Every year, as the deadline for filing exogenous information (información exógena) with Colombia’s tax authority (DIAN) approaches, I get the same question from business owners and CFOs: "how serious is a mistake in what we report?". The short answer depends on intent and magnitude, but the full answer matters more: exogenous reporting is not a minor administrative formality — it is the database DIAN systematically cross-checks against income tax and VAT filings to detect inconsistencies and strengthen its audit function.
Exogenous information is, in essence, the map the tax authority holds of every relevant transaction a company makes: payments to third parties, income, withholdings, receivables and payables. When that map does not match what was declared, DIAN does not automatically assume bad faith, but the discrepancy may trigger an audit, and it is at that stage that a mistake either stays administrative or escalates to a criminal matter.
On the criminal side, two distinct economic and corporate crime offenses must be distinguished. Article 434A of the Criminal Code punishes, under its statutory requirements, the omission of assets, the understatement of assets, or the inclusion of nonexistent liabilities carried out with the purpose of fraud or evasion. Article 434B, in turn, covers, among other conduct, failing to file a required return, omitting income, including nonexistent costs or expenses, or claiming improper tax credits, withholdings or advances. Both offenses require the objective and subjective elements set out by law, including quantitative thresholds and an official assessment by the tax authority. An inconsistency in exogenous information does not by itself constitute a crime, but it can trigger an audit and become a relevant element in a later investigation.
The risk can also reach legal representatives, officers, executives, accountants and others who took part in the relevant decisions or in preparing the information. However, criminal liability does not follow automatically from a title, from signing a return, or from formal participation in the process. In each case it must be established what the person's specific involvement was, what information they knew, what decisions they made, and whether they acted with the intent required by the offense.
For companies, the practical lesson is preventive compliance: cross-check, before filing exogenous information, the accounting records against what was actually declared; document the criteria used in gray-area transactions (discounts, provisions, related-party dealings); and keep supporting accounting, contractual and documentary records organized for the applicable legal period, taking into account the finality of the returns they support and any special retention rules. That documentation discipline is, in practice, the difference between facing an audit calmly and facing a criminal investigation years later.
If you have already received a routine request, a formal notice, or a statement of charges related to inconsistencies in exogenous reporting, the time to seek specialized criminal counsel is now, not once the file reaches the Prosecutor’s Office. The strategy for responding to DIAN and any eventual criminal defense must be built in a coordinated way, because what is answered administratively can later become evidence in the criminal proceeding.
Exogenous information will keep being, year after year, one of the points of greatest fiscal and criminal exposure for companies and executives in Colombia. My recommendation is always the same: treat it with the same legal rigor as an income tax return, not as a technical form delegated without oversight.