Colombia

General context, key principles and hot topics

1Identify the highest-profile corporate investigation under way in your country, describing and commenting on its most noteworthy aspects.

The highest-profile corporate investigations in Colombia are those regarding corruption in public contracts, and concessions in sectors such as infrastructure, health and public functions.

Criminal and administrative investigations that gain the highest profile are those related to illegal awards of public contracts, collusion and bribery to obtain public contracts and concessions, and breach of contract to the detriment of public finances and goods.

Odebrecht is currently the highest-profile investigation in Colombia, because of the amounts of money involved; the company has acknowledged paying US$11 million in bribes to government officials between 2009 and 2014 and US$6.5 million in relation to the contract for the Ruta del Sol 2 toll road concession.

As part of the criminal investigations, several other people, including a vice minister, a senator and the former president of Corficolombiana, have been sentenced for their involvement in the Odebrecht corruption case.

2Outline the legal framework for corporate liability in your country.

One of the principles of Colombia’s criminal law is societas delinquere non potest, whereby corporations cannot be held criminally liable. Nevertheless, it is possible for a corporation to be civilly liable in a criminal matter when the conduct of its employees or directors is related to their work or activities within the corporation, such as corruption (Colombian Criminal Procedure Code and Law 600, 2000). The Attorney General’s Office enforces the sanctions and judges rule on the cases.

In terms of administrative liability concerning corrupt conduct, two principal authorities are in charge of imposing sanctions on corporations:

• The Superintendence of Companies imposes administrative sanctions on companies for transnational corruption conduct, under Law 1778, 2016. Additionally, when a sentence is executed against a legal representative or an administrator of a company located in Colombia or a branch of a foreign company, the Superintendence of Companies could impose a fine on the corporation of up to 200,000 times the minimum monthly wage.
• Antitrust practices such as collusion could also be liable to administrative sanctions on corporations as enforced by the Superintendence of Industry and Commerce (Law 256, 1996; Decree 2153, 1992; Law 1340, 2009).

3Which law enforcement authorities regulate corporations? How is jurisdiction between the authorities allocated? Do the authorities have policies or protocols relating to the prosecution of corporations?

Administrative sanctions relating to transnational bribery are enforced by the Superintendence of Companies under Law 1778, 2016.

Other administrative sanctions linked with corrupt practices against free competition are enforced by the Superintendence of Industry and Commerce (Law 256, 1996; Decree 2153, 1992; Law 1340, 2009).

Civil sanctions relating to criminal activities are enforced by the Attorney General’s Office, under the Criminal Procedure Code and Law 600, 2000.

Jurisdiction between the authorities is allocated depending on whether the case is civil, administrative or criminal. However, different authorities can pursue a corporation at the same time for the same conduct in the event that there has been an infringement of different laws or regulations.

Authorities may have internal policies or protocols relating to the prosecution of corporations; nevertheless, procedures are established in the laws, decrees and circulars.

4What grounds must the authorities have to initiate an investigation? Is a certain threshold of suspicion necessary to trigger an investigation?

The Attorney General’s Office is obliged by law to initiate an investigation following a criminal complaint or receipt of information relating to a criminal complaint. There is no need to corroborate the information before the initiation of an investigation. However, prosecutors have the duty to verify the information and gather new evidence before the indictment.

In the same way, administrative authorities, such as superintendencies, have a broad discretion to initiate investigations.

5How can the lawfulness or scope of a notice or subpoena from an authority be challenged in your country?

Under Colombia’s legal framework, natural and legal persons are encouraged to co-operate with the authorities. However, the lawfulness of a notice or subpoena may be challenged in any case with a constitutional action, such as a writ for protection of fundamental rights (amparo).

Depending on the law enforcement authority and the jurisdiction, and when the procedures permit it, ancillary claims or appeals against a subpoena or notice can be made before a fundamental guarantees judge.

6Does your country make use of co-operative agreements giving immunity or leniency to individuals who assist or co-operate with authorities?

Depending on the jurisdiction, co-operative agreements can be made with different authorities.

For some criminal matters, prosecutors may apply the principle of discretionary prosecution principle (Article 324, Criminal Code) or reach a settlement with natural persons who assist or co-operate with authorities.

Under Decree 1523, 2015, companies and natural persons involved in a business cartel may denounce its existence, confess their participation and provide evidence that will allow the authorities to sanction the other participants, and thus obtain total or partial leniency of a fine imposed by the Superintendence of Industry and Commerce for an infringement of free competition.

Additionally, Article 7 of Law 1778, 2016 establishes that sanctions for transnational bribery could be adjusted in consideration of criteria such as collaboration, acknowledgement or express acceptance of an offence.

7What are the top priorities for your country’s law enforcement authorities?

The top priorities for Colombia’s law enforcement authorities are currently illegal drug trafficking, money laundering, financing of terrorism, corruption and antitrust practices.

Cyber-related issues

8Does your country regulate cybersecurity? Describe the approach of local law enforcement authorities to cybersecurity-related failings.

