SAGRILAFT, SARLAFT and PTEE: What They Are and How They Differ
Colombia's three systems against money laundering and corruption, and what changed in 2026.
Talk to us on WhatsApp COX for SAGRILAFT and PTEE See every service
SAGRILAFT is the anti-money laundering system of Colombian companies outside the financial sector, supervised by the Superintendency of Companies. SARLAFT is the system of the entities supervised by the Financial Superintendency. PTEE is the business transparency and ethics programme against corruption and transnational bribery. Since Circular 100-000020 of 2026, SAGRILAFT and PTEE are a single system in Chapter IX: the Self-Control and Risk Management System LA/FT/FP and C/ST.
What Each One Is
SAGRILAFT
Self-Control and Comprehensive Risk Management System for money laundering, terrorist financing and financing of the proliferation of weapons of mass destruction (LA/FT/FPADM).
The system that companies of the real sector supervised by the Superintendency of Companies must implement when they meet the thresholds of the rules: identify, measure, control and monitor the risk of being used to launder money or finance terrorism.
SARLAFT
Money Laundering and Terrorist Financing Risk Management System.
The equivalent system for the entities supervised by the Financial Superintendency, such as banks and insurers, set out in its Basic Legal Circular as reissued by Circular Externa 006 of 2025, in force since 26 June 2025. The Superintendency of the Solidarity Economy also requires a SARLAFT from the cooperatives and other organisations it supervises, in Title V of its own Basic Legal Circular.
PTEE
Business Transparency and Ethics Programme.
The programme against corruption and transnational bribery for companies supervised by the Superintendency of Companies. Until 2026 it ran in parallel with SAGRILAFT, with its own manual and its own officer.
Side by Side
| SAGRILAFT | SARLAFT | PTEE | |
|---|---|---|---|
| Supervisor | Superintendency of Companies | Financial Superintendency | Superintendency of Companies |
| Who applies it | Real-sector companies that meet the thresholds | Supervised financial entities | Real-sector companies that meet the thresholds |
| Risks it covers | Money laundering, terrorist financing and proliferation financing | Money laundering and terrorist financing | Corruption and transnational bribery |
| Beneficial owner | 5% or more, as defined in the Tax Statute (Article 631-5) | 5% or more, as defined in the Tax Statute, plus the shareholders with more than 5% of the capital | 5% or more, as defined in the Tax Statute (Article 631-5) |
| Where it is set out | Chapter IX of the Superintendency of Companies' Basic Legal Circular, since 2026 | Basic Legal Circular of the Financial Superintendency, reissued by Circular Externa 006 of 2025 | Chapter IX of the Superintendency of Companies' Basic Legal Circular, since 2026 |
What Changed in 2026
On 2 July 2026 the Superintendency of Companies issued Circular Externa 100-000020, a new Basic Legal Circular that repealed the previous ones.
SAGRILAFT and PTEE, one system
Both now sit in Chapter IX, in a single system that covers money laundering, terrorist financing and proliferation financing together with corruption and transnational bribery.
One compliance officer, one manual
One policy and one manual for five risks: money laundering, terrorist financing, proliferation financing, corruption and transnational bribery. A principal officer and a deputy with the same requirements, and a ban on paper compliance: a system copied from someone else does not count.
Who answers for it
The Superintendency of Companies can sanction the obligated company, its directors, the compliance officer and the statutory auditor (Law 222 of 1995, Article 86, section 3), with fines measured in UVB.
Deadline: 31 May 2027
Companies already obligated have until that date to adapt, and until then the SAGRILAFT and PTEE they implemented remain valid. A company that meets the thresholds for the first time at the 31 December 2026 cut-off also has until 31 May 2027, and applies Chapter IX directly.
SARLAFT did not change with this circular: it belongs to the Financial Superintendency.
Does My Company Have to Implement It?
