Colombia

General context, key principles and hot topics

1 Identify the highest-profile corporate investigation under way in your country, describing and commenting on its most noteworthy aspects.

The highest-profile corporate investigation in Colombia is that against Odebrecht, not only for the amounts involved in the illegal transactions but also for the number of people that have been investigated, indicted or convicted. According to the Attorney General’s Office of Colombia, amounts paid in bribes in this case exceeded 148 billion pesos. Additionally, more than 120 persons have been tied to this investigation; 54 persons have been indicted and 18 persons have been convicted, including a vice minister and a senator.

2 Outline the legal framework for corporate liability in your country.

There are no criminal proceedings (prosecutions) against companies under Colombian law. Investigation of legal entities is purely administrative and independent from the criminal liability of natural persons. However, a corporation can face the following sanctions:

• cancellation of its legal status within the criminal procedure when it is proved that the legal entity was used, totally or partially, to commit crimes;
• imposition of civil liability within the criminal procedure when a director or employee is involved in the criminal process for having committed corruption offences. This liability is ancillary because it depends on the conviction of the employee or director;
• debarment ipso jure after directors or controller partners are criminally convicted;
• in antitrust cases, imposition of significant fines within an administrative proceeding led by the Superintendence of Industry and Commerce, and
• imposition of harsh penalties within an administrative proceeding under the following conditions: (1) if a director or employee has been convicted of crimes against the public administration, environment, economic and social order, financing of terrorism or organised crime, management of resources relating to terrorism or organised crime, or any activities associated with misappropriation of public property, or has reached a pretrial resolution based on the principle of discretionary prosecution (principio de oportunidad) in the course of investigation of the aforementioned offences or relevant court proceedings; (2) if an organisation has gained either directly or indirectly or tried to gain undue advantage from a crime committed by an employee; and (3) if an organisation permitted a crime or allowed for its commission by its acts or omissions. In this situation, potential penalties include:
  • a fine of up to 200,000 monthly wages (roughly 247 billion pesos) and mandatory forfeiture of the alleged benefit or the benefit gained from the offence. Upon the decision of the competent authority, up to 10 per cent of the fine can be used to implement, improve or update transparency and business ethics programmes within the organisation that was held liable;
  • the publication of an abstract of the decision concerning the liability of the organisation in the media and on the organisation’s corporate website;
  • prohibition from receiving any sort of material aid or subsidies from the state for 10 years (previously, the maximum term was five years);
  • prohibition from participating in public procurement and contracting for 20 years;
  • dismissal of employees with managerial functions who were found guilty, and suspension of the individuals who condoned the unlawful conduct; and
  • inclusion of information about the organisation held liable in a public register.

Typically, the individuals within an organisation who will face criminal sanctions are its legal representatives.

3 Which law enforcement authorities regulate corporations? How is jurisdiction between the authorities allocated? Do the authorities have policies or protocols relating to the prosecution of corporations?

The enforcement authorities empowered to investigate and prosecute corporate conducts depend on the specific matter under investigation:

• The Attorney General’s Office investigates criminal activities conducted by individuals.
• The Superintendence of Companies investigates corporate activity in respect of transnational bribery, money laundering and violations of local corruption laws.
• The Superintendence of Industry and Commerce investigates anticompetitive conduct by individuals and corporations.
• The Financial Superintendence investigates securities and banking law matters.

Jurisdiction is allocated depending on the nature of the laws or regulations that have been infringed. Nothing prevents a case from being pursued simultaneously by different authorities. Even though policies or protocols relating to the prosecution of corporations may exist, they are not communicated to the public nor are they established in any official regulation.

4 What grounds must the authorities have to initiate an investigation? Is a certain threshold of suspicion necessary to trigger an investigation?

The Attorney General’s Office has ample discretion to initiate a criminal investigation. Generally, the prosecutor learns of criminal charges when a complaint is filed by the victim or the witness of a crime, or de officio. The pretrial discovery stage is closed and conducted under the sole direction of the prosecutor. There is no debate at this stage. However, persons who become aware of criminal investigations against them can request disclosure of the evidence. If there is a reasonable inference that a person is the author of a crime, the prosecutor formally notifies the person that they are the subject of an official criminal investigation at an indictment heading. The accused is entitled to the right to be represented by counsel at this hearing, and the judge decides on the imposition of security measures involving, or not involving, the deprivation of liberty.

Administrative authorities, such as the Superintendence of Corporations, also have discretion to initiate investigations.

5 How can the lawfulness or scope of a notice or subpoena from an authority be challenged in your country?

The scope of a notice or subpoena issued by an authority can be limited as follows:

• written communications, conversations, digital documents, videos, recordings and illustrations between defendants and their attorneys are protected;
• communications between a defendant and other persons who are exempted by law from testifying, such as spouses or relatives within the fourth degree of consanguinity or second degree of affinity relationship, are also protected;
• parties are not compelled to produce privileged information or information about facts that are not related to the accusation; and
• parties and non-parties can assert the privilege against self-incrimination. Invoking the right against self-incrimination cannot be used to impute guilt at trial.

Additionally, the lawfulness of a notice or subpoena may be challenged if it violates fundamental rights through a constitutional action known as acción de tutela.

6 Does your country make use of co-operative agreements giving immunity or leniency to individuals who assist or co-operate with authorities?

