Corporate Criminal Law

In Colombia, corporate criminal risk does not begin with formal charges. It begins much earlier: with a poorly documented transaction, a decision no one authorized in writing, a payment with no clear cause or a contract signed by someone who had no authority to do so. By the time the summons from the Fiscalía (Colombia's public prosecution service) arrives, the damage already has weeks or months of history.

This guide is written for executives, legal representatives, board members, officers and statutory auditors who want to understand how criminal risk works in a Colombian company, what conduct triggers it, how a technical defense is built and, above all, what can be done before the problem exists. Because in criminal matters, acting late is almost always more costly than acting well.

Why prevention costs less than defense

An active criminal proceeding —even one that ends in preclusión (dismissal of the case)— damages the executive's reputation, generates defense costs sustained over months or years, interrupts management duties, affects banking and commercial relationships, and may lead to precautionary measures over assets before there is any judgment. Preventing that scenario through a compliance system, solid documentation of decisions and a clear structure of authority is, in practical terms, the lowest-cost, highest-return investment a company can make in legal matters.

Reactive defense is also possible —and Cafore conducts it with technical rigor—, but it starts at a disadvantage: the Fiscalía has already gathered evidence, the complainant has already fixed their account and the documents that could exonerate the executive may be scattered, incomplete or simply nonexistent. Prevention builds the defense file before there is a prosecution file.

Who is exposed

The 4 executive profiles that are most frequently investigated

Corporate criminal risk is not spread evenly within an organization. The Fiscalía builds its cases by looking for the people who had real power over the conduct under investigation: who decided, who signed, who knew, who failed to act on a red flag. Four profiles concentrate the greatest exposure.

1. Legal representative

It is the profile with the greatest procedural visibility. The text of article 29 of the Código Penal provides that a person who acts as a member or representative body of a legal entity and carries out the punishable conduct is liable as a principal, even though the special elements of the offense are present not in that person but in the company. In simple terms: the general manager may be charged with an offense "of the company" even if they obtained no direct personal benefit, provided they were acting on its behalf.

This does not mean that the position creates automatic guilt —article 12 expressly prohibits that—, but it does mean that the legal representative is always the first name on the Fiscalía's checklist. What protects them is not the position but showing that their specific conduct did not fit the statutory definition, was not unlawful or was not culpable.

2. De facto officer

Colombian law does not require a person to hold a formal title in order to be treated as an officer. Anyone who gives instructions that are obeyed, controls the cash, decides on hiring or sets the company's operational direction may be investigated as a de facto officer, even if on paper they appear as an adviser, an investing shareholder or an outside consultant. The Fiscalía and the courts look at real power, not at the organization chart.

This profile is especially common in family businesses where the founder keeps informal control after transferring the legal representation, and in corporate groups where one natural person controls several companies through verbal instructions.

3. Board member

The board of directors approves decisions, receives reports and sets guidelines. If those decisions, or that silence in the face of red flags, are linked to punishable conduct, the board member faces the risk of investigation, particularly under article 30 of the Código Penal: whoever induces another to carry out unlawful conduct —that is, whoever orders or promotes it— receives the same penalty as the principal. The board minutes that approved the transaction in question become evidence of knowledge and encouragement.

What protects a board member is not having voted with the minority, but having left a documentary record of their opposition, having asked for additional information before deciding and having acted with the diligence the position demands.

4. Statutory auditor

The statutory auditor is in a particular position: they are under a legal duty to report irregularities. If the auditor knew or ought to have known of an irregular transaction —money laundering, document forgery, misappropriation of funds— and did not act, they face liability for omission. The text of article 325 of the Código Penal specifically criminalizes the failure to apply controls in financial institutions, but the principle of liability for negligent omission extends to other contexts. An auditor who signs financial statements that do not reflect reality takes on a risk worth knowing about in advance.

How the offense works

The structure of an offense: statutory definition, unlawfulness and culpability

Understanding how an offense is built in Colombian law is the first step to understanding how it is taken apart. The text of article 9 of the Código Penal provides that for conduct to be punishable it must fit a statutory definition, be unlawful and be culpable. Causation on its own is not enough for the legal attribution of the result. Each of those three elements is a filter the Fiscalía must get past —and one the defense can attack.

Statutory definition: does the conduct fit a criminal offense?

