Compliance · Counterparty due diligence
SAGRILAFT: what it is and what it requires of your company
SAGRILAFT is Colombia’s anti-money-laundering and counter-terrorist-financing risk system: the Sistema de Autocontrol y Gestión del Riesgo Integral de Lavado de Activos, Financiación del Terrorismo y Financiación de la Proliferación de Armas de Destrucción Masiva (self-control and comprehensive risk management system for money laundering, terrorist financing, and financing the proliferation of weapons of mass destruction). The Superintendence of Companies (Supersociedades) requires it of real-sector (non-financial) companies that exceed certain thresholds. Since July 2026 it’s in Chapter IX of the Basic Legal Circular (Circular Básica Jurídica), unified with the PTEE.
This page explains the general framework. It doesn’t replace reading the current regulatory text or advice from a compliance professional.
What the acronym means, letter by letter
In the regulations, these three risks together are abbreviated as LA/FT/FPADM, or LA/FT/FP. Since 2026, the same system also covers local corruption and transnational bribery (C/ST). The word that organizes everything else is self-control: the rule doesn’t ask the company to report crimes, it asks the company to put its own system in place so it isn’t used as a vehicle for them.
- Sistema de Autocontrol y Gestión del Riesgo Integral: self-control and comprehensive risk management system The internal mechanism the company must set up and maintain
- LA: lavado de activos (money laundering) Making funds of illegal origin look legitimate
- FT: financiación del terrorismo (terrorist financing) Channeling funds, legal or not, to terrorist activities
- FPADM: financiación de la proliferación de armas de destrucción masiva (financing the proliferation of weapons of mass destruction) Financing the development of or trafficking in nuclear, chemical, or biological weapons
Who requires SAGRILAFT and which rule it’s in
It’s required by the Superintendence of Companies, the government agency that supervises and controls real-sector companies in Colombia. Until July 2026, the obligation was in Chapter X of the Basic Legal Circular, added by External Circular 100-000016 of 2020. External Circular 100-000020 of July 2, 2026 reissued the Basic Legal Circular and merged that chapter with the PTEE chapter into Chapter IX, which governs the Sistema de Autocontrol y Gestión de Riesgos LA/FT/FP y C/ST (self-control and risk management system). The name SAGRILAFT is still used to refer to that system.
Companies that already had a system in place have a transition period to adjust it to Chapter IX (section 9.29), during which the previous system is considered valid. SAGRILAFT applies to the real sector. Entities supervised by the Financial Superintendence (banks, insurers, brokerage firms) have their own system, SARLAFT, which is a different rule from a different authority.
Which companies SAGRILAFT applies to
The obligation falls on companies, single-owner companies, and branches of foreign companies supervised or controlled by the Superintendence of Companies that exceed the total revenue or total asset thresholds set in Chapter IX, measured in basic value units (UVB) as of December 31 of the previous year. Some sectors have their own thresholds, and some companies fall under a Minimum Measures Regime, a simplified version of the system.
Determining whether your company is required to comply means checking three things: whether it’s supervised or controlled by the Superintendence of Companies, what its revenue and assets were in the previous fiscal year, and whether its economic activity falls in one of the sectors with their own regime. That check is usually done by the legal department or the statutory auditor (revisor fiscal), against the current text of Chapter IX.
What a SAGRILAFT must include
The system is made up of several pieces that must exist, be approved, and work, beyond the document that describes them. These are the main ones set out in Chapter IX.
LA/FT/FP and C/ST policy
The document approved by the company’s highest governing body, in which the company sets its position on the risk.
Procedures manual
How that policy is carried out day to day: who does what, when, and using which form.
Risk matrix
Identifying and measuring the company’s own risk based on its activity, its size, and the areas where it operates.
Compliance officer
The person designated as responsible for the system before management and before the Superintendence.
Counterparty due diligence
Knowing and verifying who the company does business with: clients, suppliers, employees, partners.
Red flags
The defined warning signs that require a transaction to be examined more closely.
Reporting to the UIAF
Reporting suspicious transactions to the UIAF (Unidad de Información y Análisis Financiero), Colombia’s financial intelligence unit.
Training and auditing
Training staff and periodically reviewing that the system works.
