🇨🇴 Colombia · Superintendency of Companies · Chapter IX
SAGRILAFT and PTEE are now one system. Adapt yours before May 2027
On 2 July 2026 Colombia's Superintendency of Companies issued Circular Externa 100-000020, a new Basic Legal Circular that repealed the previous circulars and merged SAGRILAFT with the Business Transparency and Ethics Programme into a single system, Chapter IX. Companies already in scope have until 31 May 2027 to adapt, and until then their SAGRILAFT and PTEE remain valid. COX is the operating system for that compliance: documented due diligence, list screening, a risk matrix, and the evidence the Superintendency asks for when it arrives.
Regulatory framework of reference
- Circular Externa 100-000020 of 2026: the Basic Legal Circular that merged SAGRILAFT and PTEE into Chapter IX
- Superintendency of Companies: issues the circular; in the first instance, its Compliance Directorate, within the Delegature for Economic and Corporate Affairs, imposes the sanctions
- UIAF: receives the suspicious operation report through SIREL and, after a quarter without one, the absence report (AROS)
- Transition deadline: 31 May 2027 for companies already in scope, whose SAGRILAFT and PTEE remain valid until then
- Minimum Measures Regime: from 369,676 UVB of revenue or 616,127 UVB of assets in the sectors it lists, with lighter requirements
What Circular 100-000020 of 2026 changed
One system, one chapter
SAGRILAFT and PTEE stop being parallel programmes with separate manuals, matrices and governance. They now sit together in Chapter IX of the Basic Legal Circular, covering money laundering, terrorist financing, weapons proliferation financing and, additionally, corruption and transnational bribery.
One compliance officer
The role is unified. Companies that ran a SAGRILAFT lead and a PTEE lead, or one person wearing both hats and filing two reports, move to a single line of responsibility.
A professionalised compliance officer
The new regime requires a professional degree, at least one year of experience in compliance roles, a specialisation, a master's degree or a ninety-hour diploma in these risks, refresher education at least every three years and residence in Colombia, plus a deputy meeting the same requirements.
Ten obligated entities per officer
One compliance officer may not serve more than ten obligated entities, except within a business group or a declared control situation. Nor may the officer be the statutory auditor or the legal representative.
Thresholds indexed to UVB
Scope thresholds are expressed in Basic Value Units (UVB) rather than minimum wages, and sanctions are also set in UVB. Assess your position as at 31 December of the prior year.
Additional sectors
The Minimum Measures Regime includes, among others, the pharmaceutical, infrastructure and construction, manufacturing and mining and energy sectors.
Who sanctions can reach
The chapter provides for sanctions on the obligated entity, its directors, the compliance officer and the statutory auditor, under Article 86(3) of Law 222 of 1995.
Transition deadline: 31 May 2027
Companies already in scope have until that date to adapt, and until then their SAGRILAFT and PTEE remain valid. A company that becomes obligated for the first time as at 31 December 2026 must have the system in place by 31 May 2027, and applies Chapter IX directly.
Is your company in scope?
The full system applies to companies supervised or controlled by the Superintendency of Companies with total revenue or assets of 4,929,017 UVB or more as at 31 December of the prior year. In these sectors the threshold falls to 3,696,762 UVB:
- Real estate agents
- Trade in precious metals and stones
- Legal services
- Accounting services
- Construction of buildings and civil engineering works
- Vehicle trading
Virtual asset activities have their own rules from 12,323 UVB, and chambers of commerce with ordinary revenue from 4,929,017 UVB and Confecámaras are also obligated. Below the full-system threshold the Minimum Measures Regime applies, from 369,676 UVB of revenue or 616,127 UVB of assets in sectors such as real estate, legal and accounting services, pharmaceuticals, construction, manufacturing and mining and energy. Falling below the higher threshold does not mean falling outside, and a company that stops meeting the threshold stays obligated for two more years in the full system and one in the Minimum Measures Regime.
Your duties under Chapter IX
Compliance officer and deputy
Appointed by the board or the highest corporate body, meeting the professional profile the new regime requires, with an equivalent deputy. The appointment is reported to the Superintendency within fifteen business days, and if the officer leaves there are thirty calendar days to appoint another.
Integrated manual
A single document covering ML/TF/PF risks together with corruption and transnational bribery, setting out policies, procedures and owners.
Due diligence and enhanced due diligence
Knowing your counterparties, with a reinforced procedure for higher-risk ones, including politically exposed persons. Information is updated at least once a year for high-risk counterparties and every two years for medium or low-risk ones.
Beneficial ownership
Identifying the natural person who holds five per cent or more of the capital, the votes or the benefits, or who controls by other means, under Article 631-5 of the Tax Statute, with supporting documentation.
