Criminal liability of company directors and managers in Colombia

When the Fiscalía opens an investigation into something that happened inside a company —a doctored invoice, a discharge into a river, a rigged public tender, a fatal workplace accident— the businessperson's first question is usually the wrong one. It is not "what will happen to the company?", but "which of us are they going to call to answer?". And the answer, in Colombia, is almost never "the company".

Colombian criminal law goes after natural persons: the manager, the legal representative, the board member who approved it, the department head who gave the order or tolerated it. The underlying reason —which we explain next— is that criminal liability is personal and rests on individual culpability, not on the fact of belonging to an organization. Understanding that boundary, knowing which of an executive's decisions are legitimate management and which cross over into crime, is today part of the craft of managing a company.

This guide is written from a single perspective: that of the company and its executives as potential subjects of criminal liability. We do not deal here with the company as a victim, nor with prevention and compliance, nor with the detail of financial offenses or cybercrime; for that we refer you to the sibling guides. We focus on the uncomfortable part: when, how and why an officer can end up being charged, and what to do —and not do— when that risk stops being abstract.

The essentials

If you are short of time, these are the ideas this text develops in detail:

• In Colombia the company does not go to prison: the penalty falls on the guilty natural person —officer, legal representative, board member— by mandate of the principle of culpability (art. 12 of the Código Penal).
• The company can indeed suffer serious consequences: suspension or cancellation of its legal personality, closure of its establishments, confiscation of its assets and civil liability, on top of administrative penalties outside the criminal proceeding.
• The position is not, in itself, either an offense or a shield. You are liable for having acted with willful intent or with negligence and for having had control over the act; but "I did not know" does not excuse someone who had the duty and the ability to know and to prevent.
• The most frequent risks arise from everyday decisions: taxes, public procurement, the environment, occupational safety and the handling of company assets.
• A private party can be liable for offenses that seemed reserved to public servants: as an interviniente (art. 30 of the Código Penal) or through offenses defined in their own right, such as collusion and bribery.
• The executive's defense and the company's defense can come into conflict. They frequently need separate lawyers.
• What is done —or left undone— in the first hours of an allanamiento (a search of the company's premises) weighs more than many months of defense afterward.

In Colombia the company does not go to prison: the natural person is the one who answers

The principle has been stated for centuries in a Latin formula: societas delinquere non potest, a company cannot commit an offense. Under our legal system, the Código Penal (Colombia's Criminal Code, Ley 599 de 2000) allows penalties only for conduct carried out with culpability, and it outlaws every form of strict liability. Because a legal person has no will or awareness of its own —it always acts through human beings—, the criminal penalty falls on the natural person who decided on, carried out or tolerated the act.

It is worth pausing on what this principle means for you in practice. It means, first, that the criminal case will look for a name of its own: pointing at "the company" is not enough, and the Fiscalía (Colombia's Prosecutor's Office) must identify the person who knew, decided or supervised. It means, second, that the corporate structure does not protect you: setting up a stock corporation, a holding company or a chain of subsidiaries does not place a wall between the act and whoever directs it. And it means, third, that criminal blame is individual: each executive answers for their own conduct —for what they did, ordered or allowed to happen when they could have prevented it—, not for a collective outcome that has nothing to do with them.

This does not mean the company escapes unharmed. Although no penalty is imposed on it, it can suffer severe consequences for having been the instrument of the offense. In the criminal proceeding, the juez de control de garantías (the judge who oversees constitutional guarantees at the pre-trial stage) may order the suspension of the company's legal personality (personería jurídica) or the temporary closure of the establishment where there are well-founded reasons to believe that it was devoted, in whole or in part, to criminal activities; and that measure becomes permanent in the judgment of conviction. To this are added the comiso (confiscation of the assets involved), civil liability for the damage caused and, on fronts other than the criminal one, the administrative penalties of the superintendencias (Colombia's sectoral regulators), the DIAN (Colombia's tax authority) or the environmental authorities. In other words: the individual risks their freedom; the company, its assets and its very existence.

