Employee Fraud Investigation in Costa Rica: Criminal Case

Employee Fraud Investigation in Costa Rica: What to Do When You Suspect Fraud or Bribery

---

Your CFO just flagged numbers that don’t add up, or cash that’s gone missing. Or a client says an employee asked for payment in cash with no invoice, or a “commission” under the table. That exact moment — before anyone gets fired, before anyone calls the police — is when a proper employee fraud investigation matters most. The company has a short window to act correctly. What it does in the next few hours can decide whether the case ends in a well-supported termination or a lost labor claim, plus added criminal exposure for the company itself.

What to do (and not do) in the first hours after detecting fraud

The natural instinct when fraud surfaces is to react immediately: confront the person, search their computer, or fire them the same day. However, done without a protocol, this can destroy evidence, taint the termination, or expose the company to a lawsuit. In fact, the real choice isn’t “act fast or act right” — it’s doing both at once.

Termination for loss of trust: the law requires an objective fact, not a suspicion

Costa Rica’s Labor Code allows termination for cause when an employee commits an act that makes continuing the employment relationship untenable. This includes objective loss of trust (Art. 81). Our full guide on Termination for Cause in Costa Rica breaks down every legal ground in detail. The Sala Segunda has been consistent on one point: it isn’t enough for the employer to subjectively “lose faith” in an employee. Instead, there must be an objective, verifiable fact — such as theft, unfair competition, or disclosure of secrets — that makes the relationship untenable. A suspicion, a rumor, or a hunch, on its own, won’t support this ground for termination if the case ends up before a labor court.

This is exactly what turns the internal investigation into an essential step, not a mere formality. Put simply, it’s the tool that converts a suspicion into the objective, verifiable fact the law requires.

Is there an obligation for internal “due process”?

Here’s a point that surprises many companies, especially those coming from parent companies in jurisdictions that do require this. In Costa Rica’s private sector, unlike public employment, no rule requires the employer to run an internal “due process” procedure. Nor must it give the employee a prior hearing before terminating for just cause. The Sala Segunda confirmed this expressly in ruling N.° 00488-2015. In that case, it rejected a worker’s claim that he had no chance to respond to the irregularities attributed to him before his termination. The court noted that private-sector employers aren’t required to run any procedure before dismissal.

That doesn’t mean investigating is optional, though. Instead, it means the internal investigation, in a private company, isn’t a formal legal requirement. It’s a strategic decision to gather the objective, verifiable fact that loss-of-trust case law demands, and to protect the company from a later claim of wrongful or discriminatory termination.

The one-month deadline (Art. 414) and how it runs during an investigation

Article 414 of the Labor Code states that an employer’s right to terminate for cause or discipline a violation expires after one month. That period is counted from when the cause arose or the facts became known. It’s a short, strict deadline. Letting it run out while gathering evidence in a disorganized way is one of the most common, and most costly, mistakes companies make.

Acting within the first 48-72 hours isn’t a legal deadline in itself. Instead, it’s a risk-management practice with two distinct goals. On the labor side, it keeps Article 414’s one-month clock from working against the company because of internal delays in organizing the investigation. On the criminal side, when the facts might constitute a crime, acting quickly helps prevent the conduct from continuing while the company deliberates.

How notifying the intended sanction resets the clock

The rule itself includes an important mechanism for investigations that need more time. If the company must follow a sanctioning procedure, it must notify the employee of the intended sanction within that first month. From that notice, the deadline starts running again. It runs from the point the employer or the competent body is able to resolve the matter. The only exception: if the procedure stalls due to the employer’s own fault, the deadline does run against the company during that delay. In practice, this gives a well-structured investigation more real room than it might seem at first. That’s true as long as the intended sanction is notified in time and the process doesn’t stall through the company’s own negligence.

This is precisely what turns a structured investigation protocol into more than good practice. With documented dates, responsibilities, and progress, a company can show exactly when it learned the facts and when it notified the intended sanction. It can also show that the process moved with the diligence the law requires — instead of risking a challenge over letting the deadline lapse through inaction.

