SAGRILAFT Anti-Money-Laundering Policy Colombia (Política SAGRILAFT)

A SAGRILAFT Anti-Money-Laundering Policy Colombia (Política SAGRILAFT — Sistema de Autocontrol y Gestión del Riesgo Integral del Lavado de Activos y Financiación del Terrorismo) is a mandatory corporate governance document that defines the risk management framework a Colombian company must implement to detect, prevent, and report activities related to money laundering (lavado de activos — LA), terrorist financing (financiación del terrorismo — FT), and financing of weapons of mass destruction proliferation (financiación de la proliferación de armas de destrucción masiva — FPADM). The SAGRILAFT framework was established by the Superintendencia Financiera de Colombia (SFC) through Circular Básica Jurídica 100-000016 de 2020, replacing the earlier SIPLAFT framework and expanding AML/CFT obligations to a broader range of supervised entities.

The legal foundation for SAGRILAFT rests on multiple Colombian statutes and international commitments. Ley 526 de 1999 created the Unidad de Información y Análisis Financiero (UIAF) as the Colombian financial intelligence unit responsible for collecting, processing, and analysing financial information to combat money laundering. Ley 1121 de 2006 broadened AML/CFT obligations and introduced specific obligations for designated non-financial businesses and professions (DNFBP). The Código Penal (Ley 599 de 2000) Articles 323-327 define the offence of lavado de activos and establish criminal penalties of 128 to 450 months of imprisonment plus asset confiscation. Colombia is a member of the Financial Action Task Force (GAFI/FATF) through its membership in GAFILAT (Grupo de Acción Financiera de Latinoamérica) and must comply with FATF's 40 Recommendations.

The SAGRILAFT policy documents four core risk management stages established by the SFC: (1) identificación de riesgos — systematic identification of LA/FT/FPADM risk factors in the company's customer base, products, distribution channels, and geographic exposure; (2) medición o evaluación — quantifying inherent and residual risk levels using the SFC's risk matrix methodology; (3) control — implementing policies, procedures, and technological controls to mitigate identified risks; and (4) monitoreo — ongoing monitoring of risk indicators and the effectiveness of controls, with regular reporting to the junta directiva and the Oficial de Cumplimiento. Forms-legal.com provides a structured template that satisfies the SFC's current documentation requirements.

The Oficial de Cumplimiento (Compliance Officer) is a critical role established by the SAGRILAFT framework. Under SFC guidance, this officer must have direct access to the junta directiva, sufficient resources and independence, professional qualifications in financial compliance or law, and clear authority to implement and enforce the SAGRILAFT policy. The officer is responsible for filing Reportes de Operaciones Sospechosas (ROS) with the UIAF through the SISLA (Sistema en Línea de la UIAF) platform within the timeframes established by Ley 526 de 1999 and SFC circulars.

The legal framework governing the SAGRILAFT Anti-Money-Laundering Policy Colombia (Política SAGRILAFT) in Colombia draws on several key statutes and regulatory bodies. Under the Constitucion Politica de 1991, Colombian administrative law governs government procedures. The DIAN administers tax declarations (RUT, IVA, Renta, Retencion). The Codigo de Procedimiento Administrativo (CPACA, Ley 1437 de 2011) governs administrative proceedings. The Accion de Tutela (art. 86) protects fundamental rights through the Corte Constitucional. The Defensoria del Pueblo assists citizens. Parties executing a SAGRILAFT Anti-Money-Laundering Policy Colombia (Política SAGRILAFT) in Colombia should confirm the document reflects current law, including any amendments enacted since the original drafting date. The Circular Básica Jurídica SFC 100-000016 de 2020; Ley 526 de 1999 (UIAF); Ley 1121 de 2006 sets the foundational requirements.

A SAGRILAFT Anti-Money-Laundering Policy Colombia is mandatory for all entities supervised by the Superintendencia Financiera de Colombia (SFC) under Decreto 663 de 1993 (Estatuto Orgánico del Sistema Financiero — EOSF), including banks (establecimientos bancarios), insurance companies, fiduciaries, securities brokers, pension fund administrators (AFP), exchange houses (casas de cambio), and financial cooperatives. The SFC's Circular 100-000016 de 2020 defines the specific SAGRILAFT obligations applicable to each category of supervised entity.

Beyond the financial sector, Colombian companies in designated non-financial businesses and professions (APNFD) regulated by the Superintendencia de Sociedades must implement SAGRILAFT-equivalent systems under the Circular Externa 100-000016 de 2020 and the Superintendencia's own SAGRILAFT implementing guidance. These include: real estate agencies and construction companies handling property transactions above 450 SMMLV; car dealerships and vehicle dealers with transactions above specific thresholds; precious metals and gems dealers; accountants and lawyers providing company formation, trust management, or real estate transaction services; and notaries (notarías) and registrars.