In criminal proceedings, if a defendant self-discloses wrongdoing or voluntarily shares information with the prosecutors in connection with its investigation, the prosecutor may agree to charge the defendant with a lesser offence. If the defendant agrees to plead guilty at the indictment, their sentence will be reduced by up to half. If the defendant accepts responsibility at the preparatory hearing, they will get a reduction of up to one-third of the conviction. If this happens during the oral trial, the defendant will get a reduction of up to one-sixth of the conviction.

In administrative proceedings, leniency programmes are operated under administrative rules by both the Superintendence of Industry and Commerce and the Superintendence of Corporations and both contemplate complete and partial amnesty for fines imposed on organisations and individuals who confess to having participated in unlawful conduct and who provide timely, detailed and effective assistance to the authority that is competent for detecting, investigating and prosecuting the conduct involved.

7 What are the top priorities for your country’s law enforcement authorities?

The top priorities for Colombia’s law enforcement authorities are money laundering, trans­national bribery, local corruption, collusion and antitrust practices.

8 To what extent do law enforcement authorities in your jurisdiction place importance on a corporation having an effective compliance programme? What guidance exists (in the form of official guidance, speeches or case law) on what makes an effective compliance programme?

The adoption and effectiveness of a compliance programme is a factor in the mitigation of sanctions.

For example, Law 1778/2016 establishes that the existence and execution of an effective compliance programme is a mitigating factor when applying penalties to companies that have engaged in transnational bribery. The Superintendence of Corporations has issued guidelines detailing the basic elements of compliance programmes, as follows:

• the appointment of a compliance officer;
• tailoring the programme to the most prominent risk for the company, including all the applicable policies, procedures and the creation of a risk matrix;
• demonstration of the approval and participation of the corporate management body;
• the design and implementation of audit and monitoring mechanisms;
• implementation of a training programme; and
• publication of the compliance programme among relevant stakeholders.

Even though the Colombian antitrust regime provides no benefits for implementing a compliance programme, in 2022, the government created the Compliance Direction, which is part of the Deputy of Competition Protection Division at the Superintendence of Industry and Commerce and will be in charge of (1) following up the guarantees accepted during administrative investigations into breaches of the competition protection and unlawful competition regulation, (2) the surveillance of conditions set with regard to requests of merger control clearances, (3) undertaking administrative procedures in respect of the breach of guarantees, conditions, the obstruction of investigations and the omission of requests for information, and (4) the effective implementation of a compliance programme being established as part of the guarantees and conditions.

Cyber-related issues

9 Does your country regulate cybersecurity? Describe the approach of local law enforcement authorities to cybersecurity-related failings.

There are many cybersecurity regulations relating to data protection, cybercrime and e-commerce, among other things. Guidance on cybersecurity matters is provided by the National Council of Economic and Social Policy through documents Nos. 3701/2011, 3854/2016 and 3995/2020, which establish national cybersecurity policy guidelines, general standards for cybersecurity, cyber defence and risk management measures. Decree 338/2022, issued in 2022, establishes general guidelines for digital security governance, with which the government seeks to combine and boost legal development, technical advances, and state and private knowledge to strengthen the country’s cybersecurity. According to Decree 338/2022, digital security governance is ‘the set of inter­actions and approaches between multiple stakeholders to identify, frame, propose, and coordinate proactive and reactive responses to possible threats to the confidentiality, integrity or availability of technological services, information systems, technological infrastructure, networks and information that together constitute the digital environment’.

Enforcement actions in relation to cybersecurity are mainly taken by the Superintendence of Industry and Commerce because they generally involve data breach protection; however, when breaches become felonies, criminal investigations should be initiated by the Attorney General’s Office.

10 Does your country regulate cybercrime? What is the approach of law enforcement authorities in your country to cybercrime?

Colombia regulates cybercrime specifically through Law 1273/2009, and inclusion in the Criminal Code of more than 10 criminal offences relating to cybercrime. Additionally, in 2018, Colombia adopted the Budapest Convention on Cybercrime, which eases transnational cybercrime investigations because of the formalisation of information exchange channels between the countries that are signatories of the Convention.

Cross-border issues and foreign authorities

11 Does local criminal law have general extraterritorial effect? To the extent that extraterritorial effect is limited to specific offences, give details.

Although the territoriality principle remains the primary jurisdictional basis, Colombian criminal law has extraterritorial effect in the following circumstances:

• persons who commit a crime abroad against the existence and security of the state, the constitutional regime, the economic and social order or the public administration, or who falsify national currency, or who engage in the crime of financing terrorism and administration of resources relating to terrorist activities;
• persons who, in the service of the Colombian state, enjoy immunity recognised by international law and commit a crime abroad;
• persons who, in the service of the Colombian state, do not enjoy immunity recognised by international law and commit a crime abroad (other than those mentioned above), when they have not been brought to trial abroad;
• Colombian nationals, after having committed a crime in a foreign territory, who are then punished under Colombian criminal law with a custodial sentence;
• foreigners in Colombia, after having committed a crime abroad to the detriment of the state or a Colombian national; and
• foreigners who have committed a crime abroad to the detriment of a foreigner, provided that the following conditions are met: (1) the crime occurs in Colombian territory; (2) the crime warrants a custodial sentence in Colombia, the minimum for which is not less than three years; (3) the crime is not a political crime; and (4) a request for extradition has not been granted by the Colombian government.

The Criminal Code also has extraterritorial effect for prosecuting cross-border bribery of a foreign public official in international transactions.