How to collect evidence without violating employee rights

Article 24 of the Constitution protects the right to privacy and to secrecy of communications. Reviewing an employee’s email, files, or messages during an internal investigation isn’t automatically illegal, but it has to happen within clear limits:

• Company-provided systems and accounts (corporate email, computers, internal systems) can be reviewed under certain conditions. Specifically, a clear internal policy, known to the employee from the start of employment, must authorize it.
• Strictly personal communications — even when they happen on a company device — keep a level of constitutional protection that must be respected.
• The Personal Data Protection Law (Law 8968) requires that any personal data collected during the investigation be handled under its processing principles. This applies even for a legitimate purpose.
• Workplace video surveillance, while not governed by a specific law in Costa Rica, must still respect the same privacy limits. As a result, a visible, well-known policy on this is strongly recommended.

Evidence gathered in violation of these limits isn’t just at risk of being inadmissible in a later judicial or criminal proceeding. In fact, it can become the basis for the employee’s own claim against the company.

When should you file a criminal complaint, not just terminate?

If the facts under investigation could amount to bribery, corruption, or transnational bribery, the company enters the territory of Law 9699 on corporate criminal liability. At that point, the internal investigation stops being just a labor tool. Instead, it becomes part of the company’s own criminal defense strategy. A well-documented investigation, with effective cooperation toward the Public Prosecutor’s Office when appropriate, can be recognized as a mitigating factor for the legal entity’s liability. A late, tainted, or poorly handled investigation, on the other hand, can become the connecting act that increases the company’s own exposure.

Did your employee divert company funds? The crime of fraudulent administration

When the investigation isn’t about bribing a third party, the situation is different. Sometimes an employee has diverted, hidden, or mishandled funds or assets they were responsible for. In that case, the applicable crime is usually fraudulent administration (Art. 222 of the Criminal Code). It’s one of the property crimes the Public Prosecutor’s Office investigates most often in a corporate setting. Generally, the rule punishes anyone who, while managing or safeguarding someone else’s assets, harms the owner. This can happen by altering accounts, prices, or contract terms, faking transactions or expenses, or improperly withholding or using funds.

The penalty tracks Article 216 (fraud), based on the amount defrauded. Specifically, it’s two months to three years if the amount doesn’t exceed ten base salaries (roughly ₡4,622,000 for 2026), and six months to ten years if it does. Notably, the penalty rises by a third when the person managing the funds draws resources, in whole or in part, from public savings.

Two different legal tools, and they can coexist in one investigation

Unlike Law 9699 — which targets the company when an employee acts in its benefit against the Public Administration — fraudulent administration targets the employee when they act against the company’s own interests. These are two separate criminal tools. As a result, both can apply within the same internal investigation. For example, an employee who diverts company funds to pay a bribe can, depending on the facts, face charges for both fraudulent administration and involvement in the bribery itself.

Favorable case law for the company as victim: the Sala Tercera, in ruling N.° 00780-2009, clarified a point that directly benefits the affected company when proving its case.

Why the exact amount doesn’t need to be proven transaction by transaction

The “amount defrauded” required by Article 222 doesn’t have to be shown through an exact, isolated calculation of each transaction. Instead, it can be established from the total value of the harm caused by the conduct as a whole, even when the court doesn’t quantify each individual transaction. That same ruling confirmed, citing its earlier decision N.° 1114-2005, that fraudulent administration carried out through repeated acts against the same assets is judged as a single continuous crime, not multiple separate offenses. As a result, this simplifies the prosecution’s case when an employee’s scheme ran for months or years.

The phases of a well-run employee fraud investigation

A solid internal investigation generally moves through four phases. First, containment: preserving access and evidence without alerting the person. Second, collection: gathering documentary evidence and interviews within the legal limits of privacy. Third, analysis: determining whether the objective fact the law requires exists, and whether the facts warrant a criminal complaint. Fourth, execution: termination and/or complaint, within the Article 414 deadline. Each phase involves technical decisions that, if handled poorly, can undo everything that came before. That’s why this isn’t a form you fill in on autopilot — it’s a process designed case by case, with legal advice from day one.