The most instructive case of this dual track is soborno transnacional (transnational bribery). Ley 1778 de 2016 created a regime of liability administrative —not criminal— for legal persons that, through their employees, contractors, officers or associates, bribe a foreign public servant; the Superintendencia de Sociedades (Colombia's corporate regulator) investigates and fines the company. But the flesh-and-blood officer who offered or paid the bribe is also liable criminally. One and the same act, two different parties liable and two jurisdictions: the company before the Superintendencia, the individual before the criminal judge. We will come back to this example, because few others sum up so well the logic of the entire system.

The officer's duty and where it borders on criminal law

Before speaking of offenses, it is worth recalling the standard of conduct that commercial law requires of whoever manages a company. Ley 222 de 1995 set a high bar: administradores —a company's officers— must act in good faith, with loyalty and with the diligence of a good businessman, and their actions must be carried out in the interest of the company. That same article lists specific duties —to see to the strict compliance with the law and the bylaws, to keep commercial matters confidential, to refrain from using inside information and from incurring conflicts of interest— that outline the profile of sound management.

What happens when those duties are breached? The first consequence is not criminal but civil and corporate. The officer answers with their own assets for the damage they cause and may be removed from their position. The law is demanding: that liability is joint, several and unlimited, and in certain cases —failing to perform their duties, exceeding them, breaching the law or the bylaws— the officer's fault is presumed, so that it falls to them to prove that they acted with diligence.

The boundary with criminal law is, then, as follows. Breach of these duties, on its own, is a civil or corporate matter. It crosses into criminal territory when the conduct also fits a statutory definition in the Código Penal and is carried out with dolo (willful intent) or culpa (negligence). Not every bad deal is an offense; an unfortunate decision, a business risk that went wrong or a loss makes no one a criminal. But a deal made in the knowledge that it defrauds the treasury, deceives a third party, pollutes a river or fraudulently disposes of company assets certainly can be. The prudent officer learns to recognize that line before signing, because it is precisely at the moment of signing —of authorizing, of voting, of giving the order— that legitimate management and crime touch.

The common mistake. Many executives believe that complying with a formal requirement puts them in the clear: "the board approved it", "the accountant said so", "it was in the budget". Formality does not purge willful intent. If you know the transaction is irregular, approving it at a board meeting or dressing it up in minutes does not protect you; on the contrary, it leaves written evidence of your conscious involvement.

A map of the offenses that arise in the ordinary course of business

You do not have to run a criminal organization to end up in a criminal case. The most frequent risks arise from everyday operating decisions: an income tax return, a bid in a public tender, a payment to "speed up" a procedure abroad, a discharge into a river, a shift worked without the required protections. Below are the fronts that most often compromise executives in Colombia, each with its definition, a concrete example and the mistake that recurs the most.

1. Tax offenses. The Código Penal today punishes two central forms of conduct: omitting assets or including non-existent liabilities in tax returns, and defrauding or evading taxes by omitting income or inflating costs. This is no longer merely a penalty from the DIAN: there is a prison sentence for whoever decides and signs. Example: as legal representative, you approve an income tax return that "forgets" to record assets held abroad above the statutory threshold in order to pay less tax; that omission, made with the purpose of evasion, is a criminal matter. The common mistake: thinking it is enough to correct and pay if the DIAN objects. Payment can extinguish the criminal action, but only within the strict limits the law sets and up to a counted number of times; it is not an unlimited undo button.

2. Collusion and public procurement. A private party who colludes with other bidders to rig a licitación —a public tender— commits an offense in their own right: they do not need to hold public office. And the private contractor who agrees with a public servant to an interés indebido (an improper personal interest in the award of a contract), or to a contrato sin cumplimiento de requisitos legales (a contract awarded without meeting the statutory requirements), may be liable as an interviniente (a private party who takes part in an offense that only a public servant can commit) in those public-servant offenses. Example: your company and two others "divide up" the public tenders in a region and agree on who wins each one in exchange for rotating the contracts; that agreement is punishable even though you have never been a public servant. The common mistake: believing that a verbal agreement, with no documents, is undetectable and goes unpunished; the Superintendencia de Industria y Comercio (Colombia's competition and consumer authority) and the Fiscalía reconstruct these cartels from emails, chats and bidding patterns.

