Prosperidad Social subsidies: the criminal risks behind managing state aid

A social-assistance payment may look simple from the outside: the State identifies a beneficiary, schedules a transfer and deposits the money into an account or makes it available through an authorized payment network. Behind that apparently straightforward transaction, however, there is an extensive chain of databases, identity checks, targeting decisions, contracts, technological platforms, financial operators and public officials. When any part of that chain fails, the first consequence is usually administrative. When deception, appropriation, manipulation or a deliberate breach of duty enters the picture, the consequences may become criminal.

Prosperidad Social administers some of Colombia's largest transfer programs, including Renta Ciudadana, Renta Joven, Colombia Mayor and VAT refunds. The scale matters. Colombia Mayor alone has recently covered close to three million older adults in a single payment cycle, while one 2026 cycle of Renta Ciudadana and VAT refunds was directed to more than 770,000 households. These are not marginal operations: they involve large amounts of public money moving through national databases and payment systems every few weeks.

The agency is also changing the way that money reaches beneficiaries. Through its new Financial Information Manager, eligible recipients may register a bank account or electronic deposit so that transfers can be delivered directly, using the Ministry of Finance's integrated financial system and mass-payment mechanisms. Prosperidad Social requires the beneficiary to be the holder of the registered product and verifies that the account is active and able to receive transfers. The model promises shorter waiting times, fewer intermediaries and greater traceability. It also creates a larger digital surface on which identity fraud, account substitution, unauthorized access and manipulation of payment information must be anticipated.

When false information crosses the criminal line

The first area of exposure is the registration or continued inclusion of people who do not meet the requirements of a program. A person may provide inaccurate information about income, household composition, residence or socioeconomic circumstances. A relative may continue receiving money assigned to a beneficiary who has died. Someone may use another person's identity or financial product to redirect a transfer.

But the legal analysis cannot stop at the discovery of an inconsistency.

Article 453 of Colombia's Criminal Code defines procedural fraud as the use of fraudulent means to mislead a public official and obtain a judicial or administrative decision contrary to law. Therefore, an incorrect entry in a form is not automatically procedural fraud. It is necessary to establish the fraudulent mechanism, the intention to mislead the authority and the unlawful decision sought through that deception. Similarly, document-related offenses under articles 286 to 291 require proof that a public or private document was falsified, altered, used or made to contain false information under the particular conditions established by law.

The difference is important because public databases are not infallible. A family may have moved and failed to update its address. A civil-registry record may not yet have been reflected in another system. Two people may have similar names or identification information. A beneficiary may misunderstand a question or receive poor assistance when completing a form. Those situations may justify correction, suspension or reimbursement, but they do not, by themselves, prove a crime.

The criminal assessment changes when the evidence shows a conscious plan: inventing household members, concealing income, falsifying certificates, impersonating another person or repeatedly collecting funds after knowing that the legal basis for the payment no longer exists. In those cases, the authorities will look not only at the inaccurate information but also at what the person knew, what steps were taken to maintain the deception and what financial benefit was obtained.

Digital payments introduce an additional distinction. Article 269I of the Criminal Code addresses theft committed by overcoming computer-security measures, manipulating an information system or impersonating a user before authentication and authorization mechanisms. Article 269J separately covers non-consensual transfers of assets obtained through computer manipulation or a similar device. These provisions may become relevant when a subsidy is diverted by taking control of an account, replacing the registered financial product or defeating digital identity controls. Merely receiving an erroneous deposit, however, is not equivalent to hacking or computer-related theft; the means used and the recipient's subsequent conduct must be examined.

Deceased beneficiaries, duplicate records and verification visits

Cases involving deceased beneficiaries require particular care. They can generate understandable public indignation, but the underlying facts are not always identical. Sometimes payments continue because databases have not yet been updated. In other cases, a family member may have access to the deceased person's account and continue withdrawing funds deliberately. The first situation may arise from an institutional delay; the second may reveal impersonation, deception or unlawful appropriation.

Prosperidad Social has been strengthening field and database verification. In 2026, for example, it began visits to more than 51,000 households participating in the Hambre Cero strategy to confirm basic information and ensure that assistance reaches the intended population. The agency has also explained that certain Colombia Mayor payment processes depend on survival information supplied by the National Civil Registry. These controls illustrate how an administrative verification can expose discrepancies that later require a legal explanation.

Receiving a visit, a request for information or a notice of suspension does not mean that the person has been criminally charged. It is generally the beginning of an administrative clarification. Yet the response should not be improvised. An inaccurate explanation, an altered document or an attempt to reconstruct events falsely can create a more serious problem than the original inconsistency.

