AML Rules and Regulations in Colombia: Comprehensive Guide

05 Sep AML Rules and Regulations in Colombia: Comprehensive Guide

AML Rules and Regulations in Colombia: Historically burdened by illicit activities such as drug trafficking, smuggling, and corruption, has developed a comprehensive framework to combat money laundering. Anchored in national legislation and aligned with international standards, its AML regime encompasses strong laws, institutional oversight, sectoral compliance obligations, and new measures for emerging sectors such as cryptocurrencies.

Legal Framework & Institutional Structure

Colombia’s AML architecture rests on several cornerstone laws and regulatory bodies:

• Law 190 of 1995 and Law 599 of 2000 (Penal Code) criminalize money laundering and define associated penalties. Predicate crimes include drug trafficking, corruption, customs fraud, and people smuggling.
• Law 526 of 1999 established the UIAF (Unidad de Información y Análisis Financiero), the Financial Intelligence Unit tasked with receiving, analyzing, and reporting suspicious financial activity to the Prosecutor’s Office, the Financial Superintendence, and tax authorities.
• Law 1121 of 2006 extended AML provisions to cover terrorist financing, requiring enhanced diligence in higher-risk scenarios.
• The Superintendencia Financiera de Colombia (SFC) oversees financial sector entities such as banks, insurers, and securities firms, mandating compliance with SARLAFT, the AML/CTF risk management system for supervised institutions.
• The Superintendencia de Sociedades governs non-financial corporates through SAGRILAFT, requiring robust risk management systems across sectors such as real estate, construction, precious metals, legal services, and virtual assets.

Compliance Obligations

Entities within the AML scope must establish robust systems to ensure compliance:

Customer Due Diligence (CDD) and KYC: Companies must identify clients, verify their identities, and assess sources of funds. For corporate clients, ownership and representation must also be verified.

Enhanced Due Diligence (EDD): High-risk clients, such as politically exposed persons (PEPs) or clients from high-risk jurisdictions, trigger stricter scrutiny and deeper investigative measures.

Suspicious Transaction Reporting (STR): Financial and non-financial institutions are required to report suspicious transactions to the UIAF. In cases where no suspicious activity is detected, some sectors must still submit a “non-report” declaration.

Internal Controls and Oversight: Regulated entities must:

• Appoint a compliance officer with appropriate authority and independence.
• Maintain internal monitoring systems and detailed record-keeping.
• Conduct regular employee training on AML risks and controls.
• Update their AML systems based on evolving risk exposures.

Regulatory Sanctions: Non-compliance can trigger penalties for both institutions and individuals, including compliance officers, directors, and legal representatives. Fines can reach up to 200 minimum monthly wages, alongside reputational damage and potential criminal liability.

Cryptocurrency and Emerging Regulation

Although cryptocurrencies are not considered legal tender in Colombia, they are subject to growing AML oversight.

• In 2021, a resolution required virtual asset service providers (VASPs) to submit suspicious transaction reports, monthly reports, and client information through the UIAF’s platform.
• In 2023, tax authorities clarified that cryptocurrencies are recognized as assets but not legal tender, underscoring the need for formal regulation.
• In 2024, Bill 510 passed its first legislative debate, aiming to establish a comprehensive regulatory framework for VASPs. The bill would mandate robust AML/CTF controls, KYC procedures, consumer protection standards, and compliance oversight mechanisms.

This demonstrates the government’s proactive approach to addressing financial crime risks associated with digital assets while also encouraging innovation in blockchain technologies.

International Standards and Effectiveness

Colombia aligns its AML regime with recommendations from the Financial Action Task Force (FATF). Evaluations have shown significant improvements in areas such as customer due diligence, suspicious transaction reporting, correspondent banking controls, and sanctions enforcement.

While progress has been strong, challenges remain in fully regulating non-profit organizations, strengthening beneficial ownership disclosures, and adapting frameworks to new technological risks. Nevertheless, the country continues to maintain a largely compliant status at the international level.

Real-World Example: The Tierra Santa Case

A powerful example of Colombia’s AML framework in action emerged in September 2022 when Tierra Santa SAS, a low-cost clothing retailer, was investigated for operating a large-scale money laundering scheme.

Authorities discovered that the company had allegedly used over 60 front companies to simulate imports and launder illicit funds through smuggled clothing and accessories. The UIAF first flagged 68 suspicious operations, which led to raids across major cities including Barranquilla, Santa Marta, Montería, and Valledupar.

The investigation resulted in the seizure of more than 1,100 assets valued at over 1.2 billion pesos. The company and its executives faced accusations of illicit enrichment, customs fraud, and conspiracy, with potential prison terms of up to 30 years for those found guilty.

This case underscores two important aspects of Colombia’s AML environment:

1. The interconnected role of financial intelligence, tax, and law enforcement agencies in uncovering sophisticated laundering operations.
2. The vulnerabilities in the non-financial sector, which criminals increasingly exploit to disguise illicit proceeds.

By targeting an established retail chain, Colombian authorities sent a strong signal that AML rules apply across all industries, not just the financial system.

So to Conclude…

Colombia’s AML framework is comprehensive, adaptive, and strongly enforced. The laws provide a solid legal foundation, while institutions such as the UIAF, SFC, and Superintendencia de Sociedades ensure regulatory oversight across both financial and non-financial sectors. Compliance requirements—from due diligence to reporting and internal controls—are designed to keep businesses vigilant and accountable.

At the same time, Colombia is modernising its approach by expanding AML obligations into the cryptocurrency space, ensuring that new technologies do not become loopholes for financial crime. Internationally, the country continues to strengthen its alignment with FATF standards, showing its commitment to maintaining credibility on the global stage.

The Tierra Santa case serves as a stark reminder that money laundering risks are not limited to banks or financial firms. Retail, construction, and many other sectors face exposure, making cross-sector cooperation vital.

Colombia has made significant progress in building an AML regime that balances enforcement with adaptability. Challenges remain, but its proactive stance, institutional strength, and ongoing reforms make it one of the stronger AML frameworks in South America.

If your organisation operates in Colombia or across South America, staying compliant with AML rules is not optional—it’s essential. Explore our AML training courses and compliance resources to ensure your team is fully equipped to meet regulatory expectations and protect your business from financial crime risks.