The text of article 10 of the Código Penal requires the law to define the basic features of the offense unambiguously, expressly and clearly. That a transaction looks irregular or causes harm is not enough: it must match a specific statutory description. A bad business decision, a loss of assets or a breach of contract is not an offense merely because it harms someone. Technical defense begins by checking whether the executive's specific conduct does or does not fit the offense charged.

Unlawfulness: was there actual harm without lawful justification?

The text of article 11 of the Código Penal requires that the conduct have actually harmed or endangered the protected legal interest, without lawful justification. There are grounds of justification —self-defense, necessity, performance of a legal duty— that rule out unlawfulness even where the conduct fits the statutory definition. In business settings, a decision taken within the framework of the bylaws and the law may not be unlawful even if it causes losses.

Culpability: did the executive act with intent or with negligence?

This is the most important element for the defense of executives. On this point, article 12 of the Código Penal (Colombia's Criminal Code) is categorical: "Penalties may be imposed only for conduct carried out with culpability. Every form of strict liability is eradicated." In Colombia there is no automatic criminal liability by virtue of a position. It is not enough that the company committed an offense; it must be proven that that specific executive acted with intent —they wanted the result— or with negligence —they acted with gross negligence that produced the result—.

This is the technical basis of preventive defense: if the executive took decisions on an informed basis, with the necessary authorizations, without personal benefit and with the controls in operation, individual culpability is hard to prove. Documenting that process is the defense before there is a proceeding.

Where the risk is concentrated

The map of criminal risks by type of industry

Corporate criminal risk is not the same in every sector. The conduct that triggers investigations varies with the type of operation, the sector's regulation, the type of clients and the nature of the funds the company handles. This map allows the executive to identify their areas of greatest exposure.

Sector exposure is not deterministic: a financial-sector company with an active SAGRILAFT, documented due diligence and a reporting line for suspicious transactions has a radically different risk profile from a company in the same sector that handles cash without controls. Compliance reduces the risk in any industry; the absence of compliance amplifies it in all of them.

The most frequent offenses

The 6 most common offenses in a business context

The Colombian Código Penal (Ley 599 de 2000) defines dozens of offenses that can arise in a business context. These six account for the greatest frequency in investigations against executives and companies in Colombia.

1. Money laundering — article 323 CP

This is the offense with the greatest exposure for companies that receive payments from clients whose source of funds has not been verified. Article 323 penalizes anyone who acquires, safeguards, invests, transports, transforms, stores, keeps, holds in custody or administers assets whose indirect or direct origin lies in unlawful activities, or who gives those assets the appearance of legality. The unlawful activities that give rise to the offense include drug trafficking, extortion, kidnapping, smuggling, offenses against the public administration and criminal conspiracy, among others.

The penalty is ten to thirty years' imprisonment and a fine of one thousand to fifty thousand monthly minimum wages. A critical point: money laundering is an offense that is autonomous in Colombia. The Fiscalía does not need a prior conviction for the underlying offense —it is enough to show the link between the assets and the unlawful activity.

2. Forgery of a private document — article 289 CP

It penalizes anyone who forges a private document capable of serving as evidence, if they use it. The penalty is sixteen to one hundred and eight months' imprisonment. In a business context, it appears frequently in altered board minutes, contracts with modified terms, invoices for services never rendered and forged powers of attorney. The article has two elements that must be proven: the forgery of the document and its actual use. Without use, the offense is not consummated.

3. Aggravated criminal breach of trust (abuso de confianza calificado) — article 250 CP

The basic offense of criminal breach of trust —article 249— penalizes an officer who misuses another's movable property that is in their possession. Article 250 sets out the aggravated form, with penalties of forty-eight to one hundred and eight months' imprisonment and a fine, where the conduct is committed by abusing functions conferred by a public authority, or over the assets of companies with State participation. For executives in the private sector, the main risk is the misappropriation of company funds through unauthorized withdrawals, payments to third parties with no cause or disposals of assets beyond the scope of their authority.

4. Failure to apply controls — article 325 CP

It applies specifically to board members, legal representatives, officers and employees of financial institutions and savings and credit cooperatives who, in order to conceal the unlawful origin of money, fail to apply the control mechanisms established for cash transactions. The penalty is thirty-eight to one hundred and twenty-eight months' imprisonment and a fine. This article turns a failure to comply with SAGRILAFT into a direct criminal risk for the executives of supervised entities.

