SARLAFT for brokerage firms, trust companies and investment funds
Brokerage firms, trust companies and fund managers supervised by the Financial Superintendence of Colombia (SFC) must implement SARLAFT, the Money Laundering and Terrorist Financing Risk Management System. It is required by Part I, Title IV, Chapter IV of the SFC's Basic Legal Circular (CBJ).
The circular implements articles 102 to 107 of the Organic Statute of the Financial System (EOSF) and article 22 of Law 964 of 2005. Your entity manages third-party resources in funds and autonomous trusts: that is where illicit money can pass for investment. Líderes APLA tailors the system to each vehicle: onboarding a trustor is not the same as onboarding an investor in a fund.
Is your entity required to have SARLAFT?
| Scenario | Condition or threshold | Supervisor | Regulation |
|---|---|---|---|
| Brokerage firms, trust companies and fund managers | Full system, no size threshold | SFC | CBJ, Part I, Title IV, Ch. IV, section 2 |
| Stock exchanges, trading or registration systems, credit rating agencies, self-regulatory organizations and mutual investment funds | Exempt from the chapter | SFC | CBJ, Part I, Title IV, Ch. IV, sections 2 and 2.1 |
| All of the above | Duties under art. 102, section 2, of the EOSF, including the suspicious transaction report (ROS) to the UIAF (Colombia's Financial Information and Analysis Unit); non-exempt entities also file the cash, exempt-client and product reports | UIAF | EOSF, arts. 102 to 107; CBJ, sections 2.1.1.7 and 4.2.7 |
Here the obligation stems from SFC supervision, not from the entity's size.
Elements of SARLAFT in the securities market
- Know your customer before onboarding. If the prospect withdraws, it is reported to the UIAF as an attempted onboarding.
- Beneficial owner and trust business. Anyone holding more than 5% of the client's capital is identified. In trusts, trustors, adherents and beneficiaries are also identified, before any payment is made.
- Politically exposed persons (PEPs). Those defined in Decree 1081 of 2015 and their relatives, with enhanced due diligence.
- Segmentation and risk matrix. Clients, products, channels and jurisdictions; transactions are consolidated at least monthly.
- Principal and alternate Compliance Officer. At the second tier of the hierarchy, with 150 hours of AML/CTF training and 24 months of risk experience. The officer is sworn in before the SFC and reports to the board every quarter.
- Targeted financial sanctions. The binding UN Security Council lists are checked at onboarding and throughout the relationship. A match is reported immediately to the Deputy Attorney General and the UIAF.
ROS reports and deadlines with the UIAF
SARLAFT reports go to the Financial Information and Analysis Unit (UIAF) through SIREL (the UIAF's online reporting system), following the structure of the technical documents annexed to the chapter.
| Report | Content | Deadline |
|---|---|---|
| Suspicious transaction report (ROS) | Suspicious, attempted or rejected transactions, regardless of amount | Immediate; if there were none, a no-ROS report within the first 20 days of the following month |
| Cash transactions | Single transactions from COP 10,000,000 and multiple transactions from COP 50,000,000 per client in a month | Monthly, within the first 20 calendar days |
| Exempt clients | Clients exempted from cash transaction reporting | Quarterly, within the first 20 days of the following month |
| Products offered | Products, managed funds and active trust businesses | Monthly, within the first 20 calendar days |
AML/CTF red flags in the securities market
- Investments unrelated to the client's declared wealth profile (2025 typologies of the Financial Action Task Force of Latin America, GAFILAT).
- Funds from shell or offshore companies in opaque jurisdictions, or arriving through several layers of transfers.
- Transactions outside the client's economic activity and without a reasonable explanation: the SFC's definition of an unusual transaction.
Penalties for SARLAFT non-compliance
Failing to apply controls in order to conceal illicit money is punishable by 38 to 128 months in prison (article 325 of the Criminal Code). In addition, article 107 of the EOSF provides for administrative penalties against a supervised entity that does not apply SARLAFT controls. The SFC deems operating without complying with the chapter an unsafe and unauthorized practice.
How Líderes APLA implements SARLAFT at your brokerage or trust company
- Gap assessment by business line: brokerage, collective investment funds and trusts.
- Risk matrix by vehicle, with inherent and residual risk.
- SARLAFT manual: onboarding of investors and trustors, beneficial owner and PEPs.
- Support for the officer: quarterly report to the board, ROS and SIREL reports; AplaSoft logs every list check with date and time.
- Training for the officer, the board and sales staff through e-learning courses.
Delivered through our AML/CTF Consulting in Colombia. SFC rules: regulations; acronyms: glossary.
Is your brokerage or trust company expecting an SFC inspection? Let's review your SARLAFT: the initial assessment is free.
Updated: October 2026.
Frequently asked questions
Should a brokerage firm have SAGRILAFT or SARLAFT?
What is SARLAFT 4.0?
Do stock exchanges and self-regulatory organizations have SARLAFT?
How soon must the ROS be sent to the UIAF?
Does AplaSoft replace my brokerage firm's systems?
Tell us what your company needs
Fill in the form and a specialist will get back to you shortly with the scope for your sector. Free of charge and with no commitment.