Guidance on cybersecurity is established by the National Council of Economic and Social Policy (CONPES). Two strategy documents – CONPES 3701, 2011 and 3854, 2016 – set forth national cybersecurity policy guidelines with the aim of developing a national strategy to counteract the increase in computer threats that significantly affect the country. In this frame of reference, cybersecurity is defined as the capacity of the state to minimise the level of risk to its citizens and the degree to which they may be affected by cybernetic threats or incidents.

There is a broad national legal framework for cybersecurity relating to data protection, cybercrime and e-commerce, among others.

There are different guidelines for corporations regarding cybersecurity. For example, the Ministry of Information and Communications Technology – which is in charge of promoting the access, effective use and mass appropriation of information and communications technology – has issued guidance regarding the security and privacy of information, and for the assessment of digital security risk Assessment.

Finally, enforcement action in relation to companies’ preparedness for and response to data breaches is taken by the Superintendence of Industry and Commerce. The majority of such incidents relate to data breach protection. However, when breaches become felonies, criminal investigations may be initiated by the Attorney General’s Office.

9Does your country regulate cybercrime? What is the approach of law enforcement authorities in your country to cybercrime?

With Law 1273, 2009, Colombia has included in the Criminal Code more than 10 crimes relating to cybercrime. Under Law 1928, 2018, Colombia adopted the Budapest Convention on Cybercrime.

Special units have been created within the national police service and in the Attorney General’s Office to enforce cybercrime prevention and investigations.

Cross-border issues and foreign authorities

10Does local criminal law have general extraterritorial effect? To the extent that extraterritorial effect is limited to specific offences, give details.

Colombian criminal law has extraterritorial effect in six situations, as set out in Article 16 of the Colombian Criminal Code:

• if a person carries out any of the following acts in a foreign country:
  • crimes against the security of the Colombian state;
  • crimes against the constitutional system;
  • crimes against economic policy (excluding money laundering crimes);
  • crimes against public administration;
  • counterfeiting Colombian currency; or
  • financing terrorism;
• if a person working for the Colombian state is covered by international law immunity and perpetrates a crime in a foreign state;
• when a person working for the Colombian government is not covered by international law immunity but commits a crime other than those listed above, provided the perpetrator has not been convicted of that crime in the foreign country;
• if a Colombian person, except in relation to the aforementioned felonies, is in Colombian territory after committing a crime abroad, and when the sanction under Colombian criminal law is imprisonment of no less than two years, provided the perpetrator has not been convicted of that crime in the foreign country;
• if a foreigner (other than a person described above) is in a Colombian territory after committing a crime abroad that affects the Colombian state or a Colombian national, and when sanction under Colombian criminal law is imprisonment of no less than two years, provided the perpetrator has not been convicted of the crime abroad;
• if a foreign person perpetrates a crime abroad against another foreigner. Nevertheless, the crime must comply with the following conditions:
  • the offender must be in a Colombian territory;
  • Colombian criminal law sanctions the crime with imprisonment of no less than three years;
  • the crime is not political; and
  • extradition has not been granted.

Besides the aforementioned legislation, Colombian criminal law has extraterritorial effect for prosecuting cross-border bribery of a foreign public official in international transactions. This is regulated in Article 433 of the Colombian Criminal Code. (Note that Colombian criminal law only pursues individuals, not corporations.)

11Describe the principal challenges that arise in your country in cross-border investigations, and explain whether and how such challenges depend on the other countries involved.

The principal challenges that arise in cross-border investigations in Colombia are to:

• accomplish a constant and effective communication between the two countries’ authorities that are in charge of the legal investigation and prosecution of the crimes;
• ensure that each country’s authorities fully exchange useful information pertaining to criminal investigations;
• ensure effective co-operation between the countries involved, to carry out the legal investigation and prosecution of the felonies;
• identify (in the event that the countries with different laws regarding the same event) which legal framework is applicable;
• ensure that the legal authorities in the countries involved in cross-border investigations apply any precautionary measures requested by other states; and
• ensure that the legal authorities of the countries involved in cross-border investigations pursue assets relating to foreign felonies requested by other states.

12Does double jeopardy, or a similar concept, apply to prevent a corporation from facing criminal exposure in your country after it resolves charges on the same core set of facts in another? Is there anything analogous in your jurisdiction to the ‘anti-piling on’ policy as exists in the United States (the Policy on Coordination of Corporate Resolution Penalties) to prevent multiple authorities seeking to penalise companies for the same conduct?

Double jeopardy is established in Article 8 of the Colombian Criminal Code, specified as a prohibition of double criminality, in that no person can be charged more than once for the same criminal conduct, regardless of the name given to the conduct in other countries (provided that the core set of facts are the same).

13Are ‘global’ settlements common in your country? What are the practical considerations?

Global settlements are not legally binding nor are they common; however, Colombia has signed international treaties and co-operation agreements with various countries, including Peru, Brazil and Spain, for mutual assistance in pursuing certain crimes, such as cross-border bribery and corruption.

14What bearing do the decisions of foreign authorities have on an investigation of the same matter in your country?

