SAGRILAFT for Small and Medium Businesses: Who Must Comply and What Happens If They Don't?
## What is SAGRILAFT?
SAGRILAFT (the Self-Control and Comprehensive Risk Management System for Money Laundering, Terrorism Financing, and Financing of Weapons of Mass Destruction Proliferation) is the prevention mechanism the Superintendency of Companies requires of Colombian businesses.
It's governed by External Circular 100-000016 of July 27, 2020 and its updates.
Which companies are required to comply?
The obligation applies to commercial companies overseen by the Superintendency of Companies that meet at least one of these criteria at the close of the previous year:
- Total assets exceeding 40,000 monthly minimum wages (approx. $52 billion COP in 2025)
- Total income exceeding 40,000 monthly minimum wages
Since 2021, it has also applied to companies in high-risk sectors at lower thresholds: - Games of chance - Real estate activities - Accounting and legal services carrying out specific activities - Trade in vehicles, jewelry, precious metals - Investment management activities
What must the system include?
A valid SAGRILAFT system must include:
- Prevention policies for money laundering/terrorism financing/weapons proliferation financing, approved by the Board of Directors or highest governing body
- Due-diligence procedures (know-your-customer — KYC)
- A formally appointed Compliance Officer
- Risk matrices covering factors such as: clients, products, distribution channels, jurisdictions
- An annual training program for employees
- Reports to the UIAF (Financial Information and Analysis Unit) when there are suspicious transactions
- Periodic internal review and audit
Penalties for non-compliance
The Superintendency of Companies can impose administrative penalties ranging from fines to administrative takeover of the company:
| Type of violation | Penalty |
|---|---|
| Not implementing the system | Up to 200 minimum wages |
| Not appointing a Compliance Officer | Up to 100 minimum wages |
| Not reporting suspicious transactions | Up to 200 minimum wages |
| Repeat violations | Up to double |
Additionally, legal representatives and administrators can be barred from engaging in commerce.
Most common implementation mistakes
- Copying and pasting generic templates without adapting them to the company's actual activity
- Appointing a Compliance Officer without training them
- Not updating the risk matrix annually
- Skipping reports on suspicious transactions out of fear or lack of awareness
- Not training employees who have contact with clients
When should you implement it even if it's not mandatory?
Even if your company isn't required to, implementing a money-laundering prevention system has practical advantages:
- Access to credit: banks favor companies with compliance controls
- Public tenders: several State entities require it as an eligibility condition
- Reputation: protects the company's image with partners and clients
- Risk prevention: catches suspicious transactions before they compromise the company
Deadlines to implement it
Companies that cross the threshold in a given year have until January 31 of the following year to implement the system. Once required, it must be kept active and continuously updated.
Has your company just crossed the compliance thresholds, or are you unsure whether it applies to your case? Our compliance team can run that assessment and guide you through implementation.
El asistente jurídico digital de Jurídiconline analiza tu situación específica. La revisión inicial es gratuita.