Administrative authorities in Colombia only have powers to conduct investigations against companies and individuals for illegal conduct that has effects or violates protected legal rights or property in the Colombian territory in accordance with the territorial principle.

12 Describe the principal challenges that arise in your country in cross-border investigations, and explain whether and how such challenges depend on the other countries involved.

The challenges that arise in cross-border investigations are:

• communication problems that arise from local language, business customs or culture;
• limited investigatory resources;
• limited availability and accessibility of information because of differences in laws governing the attorney–client privilege;
• limited availability and accessibility of information because of differences in data protection laws;
• ensuring the application of precautionary measures; and
• pursuit of assets relating to foreign felonies.

The effects that these challenges may have on an investigation will depend on the countries involved. For instance, when conducting investigations in foreign countries with a history of government suppression, investigators should be cautious about the words they use to avoid eliciting negative emotions that will have an alarming effect on the investigation. Specifically, words such as ‘review’, ‘analysis’ or ‘discussion’ are more impartial. Likewise, instead of ‘whistleblower’ or ‘informant’, terms such as ‘employee’ or ‘colleague’ are more neutral. Another example relates to data privacy laws since some countries have restrictive data privacy laws that require even that internal investigations be disclosed to the government.

13 Does double jeopardy, or a similar concept, apply to prevent a corporation from facing criminal exposure in your country after it resolves charges on the same core set of facts in another? Is there anything analogous in your jurisdiction to the ‘anti-piling on’ policy as exists in the United States (the Policy on Coordination of Corporate Resolution Penalties) to prevent multiple authorities seeking to penalise companies for the same conduct?

There are no criminal proceedings (prosecutions) against companies in Colombia. However, the Criminal Code establishes the prohibition of double criminality, under which no person can be charged more than once for the same criminal conduct provided that the core set of facts are the same.

14 Are ‘global’ settlements common in your country? What are the practical considerations?

Global settlements are not binding in Colombia.

15 What bearing do the decisions of foreign authorities have on an investigation of the same matter in your country?

As a general rule, a favourable judgment issued by a foreign authority is applicable in Colombia provided that the core set of facts are the same, owing to the prohibition of double criminality.

Economic sanctions enforcement

16 Describe your country’s sanctions programme and any recent sanctions imposed by your jurisdiction.

Colombia has enhanced corporate liability through Law 2195/2022. This Law expanded the list of offences for which organisations can be held liable and, therefore, organisations can now be sanctioned if:

• a director or employee has been convicted of crimes against the public administration, environment, economic and social order, financing of terrorism and organised crime, management of resources relating to terrorism and organised crime, or any activities associated with misappropriation of public property, or has reached a pretrial resolution based on the principle of discretionary prosecution (principio de oportunidad) in the course of investigation of the aforementioned offences or relevant court proceedings;
• the organisation gained either directly or indirectly or tried to gain undue advantage from a crime committed by an employee; or
• the organisation permitted a crime or allowed for its commission through its acts or omissions.

Penalties include the following:

• a fine of up to 200,000 monthly wages (roughly 247 billion pesos) and mandatory forfeiture of the alleged benefit or the benefit gained from the offence. If so decided by the competent authority, up to 10 per cent of the fine can be used to implement, improve or update transparency and business ethics programmes within the organisation that was held liable;
• publication of an abstract of the decision concerning the liability of the organisation in the media and on the organisation’s corporate website;
• prohibition from receiving any sort of material aid or subsidies from the state for 10 years (previously, the maximum term was five years);
• prohibition from participating in public procurement and contracting for 20 years;
• dismissal of employees with managerial functions who were found guilty, and suspension of the individuals that condoned the unlawful conduct; and
• inclusion of information about the organisation held liable in a dedicated register.

Law 2195/2022 also establishes the mitigating and aggravating circumstances that affect the sanctions imposed on organisations. Mitigating circumstances include, in particular:

• admission of guilt before the issuance of the order compelling testimony, except for cases of repeated offences;
• facilitation of verification of the assets of the accused;
• self-disclosure and provision of evidence by the organisation;
• adoption of measures to prevent corruption in the future; and
• non-realisation of the benefit gained from the corruption offence.

The aggravating circumstances are:

• unlawful economic profit;
• repeated offence;
• resistance, refusal or interference with the investigation or oversight actions and violation of the procedural rights of the defendant;
• implementation of fraud schemes or the use of an intermediary to conceal the offence or its consequences; and
• reluctance to execute the orders of the competent authority or a lack of respect for the relevant decisions.

In March 2022, the Superintendence of Corporations imposed a fine of more than 8.3 billion pesos on Carpenter Marsh Fac Colombia Corredores de Reaseguros SA (previously JLT RE Colombia Corredores Colombianos de Reaseguros SA) for trans­national bribery.

17 What is your country’s approach to sanctions enforcement? Has there been an increase in sanctions enforcement activity in recent years, for example?

During the past decade, Colombia has introduced several legislative measures against corruption. In 2011, the government enacted the Anti-Corruption Statute, which amended the Criminal Code, introduced harsh sanctions against corrupt individuals and increased the term of debarment preventing former public officers from interacting with state-owned entities. In 2013, Colombia joined the Organisation for Economic Co-operation and Development (OECD) Anti-Bribery Convention. In 2016, Congress enacted Law 1778, which creates a regime of direct administrative liability for legal entities involved in transnational corruption. In 2022, the government enacted Law 2195, which enhanced corporate liability by (1) expanding the list of offences for which companies can be held liable, (2) clarifying the categories of companies subject to sanctions for these offences (namely, organisations that are members of temporary joint ventures or consortia, state corporations, state-owned enterprises, not-for-profit organisations registered in Colombia and foreign affiliates), and (3) extending the list of liability measures for the above-mentioned offences. As a result of this, there has been an increase in enforcement activity relating to corruption investigations involving corporations and individuals.

