In brief
On 2 July 2026, the Superintendence of Companies issued its new Basic Legal Circular, which, among other things, integrally unified two previously separate compliance systems: (i) the Self-Control and Risk Management System for Money Laundering, Terrorist Financing, and Financing the Proliferation of Weapons of Mass Destruction ("SAGRILAFT"), and (ii) the Business Transparency and Ethics Program ("PTEE") for anti-corruption and anti-bribery. Both prior regimes and all amending circulars issued between 2020 and 2024 are expressly repealed.
Colombian companies and branches of foreign companies supervised by the Superintendence of Companies must assess whether the new thresholds — now expressed in Basic Value Units (UVB) rather than minimum monthly wages — trigger compliance obligations and must integrate and adapt their existing programs to the new unified system by 31 May 2027.
Key takeaways
- Assess your applicability. Determine whether your entity meets the general threshold of 4,929,017 UVB in total income or assets (equivalent for 2026 to COP 59.6 billion, approximately USD 19 million at current exchange rates1) or any sector-specific threshold, including those applicable to real estate, precious metals, or vehicle commerce.
- Consolidate your compliance programs. Entities currently operating separate SAGRILAFT and PTEE programs must merge them into one integrated policy and one unified procedures manual — both calibrated to your entity's actual risk profile. Copied or generic templates will not satisfy the new "paper compliance" prohibition.
- Review your Compliance Officer's qualifications. The new framework raises the minimum experience requirement from six months to one year, mandates formal knowledge accreditation (specialization, master's degree, or diploma of at least 90 hours), and requires knowledge updates every three years.
- Appoint an alternate Compliance Officer. Designation of a substitute or alternate Compliance Officer is no longer discretionary. Any vacancy must be filled within a strict, non-extendable 30-calendar-day window.
- Plan for the 31 May 2027 deadline. Existing obligated entities must adapt their systems to the new unified framework by that date. New first-time obligated entities qualifying as of 31 December 2026, face the same deadline.
In more detail
A single unified compliance system
The new Basic Legal Circular integrally modifies and unifies the previous Chapter X (SAGRILAFT) and Chapter XIII (PTEE) of the Basic Legal Circular into a single unified system, called the "Self-Control and Risk Management System for ML/TF/CPF and C/ST".
The new Basic Legal Circular was issued by the Superintendence of Companies on 2 July 2026, and entered into force upon the date of its publication. Where previously, companies maintained two separate policy documents and procedures manuals, the new framework requires one integrated policy and one integrated procedures manual covering both AML/CTF/CPF and anti-corruption/anti-bribery risk streams in a single instrument.
Critically, the System must be adjusted to the particular conditions and characteristics of each obligated entity, with the express purpose of eliminating "paper compliance". Copied templates are expressly insufficient under the new regulation.
Who must comply
The obligation to implement the unified System applies to companies and branches of foreign companies subject to the vigilance or control of the Superintendence of Companies — provided they are not supervised by another authority and are not subject to a special supervisory regime — that, as of 31 December of the prior fiscal year, reported total income or total assets equal to or greater than 4,929,017 Basic Value Units (UVB):
| Threshold | Value |
|---|---|
| In UVB | 4,929,017 UVB |
| In COP | COP 59,690,395,870 |
| In USD (at current exchange rates2) | USD 19,098,054 |
Entities that do not meet the full System threshold but fall within lower sector-specific thresholds are subject to a simplified Minimum Measures Regime, governed directly by the legal representative rather than a dedicated Compliance Officer.
Implementation deadlines
Entities that were already obligated at the time of issuance of the new Circular — under the prior SAGRILAFT and PTEE frameworks — must adjust their existing systems to the new requirements no later than 31 May 2027. Their existing systems remain valid during that transition period.
Entities that become obligated for the first time must implement the System no later than 31 May of the year following the year in which they first acquire obligated-entity status.
If an entity subsequently falls below the applicability thresholds, it must nonetheless continue to comply for a minimum permanence period of two additional years under the full System, or one additional year under the simplified Minimum Measures regime.
| Entity category | Deadline |
|---|---|
| Existing obligated entities (previously under SAGRILAFT/PTEE) | 31 May 2027 |
| New first-time obligated entities (qualifying as of 31 December 2026) | 31 May 2027 |
| New first-time obligated entities (qualifying as of 31 December 2027, onward) | 31 May of the following year |
| Full System permanence period | Two additional years from falling below threshold |
| Minimum Measures permanence period | One additional year from falling below threshold |
The full text of the new Basic Legal Circular may be accessed, in Spanish, here.
Please do not hesitate to contact us if you have any questions or require our assistance.
----------
1 The applicable exchange rate as of 11 August 2026, corresponds to COP 3,125.47.