Operating in Cartel-Influenced Markets: A Practitioner’s Frank Assessment from Colombia

When a client asks whether they can responsibly enter Colombia, my honest answer is yes — but only on the understanding that the relevant threat is no longer the obvious one. Organized crime has adapted, and sometimes it even works through legitimate-looking corporate structures and intermediaries rather than presenting itself as an identifiable criminal counterparty. That change in appearance, not in substance, is what makes the risk harder to manage today.

The most immediate and recurring risk today is extortion. “Vacunas” — demands for “protection payments” to keep operations running or safeguard employees’ safety — are making a significant comeback across Colombia, particularly where illegal armed groups remain active. This is not hypothetical: it is happening now to companies operating in Colombia’s agricultural frontier, in mining regions (usually in areas where the state’s presence is thin), and increasingly on the outskirts of major cities. When such a demand is made, the company needs to know exactly what to do and that response cannot be improvised in the moment.

Companies need clear, pre-established protocols for extortion: instructions for employees receiving the initial threat, clarity on who decides, how the incident is escalated and reported to authorities, what payments are prohibited, and how each step is documented. Legal exposure deserves candor. A payment to an illegal armed group can trigger criminal exposure under Colombian law tied to financing illegal armed organizations, falling mainly on the company’s directors, officers, and employees. That exposure does not always surface immediately: the Chiquita Brands case shows consequences for such payments can emerge years, even decades later. An executive who improvises without a framework, authorizing payments without legal guidance or documentation, is personally at risk. Having no protocol is not neutral — it is itself an aggravating factor prosecutors will seize upon.

The two mistakes I see most often in foreign companies entering this market are avoidable. The first is failing to train employees on handling contact with illegal armed groups, so the first threat received is met with an immediate, unauthorized payment. The second is repeating that same unprotocoled response once the threat returns — paying a second and third time or bringing in foreign private security firms — without engaging Colombian authorities, such as GAULA. Both patterns heighten the risk rather than reducing it.

Cartels and illegal armed groups rarely show up at the negotiating table themselves. What frequently does show up is a network of nominees and front persons — what Colombian law calls “testaferrato” — holding equity through layers of seemingly legitimate vehicles, contracting with formal companies, or diverting corporate resources on their behalf. These structures have infiltrated industries any multinational might engage: transport, agro-industry, mining, construction, private security. This blurring of licit and illicit activity is the daily operating environment. A logistics provider or landlord could, without adequate scrutiny, turn out to be a vehicle for money laundering or controlled by individuals tied to armed groups.

This is why due diligence in these markets cannot be a one-time exercise at onboarding. Rigorous counterparty due diligence — beneficial ownership tracing, source-of-wealth verification, reputational screening, and structured red-flag analysis — must be continuous. Relationships change; ownership structures shift. A supplier that was clean eighteen months ago may not be today. Ongoing monitoring is the only way to know who you are actually dealing with, and what controls to layer on top.

A further dimension of risk is the relationship between organized crime and public officials. In Colombia and the broader region, cartels and criminal networks frequently maintain relationships with government actors, usually at the regional level. Where those relationships exist, they can affect how quickly and effectively local authorities respond to a security incident, how permits and inspections are handled, and how disputes involving a company end up being resolved.

That risk is separate from ordinary corruption risk in interactions with public officials, which demands its own discipline regardless of cartel presence. Every interaction with a public official must be conducted with particular care: strict avoidance of conduct that could be seen as seeking improper influence, discipline around gifts and hospitality, and zero tolerance for favors that could later be characterized as corruption or as facilitating illicit interests.

Underpinning all of this — due diligence, extortion protocols, public-official interactions — is documentation. Thorough, contemporaneous documentation is not administrative overhead; it is the company’s central line of defense. If authorities, prosecutors, or civil claimants later scrutinize the company’s conduct, the question will be whether it acted reasonably and in good faith given what it knew.

None of this eliminates risk. Good governance, rigorous due diligence, clear protocols, and meticulous documentation manage and reduce exposure, and demonstrate the seriousness a difficult environment demands. But they do not make a cartel-influenced market safe in any absolute sense. Some risks cannot be reduced by good compliance practice: the safety of employees and their families against an armed group’s unilateral decisions, the unpredictability of how a local criminal structure will react to a company’s presence, and the possibility that consequences for a decision made today will surface years later. My honest advice: entry is defensible and can be responsibly managed with the right legal and compliance architecture and the right local partners who understand the landscape. Infrastructure and oil and gas, in particular, offer near-term upside for companies willing to make that commitment — but only if the client accepts, knowingly and deliberately, that some risk cannot be engineered out of the equation.