According to the Colombian legal system in criminal matters, the decisions issued by a foreign authority abroad shall be legally binding for all judicial proposes. Therefore, the notion of prohibition of double criminality or double jeopardy, would also apply in this case.

However, this rule does not apply to decisions made abroad in connection with the following situations:

• when a Colombian national commits a crime abroad on a state-owned or state-operated ship or aircraft;
• when a person commits any of the following felonies in a foreign country:
  • crimes against the security of the Colombian state;
  • crimes against the constitutional system;
  • crimes against the economic policy (excluding money laundering);
  • crimes against public administration; or
  • counterfeiting Colombian currency; or
• if a person working for the Colombian state, who is covered by international law immunity, perpetrates the crime abroad.

Economic sanctions enforcement

15Describe your country’s sanctions programme and any recent sanctions imposed by your jurisdiction.

In an administrative case that falls under its jurisdiction, the Superintendence of Companies an impose the following administrative sanctions on a corporation for transnational corruption conduct (Law 1778, 2016): (1) disqualification from contracting with the Colombian government for up to 20 years; (2) a fine of up to 200,000 times the statutory monthly minimum wage; (3) publication in national newspapers, and on the website of the sanctioned legal entity, of an excerpt from the sanctioning administrative decision, for up to one year; (4) disqualification from receiving any type of incentive or subsidy from the government for five years.

Since Colombia does not have criminal liability for corporations, the sanctions on natural persons in a case of bribery could be imprisonment, a fine of between 66.66 and 150 times the statutory monthly minimum wage, or disqualification from contracting with the Colombian government for up to 20 years.

However, the disqualification from contracting with the Colombian government will extend to the corporation, its parent, its subordinates and the branches of foreign companies, with the exception of limited companies, if (1) the actions of the natural person involved in corruption crimes relate to the corporation’s activities and (2) if a convicted person is an administrator, legal representative, member of the board of directors, or controlling partner or shareholder of the company.

Currently, numerous corruption investigations are being carrying out by different authorities; nevertheless, until now, only the Superintendence of Companies has imposed a significant fine on a corporation (4.6 billion Colombian pesos) in the framework of an agreement.

16What is your country’s approach to sanctions enforcement? Has there been an increase in sanctions enforcement activity in recent years, for example?

Since Law 1778, 2016 came into force, there has been an increase in enforcement activity relating to corruption investigations involving corporations and individuals; nonetheless, most of them are still under investigation, and therefore no sanctions have yet been applied.

17Do the authorities responsible for sanctions compliance and enforcement in your country co-operate with their counterparts in other countries for the purposes of enforcement?

Law 1573, 2012 promotes co-operation between the Colombian authorities and their counterparts in other countries for the purposes of enforcement of anti-corruption legislation. The Criminal Procedure Code and statutes such as Law 1778, 2016 also allow for international co-operation in investigations.

18Has your country enacted any blocking legislation in relation to the sanctions measures of third countries? Describe how such legislation operates.

Colombia has not enacted any blocking legislation in relation to the sanctions measures of third countries. However, Colombia is a party to the United Nations Security Council Consolidated List of sanctions and it is common practice for reference to be made to the sanctions list compiled by the Office of Foreign Assets Control of the US Department of the Treasury.

19To the extent that your country has enacted any sanctions blocking legislation, how is compliance enforced by local authorities in practice?

Not applicable.

Before an internal investigation

20How do allegations of misconduct most often come to light in companies in your country?

Allegations of misconduct in Colombia most often come to light by means of media reports and criminal complaints. It has become more common that former employees of companies file complaints against it; therefore, whistleblowers are also relevant in allegations of misconduct. Note that collaboration agreements for whistleblowers are being vigorously enforced by the authorities.

Information gathering

21Does your country have a data protection regime?

Individuals in Colombia have the constitutional right to be aware of, update and rectify the information about them in databases. This constitutional right is implemented by specific legislation on personal data protection and privacy – primarily by Law 1581, 2012, Decree  1377, 2013, Decree 1074, 2015 and certain additional implementing regulations.

There is also a separate specific regulation, primarily contained in Law 1266, 2008, that regulates the collection, use and transfer of financial information (i.e., credit, risk and banking information).

22To the extent not dealt with above at question 8, how is the data protection regime enforced?

The data protection regime is enforced by the Superintendence of Industry and Trade (hereinafter SIC), which has the power to initiate administrative investigations, ex officio or at the request of an interested third party. The SIC is active in its enforcement of the data protection regime, but the likelihood of an enforcement action will ultimately depend on the type of irregularity or infraction, and how it is brought to the SIC’s attention. For any kind of violation of Colombian data protection regulations, the SIC may:

• impose sanctions (e.g., fines of up to 1.475 billion pesos, temporary suspension or cancellation of activities related to data processing); or
• order preventive measures (e.g., issue instructions to protect personal data).

The SIC may also co-operate with international data protection authorities when a foreign legal entity is violating the data protection rights of individuals located in Colombia.

23Are there any data protection issues that cause particular concern in internal investigations in your country?

