Compliance · SAGRILAFT and SARLAFT
SAGRILAFT vs. SARLAFT: how they differ and why they aren’t the same
SAGRILAFT and SARLAFT aren’t the same. SAGRILAFT (Colombia’s self-control and comprehensive risk management system for money laundering, terrorist financing, and proliferation financing) is required by the Superintendence of Companies (Supersociedades) of real-sector companies, and since July 2026 it’s regulated in Chapter IX of that agency’s Basic Legal Circular, merged with the PTEE. SARLAFT (the money laundering and terrorist financing risk management system) is required by the Financial Superintendence of Colombia of the entities it supervises, such as banks and insurers.
This page explains the general framework of both systems. It doesn’t replace reading the current regulatory text or advice from a compliance professional.
SAGRILAFT and SARLAFT aren’t the same
Both systems share the same purpose: to keep an organization from being used to make funds of illegal origin look legitimate or to channel funds to terrorism. What separates them is who requires them, which regulation they’re in, and who they apply to. SAGRILAFT belongs to the real sector and is supervised by the Superintendence of Companies. SARLAFT belongs to the financial sector and is supervised by the Financial Superintendence.
A company doesn’t choose which one to implement: its supervisor determines it. An industrial, commercial, or services company doesn’t set up a SARLAFT, and a bank doesn’t set up a SAGRILAFT. What SAGRILAFT is and which pieces it includes is covered in the SAGRILAFT guide.
- SAGRILAFT Sistema de Autocontrol y Gestión del Riesgo Integral de Lavado de Activos, Financiación del Terrorismo y Financiación de la Proliferación de Armas de Destrucción Masiva: the self-control and comprehensive risk management system for money laundering, terrorist financing, and financing the proliferation of weapons of mass destruction. Superintendence of Companies.
- SARLAFT Sistema de Administración del Riesgo de Lavado de Activos y de la Financiación del Terrorismo: the money laundering and terrorist financing risk management system. Financial Superintendence.
- LA/FT/FP and C/ST Money laundering, terrorist financing, financing the proliferation of weapons of mass destruction, local corruption, and transnational bribery: the risks covered by the Superintendence of Companies’ unified system since 2026.
Which regulator requires each one, and where it’s regulated
SAGRILAFT: Superintendence of Companies
The Superintendence of Companies supervises commercial companies, sole proprietorships, and branches of foreign companies in the real sector. Until July 2026, SAGRILAFT was set out in Chapter X of its Basic Legal Circular, and the PTEE (Programa de Transparencia y Ética Empresarial, the Business Transparency and Ethics Program) in Chapter XIII.
External Circular 100-000020 of July 2, 2026 issued a new Basic Legal Circular and merged those two chapters into Chapter IX, which regulates the Self-Control and Risk Management System for LA/FT/FP and C/ST. The new system adds local corruption and transnational bribery to the money laundering and terrorist financing risks. How the two programs relate is explained in SAGRILAFT and PTEE.
The name SAGRILAFT is still in use: the Superintendence itself keeps it on its website and in section 9.31 of the new chapter, and this article uses it in that sense.
SARLAFT: Financial Superintendence
SARLAFT is set out in the Financial Superintendence’s Basic Legal Circular, Part I, Title IV, Chapter IV, which contains the instructions on managing money laundering and terrorist financing risk. That circular was reissued by External Circular 006 of 2025, which kept SARLAFT in the same location. The chapter implements articles 102 and following of the Organic Statute of the Financial System (Estatuto Orgánico del Sistema Financiero).
SAGRILAFT and SARLAFT, side by side
The table summarizes the differences based on the current text of each circular. The Superintendence of Companies column describes the Chapter IX system.
| SAGRILAFT (Supersociedades) | SARLAFT (Financial Superintendence) | |
|---|---|---|
| Name in the current rules | Self-Control and Risk Management System for LA/FT/FP and C/ST | Money Laundering and Terrorist Financing Risk Management System |
| Regulator | Superintendence of Companies | Financial Superintendence of Colombia |
| Regulation | Chapter IX of the Basic Legal Circular (External Circular 100-000020 of 2026) | Part I, Title IV, Chapter IV of the Basic Legal Circular (reissued by External Circular 006 of 2025) |
| Who it applies to | Commercial companies, sole proprietorships, and branches of foreign companies supervised by Supersociedades that exceed the thresholds, some sectors with their own rules, and chambers of commerce | Entities supervised by the Financial Superintendence, such as banks, insurers, and trust companies, except for the exemptions listed in the chapter |
| What triggers the obligation | Total revenue or assets at or above the threshold, measured in UVB (basic value units) as of December 31 of the previous year, or belonging to a sector with its own regime | Being an entity supervised by the Financial Superintendence |
| Risks covered | Money laundering, terrorist financing, financing the proliferation of weapons of mass destruction, local corruption, and transnational bribery | Money laundering and terrorist financing |
| Who must be known | Counterparties: partners, employees, clients, creditors, contractors, and suppliers | Current and potential clients, and the entity’s users |
| Stages | Identification, measurement or assessment, control, and monitoring | Identification, measurement or assessment, control, and monitoring |
| Person responsible | Principal and alternate compliance officers, appointed by the board of directors or the highest governing body | Compliance officer and alternate, appointed by the board of directors or equivalent body |
| Suspicious transactions | Reported to the UIAF | Reported to the UIAF |
The two systems share stages and vocabulary because both follow the standards of the Financial Action Task Force (FATF, known in Spanish as GAFI). They differ in their starting point: SARLAFT is built around a financial institution’s client, and the Superintendence of Companies system is built around all of a real-sector company’s counterparties.