Each of these elements generates evidence, and that evidence is what the Superintendence reviews when it asks. A system that exists on paper but leaves no trace of having been carried out is, in practice, a system that doesn’t exist.
The order in which these pieces are put in place is in how to implement SAGRILAFT: stages and elements.
SAGRILAFT and SARLAFT: how they differ
They’re two systems with the same purpose and a different authority. The confusion is so common that it’s worth settling in a single table.
| SAGRILAFT | SARLAFT | |
|---|---|---|
| Who requires it | Superintendence of Companies | Financial Superintendence |
| Who it applies to | Real-sector companies under supervision or control that exceed the thresholds | Entities supervised by the Financial Superintendence: banks, insurers, trust companies, brokerage firms |
| Where it’s regulated | Chapter IX of the Superintendence of Companies’ Basic Legal Circular | Part I, Title IV, Chapter IV of the Financial Superintendence’s Basic Legal Circular |
| Focus | Self-control and comprehensive risk management | Management of money laundering and terrorist financing risk |
A real-sector company doesn’t implement SARLAFT, and a bank doesn’t implement SAGRILAFT. The full comparison is in SAGRILAFT vs. SARLAFT: how they differ.
SAGRILAFT and PTEE: a single system since 2026
The PTEE is the Business Transparency and Ethics Program (Programa de Transparencia y Ética Empresarial), and it addressed a different risk: corruption and bribery, particularly transnational bribery. It lived in Chapter XIII of the same Basic Legal Circular, with its own thresholds and its own scope.
External Circular 100-000020 of 2026 merged the two into Chapter IX: a single system, with one policy and one procedures manual, that manages money laundering, terrorist financing, proliferation financing, local corruption, and transnational bribery together. Companies that had both programs must adjust them to the new chapter within the transition period.
What each program was and what changed with the merger is in SAGRILAFT and PTEE.
What counterparty due diligence is
A counterparty is any individual or legal entity with which the company establishes a relationship: clients, suppliers, contractors, employees, partners, associates. Due diligence is the process of getting to know them before onboarding them and keeping that knowledge up to date for as long as the relationship lasts.
In practice, it comes down to four specific obligations: identifying the counterparty, verifying the information it provides, checking it against the restrictive lists that are binding in Colombia, and keeping evidence of having done all of the above. When a counterparty’s risk is higher, the rule requires enhanced due diligence, with additional checks.
What it looks like in operations
It’s the piece of the system with the heaviest operational workload. A company with four hundred suppliers has four hundred files to open and maintain over time.
- Identify the counterparty 400 open files, each with up-to-date identification data
- Verify the information Someone reviews each document and decides whether it’s acceptable
- Keep that knowledge up to date Documents that expire and have to be requested again, with no one sending a reminder
- Keep the evidence Being able to show, months later, who reviewed what and when
Unlike the policy or the manual, this piece isn’t written once: it’s carried out every day. Which measures it requires and when it must be enhanced is in counterparty due diligence under SAGRILAFT.
The document side can be run in a system
Of everything a SAGRILAFT requires, one part is pure document operations: defining which documents to request from each counterparty, requesting them, checking that they arrive, reviewing them against criteria, knowing when they expire, and keeping evidence of each decision with the person responsible and the date.
That’s a configurable document requirements matrix. In NAVA 360, your company defines which document is required of each type of counterparty, with what validity period, who approves it, and which criteria it’s reviewed against; the counterparty uploads them; your team or the back office validates them; and every approval and every rejection is logged with the person responsible and the date. The same capability works for occupational health and safety (OHS) requirements or for the requirements of an operator client: what changes from one case to another is the documents and the validity periods.
What NAVA doesn’t do
NAVA doesn’t implement your SAGRILAFT. Specifically, NAVA:
- It doesn’t write or approve your system’s policy or procedures manual
- It doesn’t build your money laundering risk matrix
- It doesn’t replace the compliance officer or perform their duties
- It doesn’t check restrictive lists or screen counterparties
- It doesn’t generate or submit suspicious transaction reports to the UIAF
- It doesn’t provide legal advice on compliance matters
What NAVA operates is counterparty document management and the traceable evidence of that management. It’s one piece of the system, not the system.