Counterparty due diligence under SAGRILAFT: what the rules require

What due diligence is and what a counterparty is

The Superintendence of Companies defines due diligence as the process through which a company adopts measures to know the counterparty, its operations, its legal transactions, its products, and the volume of its transactions. Put simply: knowing who the counterparty is, who is behind it, and whether the business makes sense given what you know about it.

A counterparty is any individual or legal entity with which the company has commercial, business, contractual, or legal ties of any kind. The rules list, among others, partners, employees, clients, creditors, contractors, and suppliers. A transportation provider or a maintenance contractor is a counterparty just as much as a buyer.

The guide what SAGRILAFT is introduces this piece in a single paragraph, and how to implement SAGRILAFT covers the full system. This article goes deeper into due diligence: which measures it requires, when it must be enhanced, what list checks are, and what the cycle looks like with a supplier.

Where it’s regulated today

Until July 2026, the instructions were in Chapter X of the Basic Legal Circular (Circular Básica Jurídica). External Circular 100-000020 of July 2, 2026 issued a new Basic Legal Circular and merged the former Chapters X (SAGRILAFT) and XIII (PTEE) into a single Chapter IX, which covers money laundering, the financing of terrorism and of weapons proliferation, domestic corruption, and transnational bribery. How the two former programs related to each other is explained in SAGRILAFT and PTEE.

Companies that were already subject to the rules must adjust their system by May 31, 2027, under the transition period in section 9.29. In the meantime, the systems already in place remain valid. What follows is based on Chapter IX.

What minimum measures the rules require

Chapter IX starts from one principle: not every counterparty calls for the same depth of review. This is the risk-based approach. The company must apply measures proportionate to its level of risk and avoid excessive due diligence that disrupts its operations. Within that framework, section 9.15.1 sets these minimum guidelines.

That database has minimum content: the counterparty’s name, identification, address, beneficial owner, legal representative’s name, contact person’s name and position, and the date of the know-your-counterparty or monitoring process.

The beneficial owner is the individual who ultimately owns or controls the counterparty, directly or indirectly. Chapter IX refers to the definition in Article 631-5 of Colombia’s Tax Code (Estatuto Tributario) and requires specifying how that control is exercised: through ownership, with shares or interests, or by other means.

Due diligence is carried out before the transaction or relationship begins, and only exceptionally afterward, always with the risks under control and the process documented. If it can’t be completed satisfactorily, the company must assess, under its policy, whether to continue the relationship and whether a suspicious transaction report to the UIAF (Unidad de Información y Análisis Financiero, Colombia’s financial intelligence unit) is warranted.

What a binding list check is

When people search for “consulta SAGRILAFT” (a SAGRILAFT check), they almost always mean checking whether a person or company appears on a list. The rules refer to binding lists (listas vinculantes): lists of individuals and entities associated with terrorist organizations that are binding on Colombia under Article 20 of Law 1121 of 2006 and international law. Chapter IX names two groups:

• The lists that derive from United Nations Security Council resolutions, including Resolutions 1267 of 1999, 1373 of 2001, 1718 and 1737 of 2006, 1988 and 1989 of 2011, and 2178 of 2014, and those that succeed them.
• Any other list binding on Colombia. The circular gives as examples the United States terrorist lists and the European Union lists of terrorist organizations and of persons designated as terrorists.

The rules require checking these lists on an ongoing basis, not only at onboarding. If any property, asset, product, fund, or right is identified in the name or under the control of a listed person or entity, the compliance officer must report it immediately to the UIAF and notify the Office of the Attorney General (Fiscalía General de la Nación).

Lists aren’t the whole review. Chapter IX requires adequate human and technological resources to gather information on the commercial, reputational, and sanctions background, in administrative, criminal, or disciplinary matters, of the persons subject to due diligence, including contractors and prospective contractors.

When enhanced due diligence applies

Enhanced due diligence (debida diligencia intensificada) means deeper knowledge of the business, the counterparty, and the origin of the assets received, with activities beyond those of ordinary due diligence. Section 9.17 requires it in these cases.

On top of the standard measures, enhanced due diligence adds three obligations:

• Obtain senior management approval to begin or continue the business relationship.
• Take reasonable measures to establish the origin of the funds.
• Carry out ongoing, enhanced monitoring of the contractual relationship.

The due diligence cycle for a supplier

With a supplier that is a legal entity, due diligence usually follows a sequence like the one below. Each company’s policy and manual set the order and the detail: these steps are common practice, not a procedure the rules impose as written.

1. Request the information The supplier fills out the know-your-counterparty form the company designed and submits the documents its policy requires
2. Identify and verify The identity of the supplier and its legal representative is checked against documents and independent sources
3. Identify the beneficial owner The ownership and control structure is traced back to the individuals behind it
4. Check lists and background The compliance team checks the binding lists and the background with its own tools
5. Rate the risk and decide The team determines whether enhanced due diligence applies, and the onboarding is approved by whoever the policy designates
6. Monitor and update The relationship is followed for as long as it lasts, and the information is updated as often as the rules require

How often it’s updated

• High-risk counterparties At least once a year
• Medium- or low-risk counterparties At least every two years
• Changes or red flags Right away, without waiting for the deadline, when the counterparty’s legal, corporate, economic, or financial conditions change

Document expiration is a separate clock from the one the rules set: a certificate that expires has to be requested again even if the general update isn’t due. How those dates are tracked is explained in contractor document expirations.

Which documents are usually requested

Chapter IX doesn’t include a list of documents: each company defines it based on its risk. From a supplier that is a legal entity, it’s common to request:

• Certificate of existence and legal representation issued by the chamber of commerce.
• RUT (Registro Único Tributario, Colombia’s tax registration).
• The legal representative’s ID document.
• Shareholder structure or beneficial ownership statement.
• Financial statements for the last fiscal year.
• Bank certification letter.
• Know-your-counterparty form, with authorization to process personal data.

Setting which document is required, based on each third party’s activity and profile, is the job of a document requirements matrix.

Evidence and the document side in a system

Section 9.22 requires that the information the counterparty provides, and the name of the person who verified it, be documented with the date and time, so the company can prove it exercised due and timely diligence. Supporting records are kept as provided in Article 28 of Law 962 of 2005, and data processing must comply with Law 1266 of 2008 and Law 1581 of 2012 (Colombian data protection law).

Part of this whole process is pure document operations: requesting documents, reviewing them against criteria, knowing when they expire, and keeping a record of every decision. In NAVA 360, the supplier or contractor registers and uploads its documents from its portal; your team approves, rejects, or leaves them pending against the defined review criteria; the system calculates the expiration date and flags what’s expiring soon; and every approval and every rejection is logged with the person responsible and the date. Your company defines which documents are requested, for its due diligence or for any other requirement.