harm.
  • Letting the querella deadline run out. In querellable offenses, six months of silence close the criminal door.
  • Announcing the investigation internally. The rumor reaches the files of the person involved before you do.
  • Filing an improvised criminal complaint, with no chronology, no amount and no inventory of evidence. It invites the case to be shelved for "lack of grounds".

Common myths

Beliefs that lead to wrong decisions circulate around corporate fraud. These are the costliest:

  • "Since it is a crime, the Fiscalía investigates on its own and quickly." Many internal frauds are querellable: without a querella there is no investigation, and even in ex officio offenses the victim who drives the case obtains better results.
  • "Desfalco is an offense by that name." It is not. Peculado applies to public officials; in a private company the act will be abuso de confianza, aggravated theft, administración desleal or another, depending on the facts.
  • "If I recover the money I cannot file a complaint; if I file a complaint, I do not recover." False. The criminal, civil and labor routes coexist; the only thing you cannot do is collect twice for the same harm.
  • "A company cannot be a victim, only people can." False. Art. 132 recognizes the legal person as a victim.
  • "Without a conviction there is no way to secure the assets." False. From the imputación onward, precautionary measures may be requested (art. 92) and the prohibition on disposal applies (art. 97).
  • "Filing a complaint is terribly expensive and leads nowhere." With the evidence in order and, where available, the figure of the acusador privado, the company can set the pace and pursue recovery with judgment.

What to do in the first hours

If you have just detected a possible offense against your company, this is the order of priorities:

  1. Do not yet confront the alleged wrongdoer, and do not discuss the discovery outside the smallest indispensable circle.
  2. Preserve the evidence: secure documents, emails and records; order forensic copies; do not handle the devices.
  3. Restrict access discreetly, within a scope that does not give the investigation away.
  4. Reconstruct the facts in a chronology with supporting documents and estimate the amount of the harm.
  5. Put the corporate front in order if the person involved holds the legal representation: define who is empowered to act for the company.
  6. Take advice before filing: settle the legal characterization and whether the offense is ex officio or querellable —and, in the latter case, how much of the deadline is left—.
  7. File the well-built criminal complaint or querella and promptly request the precautionary measures over assets.
  8. Appear as a victim and assess the conversion to acusador privado if the offense allows it.
  9. Coordinate the criminal, civil and labor fronts with a single approach, and plan the prevention so that it does not happen again.

Acting well in the first hours changes the outcome of a case; acting on impulse changes it too, but for the worse. At Cafore Abogados we support the affected company in putting the evidence in order, choosing the route, filing the complaint and pursuing recovery, with judgment and with no promises as to the outcome. If your company faces a situation like this, tell us the facts and we will advise you on the most suitable route, the timing and the costs. You can reach us at 313 8411825.

Why it is worth having a corporate criminal lawyer

When the company is the victim, the benefit of having a corporate criminal lawyer is not abstract: it is measured in evidence that survives a trial, deadlines that do not expire and assets that can still be pursued. The three costliest mistakes —confronting the person involved before securing the evidence, letting the querella deadline run out and dismissing without support— almost always happen in the first days, when the decision is taken by someone who does not litigate criminal cases.

A corporate criminal lawyer brings three concrete things: they characterize the act (an abuso de confianza is not the same as an administración desleal, and whether the clock is running depends on that), they set the order in which the evidence is collected so that it does not fall apart, and they coordinate the criminal front with the labor and corporate fronts so that one does not damage the other. If you also want to shield the company going forward, that is worked on in the criminal compliance program.

