Corporate Compliance 2026

Below, we present an informational bulletin outlining the main corporate obligations to be addressed during 2026, together with a detailed explanation of each.

Corporate Secretariat – First quarter of 2026

Annual compliance with corporate obligations due for the first quarter of 2026, in accordance with Colombian regulations. For this purpose, the obligation includes the following:

1.     Ordinary shareholders' meeting or highest corporate body for the year 2026, whereby the financial statements of the previous year and the management report of the legal representative are approved, on a business date within the first three months of the year 2026.

2.     Deposit of Financial Statements before the Chamber of Commerce, within the month following their approval by the highest corporate body.

3.     Renewal of Mercantile Registration and Registration of Non-Profit Entities (if applicable), within the first three months of the year.

Single Registry of Proponents (RUP) – April 9, 2026

The companies that have the Sole Registry of Bidders - RUP, must comply annually with the obligation to renew it, within the first 5 working days of the month of april. For this year, its expiration date is april 9, 2026.

Statutory Auditor – As of the date of the Ordinary Shareholders’ Meeting at which the Financial Statements are approved, provided that the minimum thresholds are met.

All companies whose total assets as of december 31, 2025 are equal to or greater than 5.000 statutory monthly minimum wages (SMMLV) and/or whose gross income as of the same date is equal to or greater than 3.000 SMMLV are required to appoint a Statutory Auditor.

On the other hand, the Code of Commerce has established the following as obligated, regardless of whether they comply with the aforementioned ceilings:

• Corporations and limited partnerships by shares.
• Branches of foreign companies.
• Companies in which, by law or by the bylaws, the administration does not correspond to all the partners, when so provided by any number of partners excluded from the administration representing not less than twenty percent (20%) of the capital.

Filing of Financial Statements with the Superintendence of Companies (if supervised or controlled)

Companies subject to supervision or control by the Superintendence of Companies are required to file the financial information requested within the deadlines established in the Single Circular and in any specific information requests issued by such authority.

Superintendence of Companies

1.    SAGRILAFT – May 31, 2026

All companies subject to inspection, surveillance, or control by the Superintendence of Companies of Colombia that, during the immediately preceding year, obtained revenues or assets equivalent to forty thousand (40.000) Monthly Legal Minimum Wages (SMMLV), as well as certain specific sectors with different thresholds depending on their activities and CIIU codes, are required to implement the Self-Control and Comprehensive Risk Management System for Money Laundering and Terrorist Financing (SAGRILAFT) by may 31, 2026.

The applicable thresholds for 2026 are as follows:

2.    Minimum Measures Regime - May 31, 2026

The Minimum Measures Regime associated with Money Laundering and Terrorist Financing (ML/TF) must be implemented by Chambers of Commerce, foreign Non-Profit Entities (ESALES), and Designated Non-Financial Businesses and Professions or DNFBPs (real estate agents, dealers in precious stones and metals, legal services, or accounting services) with revenues equal to or greater than 3.000 Current Minimum Legal Monthly Wages (SMMLV) or assets equal to or greater than 5.000 SMMLV, provided they fall under the economic activity code defined for their specific sector:

Transparency and Business Ethics Program (PTEE) – May 31, 2026

Supervised companies are required to implement the Transparency and Business Ethics Program (PTEE) if, as of december 31 of the immediately preceding year (2025), they have carried out transactions with foreign natural or legal persons for amounts equal to or greater than one hundred (100) Monthly Legal Minimum Wages (SMMLV) and, additionally, have obtained total revenues or total assets equal to or greater than thirty thousand (30.000) SMMLV.

The implementation deadline is may 31, 2026.

Report No. 75 – SAGRILAFT and PTEE

Informe Report submitted to the Superintendence of Companies regarding the management of the Self-Control and Comprehensive Risk Management System for Money Laundering, Terrorist Financing and the Financing of the Proliferation of Weapons of Mass Destruction (SAGRILAFT) and the Transparency and Business Ethics Program (PTEE). Pursuant to External Circular 100-000003 of 2024, this report now consolidates those previously filed as Report No. 50 and Report No. 52 (now Report No. 75).

Report No. 75 must be submitted by companies required to implement SAGRILAFT and/or PTEE, in accordance with the provisions set forth in Chapters X and XIII of the Basic Legal Circular.

For 2026, the maximum filing deadline falls in July, and the exact date depends on the last two (2) digits of the Tax Identification Number (NIT):

Report No. 58 – Compliance Officers

Obligated parties that are required to appoint (i) a SAGRILAFT Compliance Officer and/or (ii) a Transparency and Business Ethics Program (PTEE) Compliance Officer, as well as their respective alternate compliance officers, must complete Report No. 58 – Compliance Officers within fifteen (15) business days following the initial appointment, modification, or replacement, of either the principal or alternate compliance officer, as applicable.