18 Do the authorities responsible for sanctions compliance and enforcement in your country co-operate with their counterparts in other countries for the purposes of enforcement?

Local legislation promotes co-operation between the Colombian authorities and their counterparts in other countries for the purposes of enforcement of anti-corruption legislation. Colombia is officially a member of the OECD since 2020. Colombia is also a member of the United Nations and the Organization of American States and as such signed the United Nations Convention against Corruption and the Inter-American Convention against Corruption. The Information and Financial Analysis Unit is a member of the Egmont Group, which provides a platform for agencies around the world to exchange expertise and financial intelligence to combat money laundering and terrorist financing.

19 Has your country enacted any blocking legislation in relation to the sanctions measures of third countries? Describe how such legislation operates.

Colombia has not enacted any blocking legislation in relation to the sanctions measures of third countries.

20 To the extent that your country has enacted any sanctions blocking legislation, how is compliance enforced by local authorities in practice?

Not applicable.

Before an internal investigation

21 How do allegations of misconduct most often come to light in companies in your country?

Self-reporting

Businesses are generally not obliged to self-report internal wrongdoings to authorities in Colombia. However, self-reporting to law enforcement agencies may be advisable in certain circumstances. For example, the statutory auditor has a legal obligation to report to authorities corrupt conduct that is detected in the course of its auditing activities. Failure to do so will trigger legal consequences for the auditing company and the auditors themselves. Similarly, the administrators of a company also have a legal duty to inform shareholders and investors as soon as they become aware of internal wrongdoing. Organisations that self-report can apply for immunity provided they confess and pledge to co-operate with the competent authority until the end of the investigation. In accordance with the Criminal Code, an employee who is under investigation for crimes can try to mitigate criminal sanctions by applying to the Attorney General’s Office for a reduction in penalties and imprisonment; the degree of leniency will depend on the extent and value of the information that the individual provides to the prosecutor and the level of co-operation.

Whistleblowers

During the past few years, whistleblower reports of potential illegal conduct have become more common and effective because the Attorney General’s Office, the Superintendence of Industry and Commerce and the Superintendence of Corporations have constructed robust programmes that include a provision for witness protection. Companies are encouraged to consider setting up anonymous internal reporting hotlines, following the guidelines of the anti-money laundering and anti-bribery and anti-corruption administrative authority, the Superintendence of Companies, and they must ensure that whistleblowers are protected from retaliation for their claims.

Information gathering

22 Does your country have a data protection regime?

Personal data protection is specifically regulated by the General Data Protection Act (Law 1581/2012) and its regulatory decrees, Circular 002/2015 from the Superintendence of Industry and Commerce (SIC), and Title V of the General Circular of the Superintendence. These regulations establish a set of minimum requirements for the collection, storage, use and any type of operation to be performed with data with the purpose of protecting the rights of the individuals whose data is processed and to assure them that any company handling their data will comply with all the legal requirements.

23 To the extent not dealt with above at question 9, how is the data protection regime enforced?

The General Data Protection Act (Law 1581/2012) regulates the protection of personal data in Colombia. The SIC, which is the national competition and data authority, has exclusive powers to conduct administrative investigations and impose fines for infractions of antitrust laws, unfair trade practices and consumer protection laws, and to sanction non-compliance with the General Data Protection Act. Specifically, the SIC may impose punishments and fines for collusion when an anticompetition agreement (cartel) involves public resources or a public entity, or affects public procurement. In such cases, the SIC has jurisdiction to investigate the conduct of individuals and issue an administrative decision. However, ultimately, the Attorney General’s Office decides whether to bring a criminal prosecution. The SIC can also impose sanctions for non-compliance of the General Data Protection Act, including fines, suspension of activities relating to data processing, or permanent or temporary closure of the operation.

24 Are there any data protection issues that cause particular concern in internal investigations in your country?

Under Colombian law, any type of processing of personal data requires prior and informed consent, and personal data must be collected for specified, explicit and legitimate purposes. Internal investigations must respect and guarantee employees’ confidentiality and privacy rights and, therefore, proper data protection measures should be taken in advance to grant legal entities legal access to employees’ sources of information. If this is not possible, legal entities must obtain proper consent and authorisation before accessing information that may contain the personal data of employees.

25 Does your country regulate or otherwise restrict the interception of employees’ communications? What are its features and how is the regime enforced?

The interception of employees’, or any other persons’, communications is prohibited in Colombia as it is considered a breach of Article 15 of the Colombian Constitution (right of confidentiality and privacy). However, there can be exceptions to this general rule.

The most common exception to this rule is the interception of communications as part of a criminal investigation. In this context, once a criminal process is open, the prosecutor can order the interception of communications whenever there is a reasonable ground to think that a crime is being committed. The order must be executed by the prosecutor’s team and, once the results are ready, the prosecutor must go to a judge for a review of the interception. This process is regulated by Article 235 of the Colombian Code of Criminal Procedure.

Dawn raids and search warrants

26 Are search warrants or dawn raids on companies a feature of law enforcement in your country? Describe any legal limitations on authorities executing search warrants or dawn raids, and what redress a company has if those limits are exceeded.