The service: Emergency Internal Investigation

At AG Legal, we offer a rapid-response service for companies that detect possible fraud, bribery, or fund mismanagement by an employee. Our labor law team and our criminal law team lead the investigation together. This isn’t two separate services — it’s a single strategy that adjusts to what the facts reveal:

• Investigation team activation within the first 48-72 hours of the case being reported.
• Design and execution of the containment and evidence-collection protocol, within the legal limits of privacy and data protection.
• Findings report with a concrete recommendation: termination, a criminal complaint, or both.
• Representation in the termination process and, if warranted, in the criminal complaint and its follow-up.

In practice, many cases start and end as a purely labor matter. The objective fact is proven, the termination is applied within the Article 414 deadline, and there’s nothing more to do. But if what the employee did amounts to fraudulent administration, bribery, or another crime, the same case file moves smoothly to the criminal team. In fact, that team is already involved from the start of the investigation. This avoids the common mistake of treating the case as a pure HR issue until it’s too late to preserve the criminal evidence.

Acting within this window isn’t just good practice. It’s what lets the company document the diligence labor case law requires within the Article 414 one-month deadline. It also lays the groundwork for a possible mitigating factor under Law 9699 if the case escalates to the criminal track.

Practical recommendations

1. Don’t confront or fire the employee the same day the suspicion arises. Activate a containment and evidence protocol first.
2. Also document everything from the start: dates, people involved, and every step of the investigation.
3. Likewise, review your internal monitoring policies for email and systems. Without a clear policy known to the employee, collected evidence can be challenged.
4. Bring in outside legal counsel from the beginning, not just at the end, so the investigation itself is defensible.
5. If the facts could be criminal, hire legal counsel to analyze and build the criminal complaint properly. Treat it as part of the same strategy, not a separate, later step.

Frequently Asked Questions

Is my company required to run a “due process” before firing an employee for fraud?

No. The Sala Segunda confirmed (ruling 00488-2015) that Costa Rica’s private sector has no legal requirement for an internal prior-hearing procedure before terminating for just cause. However, the company still needs to prove an objective, verifiable fact.

How long does the company have to fire an employee after discovering the fraud?

One month, under Article 414 of the Labor Code, counted from when the cause arose or the facts became known. If the company follows a sanctioning procedure, notifying the intended sanction within that month resets the clock. It then runs again until the company can resolve the matter, unless the process stalls due to the employer’s own fault.

Can the company review an employee’s email during the investigation?

Yes, if it’s a company-provided system and a clear internal policy, known to the employee, authorizes it. Strictly personal communications keep constitutional protection under Article 24.

More on Termination Grounds and Criminal Exposure

Is “losing trust” in an employee enough to terminate for cause?

No. The Sala Segunda requires an objective, verifiable fact — such as theft, unfair competition, or disclosure of secrets — that makes the relationship untenable. The employer’s subjective suspicion alone isn’t enough.

What crime applies when an employee diverts the company’s own funds?

Generally fraudulent administration (Art. 222, Criminal Code), carrying 2 months to 3 years if the amount doesn’t exceed ten base salaries, or 6 months to 10 years if it does. It’s different from Law 9699, which targets the company, not the employee.

Can an internal investigation help the company if the case becomes criminal?

Yes. Under Law 9699, a well-documented internal investigation and effective cooperation with the Public Prosecutor’s Office can be treated as mitigating factors for the legal entity’s criminal liability.

Recommended reading

• Corporate Criminal Liability in Costa Rica: Complete Guide to Law 9699
• Money Laundering in Costa Rica: Crypto and Real Estate
• Termination for Cause in Costa Rica: Guide for Employers
• Travel Ban in Costa Rica: What to Do If Under Investigation

This article is for informational purposes only and does not replace individualized legal advice. Laws and their judicial interpretation can change; always consult a lawyer before making decisions based on this content.