Under Colombian data protection regulations, any type of processing of personal data requires prior and informed consent. Moreover, personal data must be collected for specified, explicit and legitimate purposes. Thus, save for certain exceptions (e.g., public data, or information required by a government entity or in connection with judicial proceedings, among others), personal data may only be processed with prior consent and for the specific purposes for which it was collected.

Additionally, even in an internal investigation, individuals must be afforded all the rights granted by data protection laws.

24Does your country regulate or otherwise restrict the interception of employees’ communications? What are its features and how is the regime enforced?

The interception of employees’ communications may be legal as part of an internal audit or investigation. Nevertheless, the scope of that interception must remain restricted to corporate emails and other correspondence relating to company matters. Investigation of any other communications will be illegal without prior authorisation by a judge.

Dawn raids and search warrants

25Are search warrants or dawn raids on companies a feature of law enforcement in your country? Describe any legal limitations on authorities executing search warrants or dawn raids, and what redress a company has if those limits are exceeded.

Yes. According to Articles 219 to 232 and 237 of the Criminal Procedure Code (Law  906, 2004), the following legal limitations apply to any authority executing a search warrant or a dawn raid:

• a written order from the prosecutor must exist, unless:
  • the owner or the holder of the property agrees with the authorities that the written order is not necessary;
  • the property is an open field, abandoned or in full public view; or
  • there is an emergency;
• the written order must be limited to a specific area of the property;
• the purpose of the written order is to gather evidence or to capture the possible liable person;
• a probable cause shall exist relating to the existence of evidence or that the possible liable person is inside the property; and
• a judge must study the dawn raid procedure within 24 hours after the competent authority has submitted its activity report, and confirm whether Colombian law has been respected.

If the above conditions are not met, the authority cannot admit any of the evidence that has been collected, and if a person has been captured, the authority must free him or her.

Furthermore, although there is no automatic redress, if the limitations are not observed, there may be legal consequences for the authority, such as for prevarication.

26How can privileged material be lawfully protected from seizure during a dawn raid or in response to a search warrant in your country?

During a dawn raid, a company or natural person can ask the authority in charge directly not to seize privileged material. If the authority nevertheless seizes this kind of material, the company or natural person can note this irregular situation in the dawn raids record.

Furthermore, the company or natural person whose privileged material has been seized can ask for a hearing to be held, at which a judge will study the specifics of the case and determine whether the material could be seized or not.

The authority must exclude from the investigation and process all privileged material that could be seized unlawfully.

27Under what circumstances may an individual’s testimony be compelled in your country? What consequences flow from such compelled testimony? Are there any privileges that would prevent an individual or company from providing testimony?

The general rule for an individual’s testimony to be compelled is that anyone with knowledge about relevant facts that are investigated by the authority has the duty to testify. The person testifying must refer only to the truth, or otherwise be at risk of committing perjury. The principal exceptions to this duty are the privilege of professional secrecy and the right against self-incrimination or incriminating a relative.

Whistleblowing and employee rights

28Describe the whistleblowing framework in your country. What financial incentive schemes exist for whistleblowers? What legal protections are in place for whistleblowers?

In view of Colombia’s history of civil war and the fight against illegal drugs and terrorism, there is a broad protection programme for informers, victims and public officials, mostly in connection with investigations relating to terrorism, illegal drugs, sexual harassment and violence. Nevertheless, in high-profile corruption cases too, whistleblowers may request protection.

The programme is under control of the Attorney General’s Office and the National Protection Unit. There are also financial incentive schemes for whistleblowers, which are authorised by the government through the Ministry of Defence.

Further, Article 19 of Law 1778, 2016 establishes some benefits for whistleblowers in transnational corruption cases, such as total or partial exoneration of an administrative sanction.

The Superintendence of Companies also promotes the existence of whistleblower channels in corporations as good anti-corruption practice.

29What rights does local employment law confer on employees whose conduct is within the scope of an investigation? Is there any distinction between officers and directors of the company for these purposes?

Colombian law does not limit employees’ rights within the scope of internal or external investigations and there is no distinction between officers or directors for these purposes. Nonetheless, employees whose work requires monitoring and enforcing could be subject to internal company controls or have their employment agreement terminated if they are found to be in breach of their labour obligations.

To sanction an employee, a company must comply with the disciplinary procedure incorporated in both its employee handbook and the constitutional guidelines set forth in Ruling C-593 of 2014, which require the employer to notify the employee of:

• the date of the disciplinary procedure;
• the possibility of being accompanied by a co-worker during the procedure; and
• the misconduct that led to the procedure.

In addition, the employee has the right to:

• provide evidence and arguments that contradict the allegations made by the employer;
• evaluate the evidence submitted by the employer; and
• appeal any and all sanctions imposed.

30Do employees’ rights under local employment law differ if a person is deemed to have engaged in misconduct? Are there disciplinary or other steps that a company must take when an employee is implicated or suspected of misconduct, such as suspension or in relation to compensation?

Colombian law does not limit or differentiate rights for employees who are considered to have engaged in misconduct. A company may take disciplinary measures against such employees, following the disciplinary procedure set forth in its employee handbook and the constitutional guidelines.