For beneficiaries and their families, the prudent course is usually straightforward: report deaths and material changes promptly, preserve the communications made to the agency, avoid using another person's financial product and return or clarify payments that are known to be improper. Good faith is easier to demonstrate when there is a clear record of timely action.

The contracting risks behind the payment system

The second major area of exposure lies in public procurement.

Transfer programs require payment operators, software providers, verification services, call centers, identity-validation tools, cybersecurity systems, data-processing services and logistical networks. Each contract may involve technical urgency and pressure to avoid interrupting payments to vulnerable populations. That urgency is real, but it does not eliminate the legal duties governing planning, selection, execution, supervision and liquidation.

Articles 408 to 410 of the Criminal Code address violations of the rules on disqualifications and conflicts of interest, undue interest in the execution of public contracts, and contracts processed, executed or liquidated without compliance with essential legal requirements. These offenses are principally structured around the conduct of public officials. Contractors and private executives, however, may also be investigated as participants when the evidence shows that they knowingly promoted, facilitated or benefited from the unlawful arrangement.

Not every contractual defect is criminal. Public contracts often generate disputes over technical specifications, delays, service levels, interpretation of obligations or the sufficiency of supporting documents. Criminal liability requires more than poor administration or a disagreement with an auditor. The prosecution must identify the conduct of each person and prove the legally required mental element.

The risk becomes more serious when specifications are manipulated to favor a bidder, essential requirements are consciously ignored, payments are authorized for services that were not performed, supervision reports are fabricated or benefits are offered to influence an official decision. Articles 405 to 407 regulate different forms of bribery involving public officials and persons who give or offer an improper benefit.

This is why the most important file in a public contract is not always the final contract itself. The real story is often found in preliminary studies, meeting minutes, technical evaluations, change requests, payment approvals, warning emails and supervision reports. Those records reveal whether a decision was reasoned and documented or whether the formal paperwork was created only after questions arose.

Public funds and individual responsibility

The Criminal Code also protects public resources through the peculado offenses. Article 397 addresses appropriation of State assets or funds by a public official for personal benefit or the benefit of another. Article 399 covers the use of public resources for an official purpose different from the one legally assigned, under the circumstances described by that provision. The distinction matters: money does not need to disappear into someone's pocket for its improper diversion to create legal exposure.

Still, responsibility is personal. A senior title, a signature on an organizational chart or membership on a committee does not automatically make someone criminally liable. Investigators must determine who had custody or decision-making authority, who knew of the irregularity, who issued or approved the relevant instruction and whether the person intended to appropriate, divert or facilitate the misuse of the funds.

The same principle applies to executives at banks, digital wallets and payment networks. A control failure is not automatically a crime. Large systems can produce duplicate records, rejected transfers or identity mismatches without anyone acting dishonestly. Exposure increases when concrete warnings are ignored, controls are deliberately bypassed, records are manipulated or irregular payments continue after those responsible have acquired reliable knowledge of the problem.

In practice, criminal investigations often begin by looking at the institutional failure and only later attempt to identify individual conduct. That sequence can be dangerous for directors and compliance officers because organizational language—"the operator failed," "the bank allowed it," "the agency knew"—may obscure who actually made each decision. A serious defense reconstructs the chain person by person, document by document and alert by alert.

Prevention before the first official request

For operators, contractors and executives, prevention should begin before a payment cycle or contract goes live.

Identity-verification rules should be written and auditable. Changes to bank accounts or electronic deposits should require enhanced validation. Alerts concerning deceased recipients, duplicate records and unusual withdrawals should have assigned owners and response times. Decisions to release, suspend or redirect payments should leave a clear record of the information available at that moment and the reasons for the decision.

Contractors should also separate commercial pressure from compliance decisions. A deadline imposed by the agency does not justify certifying an unfinished service, overlooking a security weakness or approving a payment without support. When the operation involves vulnerable beneficiaries, interruptions can have serious human consequences; that makes good planning more important, not less.

Preventive criminal counsel is particularly valuable when the legal and technical teams are still able to modify the process. Once the Comptroller General's Office, the Attorney General's Office, an internal control unit or a criminal investigator has requested documents, the organization is no longer designing its risk environment—it is explaining it.

Prosperidad Social's programs pursue a legitimate and indispensable social objective. Millions of people depend on them for food, education, basic expenses and a measure of security in old age. That human purpose should never be lost behind the language of databases, contracts and payment cycles.

Precisely because these resources matter so much, their administration demands more than speed. It demands traceability, honest decision-making and a clear understanding of the boundary between a correctable administrative error and conduct that may engage the criminal law. Protecting public funds and protecting the people who depend on them are not competing goals. Properly understood, they are the same responsibility.