Obligations of Financial Superintendency

1.    SARLAFT

All entities subject to inspection, surveillance, or control by the Financial Superintendency of Colombia are required to implement, maintain, update, and effectively apply the System for the Administration of the Risk of Money Laundering, Terrorist Financing, and the Proliferation of Weapons of Mass Destruction (SARLAFT), in accordance with the instructions set forth in the Basic Legal Circular, the Organic Statute of the Financial System, and other applicable regulations.

The obligation to implement SARLAFT is not subject to minimum thresholds of income, assets, or operational size. This requirement is objective and sector-based, and arises solely from holding the status of an entity supervised by the Financial Superintendency of Colombia.

2.    Minimum Measures Regime

Entities supervised by the Financial Superintendency of Colombia are not subject to a minimum measures regime equivalent to that applicable to other sectors, since the general rule is the full and comprehensive implementation of SARLAFT, in accordance with the parameters established in the Basic Legal Circular.

However, certain entities exempt from the full application of Chapter IV must, in all cases, comply with specific AML/CFT risk control obligations, particularly those related to the reporting of suspicious transactions, cash transaction reports, and other reports required by the Unidad de Información y Análisis Financiero (UIAF), as provided for in the Organic Statute of the Financial System.

3.    Transparency and Business Ethics Program (PTEE)

Entities supervised by the Financial Superintendency of Colombia (SFC) are not subject to the Transparency and Business Ethics Program (PTEE).

4.    SARLAFT Compliance Officer

Entities required to implement SARLAFT must appoint a Compliance Officer, along with a duly designated alternate when applicable, who must meet the requirements of suitability, experience, independence, and dedication established by the Financial Superintendency of Colombia.

The Compliance Officer shall be responsible for the proper implementation, execution, monitoring, and continuous improvement of SARLAFT, as well as for coordination with the competent authorities in matters related to AML/CFT risk prevention.

5.    UIAF Reports

Entities supervised by the Financial Superintendency of Colombia must comply with the reporting obligations required by the UIAF, in accordance with the applicable technical specifications, deadlines, and reporting frequency, through the SIREL system.

6.     Mandatory AML/CFT Training

Supervised entities must implement ongoing training programs on the prevention of money laundering, terrorist financing, and the financing of the proliferation of weapons of mass destruction, addressed to directors, employees, and any other individuals linked to the entity.

Obligations of the National Superintendency of Health

1.    SARLAFT

All legal entities subject to inspection, surveillance, or control by the National Health Superintendency are required to implement, maintain, update, and effectively apply the System for the Administration of the Risk of Money Laundering and Terrorist Financing (SARLAFT), in accordance with the provisions of External Circular No. 009 of 2016 and other applicable regulations.

The obligation to implement SARLAFT is not subject to income, asset, or operational size thresholds, but rather derives directly from the entity’s status as a supervised entity within the General System of Social Security in Health (SGSSS).

2.    Transparency and Business Ethics Program (PTEE)

Entities supervised by the National Superintendency of Health are required to adopt and implement a Transparency and Business Ethics Program (PTEE), in accordance with the guidelines established in External Circular No. 2022151000000053-5 of 2022, which sets forth specific directives for the healthcare sector regarding ethics, transparency, and good corporate governance.

3.  SARLAFT and PTEE Compliance Officer

Entities required to implement SARLAFT must appoint a Compliance Officer, along with a duly designated alternative, when applicable. Such officers must meet the requirements of suitability, experience, independence, and dedication established by the competent supervisory authority.

The Compliance Officer shall be responsible for the proper implementation, execution, monitoring, and continuous improvement of SARLAFT and PTEE, as well as for coordination with the competent authorities in matters related to the prevention of AML/CFT risk.

4.    UIAF Reports

Entities supervised by the National Superintendency of Health must comply with the reporting obligations required by the Unidad de Información y Análisis Financiero (UIAF), in accordance with the applicable technical specifications, deadlines, and reporting frequency, through the SIREL system.

5.    Mandatory AML/CFT and PTEE Training

Supervised entities must implement ongoing training programs on the prevention of money laundering, terrorist financing, and the financing of the proliferation of weapons of mass destruction, as well as on PTEE, aimed at directors, employees, and any other individuals linked to the entity.

Obligations of the Superintendency of the Solidarity Economy

1.    SARLAFT

Solidarity economy organizations subject to inspection, surveillance, or control by the Superintendencia de la Economía Solidaria are required to implement, maintain, and apply the System for the Administration of the Risk of Money Laundering and Terrorist Financing (SARLAFT), in accordance with the provisions of External Circular No. 20 of 2020, External Circular No. 32 of 2021, and any other regulations that amend or supplement them.

This obligation arises solely from holding the status of a supervised entity, without prejudice to the criteria of graduality and proportionality defined by the Superintendency of the Solidarity Economy.