Furthermore, employees whose job descriptions include additional ethical compliance obligations may have their employment agreement terminated for cause, in which case, the employee shall not be entitled to the legal severance payment.

31Can an employee be dismissed for refusing to participate in an internal investigation?

Yes. If this conduct has been included in the employment contract, handbook or company policy as a cause for termination of the employment agreement, the employer may terminate the labour relationship with cause.

Commencing an internal investigation

32Is it common practice in your country to prepare a document setting out terms of reference or investigatory scope before commencing an internal investigation? What issues would it cover?

Preparing a document setting out the terms of reference or investigatory scope before commencing an internal investigation will depend on a company’s internal audit structure, its experience and the information available; however, it is common for internal auditors and members of a company’s compliance department to do this.

33If an issue comes to light prior to the authorities in your country becoming aware or engaged, what internal steps should a company take? Are there internal steps that a company is legally or ethically required to take?

There are no internal steps that companies are legally required to take. Nevertheless, it is important for the company to follow its own good practice policy. For instance, first, the company should conduct an internal investigation (using internal resources or hiring a third party specialist in auditing and risk consultancy) to enable it to gather information and documentation about the issue. Once the issue has been analysed and the compliance officer has assessed the risk, it is important to report the matter to the board. The compliance officer may consult an expert to gain an understanding of the possible consequences for the company, and thus be able to offer proper advice to the board regarding the best course of action to be taken. The board will decide whether to denounce the issue to the authorities, provided it is not mandatory under the Criminal Code.

34What internal steps should a company in your country take if it receives a notice or subpoena from a law enforcement authority seeking the production or preservation of documents or data?

Colombia’s legal framework encourages individuals and corporations to co-operate with the authorities. Nevertheless, the lawfulness of a notice or subpoena may be challenged in any case with a constitutional action such as a writ for the protection of fundamental rights (amparo) or, in criminal case, before a fundamental guarantee judge.

35At what point must a company in your country publicly disclose the existence of an internal investigation or contact from a law enforcement authority?

An internal investigation or contact from a law enforcement authority are confidential; therefore, there is no legal obligation to publicly disclose their existence.

Decree 2555, 2010 establishes that companies registered on the Colombian Stock Exchange must disclose ‘relevant events’. Contact from a law enforcement authority could be interpreted as a relevant event if, for example, it could affect the share price or the company value.

36How are internal investigations viewed by local enforcement bodies in your country?

The authorities always welcome internal investigations as a sign of co-operation. There are no requirements regarding the conduct or form of internal investigations, except for labour internal investigations, as discussed in question 29.

Attorney–client privilege

37Can attorney–client privilege be claimed over any aspects of internal investigations in your country? What steps should a company take in your country to protect the privilege or confidentiality of an internal investigation?

Attorney–client privilege may be claimed over communications or any kind of information exchanged between a lawyer and a client.

A company should have a professional relationship (i.e., a written contract) with external counsel and all communications or information shall refer to the matter of this relationship. Furthermore, the protected material shall specify that it is covered by attorney–client privilege.

38Set out the key principles or elements of the attorney–client privilege in your country as it relates to corporations. Who is the holder of the privilege? Are there any differences when the client is an individual?

There is a general obligation for all professionals, including attorneys, to keep professional secrecy. Article 74 of the Colombian Constitution sets forth that professional secrecy is inviolable. This privilege protects the privacy as its underlying interest (Article 15, Colombian Constitution).

Attorneys must refuse to disclose or testify about a client’s information. Lawyers cannot be compelled to testify against their clients. Nevertheless, lawyers can be excused from complying with this duty if they know that a crime has been, or is going to be, committed.

The holder of the attorney–client privilege is the client.

39Does the attorney–client privilege apply equally to in-house and external counsel in your country?

Although there is not a specific law that differentiates between in-house and external counsel regarding professional secrecy, currently it is considered that the privilege applies only to external counsel.

40Does the attorney–client privilege apply equally to advice sought from foreign lawyers in relation to (internal or external) investigations in your country?

The attorney–client privilege applies equally to advice sought from foreign lawyers in relation to an investigation in Colombia.

41To what extent is waiver of the attorney–client privilege regarded as a co-operative step in your country? Are there any contexts where privilege waiver is mandatory or required?

The waiver of the attorney–client privilege is not necessarily considered a co-operative step. What triggers co-operative conduct is the fact that any person will share information about the investigation. In addition, there is not a specific context in which the privilege waiver is mandatory. However, there will be a lawyer will not be penalised if he or she contributes to stopping a crime from being committed.

42Does the concept of limited waiver of privilege exist as a concept in your jurisdiction? What is its scope?

Yes. As the client is the holder of the privilege, he or she can specify what part of the information he or she wishes to share and with what authority.

43If privilege has been waived on a limited basis in another country, can privilege be maintained in your own country?

If privilege has been waived on a limited basis in another country, it can be maintained in Colombia.

44Do common interest privileges exist as concepts in your country? What are the requirements and scope?

The concept of common interest privileges does not exist in Colombia.

45Can privilege be claimed over the assistance given by third parties to lawyers?