5. Testaferrato — article 326 CP

It penalizes anyone who lends their name to acquire assets with money coming from drug trafficking and related offenses, or from extortive kidnapping and extortion. The penalty is ninety-six to two hundred and seventy months' imprisonment and a fine of up to fifty thousand monthly minimum wages. In a business context, the risk arises when a natural or legal person appears as the holder of assets that are in fact controlled or financed by a third party linked to unlawful activities. Testaferrato is article 326, not 328 —that number corresponds to offenses against natural resources.

6. Procedural fraud and instrumental forgeries

In a business context, conduct involving the forgery or use of false documents to obtain procedural or contractual advantages, or advantages before public authorities, also appears frequently. The common basis of this conduct is article 289 —forgery of a private document— together with specific offenses in Title XIII of the Código Penal. The most effective preventive strategy is to keep authentic, verifiable documentation for every relevant transaction.

What does reduce the risk

Prevention mechanisms that reduce the risk profile

Preventing corporate criminal risk does not require turning the company into a Kafkaesque control environment. It requires four elements that, combined, make the executive's conduct verifiable through documents, show that the controls existed and allow decisions to be traced back to a person with authority.

SAGRILAFT and client due diligence

The Sistema de Autocontrol y Gestión del Riesgo Integral de Lavado de Activos y Financiación del Terrorismo (SAGRILAFT, the self-control system against money laundering and terrorist financing) is mandatory for real-sector companies supervised or controlled by the Superintendencia de Sociedades that exceed the thresholds of Circular Externa 100-000016 de 2020 (in the financial and cooperative sectors the equivalent system is SARLAFT) (Colombia's financial and solidarity-economy regulators), and recommended for any company that handles third-party funds or receives payments from clients with variable economic profiles. An active SAGRILAFT —with due diligence, verification of ultimate beneficial owners, restrictive lists and reporting of suspicious transactions— reduces the risk of a money-laundering investigation by showing that the company had controls and applied them.

Criminal compliance and the authority matrix

A basic criminal compliance program includes a policy for approving transactions by amount, segregation of duties between the person who orders a payment and the person who authorizes it, periodic review of suppliers and clients, an internal whistleblowing channel and documentation of sensitive decisions in minutes or verifiable communications. The authority matrix —which sets out who can bind the company and up to what amount without further approval— is especially important in protecting the legal representative: if the bylaws set limits and the executive respected them, the conduct is within the authorized framework.

Documentation of decisions

The most frequent criminal risk for executives does not come from openly criminal decisions, but from decisions that look correct at the time and that, in the absence of documentary support, cannot be distinguished from an intentional one. Every relevant transaction should leave a trail: who proposed it, what information was available, who authorized it, what the business purpose was and what result was expected. That trail is the defense before the proceeding.

Segregation of duties

Concentrating duties in a single person —who decides, signs, executes and records— removes the cross-check that protects the company and its executives. Segregation does not require complex structures: it is enough that the person who proposes a transaction is not the one who approves it, and that the person who approves it is not the one who records it. That design creates evidence that the control process existed.

Signs it is not wise to ignore

When the risk is already real: signs of an active investigation

There are moments when the risk stops being hypothetical and becomes concrete. Recognizing them early —and acting correctly— can make the difference between a proceeding that is resolved at the preliminary inquiry stage and one that reaches an oral trial.

Visits and inspections by the Fiscalía

A search of the premises, an inspection of documents or the presence of Fiscalía investigators at the company's facilities are unmistakable signs that there is an active investigation. At that moment the rules are clear: do not obstruct the procedure, do not destroy or alter documents, do not make improvised statements and contact a criminal defense lawyer immediately. Article 8 of the Código de Procedimiento Penal (Colombia's Code of Criminal Procedure, Ley 906 de 2004) guarantees the right to counsel of your own choosing from the start of the proceeding —and that right should be exercised.

Summonses and requests for information

A summons to an interview from the Fiscalía, a formal request for banking, accounting or contractual information, or a notice that the company or an executive is a "person of interest" in an investigation are signs that call for a technical response, not improvisation. The difference between answering with legal advice and answering without it can determine whether that interview produces evidence for the prosecution or evidence for the defense.

Frozen accounts or a UIAF report, and other financial controls

When a bank account is frozen, when the UIAF (Colombia's financial intelligence unit) reports a suspicious transaction to the Fiscalía or when the Superfinanciera opens an administrative investigation, the criminal risk is live. At that moment the company needs to have identified its due diligence documents, its SAGRILAFT policies and the supporting records for the transactions in question. If those documents do not exist, the problem becomes more complex.