The Criminal Procedure Code (Law 906/2004) regulates the subject in Articles 219 to 230. According to Article 220, a prosecutor can only order a search warrant when there are reasonable motives that indicate the commission of a crime and that the owner or tenant of the place to be searched is involved. When this requirement is met, the prosecutor must order the search warrant in a written order. The prosecutor must specify the exact location of the property to be searched and the procedure must be done according to the instructions and following the limitations the prosecutor has indicated in that order.

Before a prosecutor can order a search warrant, the circumstances must exist for a warrant to be necessary for the purpose of either capturing a suspect or gathering specific evidence for a case. The Criminal Procedure Code stipulates that once the search has been carried out, the procedure must be legalised before a special judge (juez de control de garantias) within 24 hours of the search.

If limits are exceeded, there are two possible outcomes: (1) the evidence collected in the search will not be admitted within any judicial proceeding; or (2) the prosecutor or the police that exceeded the powers can face disciplinary or criminal consequences (or both).

27 How can privileged material be lawfully protected from seizure during a dawn raid or in response to a search warrant in your country?

Privileged material has special protection during a dawn raid or in response to a search warrant. Organisations have the right to be assisted by a lawyer during these types of procedures and the lawyer must carefully review not only the scope of the prosecutor’s order but also how it is executed. If, for any reason, privileged material is intended to be collected, the company’s lawyer must oppose. If the material has been collected, despite the opposition, the following steps should be followed: (1) the organisation must accurately identify the material that was collected by the authority; (2) the organisation must document the opposition made to the authorities through a minute; (3) the organisation must inform the prosecutor who is in charge of the case; and (4) if necessary, the organisation can request a special hearing before a juez de control de garantias to request exclusion of the privileged material.

28 Under what circumstances may an individual’s testimony be compelled in your country? What consequences flow from such compelled testimony? Are there any privileges that would prevent an individual or company from providing testimony?

It is mandatory for a person who has any information regarding an investigation in Colombia to testify. However, there are certain privileges and exceptions to this rule, namely: (1) the right against self-incrimination; (2) the right not to testify against spouses or relatives within the fourth degree of consanguinity or second degree of affinity relationship; and (3) professional secrecy, which imposes the obligation of confidentiality on the professional to whom a professional secret is entrusted.

Whistleblowing and employee rights

29 Describe the whistleblowing framework in your country. What financial incentive schemes exist for whistleblowers? What legal protections are in place for whistleblowers?

There are whistleblowing programmes relating to criminal offences, to infractions of administrative law and to national security. Regarding whistleblowing programmes in the context of criminal law, the Attorney General’s Office can use legal means such as discretionary prosecution (principio de oportunidad) to negotiate with whistleblowers to offer them protection and legal benefits if they are involved in criminal offences. There are also whistleblowing programmes led by administrative authorities such as the Superintendency of Industry and Commerce in relation to market competition rules. Finally, the government manages a whistleblowing strategy for national security purposes. The Presidency or the Ministry of Defence manages most of these incentives.

30 What rights does local employment law confer on employees whose conduct is within the scope of an investigation? Is there any distinction between officers and directors of the company for these purposes?

Employment law has no distinction regarding director or officers in these matters.

However, depending on the level of responsibility and what the labour agreements stipulate, they would have a certain level of responsibility as regards a possible criminal act. It is important to mention that any labour or disciplinary measure arising from an investigation must comply with the right of due process so that employees can defend themselves.

31 Do employees’ rights under local employment law differ if a person is deemed to have engaged in misconduct? Are there disciplinary or other steps that a company must take when an employee is implicated or suspected of misconduct, such as suspension or in relation to compensation?

Employment law in Colombia does not provide any special or different treatment for a person who is deemed to have engaged in misconduct. However, a situation could arise in which a labour agreement can be terminated by an employer as a consequence of employee misconduct and the employee would not have the right to a severance payment. These cases must be analysed in detail and they must be properly documented to prevent future conflicts with the authorities.

When employees are implicated in, or suspected of, misconduct, internal investigations must be carried out. This internal investigation must be performed in accordance with the principles of due process. If the results of an investigation indicate that a crime has been committed, the organisation must file a criminal complaint against the employees before the relevant authorities.

32 Can an employee be dismissed for refusing to participate in an internal investigation?

Yes. However, to dismiss an employee with sufficient legal basis, it is recommended to include in labour agreements the obligation for the employee to participate and co-operate in any internal investigation that the company might have.

Commencing an internal investigation

33 Is it common practice in your country to prepare a document setting out terms of reference or investigatory scope before commencing an internal investigation? What issues would it cover?

It is common practice but not a legal requirement to start a private investigation. Investigators usually replicate such a document from what in Colombian criminal law is known as the methodology document, which is one of the first steps a prosecutor takes when starting an investigation.

The issues covered will depend on the type of investigation and the company’s policies; however, most of them cover the following points: the hypothesis, the suspects, the evidence to be obtained and the methodology to obtain the evidence.

34 If an issue comes to light prior to the authorities in your country becoming aware or engaged, what internal steps should a company take? Are there internal steps that a company is legally or ethically required to take?

According to Article 67 of the Criminal Procedure Code (Law 906/2004), most conduct that might be considered a crime must be reported to the authorities. However, before reporting to the authorities, it is important for an organisation to be advised by an expert to determine the proper time and means by which the issue should be reported to the authorities. The management team, including the board of directors, might be involved in the process, depending on the issue.