Yes. This could pertain to a new relationship protected with a new privilege, or part of the attorney–client privilege if the assistance relates to the same matter.

Witness interviews

46Does your country permit the interviewing of witnesses as part of an internal investigation?

Colombia allows witnesses to be interviewed as part of an internal investigation.

47Can a company claim attorney–client privilege over internal witness interviews or attorney reports?

Attorney–client privilege includes all the activities and information known by the attorney, if they relate to the attorney–client relationship. A company can claim attorney–client privilege in this situation.

48When conducting a witness interview of an employee in your country, what legal or ethical requirements or guidance must be adhered to? Are there different requirements when interviewing third parties?

When interviewing with an employee or a third party in Colombia, the following steps are recommended:

• informing the interviewee:
  • who is the attorney’s client;
  • that he or she has the right to have his or her own representation;
  • about the facts that are being investigated and the purpose of the interview;
  • that only the truth is expected and that possible falsehoods will be communicated to the authority;
  • if he or she is an employee, about the company’s relevant internal policies;
• avoiding incriminating questions; and
• drawing up a record of the interview, which should include a signed declaration by the witness that the deposition was given voluntarily.

49How is an internal interview typically conducted in your country? Are documents put to the witness? May or must employees in your country have their own legal representation at the interview?

An internal interview will typically include the following:

• explaining the nature of the investigation;
• asking questions to elicit personal information about the interviewee and his or her background;
• asking the witness about the facts being investigated;
• putting to the witness relevant documents found during the investigation – with prior authorisation from the client – and asking him or her about them; and
• listening to the witness’s deposition.

The interview should be recorded and that record should be signed by the interviewee.

Employees may have their own legal representation.

Reporting to the authorities

50Are there circumstances under which reporting misconduct to law enforcement authorities is mandatory in your country?

Article 67 of the Criminal Procedure Code sets forth a general duty of reporting misconduct to law enforcement authorities. Nevertheless, in accordance with Article 441 of the Criminal Code, a penalty for non-compliance with this obligation will only be applicable when the said misconduct relates to genocide, enforced displacement, torture, enforced disappearance, homicide, kidnapping, terrorism, illicit enrichment, drug trafficking, money laundering, or any other misconduct that may affect sexual integrity.

51In what circumstances might you advise a company to self-report to law enforcement even if it has no legal obligation to do so? In what circumstances would that advice to self-report extend to countries beyond your country?

A company should self-report to law enforcement when any misconduct has been committed that jeopardises the company’s legal activity, even if there is no legal obligation to do so.

In addition, the company should self-report in other countries when the misconduct could have a negative impact outside Colombia.

52What are the practical steps you need to take to self-report to law enforcement in your country?

An internal investigation regarding the misconduct should be carried out, and all relevant documents and information collected. The company should be advised about the legal consequences of the misconduct and the self-reporting. Depending on the case, the company should hire an attorney to ascertain the legal requirements for the self-report and its consequences.

The person or entity should co-operate with the competent authority during the investigation and ask the authorities to be admitted as a victim, provided this possibility is pertinent to the case.

Responding to the authorities

53In practice, how does a company in your country respond to a notice or subpoena from a law enforcement authority? Is it possible to enter into dialogue with the authorities to address their concerns before or even after charges are brought? How?

Prior to filing charges, it is customary that the authorities enter into a dialogue with the company (except in a criminal investigation). The company should appear before the authority within the established notification period, be engaged in the case so that it can be informed, provide the necessary evidence and exercise its right to a defence.

The Colombian administrative sanctioning proceeding involves a preliminary investigation in which the authority determines whether there are reasons to open a formal investigation and to file charges. During the preliminary investigation, the authority is allowed to request the company’s information, make inspections of the company’s facilities, examine computers and obtain testimonies from the company’s workers, officers and directors.

Throughout a preliminary investigation, some authorities, such as the Superintendence of Industry and Commerce, may allow the voluntary offering of information, and if the company offers warranties to the authority, its penalties may be reduced.

Overall, preliminary investigations are subject to confidentiality.

54Are ongoing authority investigations subject to challenge before the courts?

Only a deciding administrative act can be appealed and challenged before the courts. A ‘deciding administrative act’ is defined as one that resolves the merits of the specific case and can produce a definitive legal effect. As such, authorities’ decisions to initiate preliminary investigations and request evidence are not subject to judicial control in general.

Nevertheless, if within the investigation period there is a violation of the right of a fair proceeding, or if there is an infraction of a fundamental right, the company can file a constitutional injunction, which should be resolved by the court within 10 days.

55In the event that authorities in your country and one or more other countries issue separate notices or subpoenas regarding the same facts or allegations, how should the company approach this?

There is no standard practice as to how a company should act in this situation. The existence of a foreign investigation does not create effects to an investigation in Colombia per se. Recently, Colombian and foreign authorities have engaged in joint investigations in administrative matters. Colombian authorities are not obliged to follow foreign decisions, although in many cases they can be directly recognised in Colombia or through special proceedings.

