DIAN exogenous information 2026: when a mistake becomes a criminal risk

Every year, as the deadline for filing exogenous information (información exógena) with Colombia’s tax authority (DIAN) approaches, I get the same question from business owners and CFOs: "how serious is a mistake in what we report?". The short answer depends on intent and magnitude, but the full answer matters more: exogenous reporting is not a minor administrative formality — it is the database DIAN systematically cross-checks against income tax and VAT filings, and those cross-checks are the origin of most tax-fraud proceedings I see in my practice today.

Exogenous information is, in essence, the map the tax authority holds of every relevant transaction a company makes: payments to third parties, income, withholdings, receivables and payables. When that map does not match what was declared, DIAN does not automatically assume bad faith, but it does open an audit, and it is at that stage that a mistake either stays administrative or escalates to a criminal matter.

The offense most relevant here is tax fraud or evasion under Colombia’s tax sanction regime, which punishes with imprisonment the omission of assets or the inclusion of nonexistent liabilities in tax returns, once certain value thresholds are exceeded. The legal key is that the conduct must be intentional: a material data-entry error, a reasonable change in accounting criteria, or a difference in regulatory interpretation do not constitute a crime. But proving that absence of intent, once DIAN refers the case to the Prosecutor’s Office, requires a technical defense prepared from the very first request, not after a formal complaint.

The risk is heightened for executives and legal representatives, because liability does not always stop at the corporate entity. When it is established that there was a conscious decision to underreport income or inflate costs to reduce the tax burden, criminal exposure falls directly on whoever signed the return or authorized the transaction, even if an accountant formally filed the report.

For companies, the practical lesson is preventive compliance: cross-check, before filing exogenous information, the accounting records against what was actually declared; document the criteria used in gray-area transactions (discounts, provisions, related-party dealings); and retain supporting documentation for every reported figure for the statute-of-limitations period. That documentation discipline is, in practice, the difference between facing an audit calmly and facing a criminal investigation years later.

If you have already received a routine request, a formal notice, or a statement of charges related to inconsistencies in exogenous reporting, the time to seek specialized criminal counsel is now, not once the file reaches the Prosecutor’s Office. The strategy for responding to DIAN and any eventual criminal defense must be built in a coordinated way, because what is answered administratively can later become evidence in the criminal proceeding.

Exogenous information will keep being, year after year, one of the points of greatest fiscal and criminal exposure for companies and executives in Colombia. My recommendation is always the same: treat it with the same legal rigor as an income tax return, not as a technical form delegated without oversight.