SAGRILAFT and PTEE: what each program was and how they were merged

What SAGRILAFT was and what the PTEE was

Both were instructions issued by the Superintendence of Companies in its Basic Legal Circular, and both required the company to set up its own prevention system. The difference was the risk each one addressed. SAGRILAFT lived in Chapter X, added by External Circular 100-000016 of 2020, and dealt with money laundering, terrorist financing, and financing the proliferation of weapons of mass destruction. What it is and what it requires in general terms is covered in the SAGRILAFT guide.

The PTEE lived in Chapter XIII, added by External Circular 100-000011 of 2021. That circular defined it as the document that sets out the compliance policy and the procedures, run by the compliance officer, to identify, detect, prevent, manage, and mitigate the risks of corruption and transnational bribery. Its main legal reference is Law 1778 of 2016, on the liability of legal entities for acts of transnational corruption. Article 23 of that law, as amended by Article 25 of Law 2195 of 2022, tasks the Superintendence with promoting business transparency and ethics programs.

• LA: lavado de activos (money laundering) The crime in Article 323 of the Colombian Criminal Code: making funds of illegal origin look legitimate
• FT: financiamiento del terrorismo (terrorist financing) The crime in Article 345 of the Criminal Code: channeling funds to terrorist acts or organizations
• FP: financiamiento de la proliferación (proliferation financing) Providing funds to manufacture, acquire, transport, or use nuclear, chemical, or biological weapons for illegitimate purposes
• C: corrupción local (domestic corruption) The company benefiting from, or being used as a vehicle for, crimes against public administration, public assets, and others the rule lists
• ST: soborno transnacional (transnational bribery) Giving, offering, or promising a foreign public official money or any benefit in exchange for an official act related to an international business deal

Under the previous regime, a company could be required to have one program and not the other, because the criteria were different: the PTEE was triggered, among other grounds, by international business or transactions or by contracts with government entities, in addition to company size. A third acronym in the field, SARLAFT, is something else: it’s required by the Financial Superintendence, as explained in SAGRILAFT vs. SARLAFT: how they differ.

What changed with External Circular 100-000020 of 2026

On July 2, 2026, the Superintendence of Companies issued External Circular 100-000020, which reissued the entire Basic Legal Circular. In its recitals, it states that it saw the need to fully amend Chapters X and XIII and merge them into a single body of rules. The circular repealed, among others, Circular 100-000016 of 2020 (SAGRILAFT) and Circular 100-000011 of 2021 (PTEE).

The result is Chapter IX, which sets out a mandatory compliance system to prevent, detect, and manage all five risks together: LA, FT, FP, C, and ST. These are the substantive changes:

• One system, with one policy and one procedures manual for managing LA/FT/FP and C/ST (section 9.7).
• One principal compliance officer and one alternate for the whole system, with education and experience requirements that must be documented (section 9.9).
• One risk matrix covering the identification, measurement, control, and monitoring stages for all the risks (section 9.14).
• One due diligence process aimed at identifying and assessing the LA/FT/FP and C/ST risks of each counterparty (section 9.15).
• One whistleblower channel that takes confidential and anonymous reports on any of these behaviors (section 9.18.1).
• Thresholds in basic value units (UVB) and a Minimum Measures Regime (Régimen de Medidas Mínimas) for companies in certain sectors that fall below the general regime (sections 9.4 to 9.6).

Chapter IX doesn’t use the acronyms SAGRILAFT or PTEE for the current system. It mentions them in section 9.31, to say that the Superintendence may keep supervising the systems adopted under the earlier circulars.

What each risk keeps within the unified system

Merging the system doesn’t erase the difference between the risks. Money laundering and bribery are prevented with different controls, and Chapter IX keeps separate policies and reports for each block.

At one point the unified system goes beyond the sum of the two earlier ones: its definition of the ROS states that the report must cover conduct related to LA/FT/FP and also to C/ST. And the internal whistleblower channel sits alongside the external channels the company must publicize: the Superintendence of Companies’ channel for transnational bribery and the Transparency Secretariat’s channel for corruption (section 9.18.1).

What it means for a company that had SAGRILAFT and a PTEE

Section 9.29 sets a transition period. A company that, on the date the circular was issued, was bound by External Circulars 100-000016 of 2020, 100-000011 of 2021, or 100-300000 of 2024 must bring its system in line with Chapter IX no later than May 31 of the year after the circular was issued, that is, May 31, 2027. While that period runs, the systems and programs already in place are considered valid.

For a company that had both programs, the adjustment means integrating what used to be separate. These are the areas Chapter IX requires it to review:

1. Confirm whether you’re an obligated entity The criteria changed, and thresholds are now stated in UVB. A company previously bound by only one program may now fall under the general regime, the minimum measures regime, or neither.
2. Integrate the policy and the manual One policy document and one manual for all five risks, with the specific policies in section 9.7.2.
3. Unify the risk matrix A single matrix covering LA/FT/FP and C/ST across every stage of the system.
4. Review the compliance officer Check that the designated person meets the requirements and restrictions in sections 9.9.2 and 9.9.3.
5. Adjust due diligence and the whistleblower channel One counterparty due diligence procedure and one channel that cover every risk.

The general order in which the pieces of a system like this are put together is covered in how to implement SAGRILAFT: stages and elements.

What you can’t assume after the merger

• That merging means stapling two documents together. Section 9.7.1 requires companies to avoid so-called paper compliance: procedures and policies that don’t fit the company’s reality or that copy someone else’s.
• That SAGRILAFT covered corruption. Under the previous regime, complying with one didn’t satisfy the other. Under the current one, the system must cover both risk blocks.
• That the transition is an exemption. Current systems are valid only during the period in section 9.29, and the Superintendence may supervise how they were applied under the earlier circulars (section 9.31).
• That being obligated before means being obligated in the same way now. The scope changed, and it’s checked against sections 9.4 to 9.6.

Due diligence as the point of contact

Under the previous regime, Chapter XIII made clear that its due diligence wasn’t the one used in money laundering systems, which was governed by different rules. Chapter IX turns it into a single procedure to know each counterparty against all five risks, with a risk-based approach: not every counterparty calls for the same level of scrutiny.

The list of counterparties is broad: shareholders, employees, clients, creditors, contractors, and suppliers. What that knowledge requires and when it has to be enhanced is covered in counterparty due diligence.

The document side can be run in a system

Within the unified system, one part is document operations: requesting from each counterparty the information and supporting documents the company defined, verifying them, knowing when they need updating, and keeping the evidence. Section 9.22 requires that the information the counterparty provides, and the name of the person who verified it, be documented with the date and time.

That runs on a document requirements matrix. In NAVA 360, your company defines which document is required based on the element type, the activity type, and the profile, with what validity period, who approves it, and which criteria it’s reviewed against; the third party uploads its documents; your team or NAVA’s back office reviews them; and every approval and every rejection is logged with the person responsible and the date. The same matrix works for occupational health and safety (OHS) requirements or for the requirements of an operator client.