56If a notice or subpoena from the authorities in your country seeks production of material relating to a particular matter that crosses borders, must the company search for, and produce material, in other countries to satisfy the request? What are the difficulties in that regard?

If a notice or subpoena from the authorities in Colombia seeks production of material relating to a particular matter that crosses borders, the company must search for and produce the documents in other countries to satisfy the request, unless it is impossible under the laws of the foreign country to obtain or reveal such information. The General Procedural Code establishes that when it is easier for one party to the process to prove certain facts, that party has the burden of providing the material to the authority. When the documents are in another language, they should be translated by an official translator and sent to the Ministry of Foreign Affairs for legalisation and apostilles as required by the relevant countries involved.

The costs of the translation and the time taken for the Ministry of Foreign Affairs to legalise the translation of the documents may be considered as difficulties.

57Does law enforcement in your country routinely share information or investigative materials with law enforcement in other countries? What framework is in place in your country for co-operation with foreign authorities?

Law enforcement in Colombia may share information or investigative materials with law enforcement in other countries, depending on the authority that is requesting the information. Recently Colombia has become a member of the Organisation for Economic Co-operation and Development (OECD), which has led to Colombia signing different types of agreements for the exchange of information with international authorities, mostly concerning tax requirements compliance.

There is frequently an exchange of information with international authorities when the matter concerns trust, financial, criminal and corporate authorities.

Framework for co-operation with foreign authorities in Colombia

• Foreign Account Tax Compliance Act
• Foreign Corrupt Practices Act
• American Convention Against Corruption
• UN Convention Against Corruption
• OECD Anti-Bribery Convention
• Basel Committee (Basel III: International Regulatory Framework for banks)
• Law 1474, 2011
• Law 1712, 2014
• Law 1778, 2016
• Organic Statute of the Financial System
• Decree 1848, 2016
• Circular Externa 100-00005 of the Superintendence of Companies
• Decree 950, 1995

58Do law enforcement authorities in your country have any confidentiality obligations in relation to information received during an investigation or onward disclosure and use of that information by third parties?

The enforcement authorities in Colombia should act according to the legal requirements regarding retention and secrecy for any type of information relating to fundamental and constitutional assets, especially when there is an ongoing judicial proceeding. Individuals can also request certain authorities (antitrust, financial, corporate and tax) to grant special confidentiality to the information disclosed during an investigation.

Concerning commercial companies, an authority is only allowed to order the disclosure of commercial books and papers for the following purposes:

• appraisal of taxes;
• surveillance of credit institutions, commercial companies and institutions of common utility;
• investigation of crimes; and
• bankruptcy and liquidation of companies in both cases and of successions in the latter.

There may be partial disclosure of commercial books in a situation other than as listed above, and the authority can only examine what is related to the specific litigation.

The disciplinary code for public authorities contains a ban on allowing access to records, documents or information by unauthorised persons during and after an investigation.

59How would you advise a company that has received a request from a law enforcement authority in your country seeking documents from another country, where production would violate the laws of that other country?

A company that has received such a request should oppose the release of information establishing that the production of the content of the documents would violate the law in the other country. In this event, it is important that the company obtains a legal opinion with the translation of the support regulations, explaining why it is impossible under law to obtain, furnish or reveal that information.

60Does your country have secrecy or blocking statutes? What related issues arise from compliance with a notice or subpoena?

• Law 1581, 2012 establishes that any person who intervenes in the management of personal data is obliged to secure the confidentiality of that information.
• Decree 2153, 1992 establishes that natural or legal persons subject to Superintendence of Industry and Commerce investigations may request that any information regarding business secrecy, or information that is to be supplied during the investigation and the administrative process, be kept confidential. The company should paste a non-confidential summary of the matters included in the document on top of the privileged document. If the authority fails to meet this request, it is liable to disciplinary penalties.
• Law 1712, 2014 establishes that anyone can appeal a request for information when it involves commercial, industrial or professional secrets.

All information subject to investigation that is determined by its owners to be confidential cannot be accessed by third parties other than those who are part of the relevant judicial process.

61What are the risks in voluntary production versus compelled production of material to authorities in your country? Is this material discoverable by third parties? Is there any confidentiality attached to productions to law enforcement in your country?

There is a potential risk relating to how the competent authority may interpret the behaviour of a company with regard to the compelled production of material. Nevertheless, that interpretation is not a substantive merit against the party that produces material. Private persons can also request certain authorities (antitrust, financial, corporate and tax) to grant special confidentiality to the information disclosed during an investigation.

Prosecution and penalties

62What types of penalties may companies or their directors, officers or employees face for misconduct in your country?

Penalties under the Criminal Code that directors, officers or employees may face for misconduct in Colombia (depending on the crime) include:

• imprisonment;
• fines;
• seizure of goods and instruments used in committing the misconduct;
• disgorgement;
• forfeiture; or
• disqualification – for up to 20 years – from participating, directly or through a representative, in public contracting procedures such as public bids and government contracts.

Under the Criminal Procedure Code and Criminal Code, companies will be subject to a civil sanction that consists of paying for all the damage caused by the misconduct of their employees or directors, fines and disqualification from contracting with the government for up to 20 years.

