How to implement SAGRILAFT: stages, elements, and responsibilities

What SAGRILAFT is for and which regulation governs it today

The Superintendence of Companies defines it as a mandatory compliance system whose goal is to prevent, detect, and manage the risks of money laundering, terrorist financing, financing the proliferation of weapons of mass destruction, domestic corruption, and transnational bribery. It aims to keep the company from being used, or lending itself, as a vehicle for those offenses.

On July 2, 2026, the Superintendence issued External Circular 100-000020, which reissued the Basic Legal Circular. It repealed External Circular 100-000016 of 2020, which had fully overhauled the former Chapter X, and merged SAGRILAFT and the PTEE into the new Chapter IX, under the name Sistema de Autocontrol y Gestión de Riesgos LA/FT/FP y C/ST (self-control and risk management system for LA/FT/FP and C/ST).

• LA: lavado de activos (money laundering) The offense defined in Article 323 of the Colombian Criminal Code
• FT: financiación del terrorismo (terrorist financing) The offense defined in Article 345 of the Colombian Criminal Code
• FP: financiación de la proliferación de armas de destrucción masiva (financing the proliferation of weapons of mass destruction) Providing funds or financial services to manufacture, acquire, or transport those weapons for illegitimate purposes
• C: corrupción local (domestic corruption) Criminal conduct in which the company benefits or is used as a vehicle, such as offenses against public administration
• ST: soborno transnacional (transnational bribery) Giving, offering, or promising benefits to a foreign public official in an international business deal (Law 1778 of 2016)

SAGRILAFT is still the name companies use, and the circular itself keeps it when referring to systems adopted under the earlier rules. It shouldn’t be confused with SARLAFT, which belongs to a different authority (SAGRILAFT vs. SARLAFT).

The implementation sequence, step by step

Chapter IX doesn’t number a sequence of steps: it sets out elements, responsibilities, and stages. In practice, they’re carried out in this order.

1. Confirm whether the company is required to comply And whether the full system or the Minimum Measures Regime applies
2. Design the system Based on the company’s own risks, not a copy of someone else’s
3. Approve it In the minutes of the board of directors or the highest governing body
4. Appoint the compliance officer A primary officer and an alternate, meeting the circular’s requirements
5. Identify and measure the risk Segment the risk factors and build the matrix
6. Control and monitor Apply controls, due diligence, and periodic follow-up
7. Report Suspicious transactions to the UIAF, plus any other reports the rules require
8. Communicate, train, and document With a record of every activity and an audit of the system

Step 1: confirm whether your company is required to comply

The obligation applies to companies supervised or controlled by the Superintendence of Companies whose total revenue or total assets as of December 31 of the previous year exceed the threshold, and to companies in certain sectors with their own requirements. The new circular sets those thresholds in basic value units (UVB) instead of minimum monthly wages. Some companies fall under the Minimum Measures Regime (Régimen de Medidas Mínimas), a simplified version run by the legal representative. The criteria are explained in our guide what SAGRILAFT is and who it applies to, and the check is always done against the current text.

Design, approval, and the compliance officer

The company itself is responsible for the design, which must start from an analysis of its risks: sector, business activity, jurisdictions, contractors, intermediaries, distribution channels, and government contracts, among others. The circular expressly prohibits paper compliance: policies and procedures copied from other systems that don’t reflect the company’s reality.

The system includes a policy and a procedures manual. Because it absorbed the PTEE, it also requires policies on gifts, hospitality, political contributions, donations, lobbying, and government contracting, along with a code of ethics and a whistleblower channel. That component is covered in SAGRILAFT and PTEE.

Who approves it

Approval falls to the board of directors or, if the company doesn’t have one, to the highest governing body, and it must be recorded in the minutes. The legal representative and the compliance officer submit the proposal together. The same body approves any updates.

The compliance officer

The board of directors or the highest governing body appoints the officer, on the legal representative’s proposal, along with an alternate who must meet the same requirements. The officer reports directly to that body and must act with autonomy and independence. At a minimum, the circular requires:

• A professional degree, with knowledge of LA/FT/FP and C/ST risk management updated at least every three years.
• At least one year of professional experience in compliance roles related to managing these risks.
• Knowledge certified through a specialization or master’s degree, or through diploma programs of at least 90 hours on the subject.
• Residence in Colombia.

The compliance officer can’t be a director or officer of the company (including the legal representative and board members), a shareholder, the statutory auditor (revisor fiscal), or the internal or external auditor. The same person can’t hold the role in more than ten obligated companies, except within a corporate group. The appointment is reported to the Superintendence through the non-financial report, with the supporting documents listed in section 9.9.4.

The four stages and the risk matrix

Chapter IX sets four minimum stages, which repeat: the risk is reviewed periodically and whenever products, channels, jurisdictions, clients, or regulations change.

The tool that ties the four stages together is the risk matrix: the circular requires one that covers all of them, with defined methodologies and information sources. The compliance officer designs the methodologies, tailored to the company, and carries out the risk assessment.

A central part of control is knowing and verifying who the company does business with, at an intensity proportional to the risk: counterparty due diligence.

Reports, training, documentation, and roles

Reports to the UIAF and the Superintendence

• Suspicious transaction report (ROS): filed immediately with the UIAF (Unidad de Información y Análisis Financiero), Colombia’s financial intelligence unit, through SIREL whenever a suspicious transaction is detected. It isn’t a criminal complaint and doesn’t require certainty that a crime occurred.
• No-ROS report (AROS): if a quarter goes by without any ROS, the compliance officer files this report through SIREL, under the terms the UIAF sets.
• Binding lists: if an asset or fund belonging to a person or entity on these lists turns up, the compliance officer reports it immediately to the UIAF and to the Attorney General’s Office (Fiscalía General de la Nación).
• Transnational bribery: the statutory auditor and the compliance officer must report to the Superintendence of Companies any facts they learn of that may constitute this offense.

The primary and alternate officers must register in SIREL, the UIAF’s online reporting system, and the company must keep every ROS confidential.

Communication and training

The system is communicated and taught within the company and to its counterparties at least once a year, with a record of attendees, date, and topics. The goal is for anyone to recognize an unusual or suspicious transaction and know how to report it.

Documentation, record keeping, and auditing

The system’s activities must be kept in records that are complete, reliable, confidential, and available. Each counterparty’s due diligence information, along with the name of the person who verified it, is documented with the date and time, and supporting records are kept in accordance with Article 28 of Law 962 of 2005.

The document side of due diligence can run in a system

Of everything above, one part is document operations: requesting from each counterparty the documents the policy requires, reviewing them against criteria, knowing when they expire, and showing who decided what. It repeats with every supplier, client, or contractor, and it doesn’t end once they’re onboarded.

That part is organized with a document requirements matrix. In NAVA 360, your company defines which documents are required, their validity period, who approves them, and the criteria for reviewing them. The counterparty uploads them from its portal; your team approves, rejects, or leaves them pending; and the system calculates each expiration from the issue date and flags what’s expiring soon. Every approval and every rejection is logged with the person responsible and the date. The same matrix works for occupational health and safety (OHS) requirements or for any other document your company decides to request.