3. Bribery: transnational and domestic. Giving, promising or offering money or any benefit to a foreign public servant in order to obtain or keep international business is soborno transnacional; doing the same with a Colombian official is cohecho por dar u ofrecer (giving or offering a bribe to a public servant). In both, the active subject is the private party who pays the bribe. Example: to unblock the customs clearance of a shipment at a foreign port, a manager authorizes a "facilitation payment" to a customs officer; that conduct exposes the manager criminally in Colombia and, administratively, the company before the Superintendencia de Sociedades. The common mistake: dressing the bribe up as a "commission", "consulting fee" or "entertainment expense"; the accounting label does not change the nature of the payment.

4. Environmental offenses. Ley 2111 de 2021 completely rewrote the title on offenses against natural resources and the environment. Pollution, discharges, unlawful waste management, extraction without a permit and serious damage to ecosystems expose whoever directs the operation that causes them. Example: the plant you manage discharges industrial waste into a water source without complying with the environmental authority's rules; if the discharge produces a harmful effect, the conduct fits the offense of environmental pollution. The common mistake: unloading all responsibility onto the plant manager or the environmental technician; the posición de garante (the duty to avert the risk that comes with the role) of the executive who knew —or ought to have known— of the irregularity is not transferred by delegation.

5. Administración desleal (disloyal management) and corrupción privada (private-sector corruption). Whoever manages assets belonging to others can turn against them. Administración desleal punishes the officer, partner or executive who, abusing their position, fraudulently disposes of the company's assets or loads it with debt to the detriment of the partners. Corrupción privada punishes bribery between private parties: paying —or receiving— a benefit in order to favor someone to the detriment of one's own company. Example: an executive diverts the company's contracts to a company owned by their spouse, on terms that are ruinous for the former; or accepts a hidden commission from a supplier in exchange for awarding them the purchasing. The common mistake: confusing the company's assets with one's own "because, at the end of the day, I am the one who runs it"; the separate legal personality is precisely what turns that disposal into an offense.

6. Occupational risks and workers' rights. A fatal accident arising from a breach of safety rules may be read as negligent homicide; if the worker is injured, as negligent bodily injury. And there are statutory offenses that protect the rights of assembly, association and other labor guarantees against maneuvers by the employer. Example: an order is given to operate a machine without the required safety guards so as not to halt production, and a worker dies; the executive who knew of the risk and nevertheless gave or tolerated that order may be liable for negligent homicide. The common mistake: treating occupational safety and health as a paperwork formality; the management system is not a filing cabinet, it is the proof of diligence —or of its absence—.

The detail of financial offenses —money laundering, unauthorized deposit-taking, manipulation of financial statements— and of cybercrime deserves separate treatment: we develop them in the sibling guides on financial crimes and cybercrime. The map above is enough here to gauge the risk terrain of whoever is in charge.

When an executive's decision escalates into individual liability

Being the legal representative or a board member is not, in itself, an offense, nor does it automatically make you liable for everything that happens in the company. Criminal liability demands something more: that the person carried out the conduct with dolo —knowing and wanting the act— or with culpa —breaching a duty of care—, and that they had control over what happened. The position, without culpable conduct of one's own, is not enough.

But the reverse is also true: the title is no shield either. "I did not know" does not excuse where the executive had the duty and the ability to know and to prevent. Delegating functions transfers the execution, not the duty of oversight: whoever delegates keeps duties of selection, instruction and control over the person to whom they delegated. And whoever signs, approves at a board meeting or authorizes an act they know to be irregular cannot later take refuge in "only complying with a formality".

The Código Penal also distinguishes the form of taking part in the act, and the penalty depends on it. You can be liable as a perpetrator (who carries out the conduct themselves or by using another as an instrument), as a co-perpetrator (who, under a common agreement and a division of labor, contributes something significant), as a determinador (who orders or induces another to commit the offense and receives the same penalty as the perpetrator) or as an accomplice (who provides secondary assistance, with a reduced penalty).

Two figures that are decisive for the businessperson appear here. The first is the interviniente. In offenses that only a public servant can commit —such as interés indebido en la celebración de contratos or contrato sin cumplimiento de requisitos legales— the private party who takes part in their commission is liable as an interviniente, with a one-quarter reduction of the penalty. It is the route by which a private contractor ends up prosecuted alongside the official: you do not have to be a public servant to fall into an offense reserved to public servants.