It depends on the total revenue or assets at 31 December of the previous year, measured in Basic Value Units (UVB) instead of minimum wages, and on the sector. The company must also be supervised by the Superintendency of Companies and not by another supervisor with its own regime.
| Who | Threshold (revenue or assets) | What applies |
|---|---|---|
| Any company supervised by the Superintendency of Companies | 4,929,017 UVB or more | The full system |
| Real estate agents, precious metals and stones, legal services, accounting services, construction and vehicle trade | 3,696,762 UVB or more | The full system |
| Virtual assets | Contributions or operations of 12,323 UVB or more (for services to others, also 369,676 UVB of revenue or 616,127 UVB of assets) | The full system, always with enhanced due diligence |
| The sectors above plus pharmaceuticals, manufacturing, and mining and energy | 369,676 UVB of revenue or 616,127 UVB of assets | The Minimum Measures Regime |
Chambers of commerce and Confecámaras are obligated too. The circular does not give the value of the UVB in pesos: convert each threshold with the official value for the year. A company that drops below its threshold stays obligated for two more years in the full system, or one more year in the Minimum Measures Regime.
What the System Includes
- A compliance officer and a deputy, appointed by the highest corporate body
- An integrated manual with policies, procedures and owners
- Due diligence on counterparties, updated at least once a year for high-risk ones and every two years for the rest, and enhanced for PEPs and higher-risk counterparties
- Identification of the beneficial owner, from 5% as the Tax Statute defines it, with its documentary support
- A risk matrix with a documented methodology
- Suspicious operation reports to the UIAF through SIREL, immediately, and a report of absence within 10 calendar days after each quarter without one
- Training of employees and counterparties at least once a year, with a record of who received it
- Record keeping that lets every decision be reconstructed
- Permanent checks against the binding lists, with an immediate report to the UIAF and the Attorney General's Office when assets of a listed person turn up
The Compliance Officer under Chapter IX
Profile
- A professional degree and at least one year of experience in compliance roles
- A specialisation or master's degree, or a diploma course of at least 90 hours on these risks
- An update of that knowledge at least every three years
- Domicile in Colombia, and a deputy who meets the same requirements
Limits and deadlines
- No more than ten obligated companies per officer, except within a business group or a declared control situation
- Neither the statutory auditor, nor the legal representative, nor a board member or a partner can be the officer
- The appointment is reported to the Superintendency within 15 business days of the meeting that made it
- If the officer leaves, the company has 30 calendar days to appoint a new one
The Minimum Measures Regime
It is lighter, but it is still a system. The legal representative designs it, runs it and answers for it before the Superintendency, and the board approves it in the minutes. It requires training at least once a year, written due diligence on counterparties and their beneficial owners, permanent checks against the binding lists, and the legal representative registered in SIREL as the only person responsible for the suspicious operation reports and the quarterly report of absence.
Who Sanctions
Within the Superintendency of Companies, the Compliance Directorate of the Delegation for Economic and Corporate Affairs decides in the first instance, and the Deputy Superintendent for Economic and Corporate Affairs hears the appeals. The Superintendency publishes its SAGRILAFT and PTEE sanction resolutions on its website.
The Operation of the System, in COX
One file per counterparty for both fronts of Chapter IX: due diligence, restrictive list and PEP screening, adverse media, a documented risk matrix, training records and an immutable trail of every decision. The manual and the officer stay with your company.
COX for SAGRILAFT and PTEEFrequently Asked Questions
This guide is for informational purposes only and does not constitute legal advice. It summarises Circular Externa 100-000020 of 2026 without replacing it: confirm thresholds, deadlines and requirements in the official text of the Superintendency of Companies or with a Colombian adviser.
Get Ready Before May 2027
Adapting means a new officer profile, one manual instead of two and a new matrix. Start with the files.
Talk to us on WhatsApp See every service Estimate your costs
Explore more COX solutions:
COX for SAGRILAFT and PTEE Restrictive list screening Employee Compliance Training How to implement a whistleblowing channel