Complaints from shareholders, employees or clients

A formal criminal complaint filed with the Fiscalía requires the agency to assign the case to a prosecutor in order to determine whether the facts amount to an offense. Not every complaint ends in formal charges, but every one calls for a technical response. Complaints between shareholders over cash handling, misappropriation of assets or document forgery are frequent and, if they are not handled correctly from the start, they can lead to charges based on one-sided accounts.

A distinction that matters

Criminal defense of executives: the company's lawyer vs. the personal lawyer

One of the most frequent mistakes in corporate criminal crises is assuming that the company's lawyer —the in-house one, the corporate one, the one who drafts contracts— can simultaneously take on the criminal defense of every executive. That assumption has a structural flaw: interests are not always aligned.

When interests diverge

The company may have an interest in one of its executives taking responsibility in order to protect the continuity of the business. The executive may have an interest in showing that they acted on instructions or that the company had controls that someone switched off. A majority shareholder may want the investigation to point at the general manager; the general manager may want it to point at the board. Where that divergence exists —and it often does—, a single lawyer cannot represent both sides without incurring a conflict of interest.

The text of article 122 of the Código de Procedimiento Penal specifically governs incompatibility in the defense: if several accused persons share a common defense counsel and a conflict of interest arises, any of them or the Ministerio Público (in Colombia, the public-interest oversight body in criminal proceedings, not the prosecution) may ask the judge to remove that counsel. Reaching that point —in the middle of an active proceeding— is costly in time and strategy. Preventing it from the outset is the right decision.

What the criminal defense lawyer for executives does

An executive's criminal defense lawyer works on their client's individual conduct: what decisions they took, what information they had, what authorizations existed, what controls were in operation. Their aim is to build a theory of the case that shows the absence of individual culpability —or, if the facts do not allow that, the position that best protects their client's interests within the proceeding. That strategy may include cooperating with the investigation if there are technical reasons to do so, or exercising the right to silence if there are not.

Separation as an early decision

The decision to retain separate lawyers —one for the company, one or several for the executives— should be taken early, ideally before formal charges exist. Once interests have been mixed into a single strategy and procedural contradictions have emerged, correcting course is harder and more expensive. The question worth asking from the outset is simple: does everyone involved have the same interest in the outcome of the proceeding?

Procedural alternatives

The principio de oportunidad (discretionary waiver of prosecution) and charge bargaining: when and how

The Colombian adversarial criminal justice system —governed by Ley 906 de 2004— includes mechanisms that make it possible to end a proceeding before an oral trial, on terms that may be favorable to the accused. Knowing them is part of strategic defense.

Principio de oportunidad

Article 66 of the Código de Procedimiento Penal provides that the Fiscalía has a duty to bring criminal proceedings, but may suspend them, interrupt them or waive them where the law so allows. The principio de oportunidad —governed by article 324— allows the Fiscalía to forgo prosecution in cases where the State's interest in the investigation gives way to other factors: compensation of the victim, cooperation with the administration of justice, minimal harm to the protected legal interest or conditions of vulnerability of the accused. In business settings, the principio de oportunidad may be relevant where the executive cooperates actively in identifying those principally responsible or where there is verifiable full compensation.

Plea agreements (preacuerdos) and charge bargaining

The Código de Procedimiento Penal allows the prosecutor and the accused to reach plea agreements on the facts charged and on their consequences. Under article 293, if the accused accepts the charges at a hearing —whether on their own initiative or by agreement with the Fiscalía—, what has been done is deemed sufficient to serve as the accusation. Article 351 sets out the reduction of the penalty: accepting the charges at the hearing where charges are formally brought carries a reduction of up to half of the penalty that could be imposed. That reduction decreases progressively if the acceptance occurs at later stages of the proceeding.

When to consider these mechanisms

The decision to accept the charges, negotiate a plea agreement or apply for the principio de oportunidad is a strategic one that depends on a technical analysis of the case: what evidence the Fiscalía has, what level of culpability can be attributed to the executive, what the risk of going to trial is and what consequences acceptance has for their professional life and their assets. It is not a decision that should be taken under pressure or in the first hours after a summons. It requires time, documents and qualified legal advice.

