SARLAFT and SAGRILAFT for Other Obligated Entities in Colombia

Obligated entities in Colombia: SARLAFT, SIPLAFT and SAGRILAFT outside the financial sector

Colombia has no single list of obligated entities: each supervisor sets its own AML/CTF prevention system. All of them report to the Financial Information and Analysis Unit (UIAF), which groups them into 17 sectors. As of September 29, 2026, the DIAN (Colombia's tax and customs authority) accounted for 3,940 and Supertransporte (the Superintendence of Transport) for 3,391 (UIAF, reporting sectors).

SAGRILAFT is the system of the Superintendence of Companies (Supersociedades). Since External Circular 100-000020 of 2026, it has been called the "Self-Control and Risk Management System for ML/TF/PF and C/TB" (Chapter IX). Other supervisors require a SARLAFT (AML/CTF Risk Management System) or a SIPLAFT (Comprehensive AML/CTF Prevention System). If Supersociedades does not supervise you, that does not exempt you: another supervisor may require its own system.

Is your company obligated? Obligated entities by sector

Chapter IX does not apply to entities that already have a special-regime supervisor. Figures in basic value units (UVB) are those of the previous year-end close. Entities already obligated and those newly obligated at the 2026 cutoff have until May 31, 2027 (sections 9.28 and 9.29).

Elements of SARLAFT or SAGRILAFT in special sectors

• Applicable regime: a company may have two supervisors, as in virtual assets.
• Risk matrix: by counterparty, product, channel and jurisdiction; Supersociedades adds corruption and transnational bribery (C/ST).
• Due diligence and beneficial owner: covering clients, suppliers, employees and shareholders; enhanced for politically exposed persons (PEPs) and virtual assets.
• Compliance Officer: principal and alternate under the full system; under the Minimum Measures Regime, the legal representative is responsible.
• Objective reports: cash transactions, prize winners, postal money orders or player transfers, according to each sector's technical annex.

ROS reports and deadlines with the UIAF

The ROS is confidential and is not a criminal complaint (section 9.19).

Red flags in other obligated entities

• A counterparty that avoids explaining the source of its funds, or whose activity does not fit its financial profile (section 9.20).
• Accounting firms that invoice nonexistent services (Financial Action Task Force of Latin America, GAFILAT; 2025 Typologies Report).
• Lawyers who set up companies in the names of front men (same report).
• Several users of a virtual asset service provider sharing the same phone number or using false data (a Colombian case).

Penalties for non-compliance

Under Chapter IX, fines reach up to 200 monthly minimum wages (Law 222 of 1995, art. 86, section 3), calculated in UVB (Law 2294 of 2023, art. 313). Section 9.27 covers the company, its directors and officers, the Compliance Officer and the statutory auditor. Outside Chapter IX, each supervisor imposes penalties under its own regime.

How Líderes APLA implements SARLAFT or SAGRILAFT in your sector

1. Obligation assessment: your supervisor, CIIU code and figures in UVB determine your regime and your deadline.
2. Matrix and manual tailored to the supervisor: within our AML/CTF consulting, because a Supertransporte SARLAFT looks nothing like a MinDeporte SIPLAFT.
3. Reports to the UIAF: SIREL registration and a calendar according to your supervisor.
4. Tools: AplaSoft checks restrictive lists, RUES (the national business registry) and DIAN, and stores unusual transactions and ROS filings.
5. Training: the officer and department heads, with e-learning courses. Circulars in Colombian regulations; acronyms in the glossary.

Not sure whether you need SARLAFT, SIPLAFT or Chapter IX? Tell us about your business, at no cost and with no commitment.

Updated: October 2026.