The second figure is even less well known and more important for whoever is in charge: that of actuar por otro (acting on behalf of another). The Código Penal expressly provided that whoever acts as the body or representative of a legal person is liable as perpetrator, even though the special qualifications required by the statutory definition are present in the company and not in them. It is the mechanism that prevents the officer from hiding behind the legal person: the law "transfers" to the natural person the conditions that formally rest with the company.

An important nuance about the board of directors. Voting in favor of a decision known to be criminal is taking part in the act; abstaining or placing one's opposition on record changes the position of whoever does so radically. On the civil side, Ley 222 de 1995 exempts from liability anyone who had no knowledge of the act or omission or who voted against it, provided they do not carry it out. That same test —having known, having been able to decide, having had control— is the one that, on the criminal side, separates the board member who is liable from the one who is not.

Table: business offense, who is liable and what penalty is at stake

The table below sums up the map above. The penalties correspond to the Código Penal as currently in force and are expressed in months or years of imprisonment; they should be read as orders of magnitude of the risk, not as the outcome of a specific case, which depends on aggravating and mitigating circumstances and on how the judge calibrates the penalty.

If an inspection, a search of the premises or a summons arrives: what to do and what not to do

The way a company reacts in the first hours of a search can weigh more than many months of defense afterward. A search takes people by surprise, creates tension and pushes toward hasty decisions; that is where the costliest mistakes are made. Some practical rules:

• Check the order. A registro y allanamiento requires an order from the prosecutor specifying precisely the places to be searched. Ask to see it, read its scope, note who signed it and which investigation it belongs to. Indiscriminate or blanket searches are not permitted.
• Allow orderly access; do not obstruct. Physically resisting a lawful search does not help and can make matters worse. Distinguish between facilitating the access that the order authorizes and waiving your rights: they are different things.
• Do not destroy or "tidy up" documents on the spot. Deleting, altering or hiding information during a search protects no one: it constitutes separate offenses that add to the one already under investigation and destroys, along the way, any good-faith defense.
• Call a criminal defense lawyer immediately. It is a right, not a sign of guilt. Having defense counsel present at the search completely changes what ends up in the acta (the official record of the proceeding).
• No one is required to testify against themselves. Giving improvised explanations that incriminate you is an avoidable risk. Stay silent on the substance until you have advice; that silence cannot be used against you.
• Protect privileged communications and document the search. Identify and separate the communications with your lawyers, distinguish what the order covers from what it does not, and demand a copy of the acta with the inventory of everything seized.

Where an executive is summoned —to be questioned, to an interview or to a charging hearing— the rule is the same: attend with defense counsel, do not improvise versions of events and prepare the appearance in advance, going over the documents and the facts with the lawyer. Attendance, where it is mandatory, is complied with; self-incrimination, never. And one further warning: evidence obtained in breach of due process is null and void as a matter of law, so a proceeding carried out badly may end up being your best argument —but only if someone documented it in time—.

What NOT to do when facing an investigation

A good part of the damage in these cases is caused not by the act under investigation but by the reaction to it. These are the mistakes that, time and again, make an executive's position worse:

• Destroying, altering or "dressing up" documents. It is the quickest way to turn one problem into two: obstruction or procedural fraud is added to the offense under investigation, and all credibility is lost.
• Giving improvised versions of events in order to "clear everything up". Without knowing what is in the Fiscalía's file, every spontaneous explanation is a risk. What is said to reassure frequently ends up as evidence for the prosecution.
• Aligning your defense with the company's without thinking it through. Interests can diverge. Accepting the lawyer the company "assigns" you, without assessing whether it suits the organization to attribute the act to you, can cost you dearly.
• Coordinating statements with others involved. Agreeing on "what we are going to say" can constitute new offenses and it usually comes to light. Each person answers for their own conduct.
• Putting in writing what you would not want to see in a case file. Emails, chats and voice notes are seized and read. Discretion is not concealment: it is elementary prudence while an investigation is under way.
• Resigning or "disappearing" in the belief that this detaches you from the case. Criminal liability attaches to the past act; resigning from the position does not erase what was done while it was held.
• Underestimating the matter because it is "only a preliminary inquiry". The early stage is precisely when a good defense can prevent charges from being brought. Waiting for the hearing is arriving late.