Companies subject to the Régimen de Zona Franca (Decree 2147 of 2016) and free trade zone operators must maintain SAGRILAFT-compliant systems as a condition of their zone operator authorisation from the DIAN. Colombian companies with correspondent banking relationships with international financial institutions require strong SAGRILAFT documentation to satisfy the due diligence requirements imposed by their foreign banking partners under FATF Recommendation 13 on correspondent banking. Companies seeking to list securities on the Bolsa de Valores de Colombia (BVC) or access institutional capital markets regulated by the SFC must demonstrate compliance with SAGRILAFT as part of the issuer registration process.

Parties in Colombia should prepare a SAGRILAFT Anti-Money-Laundering Policy Colombia (Política SAGRILAFT) proactively rather than waiting for a dispute to arise. Courts interpret agreements based on the written terms rather than oral representations. Under the Constitucion Politica de 1991, Colombian administrative law governs government procedures. The DIAN administers tax declarations (RUT, IVA, Renta, Retencion). The Codigo de Procedimiento Administrativo (CPACA, Ley 1437 de 2011) governs administrative proceedings. The Accion de Tutela (art. 86) protects fundamental rights through the Corte Constitucional. The Defensoria del Pueblo assists citizens. Where the transaction involves regulated activities, prior approval from the relevant authority may be required before execution.

A legally sufficient SAGRILAFT Anti-Money-Laundering Policy Colombia must include the following key elements as defined by the SFC's Circular 100-000016 de 2020 and FATF Recommendations. The template provided by forms-legal.com covers all required components.

Risk methodology and matrices: The policy must document the specific methodology used to assess LA/FT/FPADM risk, including the risk factors analysed (customer risk, product/service risk, channel risk, geographic risk), the scoring methodology, and the criteria for classifying customers and transactions as low, medium, or high risk. The SFC requires that risk matrices be reviewed annually and after any significant change in business model or risk environment.

Customer Due Diligence (CDD) and Know Your Customer (KYC): Detailed procedures for verifying the identity of natural persons (personas naturales) using the Cédula de Ciudadanía, Cédula de Extranjería, or passport, and legal entities (personas jurídicas) through the NIT, Cámara de Comercio certificate, and beneficial ownership documentation. Enhanced Due Diligence (EDD) requirements for Politically Exposed Persons (PEPs — Personas Expuestas Políticamente) as defined by the FATF and the SFC's implementing guidance, including family members and close associates.

Prohibited and restricted persons screening: Procedures for consulting and monitoring the OFAC (Office of Foreign Assets Control) Specially Designated Nationals list, the UN Security Council consolidated sanctions list (CONSOLIDADA ONU), the INTERPOL notice database, and Colombia's own Listas de Vigilancia maintained by the UIAF and the SFC. Under Ley 1121 de 2006, providing financial services to sanctioned persons constitutes an autonomous criminal offence.

Suspicious Transaction Reporting (ROS): The policy must document the criteria, procedures, and timeframes for identifying unusual operations (operaciones inusuales) and escalating them for analysis to determine whether a Reporte de Operaciones Sospechosas (ROS) must be filed with the UIAF through the SISLA platform. SFC guidance establishes a maximum of 30 days from detection of the unusual pattern to filing the ROS.

Cash Transaction Reporting (RTE): For regulated entities, the policy must document automatic reporting of cash transactions exceeding the thresholds established by the SFC — currently COP$10 million for individual transactions and COP$50 million in aggregate monthly transactions from a single customer — through the Reporte de Transacciones en Efectivo (RTE) system.

Oficial de Cumplimiento: The policy must define the appointment, qualifications, functions, reporting line, and independence of the Compliance Officer, consistent with SFC requirements for supervised entities. The officer must have direct access to the junta directiva and the audit committee (comité de auditoría).

Training programme: Documentation of mandatory annual LA/FT awareness and compliance training for all employees, with particular intensity for front-line staff in customer-facing roles, as required by FATF Recommendation 18 and the SFC's training circulars.

Additional compliance elements for a SAGRILAFT Anti-Money-Laundering Policy Colombia (Política SAGRILAFT) used in Colombia include: Under the Constitucion Politica de 1991, Colombian administrative law governs government procedures. The DIAN administers tax declarations (RUT, IVA, Renta, Retencion). The Codigo de Procedimiento Administrativo (CPACA, Ley 1437 de 2011) governs administrative proceedings. The Accion de Tutela (art. 86) protects fundamental rights through the Corte Constitucional. The Defensoria del Pueblo assists citizens. Forms-legal.com provides this template as a starting point for Colombia-compliant documentation.