Risk matrix
Identifying, measuring, controlling and monitoring risk by factor, with a documented and reviewable methodology.
Reporting to the UIAF
Suspicious operation reports immediately, through SIREL. If a quarter passes without one, the officer files the absence report (AROS) within ten calendar days after the quarter ends.
Binding lists
Permanent screening against the lists binding on Colombia. If any asset under the name or control of a listed person appears, it is reported immediately to the UIAF and brought to the attention of the Attorney General's Office.
Training
Awareness and training for employees and counterparties at least once a year, with a record of attendees, date and topics.
Record keeping
Due diligence is documented with the date, time and name of whoever verified it, and the supporting records are kept for the statutory period, in a way that allows every decision to be reconstructed.
Minimum Measures Regime
In the simplified regime the legal representative answers for it: designs the system, registers in SIREL as the sole person responsible for the ROS and the quarterly AROS, and trains staff at least once a year.
How COX solves it
One file per counterparty
A single file serving both sides of Chapter IX, without duplicating the work SAGRILAFT and PTEE used to require separately.
Restrictive list screening
Screening against the Consolidated List of the United Nations Security Council, the OFAC list of the US Treasury, the consolidated lists of the European Union, the United Kingdom and Canada, at onboarding and on a recurring basis.
The Colombian sources, named
Alongside the international ones, your officer searches the national sources: the politically exposed persons published by Función Pública, the SIRI disciplinary records of the Procuraduría, the fiscal liability declared by the Contraloría, and the state contracting registers of SECOP II.
Police judicial records
The National Police portal does not allow automated queries, so your officer runs it on the official site and COX records the outcome, the downloaded certificate and who reviewed it. We would rather tell you where a person steps in than pretend nobody does.
PEP detection
Identification of politically exposed persons, their family members and close associates, with the enhanced due diligence Colombian rules require.
The report says which data was searched
Not just the date and time of the check: the specific edition of each list and its cut-off date. And when a source does not answer, the report says that list was not searched, instead of printing it with a dash next to the ones that were.
Continuous monitoring
Lists change daily. COX runs your files against every new edition and alerts you when a counterparty you already onboarded turns up later.
Adverse media
Negative news searches on the counterparty, with the evidence filed against the record.
Deep research
When a hit needs more than a search, COX produces an open-source report with every finding verified and adjudicated one by one before it moves the risk score.
Batch screening
Upload your whole portfolio and COX opens a real search for each subject, reporting in PDF and Excel. This is what settles the initial adaptation, when the counterparties you already had have to be reviewed in one go.
Documented risk matrix
Segmentation by factor with a traceable methodology, which is what the Superintendency reviews when it asks to see the system.
Digital onboarding
Forms and document upload from the counterparty's own device, validated before the file reaches your team.
Whistleblower channel
Chapter IX absorbed the Business Transparency and Ethics Programme, and with it the whistleblowing line. COX includes one, with genuinely anonymous reporting: for a reporter who chooses anonymity, no IP address and no browser data is kept.
Training with a record
Courses, attendance, content and a certificate with an expiry date. Chapter IX requires training at least once a year, with a record of attendees, date and topics.
Sealed reports and audit trail
Every report issued carries a digital fingerprint registered in the platform, so a PDF handed to you tomorrow can be checked against the one COX issued. Underneath it, an immutable record of every check, decision and approval, exportable for the statutory auditor, internal audit or the supervisor.
Non-compliance costs more than compliance
At the Superintendency of Companies, sanctions are imposed in the first instance by the Compliance Directorate, within the Delegature for Economic and Corporate Affairs, and it is doing so. In January 2024, under the previous rules, it fined one company 6,392 UVB, seventy million pesos, on each of three charges, including the stages of SAGRILAFT and due diligence; and another 33,750,000 pesos, upheld on appeal.
Chapter IX provides for sanctions on the obligated entity, its directors, the compliance officer and the statutory auditor, set in UVB.
Why COX
Live in days
Adapting your system to Chapter IX before May 2027 does not require a year-long project.
Built for the real sector
Not a banking platform in disguise. Designed for real-sector companies and for legal and accounting practices.
Pay as you go
No forced monthly fee. You pay for the counterparties you screen.
data encryption · immutable audit log · role-based access · cloud hosting
Start adapting now
The deadline is 31 May 2027, but adapting means appointing a compliance officer who meets the new profile, merging two manuals into one and rebuilding the matrix. That is not last-week work.
Frequently asked questions
Guides on this topic:
SAGRILAFT, SARLAFT and PTEE explained Due diligence and KYC What a compliance officer doesCOX also covers these countries:
Panama Mexico: PLD software Mexico: LFPIORPI Ecuador Guatemala Dominican Republic Venezuela