Colombia is currently navigating a delicate fiscal period. Facing an approximate deficit of 10 trillion pesos and mounting pressure on revenue collection, the DIAN (the National Tax and Customs Directorate) is not acting alone: it now operates in direct coordination with the Attorney General's Office to prosecute not only companies but also their legal representatives within the country.

For a foreign company with a subsidiary in Colombia, this completely shifts the risk framework. Tax compliance has ceased to be a mere accounting matter and has become a top corporate governance priority.

What is Tax Risk and Why Does It Matter at a Corporate Level?

From an executive perspective, tax risk is the possibility of incurring losses due to failures in processes, technology, or regulatory compliance. In the Colombian context, this risk translates into a direct impact on the organization's equity—and the continuity of its operations in the country.

What many headquarters fail to anticipate is that the materialization of this risk is not limited to paying the omitted taxes. The consequences extend across three dimensions:

• Financial: Default interest, fines, and penalties calculated based on the value of the obligation or the formal non-compliance.
• Reputational: Media exposure and deterioration of the brand image before local and international stakeholders.
• Criminal: Legal proceedings against the legal representative or the local financial manager for crimes such as tax fraud or the omission of withholding agents.

The Three Most Frequent Risk Vectors for Foreign Companies

Experience with European groups and multinationals operating in Colombia reveals three focal points that recur most frequently—and often reach the headquarters' radar too late.

1. Undeclared Permanent Establishment

This is arguably the most underestimated risk. A company may be generating an economic presence in Colombia—through employees with signing authority, recurring technical service contracts, or distribution warehouses—without having formalized its tax status as a Permanent Establishment (PE). The DIAN has intensified the detection of these structures. Consequences include the retroactive assessment of income tax plus penalties for omitted income, covering periods that can span several prior fiscal years.

2. Transfer Pricing: The Formal Error That Costs More Than Expected

Many companies have well-structured operations but fail in documentation. Errors or late submission of transfer pricing information generate independent penalties that do not require a substantive correction: they penalize the failure to report, regardless of whether the intercompany transactions were correct in essence. It is a penalty for form, not substance—a fact that frequently surprises CFOs accustomed to European standards where substance prevails over procedural formalism.

3. Ultimate Beneficial Owners (UBO) and Reporting Duties

Colombia has significantly tightened its transparency requirements. Failure to report beneficial owners, or providing incomplete or erroneous data, triggers severe sanctions and can link the company to money laundering or terrorist financing proceedings—even if the omission was completely involuntary.

A distinction worth understanding: Tax penalties in Colombia are technically "avoidable"—they are only imposed when there is evasion or error. Once executed, they are not part of the original tax obligation: they are an additional penalty. Timely compliance is, quite literally, the only way to avoid paying them.

How to Structure Effective Tax Risk Management

Reacting to the DIAN is expensive. Anticipating is not. Organizations that best manage their fiscal exposure in Colombia work with a structured four-stage scheme:

1. Identification and Exposure Mapping: Reviewing high-risk activities: intercompany operations, contracts with the headquarters, presence of employees with local executive functions, and distribution structures.
2. Inherent Risk Assessment: Determining the level of exposure before applying controls, on a scale ranging from Unacceptable to Acceptable.
3. Design and Implementation of Controls: Designing preventive measures (acting before the event), detective measures (operating during processes), and corrective measures (such as insurance policies or tax remediation plans).
4. Monitoring and Treatment Decisions: With the risk map in hand, the organization decides whether to mitigate risk through internal improvements, transfer it via outsourcing or insurance, or eliminate it by adjusting the operating structure.

This approach is especially relevant when the Colombian subsidiary must report to a headquarters with European internal control standards, where traceability and documentation are not optional but a condition for the financial close.

Your Colombian Subsidiary Should Not Be a Blind Spot

Foreign companies that operate in Colombia with the greatest peace of mind are not necessarily the largest or those with the most robust internal teams. They are the ones that decided to anticipate: performing the review before receiving a request, documenting before the audit arrives, and knowing their real exposure before the DIAN does.

If your company has operations in Colombia and has not conducted a tax risk review in the last 12 months, that is the first concrete step you can take today.

Do you want to know your level of tax exposure in Colombia? Schedule a 30-minute diagnostic session with our team of specialists.

Contact GlobalGAAP →