35 What internal steps should a company in your country take if it receives a notice or subpoena from a law enforcement authority seeking the production or preservation of documents or data?

Organisations are required to co-operate with the authorities. However, organisations also have a duty to analyse whether the information requested by the authority has been properly ordered. For example, prosecutors cannot request a company’s personal data from clients without the authorisation of a special judge (juez de control de garantias). Therefore, in this situation, companies should analyse the request and deny it if legal requirements have not been followed.

36 At what point must a company in your country publicly disclose the existence of an internal investigation or contact from a law enforcement authority?

Generally, there is no obligation for companies to publicly disclose any internal or official investigation.

37 How are internal investigations viewed by local enforcement bodies in your country?

Local enforcement bodies are open to receive information from internal investigations. In fact, many important criminal cases in Colombia have been successful thanks to joint efforts between the public and private sector.

There are no special requirements regarding the conduct or format in which information from an internal investigation has to be provided to the authorities. Nevertheless, it is important that any information is obtained by legal means.

Attorney–client privilege

38 Can the attorney–client privilege be claimed over any aspects of internal investigations in your country? What steps should a company take in your country to protect the privilege or confidentiality of an internal investigation?

Yes. Article 74 of the Colombian Constitution establishes that professional secrecy is inviolable. Therefore, there is constitutional protection for the attorney–client privilege.

Some of the steps suggested to protect the privilege of confidentiality are:

• all documents, emails and other communications that are under the scope of the attorney–client privilege should be marked as confidential;
• all conversations, meetings and emails should be shared only with the persons covered by the privilege;
• the presence of non-essential third parties, even family members, should be carefully reviewed because this could nullify the attorney–client privilege; and
• if a document that includes confidential information should be produced, it is important to properly redact that document. Redaction of a document is the process of concealing information while leaving intact the rest of the document or record containing it.

39 Set out the key principles or elements of the attorney–client privilege in your country as it relates to corporations. Who is the holder of the privilege? Are there any differences when the client is an individual?

Corporations hold the same right to the attorney–client privilege as individuals. The holder of the privilege is the client independently, whether an individual or a corporation.

The key principles of the attorney–client privilege are that (1) it is part of the Colombian Constitution (Article 74), (2) it is strongly linked to the right to confidentiality, which is also part of the Colombian Constitution (Article 15), and (3) according to Colombia’s disciplinary code for lawyers (Law 1123/ 2007), the attorney–client privilege remains in effect even after the attorney–client relationship ends.

40 Does the attorney–client privilege apply equally to in-house and external counsel in your country?

Colombian law makes no express distinction regarding the attorney-client privilege of in-house attorneys and external counsel.

41 Does the attorney–client privilege apply equally to advice sought from foreign lawyers in relation to investigations in your country?

Colombian law does not include any stipulation regarding the attorney–client privilege in respect of the types of lawyers or their position within a company.

42 To what extent is waiver of the attorney–client privilege regarded as a co-operative step in your country? Are there any contexts where privilege waiver is mandatory or required?

Neither co-operative agreements nor leniency programmes require the waiver of the attorney–client privilege.

43 Does the concept of limited waiver of privilege exist as a concept in your jurisdiction? What is its scope?

Yes, it is possible for parties to agree on a limited waiver of the privilege. There is no specific scope for this matter.

44 If privilege has been waived on a limited basis in another country, can privilege be maintained in your own country?

Yes, that is a possibility.

45 Do common interest privileges exist as concepts in your country? What are the requirements and scope?

This concept is not expressly regulated in Colombian legislation.

46 Can privilege be claimed over the assistance given by third parties to lawyers?

Yes. Assistance given to lawyers is covered by professional secrecy.

Witness interviews

47 Does your country permit the interviewing of witnesses as part of an internal investigation?

Yes. An organisation in Colombia can conduct interviews of witnesses as part of an internal investigation.

48 Can a company claim the attorney–client privilege over internal witness interviews or attorney reports?

Yes. If the information is protected by the attorney–client privilege, the organisation can claim it.

49 When conducting a witness interview of an employee in your country, what legal or ethical requirements or guidance must be adhered to? Are there different requirements when interviewing third parties?

There is no specific regulation for these matters. However, the following suggestions may be presented to a client: (1) the organisation must inform the employee of the nature of the investigation; (2) the organisation must follow a protocol for the interview in which respecting fundamental rights is the rule; (3) an audio or written recording (minute) of the interview must be made and, if in writing, must be signed by the employee; and (4) an employee must be allowed legal representation if it is requested.

50 How is an internal interview typically conducted in your country? Are documents put to the witness? May or must employees in your country have their own legal representation at the interview?

Internal interviews are usually conducted by experts hired by the organisation or by people within the company who have been trained for the purpose. Typically, the organisation announces the interview and advises the nature of the investigation. The interview is recorded but only once the express consent of the employee has been obtained. The questions asked will establish the time, means and place of the conduct that initiated the process. Typically, employees do not have legal representation at the interview. However, it is possible for this to be requested.

Reporting to the authorities

51 Are there circumstances under which reporting misconduct to law enforcement authorities is mandatory in your country?

Yes. Under the Criminal Procedure Code (Law 906/2004), there is an obligation to denounce conduct that might be considered a crime. There are exceptions to this rule for minor crimes (delitos querellables). Additionally, statutory auditors have a legal obligation to report to authorities any corrupt conduct that is detected in the course of auditing activities. Failure to do so will trigger legal consequences for the auditing company and the auditors themselves.