What they have in common
Although the regulations are different, both systems follow the same risk management logic. These are the pieces that appear in both.
Risk-based approach
The intensity of the controls depends on the risk identified. When the risk is high, enhanced measures apply.
Compliance officer
A person appointed by the highest governing body is responsible for how the system works, with an alternate.
Knowing the counterparty
Identifying and verifying who the relationship is with before onboarding them, and keeping that knowledge up to date.
Unusual transactions
Detecting transactions that fall outside the norm, analyzing them, and keeping the records that support the decision.
Reporting to the UIAF
Transactions classified as suspicious are reported to the UIAF (Unidad de Información y Análisis Financiero), Colombia’s financial intelligence unit.
Training
Staff must know the system and its procedures. Both regulations include communication and training.
Due diligence is the piece with the heaviest operational load in both systems. How it’s organized at a real-sector company is covered in the article on counterparty due diligence.
Why they get confused
The acronym SARLAFT appears on the onboarding and update forms that banks, insurers, and trust companies ask their clients to fill out, and many companies know it that way. As a result, in everyday use, “SARLAFT” ended up working as a generic name for any anti-money-laundering system, and you hear it at companies that actually answer to the Superintendence of Companies.
A company that looks for its obligation in the wrong regulation reads requirements from another regulator, with other definitions and other obligated parties. The starting point is the supervisor: if the company is supervised or controlled by the Superintendence of Companies, its reference is Chapter IX of that agency’s Basic Legal Circular. The steps to set up the system are in how to implement SAGRILAFT.
Other supervisors, other rules
Chapter IX itself excludes from its scope companies supervised by another entity that has a special supervision regime because of their activity. In those cases, the reference is that supervisor’s regulation, which may give its system a different name. Before adopting an acronym, the first step is to confirm who supervises the company.
If your bank asks you for a SARLAFT form
A real-sector company may receive an onboarding or update form labeled SARLAFT from its bank, insurer, or trust company. What’s happening is that the financial institution is applying its own system to its client. The Financial Superintendence chapter bars it from starting the contractual relationship until it has collected the necessary information, verified the prospective client’s identity, and approved the onboarding.
- The obligation belongs to the financial institution SARLAFT obligates the bank or the insurer, not your company. Filling out the form doesn’t make your company subject to SARLAFT.
- Your company is the client being vetted The data and supporting documents they request feed the institution’s know-your-client process. For a legal entity, onboarding must be supported by an up-to-date certificate of existence and legal representation.
- Your own system doesn’t change If your company is obligated before the Superintendence of Companies, it’s still responsible for its Chapter IX system. If it isn’t, the bank’s form doesn’t create that obligation.
- With your suppliers, the roles reverse When your company onboards a supplier or a contractor, it’s the one requesting and verifying its counterparty’s documents.
The document side can run in a system
Of everything either of these systems requires, one part is document operations: defining which documents to request from each supplier or contractor, requesting them, reviewing them against criteria, knowing when they expire, and keeping the evidence of each decision with the person responsible and the date.
That’s set up in a document requirements matrix. In NAVA 360, the company defines which document is required based on the element type, the activity type, and the profile, with what validity period, who approves it, and which criteria it’s reviewed against. The third party uploads its documents, the system calculates the expiration date from the issue date, and every approval or rejection is logged. The same matrix works for occupational health and safety (OHS) requirements or for the requirements of an operator client: what changes are the documents and the validity periods.
What NAVA doesn’t do
NAVA doesn’t implement SAGRILAFT or SARLAFT, and it isn’t an anti-money-laundering tool. Specifically, NAVA:
- Doesn’t write or approve the system’s policy or procedures manual
- Doesn’t build the money laundering risk matrix
- Doesn’t replace the compliance officer or perform their duties
- Doesn’t check restrictive lists or screen counterparties
- Doesn’t generate or submit suspicious transaction reports to the UIAF
- Doesn’t fill out or manage the know-your-client forms your bank requests
- Doesn’t provide legal advice on compliance matters
What NAVA runs is document management for suppliers and contractors and the traceable evidence of that management. It’s one piece of the system, not the system.