Update to the Superintendency of Corporations’ Basic Legal Circular

Unification of risk management systems

The most significant change is the merger of both regimes into a single framework: the new Chapter IX establishes the Comprehensive Self-Monitoring and Risk Management System for Money Laundering, Terrorist Financing, Proliferation Financing of Weapons of Mass Destruction, Corruption, and Transnational Bribery. The obligations that were previously divided between SAGRILAFT and PTEE must now be managed under a single framework.

This unification also extends to the Minimum Measures Regime, applicable to companies in sectors such as legal and accounting services, real estate agents, vehicle sales, the pharmaceutical sector, infrastructure and construction, mining, and energy, among others, as well as to those that carry out specific activities or meet the thresholds defined in the Circular.

As a result of this update, organizations subject to this regime must manage ML/TF/PWMD and C/ST risks in an integrated manner, incorporating the latter two risks, which were not covered under the scope of the previous regulation.

New thresholds: From SMLMV to Basic Value Units (UVB)

The Circular replaces the Current Legal Monthly Minimum Wages (SMLMV) with Basic Value Units (UVB) as the criterion for determining who is subject to these requirements. The UVB is a measure of value in pesos that replaces the monthly minimum wage-and in some cases, the Tax Value Unit (UVT)- as the benchmark for calculating and adjusting non-tax charges, fees, and penalties.

The general threshold is set at income or assets equal to or greater than 4,929,017 UVB, while for sectors with greater exposure (real estate agents, trading in metals and precious stones, legal services, accounting services, building construction and civil engineering works, and vehicle sales), the threshold is 3,696,762 UVB, subject additionally to compliance with the specific economic activities outlined in the regulation.

However, it is important to note that the application of these thresholds does not operate in isolation but also depends on the conduct of certain economic activities set forth in the Circular. Furthermore, the Circular includes other specific criteria that each organization must review to verify the applicability of the obligations established therein.

Finally, companies must recalculate their status as regulated entities using the new unit of measurement, as the result may differ from that obtained under the previous framework.

Expansion of the scope of reportable entities

The Circular expands its scope of application to include new entities: chambers of commerce and confederations of chambers of commerce. Under the previous regulations, it was necessary to conduct a separate analysis to determine which entities were subject to the PTEE and the SAGRILAFT; however, with the integration of both regimes into a single framework, this distinction largely disappears.

New role of the Statutory Auditor

The new regulation strengthens the responsibilities of the Statutory Auditor, who must evaluate the Self-Regulatory and Risk Management System for Money Laundering, Terrorist Financing, and Money Laundering and Terrorist Financing-Related Financial Activities (LA/FT/FPADM) and Corruption and Terrorist Financing (C/ST), and issue an opinion on its existence and effectiveness, incorporating the components of transparency and business ethics, as well as identify potential red flags based on the analysis of financial and accounting information.

Strengthening the Role of the Compliance Officer

The new Circular significantly tightens the requirements for the Compliance Officer:

• Professional degree.
• At least 1 year of verifiable experience in activities related to ML/TF/PADM and C/ST risk management, compliance, internal control, auditing, or related functions.
• Knowledge must be updated at least every 3 years.
• Proof of training in the subject matter, through a specialization or master’s degree, or through a certificate program with a minimum duration of 90 hours.
• Residence in Colombia.
• A maximum of 10 appointments as Compliance Officer for Regulated Entities, except for the exceptions provided for business groups.
• Mandatory appointment of a deputy Compliance Officer, who must meet the same requirements as the principal Compliance Officer, in order to ensure the continuity of the system in the event of the principal Compliance Officer’s absence.

New set of mandatory policies

Under the Self-Regulation and Risk Management System for AML/CFT, WMD Proliferation Financing Prevention (FPADM), and C/ST, companies must adopt new policies regarding lobbying, the prevention of financing the proliferation of weapons of mass destruction (WMD), government contracting, and codes of ethics, in addition to those already required regarding gifts and benefits, expenses for meals, lodging, and travel, as well as political contributions and donations. Furthermore, the system must be fully integrated with the codes of ethics, integrity, and good governance that organizations have already implemented.

The policies adopted by companies must comply with the minimum guidelines on Transparency and Business Ethics established by the Secretariat of Transparency of the Office of the President of the Republic of Colombia.

Compliance systems tailored to the specific circumstances of each organization

The new Circular emphasizes that the AML/CFT/FPADM and C/ST Self-Monitoring and Risk Management Systems must be designed and implemented in accordance with the nature, size, operations, and risk profile of each regulated entity. In this regard, the measures, controls, policies, and procedures adopted must be tailored to the specific characteristics of the organization and the risks that have been identified.

Therefore, it is essential that regulated entities have controls that are truly effective: the system must function, generate useful evidence, and address the specific risks of each company.

Strengthened reporting and whistleblower channels

Suspicious Transaction Reports (STR) and Reports of Failure to File Suspicious Transaction Reports (FSTR) must continue to be submitted to the Financial Intelligence Unit (FIU). In particular, STRs may include transactions related to risks of corruption and transnational bribery.

The whistleblower channel, for its part, must guarantee the confidentiality and anonymity of whistleblowers, protection against retaliation, the existence of an expedited procedure for handling reports, periodic monitoring of its operation, and the disclosure of available external channels.

In turn, the obligation to report alleged acts of transnational bribery to the Superintendency of Corporations remains in effect, in accordance with the procedures and requirements established by that entity. Thus, the Circular distinguishes between reports submitted to the UIAF regarding the prevention and detection of suspicious transactions and those that must be filed with the Superintendency of Corporations regarding possible instances of transnational bribery.

Implementation deadlines 

Companies that, as of December 31 of any given year, no longer meet the requirements that classify them as regulated entities will not be automatically excluded from the corresponding regime. The Circular establishes a minimum retention period during which they must continue to fulfill their obligations: an additional 2 years for entities subject to the Self-Regulation and Risk Management System for AML/CFT/PADM and C/ST, and an additional 1 year for companies subject to the Minimum Measures Regime.

Those who first become Regulated Entities on or after December 31, 2026, will have until May 31 of the following year to implement the system.

At Forvis Mazars we have a team of highly specialized professionals to serve as Compliance Officers, as well as to strengthen and integrate compliance programs and promote a culture of compliance for the benefit of our clients. If you require assistance with the implementation or fulfillment of the obligations outlined in this bulletin, please contact us via the email addresses provided, and we will be happy to discuss the best way to support you.