SARLAFT 2.0 for Cash-in-Transit and Security Firms in Colombia

SARLAFT 2.0 for cash-in-transit companies in Colombia

Cash-in-transit companies and other private security and surveillance services must implement SARLAFT 2.0, the Risk Management System for Money Laundering, Terrorist Financing and Financing of the Proliferation of Weapons. They are supervised by the Superintendence of Private Security and Surveillance (Supervigilancia), under External Circular 20240000245 of 2024 and its amendment 20240000275.

Many companies search for this system as SAGRILAFT, which is the Superintendence of Companies' system. Your company answers to Supervigilancia, reports to the Financial Information and Analysis Unit (UIAF) and puts its license at stake if it fails to comply. Líderes APLA builds the system on your actual operation: routes, vaults, cash-handling clients and municipalities.

Is your company required to have SARLAFT 2.0?

In Colombia, the SARLAFT 2.0 obligation depends on the type of security service, not on company size. With a new license, you have four months to comply (section 9). See Supervigilancia's list of obligated entities.

Elements of SARLAFT 2.0 in cash-in-transit

• AML/CTF/CPF policy and code of conduct: approved by the highest corporate body, together with the procedures manual.
• Principal and alternate Compliance Officer: with accredited training, six months of experience and the UIAF courses. The officer may serve no more than five companies, and Supervigilancia must be notified within 15 business days.
• AML/CTF/CPF risk matrix: since April 2026, it follows the mandatory methodological protocol of Circular 20261200000045CS. It is updated at least every six months.
• Counterparty due diligence: client, beneficial owner, purpose of the service and source of funds. Enhanced for politically exposed persons (PEPs).
• Binding lists: ongoing screening against UN lists. A match goes immediately to the UIAF and the Attorney General's Office.
• Documentation and training: date- and time-stamped records of every check, and semiannual reports from the officer.

ROS reports and deadlines with the UIAF

Formats, utilities and the 2026 calendar: the sector's page on the UIAF website.

Red flags in cash-in-transit and private security

• Amounts transported that do not match the client's size or declared activity.
• Clients that move cash without involving an entity supervised by the Financial Superintendence, especially with pickup or delivery away from offices.
• Differences between the value declared by the client and the value obtained on recount, or split shipments in the names of related persons.
• Shipments of metals, jewelry, precious stones, art or antiques without support for their origin or declared value; the circular requires all of them to be reported.
• Pressure or payments from criminal groups to guards and escorts, and corruption in contracting the service (Supervigilancia typologies).

Penalties for SARLAFT 2.0 non-compliance

Failing to comply with SARLAFT 2.0 can cost you suspension of your license for up to six months, or its cancellation. This is set out in article 76 of Decree-Law 356 of 1994, referenced in section 8 of Circular 20240000245. It also provides for warnings and successive fines of 5 to 100 minimum wages.

How Líderes APLA implements SARLAFT 2.0

1. Gap assessment against Circular 20240000245 and the 2026 protocol, with a work plan.
2. Risk matrix by client, route, type of valuable, channel and area, with inherent and residual risk.
3. Policy, code of conduct and procedures manual with counterparty onboarding forms.
4. Support for the Compliance Officer with the ROS, the transport operations report and the no-ROS reports to the UIAF.
5. Training for the board, management, operational staff and crews.

Part of our AML/CTF consulting in Colombia; the matrix and list screening run on AplaSoft, and crew training through e-learning courses. Circulars and acronyms: regulations and glossary.

Does your matrix already follow the 2026 protocol? Talk to our team in Colombia, at no cost and with no commitment.

Updated: October 2026.