2.    Transparency and Business Ethics Program (PTEE)

Entities supervised by the Superintendency of the Solidarity Economy are not required to implement a Transparency and Business Ethics Program (PTEE), as there is currently no sector-specific regulation in force mandating its adoption.

3.    SARLAFT Compliance Officer

Organizations required to implement SARLAFT must appoint a Compliance Officer, in accordance with the suitability and experience requirements established by the Superintendency of the Solidarity Economy.

The Compliance Officer shall be responsible for the implementation, execution, and monitoring of SARLAFT, as well as for fulfilling reporting obligations before the competent authorities.

4.    UIAF Reports

Solidarity economy organizations subject to inspection, surveillance, or control by the Superintendency of the Solidarity Economy must comply with the mandatory reporting obligations before the Unidad de Información y Análisis Financiero (UIAF), in accordance with the technical guidelines, deadlines, and reporting frequency defined for each type of entity, based on their level and nature of activity, through the SIREL system.

4.1. Solidarity Economy Organizations that DO NOT carry out financial activities

(Level 2 and Level 3 cooperativism)

These organizations must comply with the following reports:

4.2. Solidarity Economy Organizations that DO carry out financial activities

 (Cooperatives with financial activity)

5.    Mandatory AML/CFT Training

Supervised organizations must implement continuous training programs on the prevention of money laundering and terrorist financing, aimed at directors, employees, and members.

Obligations of the Superintendency of Private Surveillance and Security

1.    SARLAFT 2.0

All legal entities subject to inspection, surveillance, or control by the Superintendencia de Vigilancia y Seguridad Privada are required to implement the System for the Administration of the Risk of Money Laundering and Terrorist Financing (SARLAFT 2.0), in accordance with the instructions issued by such authority.

No minimum income or asset thresholds apply. This obligation arises solely from carrying out private surveillance and security activities.

2.    Transparency and Business Ethics Program (PTEE) – March 16, 2026

Legal entities supervised by the Superintendency of Private Surveillance and Security must implement a Transparency and Business Ethics Program (PTEE), in accordance with External Circular No. 20251000000035CS of 2025.

The obligation derives from the status of a supervised entity, without the application of income or asset thresholds.

3.    SARLAFT and PTEE Compliance Officer

Entities required to implement SARLAFT and PTEE must appoint a Compliance Officer, along with an alternate, where applicable, meeting the suitability and experience requirements established by the Superintendency of Private Surveillance and Security.

4.    UIAF Reports

5.     Mandatory AML/CFT and PTEE Training

Obligations of the Superintendency of Transport

1.    SARLAFT

Natural and legal persons subject to inspection, surveillance, and control by the Superintendencia de Transporte are required to implement the System for the Administration of the Risk of Money Laundering, Terrorist Financing, and the Financing of the Proliferation of Weapons of Mass Destruction (SARLAFT), in accordance with the provisions of the Unified Infrastructure and Transport Circular and the resolutions that implement it.

This obligation does not depend on income or asset thresholds, but rather on the status of a supervised entity and the type of activity carried out within the transport sector.

2.    Transparency and Business Ethics Program (PTEE) – May 18, 2026

The Transparency and Business Ethics Program (PTEE) was incorporated into the regulatory framework of the Superintendency of Transport through Resolution No. 14673 of September 18, 2025, which added Chapter 10 to Title V of the Unified Infrastructure and Transport Circular, in implementation of Law 2195 of 2022.

All legal entities supervised by the Superintendency of Transport that carry out business activities are required to implement the PTEE, without the application of thresholds expressed in statutory minimum monthly wages (SMMLV).

Implementation deadline

The Resolution established a transitional period of eight (8) months.

3.    SARLAFT and PTEE Compliance Officer

Entities obligated to implement SARLAFT and the Transparency and Business Ethics Program (PTEE) must appoint a Compliance Officer, who may perform both functions concurrently, provided that they meet the requirements of suitability, experience, independence, and dedication established by the applicable regulations of the Superintendency of Transport.

The appointment must be made by the competent governing body of the entity and must ensure continuity of the compliance function.

4.     UIAF Reports

Entities subject to SARLAFT must comply with the reporting obligations required by the Unidad de Información y Análisis Financiero (UIAF), through the SIREL system.

5.    Mandatory AML/CFT and PTEE Training

National Database Registry (RNBD)

Obligations related to the National Database Registry (RNBD) are governed by Law 1581 of 2012, Decree 1074 of 2015, and External Circular No. 002 of 2015, issued by the Superintendency of Industry and Trade, the national authority for personal data protection.

These obligations apply to personal data controllers that meet the objective criteria established by the regulations, regardless of the economic sector or the Superintendency responsible for their supervision.

Who is required to register with the RNBD?

Public or private legal entities, as well as individual merchants, acting as data controllers, are required to register with the RNBD if they meet at least one of the following criteria:

RNBD Obligations