The executive's defense is not the same as the company's

This is, perhaps, the point that most surprises those who consult us. When a case breaks, the company and the executive usually appear on the same side. Before long, their interests diverge. It often suits the company to show that the act was the work of an individual who departed from its internal policies —cooperating with the Fiscalía, handing over information, activating its compliance program—. For the executive who is singled out, that same strategy leaves them exposed.

That is why, where interests may clash, the natural person needs a defense of their own, independent of the company's. One and the same lawyer cannot loyally serve two clients whose accounts contradict each other; doing so would place them in a conflict of interest that harms both. It is advisable to define from the outset who takes on the company's defense and who takes on each executive's, how fees are handled and what information is shared, so that the protection of the organization is not built on the sacrifice of a person —or the other way around—.

The distinction we saw with Ley 1778 reappears here forcefully: the company may be litigating an administrative penalty before the Superintendencia while the officer faces, for the same act, a criminal proceeding carrying a prison sentence. And since that statute provides that the administrative action does not depend on the criminal proceeding, both fronts move forward in parallel, with different standards and different timelines. They are two battles, with two logics and, almost always, two lawyers. Confusing them —or letting one decide the other— is the costliest mistake.

Suspension or cancellation of the company's legal personality and measures over its assets

Although no penalty is imposed on the company, the criminal proceeding does have tools that can affect it profoundly. The most severe is the suspension or cancellation of its legal personality and the closure of its establishments, where there are well-founded reasons to believe that they were used to commit offenses. It is an exceptional measure, but a real one: it may be ordered during the investigation by the juez de control de garantías and become permanent in the judgment of conviction.

To that measure are added those that fall on assets. For the purposes of comiso, the Fiscalía may request the seizure, the occupation or the suspension of the power to dispose of assets and resources linked to the offense, which the juez de control de garantías orders where the statutory requirements are met. For the company, this can translate into blocked accounts, real estate or machinery immobilized and, as a result, an operation paralyzed for as long as the proceeding lasts. The common mistake: believing that these measures only arrive at the end, with the conviction. Many are requested at the outset, as precautionary measures, when the defense is only beginning to get organized; that is why it is worth anticipating them.

Common myths

A number of ideas circulate around corporate criminal liability that give a false sense of security. They are worth dismantling:

• "Since the company does not go to prison, there is no real criminal risk." False. The fact that no penalty is imposed on the company does not eliminate the risk: it concentrates it on the natural persons who run it. The risk does not disappear, it changes addressee.
• "If I did not sign, I am not liable." Not necessarily. You can be liable as a determinador —the person who gives the order— or as a co-perpetrator, without having signed anything. And whoever had the duty of oversight can be liable for what they tolerated.
• "I delegated it to the department head; the problem is theirs." Delegation transfers the execution, not the oversight. Whoever delegates keeps duties of selection, instruction and control.
• "I pay whatever the DIAN objects to and the criminal matter is closed." Only in part, and within limits. Payment can extinguish the criminal action for tax offenses, but only in the cases and up to the number of times the law allows; it is not an unlimited way out.
• "A private party cannot commit public-servant offenses." They can: as an interviniente they take part in public-servant offenses, and there are statutory offenses —collusion, bribery— that belong to the private party in their own right.
• "I resign and I am out of the proceeding." Liability attaches to the act that took place while you held the position; resigning afterward does not erase it.
• "The company's lawyer defends me too." It may suit the company to attribute the act to you. Where interests diverge, you need a defense of your own.

Checklist for an investigation into the company

If your company receives an inspection, a search order or a summons, this list puts the first decisions in order. It does not replace advice, but it helps you avoid mistakes in the critical hours:

• Contact a criminal defense lawyer immediately and do not make any statements on the substance until they arrive.
• Ask for and read the order: which authority issues it, which investigation supports it and which places and assets it covers.
• Appoint a single person to handle the proceeding and to deal with the authority, avoiding conflicting versions of events.
• Preserve, do not destroy: any deletion or alteration is a fresh offense. Freeze the information, do not delete it.
• Identify and separate the information covered by attorney-client privilege (communications with lawyers).
• Document the proceeding: record what is seized, ask for a copy of the acta and note any irregularity.
• Assess from day one whether the executive's defense must be separated from the company's.
• Map the parallel fronts: criminal, administrative (superintendencias, DIAN, the environmental authority) and civil, so that none of them decides for the others.
• Reconstruct the facts with documents, not from memory, and prepare any appearance with the lawyer.
• Keep matters discreet: while an investigation is under way, what is written or said can end up in the case file.