52 In what circumstances might you advise a company to self-report to law enforcement even if it has no legal obligation to do so? In what circumstances would that advice to self-report extend to countries beyond your country?

A company should self-report wrongdoing to the Colombian law enforcement authorities even if there is no obligation to do so because authorities can contemplate complete and partial amnesty for fines for organisations and individuals who confess to having participated in unlawful conduct and who provide timely, detailed and effective assistance to the authority responsible for detecting, investigating and prosecuting the conduct involved.

Companies should consider notifying wrongdoing in other countries when its organisation is global.

53 What are the practical steps needed to self-report to law enforcement in your country?

An in-house investigation should be carried out, during which all relevant documents and evidence are collected. Once the evidence is collected, a legal analysis should be carried out to determine whether the conduct can be considered a crime or a breach of the law in Colombia. Then, the competent authority should be informed. In criminal matters, a criminal complaint must be filed. It is important that the person or company co-operate with the authority during the investigation, to request recognition as a victim, if applicable.

Responding to the authorities

54 In practice, how does a company in your country respond to a notice or subpoena from a law enforcement authority? Is it possible to enter into dialogue with the authorities to address their concerns before or even after charges are brought? How?

First, it is important to identify the circumstances of the company. The notice or subpoena can be initiated in a criminal or an administrative procedure.

If criminal proceedings are involved, the authority will not usually establish a dialogue before a proceeding begins. If it is an administrative proceeding, the authority will contact the company with the purpose of initiating a dialogue prior to the filing of charges, as well as seeking reasonable grounds for initiating the proceedings, conducting the necessary inspections, and ensuring that the company provides the required evidence.

55 Are ongoing authority investigations subject to challenge before the courts?

Only administrative decisions, namely those defining the specific case, can be challenged before the courts. However, if a fundamental right is violated during any proceedings, the company may file an application for constitutional protection.

56 In the event that authorities in your country and one or more other countries issue separate notices or subpoenas regarding the same facts or allegations, how should the company approach this?

Within Colombian jurisdiction, there is no law or practice that obliges the Colombian authorities to take foreign investigations into account for their own investigations, as one does not directly affect the other, at least from a legal point of view. However, if a company faces this situation, it is important to analyse the process in both countries and establish a strategy. Countries might be collaborating internationally.

57 If a notice or subpoena from the authorities in your country seeks production of material relating to a particular matter that crosses borders, must the company search for and produce material in other countries to satisfy the request? What are the difficulties in that regard?

If a notice or subpoena issued by a Colombian authority involves the production of material relating to cross-border matters, the organisation must produce the material to comply with the request unless it is impossible under the legislation of that country.

58 Does law enforcement in your country routinely share information or investigative materials with law enforcement in other countries? What framework is in place in your country for co-operation with foreign authorities?

Since Colombia became a member of the Organisation for Economic Co-operation and Development (OECD) in 2020, it has entered into several agreements for the exchange of information with international authorities, which facilitate the exchange of documents between national and foreign or international authorities to be used in various investigations.

Specifically regarding cross-border crime, permanent co-operation is established between Colombia and countries such as the United States, the United Kingdom and Mexico.

The main legal instruments that regulate this matter include Law 1217/2014 (which regulates the right of access to public information, the procedures for the exercise and guarantee of the right and the exceptions to the disclosure of information), Law 1778/2016 (which provides regulations on the liability of companies for acts of transnational corruption and provides other provisions in the fight against corruption) and the OECD Anti-Bribery Convention.

59 Do law enforcement authorities in your country have any confidentiality obligations in relation to information received during an investigation or onward disclosure and use of that information by third parties?

Yes. Article 38, Paragraph 6 of the Colombian Disciplinary Code stipulates that the competent authorities must restrict access to documents, records and the like by persons not authorised to access the information during an investigation, as they must respect the secrecy of this type of information, especially if there is an ongoing judicial process.

60 How would you advise a company that has received a request from a law enforcement authority in your country seeking documents from another country, where production would violate the laws of that other country?

Given that the production of documents violates the law of the country from which they are requested, we would explain to the company why it should oppose a request for disclosure of information, based on the laws of that country. A strategic approach must be taken before the national authorities, explaining the restrictions to obtain the information.

61 Does your country have secrecy or blocking statutes? What related issues arise from compliance with a notice or subpoena?

Colombia has the following laws on these matters: (1) Law 1581/2021, which establishes that any person who intervenes in the management of personal data is obliged to keep this information confidential; and (2) Law 1712/2014, which establishes that anyone can appeal a request for information when it involves commercial, industrial or professional secrets.

Information subject to investigation that is determined by its owners to be confidential can only be accessed by those who are part of the judicial process. It is important to emphasise that anyone who claims that there is confidential information is obliged to prove that the disclosure of the information would cause present, probable and specific harm.

62 What are the risks in voluntary production versus compelled production of material to authorities in your country? Is this material discoverable by third parties? Is there any confidentiality attached to productions to law enforcement in your country?

Although not providing information relevant to the case voluntarily is not an aggravating circumstance, it is advisable to collaborate with the competent authority from the moment it is known that there is an abnormal situation in the operation of the company. The authority may order a third party to provide information relevant to the investigation. Depending on the type of process being developed, the information may or may not be confidential. In any case, it is possible in some cases to request to keep it secret during the investigation.