The article 317 of the Código de Procedimiento Penal also sets out grounds for release when the statutory time limits expire: if more than 60 days pass from the bringing of formal charges without an accusation, if more than 120 days pass from the filing of the written accusation without the trial hearing beginning, or if more than 150 days pass from the start of the oral trial without a hearing to read the judgment, the accused is entitled to release. Bear in mind that the proviso to article 317 doubles these periods where there are three or more accused persons, where jurisdiction lies with the specialized criminal circuit judges, or where acts of corruption are involved. The defense must actively track those deadlines —they are procedural rights that are lost if they are not exercised.

A practical reference

Position in the company, the offense of greatest risk and how to prevent it

This table summarizes the relationship between the position, the main criminal risk and the specific preventive measures. It is a starting point for each executive to identify their area of greatest exposure.

Checklist

A basic criminal compliance checklist for executives

These ten points do not replace a structured compliance program, but they do allow a quick assessment of the risk position of the company and of the executive. Check off each point you can answer in the affirmative with documentation available.

• An authority matrix that is defined and up to date: there is a document setting out who can bind the company and up to what amount without further approval.
• Active client due diligence: the company verifies the identity, the source of funds and the risk profile of its clients before receiving significant payments.
• Segregation of duties in financial transactions: the person who proposes a payment is not the one who approves it, and the person who approves it is not the one who records it.
• Minutes of relevant decisions: the decisions of the board, the shareholders' meeting and the committees are recorded in verifiable minutes that identify the participants and the votes.
• An active internal whistleblowing channel: there is a mechanism for employees to report irregularities without reprisal, and that channel has someone responsible for it and a record.
• A documented cash-handling policy: the company has clear rules on cash receipts and cash payments, with limits and mandatory supporting documents.
• Related-party contracts on market terms: transactions between the company and its shareholders, executives or affiliated companies have written contracts and terms that can be justified to third parties.
• Audit or statutory-audit reports preserved: the reports of irregularities and management's responses are filed and can be retrieved.
• A response plan for a summons from the Fiscalía: the company has identified who calls the criminal defense lawyer, what documents are preserved and who speaks to the authorities.
• Knowledge of the rights of the accused: the executives know that they have the right to remain silent, not to incriminate themselves and to choose their own lawyer before making any statement (article 8 CPP).

Mistakes that cost dearly

The 5 mistakes that turn a risk into formal charges

Most of the criminal proceedings against executives that Cafore has analyzed share at least one of these five mistakes. They are not mistakes made in bad faith —most are mistakes of instinct or of improvisation under pressure. But they have concrete procedural consequences.

So you can check it yourself

Laws and case law cited

• Código Penal colombiano — Ley 599 de 2000: arts. 9 (punishable conduct), 10 (statutory definition of the offense), 11 (unlawfulness), 12 (culpability and prohibition of strict liability), 29 (principal liability and representation of a legal entity), 30 (instigators and accomplices, reduction of the penalty), 249 and 250 (criminal breach of trust and the aggravated form), 289 (forgery of a private document), 323 (money laundering: 10–30 years, an autonomous offense, no prior conviction required), 325 (failure to apply controls in financial institutions), 326 (testaferrato).
• Código de Procedimiento Penal — Ley 906 de 2004: art. 8 (rights of the accused: silence, counsel, no self-incrimination), art. 66 (the duty to bring criminal proceedings), art. 122 (incompatibility in the defense), art. 286 (bringing of formal charges), art. 288 (content of the charges), art. 293 (acceptance of the charges), art. 317 (grounds for release on expiry of the statutory time limits: 60/120/150 days), art. 324 (principio de oportunidad), art. 351 (reduction of up to 50% for accepting the charges when they are brought).
• Ley 1708 de 2014 — Código de Extinción de Dominio: a proceeding autonomous from the criminal one; it applies to assets of unlawful origin even where there is no conviction; protection of the third party acting in buena fe exenta de culpa (good faith free of fault).
• Fiscalía General de la Nación — fiscalia.gov.co: frequently asked questions about the adversarial criminal process, and the preliminary inquiry and investigation stages.
• Unidad de Información y Análisis Financiero — uiaf.gov.co: SAGRILAFT obligations, suspicious transactions and non-financial obliged entities.
• Superintendencia Financiera de Colombia — superfinanciera.gov.co: Circular Básica Jurídica, the money laundering risk management system.

Content prepared by Cafore Abogados for general guidance in Colombia. The articles cited come from Ley 599 de 2000 (Código Penal) and Ley 906 de 2004 (Código de Procedimiento Penal), verified against leyes.co. This information guides initial decisions, but it does not replace the specific analysis of the documents, powers, conduct and circumstances of each case. Last editorial review: June 2026.