How we support executives at Cafore

At Cafore Abogados we advise officers, legal representatives and board members who are facing —or want to get ahead of— a criminal risk arising from their management. We assess your actual exposure, define whether your defense must be separated from the company's, accompany you at proceedings and charging hearings, and set out a sober strategy, with no promises as to the outcome, fitted to the facts and to the evidence.

If you are an executive and an operating decision has turned into an investigation, or if you want to understand your exposure before that happens, you can consult us at 313 8411825. Every case is studied with the confidentiality and the rigor that what is at stake demands: your freedom and your name.

The corporate criminal defense lawyer: what they bring and when to call them

All of the above explains why a company ends up looking for a criminal defense lawyer specializing in corporate law. The difference from a general criminal lawyer is not the Code: it is understanding how decisions are made inside a company. Who signed, who delegated, what the minutes said, what controls existed and what duty attached to each position. That material —minutes, powers of attorney, approval matrices, emails— is what defines the procedural position of each person involved, and reading it properly is half the defense.

The time to call them is before there is anyone charged: when a formal request arrives, when an internal irregularity surfaces or when the company is about to file a complaint. In that window the information can still be put in order; afterward it can only be explained. If your priority is prevention, the route is a criminal compliance program; if the company is the injured party, see how to act when your company is the victim.

Laws and case law cited

• Art. 12 of the Código Penal (Ley 599 de 2000) — the principle of culpability; it eradicates strict liability; it grounds the rule that the penalty falls on the natural person. Source
• Arts. 28, 29 and 30 of the Código Penal — joint participation in the offense; perpetrators and co-perpetrators; "actuar por otro" (art. 29, paragraph 3); participants and the interviniente with a one-quarter reduction. Art. 30 upheld as constitutional by Sentencia C-015 de 2018. Source
• Arts. 109 and 120 of the Código Penal — negligent homicide and negligent bodily injury (the occupational risks front). Source
• Art. 200 of the Código Penal — violation of the rights of assembly and association and of other labor guarantees. Source
• Arts. 250A and 250B of the Código Penal — corrupción privada and administración desleal (introduced by Ley 1474 de 2011). Source
• Arts. 407 and 410A of the Código Penal — cohecho por dar u ofrecer and agreements in restraint of competition (collusion). Source
• Art. 433 of the Código Penal — soborno transnacional (amended by Ley 1778 de 2016). Source
• Arts. 434A and 434B of the Código Penal — omission of assets or inclusion of non-existent liabilities, and tax fraud or evasion. Source
• Arts. 333 and 334 of the Código Penal (Title XI, replaced by Ley 2111 de 2021) — damage to natural resources and ecocide; environmental pollution. Source
• Arts. 23 and 24 of Ley 222 de 1995 — the duties of officers and joint, several and unlimited civil liability, with a presumption of fault. Source
• Art. 91 of Ley 906 de 2004 (the Código de Procedimiento Penal) — suspension or cancellation of legal personality and closure of premises used to commit offenses. Source
• Arts. 219, 220, 222 and 282 of Ley 906 de 2004 — when a registro y allanamiento is available and on what grounds; the scope of the order; the questioning of a suspect and the right to remain silent. Source
• Arts. 29 and 33 of the Constitución Política — due process, the presumption of innocence, the right to a defense and the privilege against self-incrimination. Source
• Ley 1778 de 2016 — administrative (not criminal) liability of legal persons for soborno transnacional, punishable by the Superintendencia de Sociedades, without prejudice to the criminal liability of the legal representative. Source
• Ley 2111 de 2021 — replaces Title XI of the Código Penal (offenses against natural resources and the environment). Source
• Corte Constitucional, Sentencia C-843 de 1999 — the legal person is not a subject of criminal punishment; the executive is the one who answers. Official text.
• Corte Suprema de Justicia, Sala de Casación Penal, SP14547 de 2016 — posición de garante: the position alone is not enough (Código Penal, art. 25). Official text.
• Corte Suprema de Justicia, Sala de Casación Penal, SP1863 de 2025 — the legal representative answers for the omission of the withholding agent (art. 402). Official text.