Prosecution and penalties

63 What types of penalties may companies or their directors, officers or employees face for misconduct in your country?

Colombian law establishes that there is no criminal responsibility for companies. However, at the end of the criminal process, there is a stage known as incidente de reparación integral, when victims of the crime request civil compensation. This compensation can be paid by the company. Also, the Colombian Criminal Code states that directors, officials or employees of a company may face penalties such as fines, imprisonment and disqualification from contracts with the government.

64 Where there is a risk of a corporate’s suspension, debarment or other restrictions on continuing business in your country, what options or restrictions apply to a corporate wanting to settle in another country?

This does not apply in Colombia.

65 What do the authorities in your country take into account when fixing penalties?

According to Law 2195/2022, mitigating circumstances include the following:

• admission of guilt before the issuance of an order compelling testimony, except in cases of repeated offences;
• facilitation of verification of the assets of the accused;
• self-disclosure and provision of evidence by the company;
• adoption of measures to prevent corruption in the future; and
• non-realisation of the benefit gained from the corruption offence.

Likely aggravating circumstances are:

• unlawful economic profit;
• repeated offence;
• resistance, refusal or interference with the investigation or oversight actions and violation of procedural rights of the defendant;
• implementation of fraud schemes or the use of an intermediary to conceal the offence or its consequences; and
• reluctance to execute the orders of the competent authority or a lack of respect for the relevant decisions.

Resolution and settlements short of trial

66 Are non-prosecution agreements or deferred prosecution agreements available in your jurisdiction for corporations?

Non-prosecution and deferred prosecution agreements are not available to organisations.

67 Does your jurisdiction provide for reporting restrictions or anonymity for corporates that have entered into non-prosecution agreements or deferred prosecution agreements until the conclusion of criminal proceedings in relation to connected individuals to ensure fairness in those proceedings?

According to Colombian law, there are no reporting or anonymity restrictions for corporates that have entered into non-prosecution or deferred prosecution agreements until the completion of criminal proceedings involving related persons, so as to ensure the fairness of the proceedings.

68 Prior to any settlement with a law enforcement authority in your country, what considerations should companies be aware of?

It is not possible to reach agreements with the authorities in Colombia. However, according to Colombian law, administrative authorities may give benefits for collaboration, which may totally or partially exonerate the company from the sanction, as long as it collaborates with the investigation.

69 To what extent do law enforcement authorities in your country use external corporate compliance monitors as an enforcement tool?

External corporate compliance monitors are not used to enforce the law in Colombia.

70 Are parallel private actions allowed? May private plaintiffs gain access to the authorities’ files?

No. It is not possible to access the archives of the authorities.

Publicity and reputational issues

71 Outline the law in your country surrounding publicity of criminal cases at the investigatory stage and once a case is before a court.

The Colombian Criminal Procedure Code (Law 906/2004) stipulates that the information subject to investigation shall not be made public until the indictment has been issued, which means that all investigative acts and information collected by the prosecutor may not be published until that stage of the process.

This does not mean that specific parties from the process cannot access the information. For example, victims have some rights to access information from investigations.

72 What steps do you take to manage corporate communications in your country? Is it common for companies to use a public relations firm to manage a corporate crisis in your country?

Corporate communication strategies depend on the sector and will differ depending on whether it is a communication campaign or crisis management. Generally, communication campaigns are planned by communication experts along with lawyers with the purpose of delivering the correct and accurate information. The steps to follow during this process include identification of the communication objective, definition of the ‘communication message’, outlining the communication strategy methodology, execution and evaluation.

Large companies in Colombia usually have communications departments or communications advisers that can help should a corporate crisis arise. These types of services are widely available.

73 How is publicity managed when there are ongoing related proceedings?

If there are two ongoing proceedings that are related, and it is intended to use confidential information from one of them in the other, it is necessary that the competent authority authorises such publicity, in accordance with the law.

Duty to the market

74 Is disclosure to the market in circumstances where a settlement has been agreed but not yet made public mandatory?

It depends on what the parties involved have agreed regarding the confidentiality of the agreement.

Environmental, social and corporate governance (ESG)

75 Does your country regulate ESG matters?

The Colombian jurisdiction does not have obligations for companies with regard to ESG matters. However, there are laws that regulate ESG matters that large companies must follow and use as the basis of their internal policies.

Law 1901/2018 sets out relevant regulations that are applicable to charitable and collective interest societies. Strategy Paper 3527 issued by the National Council for Economic and Social Policy (CONPES) sets out the national policy on productivity and competitiveness. Finally, CONPES 3582 sets out the national science and technology policy.

76 Do you expect to see any key regulatory or legislative changes emerge in the next year or so designed to address ESG matters?

The new government has announced environmental and social proposals that aim to have a positive effect on the development of these sectors, such as the implementation of renewable energies and the treatment of waste, among other things.

77 Has there been an increase in ESG-related litigation, investigations or enforcement activity in recent years in your country?

No, the application of ESG laws in Colombia is very recent, so there are no disputes about it to date.

Anticipated developments

78 Do you expect to see any key regulatory or legislative changes emerge in the next year or so designed to address corporate misconduct?

It is expected that Law 2195/2022, which obliges companies to have compliance programmes from 2022, will be properly implemented, as will the strengthening of the accountability measures of legal entities in the fight against corruption and measures to remove the corporate veil.

Footnotes