Laws and case law cited

  • Art. 67 of the Código de Procedimiento Penal (Ley 906 de 2004) — duty to report offenses that are investigated ex officio. Source
  • Art. 71 of the Código de Procedimiento Penal (Ley 906 de 2004) — querellante legítimo; a legal person lodges its querella through its legal representative. Source
  • Arts. 73 and 74 of the Código de Procedimiento Penal (Ley 906 de 2004) — querellable offenses (theft and estafa up to 150 SMLMV, abuso de confianza) and lapse of the querella after six months. Source
  • Art. 78A of the Código de Procedimiento Penal (Ley 906 de 2004) — extinction of the criminal action by full reparation in offenses against property. Source
  • Art. 82 of the Código de Procedimiento Penal (Ley 906 de 2004) — comiso of assets that are the proceeds or instrument of the offense, and comiso by equivalent value. Source
  • Art. 92 of the Código de Procedimiento Penal (Ley 906 de 2004) — precautionary measures (attachment and seizure) over the imputado's assets to secure compensation. Source
  • Art. 97 of the Código de Procedimiento Penal (Ley 906 de 2004) — prohibition on disposing of registrable assets after the imputación. Source
  • Art. 99 of the Código de Procedimiento Penal (Ley 906 de 2004) — property measures in favor of victims: return of recovered assets. Source
  • Arts. 102 and 106 of the Código de Procedimiento Penal (Ley 906 de 2004, as amended by Ley 1395 de 2010) — incidente de reparación integral and its lapse 30 days after the judgment becomes final. Source
  • Art. 132 of the Código de Procedimiento Penal (Ley 906 de 2004) — defines natural and legal persons as victims. Source
  • Art. 137 of the Código de Procedimiento Penal (Ley 906 de 2004) — the victim's right to take part in every stage of the proceedings. Source
  • Art. 254 of the Código de Procedimiento Penal (Ley 906 de 2004) — chain of custody and authenticity of the evidence. Source
  • Arts. 534, 549, 552, 553 and 554 of the Código de Procedimiento Penal (added by Ley 1826 de 2017) — special abbreviated procedure, acusador privado and conversion of the criminal action. Source
  • Art. 239 of the Código Penal (Ley 599 de 2000) — theft (text in force as amended by Ley 2197 de 2022). Source
  • Art. 241, no. 2, of the Código Penal (Ley 599 de 2000) — theft aggravated by taking advantage of the trust placed in the offender. Source
  • Art. 246 of the Código Penal (Ley 599 de 2000) — estafa (as amended by Ley 1474 de 2011). Source
  • Art. 249 of the Código Penal (Ley 599 de 2000) — abuso de confianza. Source
  • Art. 250A of the Código Penal (Ley 599 de 2000) — corrupción privada (added by Ley 1474 de 2011). Source
  • Art. 250B of the Código Penal (Ley 599 de 2000) — administración desleal (added by Ley 1474 de 2011). Source
  • Art. 289 of the Código Penal (Ley 599 de 2000) — forgery in a private document (its use is required). Source
  • Art. 397 of the Código Penal (Ley 599 de 2000) — peculado por apropiación, which applies only to public officials. Source
  • Sentencia C-516 de 2007 (Corte Constitucional) — struck down the requirement that the harm/victim be "directo" in arts. 132 and 92 of the Código de Procedimiento Penal, broadening the concept of victim. Source
  • Ley 526 de 1999 (art. 3, as amended by Ley 1762 de 2015) — functions and purpose of the UIAF (financial intelligence). Source
  • Ley 1708 de 2014 — Código de Extinción de Dominio (a standalone action against assets of unlawful origin or intended for unlawful use). Source
  • Art. 62 of the Código Sustantivo del Trabajo — termination of the contract with just cause for serious misconduct by the employee. Source

We answer your questions

Frequently asked questions

Can a company (a legal person) be a victim in criminal proceedings?
Yes. Article 132 of Ley 906 de 2004 recognizes as victims the natural and legal persons who suffer harm as a result of the offense, and the Corte Constitucional (Sentencia C-516 de 2007) struck down the requirement that the harm be "directo". Your company can take part in the proceedings, submit evidence and pursue reparation, even if the person responsible has not yet been arrested.
Can the company drive the accusation itself?
In many cases, yes. Ley 1826 de 2017 allows the victim to request the conversion of the criminal action and to act as acusador privado. The catalog of the special abbreviated procedure covers theft, estafa, abuso de confianza, corrupción privada, administración desleal, forgery in a private document and computer crimes —almost all corporate fraud—. It is requested in writing before the accusation is served, and it is worth assessing case by case.
When should your company consult a corporate criminal lawyer?
As soon as the suspicion appears and before confronting anyone. The three costliest mistakes —confronting the person involved before securing the evidence, letting the querella deadline run out and dismissing without support— almost always happen in the first days, when the decision is taken by someone who does not litigate criminal cases. Consulting early makes it possible to characterize the act correctly, to set the order in which the evidence is collected and to coordinate the criminal front with the labor and corporate fronts.
Does advice from a corporate criminal lawyer at Cafore have a cost?
Yes: legal support is a professional service and it carries fees. They are agreed in writing once we know the facts, because they depend on the complexity of the matter, on the route chosen and on the scope of the engagement. If you tell us what happened, we will advise you on the most suitable route, the timing and the costs, with no promises as to the outcome; you can reach us at 313 8411825.
Are there procedural benefits if the company or a director cooperates with the justice system?
From the victim's side, what pays off is not a benefit but the momentum: submitting an orderly chronology with supporting documents, suggesting specific investigative measures, standing by the amount claimed and requesting the precautionary measures in time. For the person under investigation, the system provides for ways out other than trial, whose availability depends on the offense and on the stage, and in offenses against property full reparation can extinguish the criminal action (art. 78A). None of those routes operates automatically, so it is worth settling with your lawyer what your company is pursuing before accepting any agreement.

To go deeper

Keep informing yourself

Related guides that expand on the key points of this article.

Does your case need professional support?

Resolve your case with professional support

Tell us about your situation and we will guide you on the most appropriate path, the timelines and the costs.