63Where there is a risk of a corporate’s suspension, debarment or other restrictions on continuing business in your country, what options or restrictions apply to a corporate wanting to settle in another country?

This does not apply in Colombia.

64What do the authorities in your country take into account when fixing penalties?

When fixing penalties in transnational corruption cases, the Colombian authorities may consider a graded series of criteria for sanctions (Article 7, Law 1778, 2016), based on the following:

• the economic benefit obtained or intended by the offender by his or her conduct;
• the greater or lesser capital capacity of the offender;
• the repetition of behaviour;
• the resistance, refusal or obstruction to the investigative or supervisory action and the procedural conduct of the offender being investigated;
• the use of means or of the person interposed to hide the infraction, the specific benefits or money, the goods or services susceptible to economic valuation, or any benefit or utility, offered or delivered to a national or foreign public official, or any of the effects of the infraction;
• the recognition or express acceptance of the infraction before the decree of evidence;
• the existence and compliance of transparency and business ethics programmes or anti-corruption mechanisms within the company, in accordance with the provisions of Article 23 of Law 1779, 2016;
• the degree of compliance with precautionary measures;
• if an appropriate due diligence process has been carried out, prior to a merger, spin-off, reorganisation or acquisition of control process in which the company committing the infraction is involved; and
• if the authorities responsible for sanctioning commission of behaviours set forth in Article 2 of Law 1778, 2016 by employees, legal representative or shareholders, have been informed in accordance with the provisions of Article 19 of Law 1778, 2016.

Resolution and settlements short of trial

65Are non-prosecution agreements or deferred prosecution agreements available in your jurisdiction for corporations?

Under Law 1778, 2016 (administrative liability of legal entities for acts of transnational corruption), non-prosecution or deferred prosecution agreements are not available in Colombia for corporations.

66Does your jurisdiction provide for reporting restrictions or anonymity for corporates that have entered into non-prosecution agreements or deferred prosecution agreements until the conclusion of criminal proceedings in relation to connected individuals to ensure fairness in those proceedings?

Under Law 1778, 2016 (administrative liability of legal entities for acts of transnational corruption), Colombia does not provide for reporting restrictions or anonymity for corporates that have entered into non-prosecution or deferred prosecution agreements until the conclusion of criminal proceedings in relation to connected individuals to ensure fairness in those proceedings.

67Prior to any settlement with a law enforcement authority in your country, what considerations should companies be aware of?

Under Law 1778, 2016, settlements with law enforcement authorities cannot be reached through agreement or negotiation. Although Law 1778 allows the authority to grant benefits in exchange for effective collaboration, the process for obtaining those benefits is not a negotiation but rather consists of filing a request with admissions of wrongdoing and supporting evidence for the same, and the authority will unilaterally determine the effectiveness of the alleged collaboration and make its own decision.

68To what extent do law enforcement authorities in your country use external corporate compliance monitors as an enforcement tool?

Law enforcement authorities in Colombia do not use external compliance monitors as an enforcement tool.

69Are parallel private actions allowed? May private plaintiffs gain access to the authorities’ files?

No. Access to Law 1778 files is very restricted.

Publicity and reputational issues

70Outline the law in your country surrounding publicity of criminal cases at the investigatory stage and once a case is before a court.

Under Colombia’s Criminal Procedure Code (which applies only to natural persons), preliminary investigations undertaken by the prosecutor are classified. Therefore, information relating to the case will not be made public until the indictment. The Criminal Procedure Code provides that all hearings must be public. However, judges may make some exceptions in relation to the publicity of certain criminal hearings.

71What steps do you take to manage corporate communications in your country? Is it common for companies to use a public relations firm to manage a corporate crisis in your country?

It is common for companies to use a public relations (PR) firm to manage a corporate crisis, and larger companies will have their own PR and communications department. In either situation, it is also common for companies to hire criminal and compliance lawyers to work on the matter with their communications team.

72How is publicity managed when there are ongoing related proceedings?

Ongoing proceedings are confidential until the indictment hearing. However, the media are always interested in high-profile cases, and will therefore gather confidential information, which is usually provided by the parties or authorities involved in the case.

When trials begin – since they are open to the public – it is common for the media to attend high-profile cases.

It is also common for individuals or companies to use the media to expose their case arguments to generate positive public opinion and to try to put pressure on the authorities.

Duty to the market

73Is disclosure to the market in circumstances where a settlement has been agreed but not yet made public mandatory?

Agreements may be confidential; thus, it depends on the kind of agreement that has been reached.

However, an excerpt from the sanctioning administrative decision sentence for trans­national corruption will be published in newspapers and on the website of the sanctioned legal entity for a maximum of one year.

Anticipated developments

74Do you expect to see any key regulatory or legislative changes emerge in the next year or so designed to address corporate misconduct?

During the next two legislative periods, we expect to see key legislative changes such as the approval of a law regarding criminal liability of corporations, as has been suggested and requested by the OECD. Therefore, compliance programmes will also be more regulated and enforced by different authorities.

Footnotes