Español

Legal Compliance
Obligations

Share:

Check here the annual obligations for:

COMPANIES

There are 7 main obligations:

Section 2.3 from Chapter V of the Legal Circular issued by the Superintendence of Industry and Commerce, establishes that every year between January 2nd and March 31st updates to the National Data Base Registry must be performed.

The mentioned updates must include any change that the data base has suffered within the previous year, i.e., if the number of data subjects included in the data base changed, if there was any change on the corporate name of the data controller, among others.

Please note that substantial changes, such as those related with the purposes to handle data, the data processor, the attention lines, classification and types of personal data, and international data transfers and transmissions, must be reported within the first 10 business days of the month in which the changes took place.

If by the time of the annual update there are any substantial changes that have not been registered those should be registered at the annual update.

Please note that when a new data base is created, it must be registered within the National Data Base Registry within the following two (2) months in which it was created.

Also, it is necessary to perform the corresponding report of claims presented by data subjects in the previous semester; such report must be performed at the National Data Base Registry and shall be complemented every semester during the first fifteen (15) business days of February and August; therefore for year 2026 the first report on claims (positive or negative) presented by data subjects must be filed no later than on February 20  2026 in which the claims performed by data subjects during the previous semester (July to December 2025) must be reported. Also, note that the second report of claims performed by data subjects, must be filed on the first fifteen (15) business days of August and therefore this year it must be performed no later than on August 25th , 2026 (in this case it is necessary to report the claims received from January to June 2026).

At last, it is important to remind you that the companies that must comply with the registry obligation are those with assets of more than 100.000 UVT (for 2025 COP $5.237.400.000, approx. USD$1,361.42). However, all the entities that perform any data handling activity (i.e. collect, use, storage) must comply with all of the other obligations established in the data protection regulation.

2.1 Companies under the surveillance of the Superintendence of Companies that (i) as of December 31, 2025, has carried out any kind of business or transactions directly or through a third party, through subordinate Companies or a branch, with foreign individuals or legal entities, equal to or greater than 100 minimum monthly legal wages (COP $350.000); and (ii) as of December 31, 2024, has had total income or total assets equal to or greater than 30,000 minimum monthly legal wages (COP $42.705.000.00039), must implement a PTEE to identify and evaluate Transnational Bribery risks.

2.2 Companies supervised by the Superintendence of Companies that (i) as of December 31, 2025, directly or indirectly (through consortiums, joint ventures or any other figure permitted by law), has entered into contracts with state entities with an amount equal to or greater than 500 minimum monthly legal wages (COP $711.750.000650); and (ii) as of December 31, 2024, has obtained total revenues or have total assets equal to or greater than 30,000 minimum legal wages (COP $42.705.000.00039), must implement a PTEE to identify and evaluate Corruption

2.3 Companies supervised by the Superintendence of Companies that (i) as of December 31, 2025, directly or indirectly (through consortiums, temporary unions or any other figure allowed by law), has entered into contracts with State Entities equal to or greater than 500 minimun monthly legal wages (COP $711.750.000); and; (ii) Belong to any of the sectors indicated below, must be obliged to identify and evaluate the Corruption Risks:

2.3.A Pharmaceutical Sector

Its economic activity registered in the commercial registry must be identified with one of the following CIIU codes: 2011, 2100, 3250 and 4645; and

As of December 31, 2025, has obtained total revenues equal to or greater than 3,000 minimum monthly legal wages (COP $4.270.500.000) or total assets equal to or greater than 5.000 minimum monthly legal wages (COP $7.117.500.000).

2.3.B Infrastructure and Construction Sector

Its economic activity registered in the commercial registry is identified with any of the following CIIU codes: 4111, 4112, 4210, 4220 or 4290; and

As of December 31, 2025, has obtained total revenues equal to or greater than 3,000 minimum monthly legal wages (COP $4.270.500.000) or total assets equal to or greater than 5.000 minimum monthly legal wages (COP $7.117.500.000).

2.3.C Manufacturing Sector

Its economic activity registered in the commercial registry is identified with one of the following CIIU codes: 1020, 1030, 1040, 1051, 1063, 1071, 1072, 1081, 1082, 1083, 1084, 1089, 1090, 1391, 1399, 1410, 1420, 1430, 1512, 1521, 1522, 1701, 1640, 2013, 2014, 2030, 2219, 2410 and 2651, 2826; and

As of December 31, 2025, has obtained total revenues equal to or greater than 3,000 minimum monthly legal wages (COP $4.270.500.000) or total assets equal to or greater than 5.000 minimum monthly legal wages (COP $7.117.500.000).

2.3.D Mining-energy sector

Its economic activity registered in the commercial registry is identified with any of the following CIIU codes: B05, B07, 4662; and

As of December 31, 2025, has obtained total revenues equal to or greater than 3,000 minimum monthly legal wages (COP $4.270.500.000) or total assets equal to or greater than 5.000 minimum monthly legal wages (COP $7.117.500.000).

2.3.E Information and communication technology sector

Its economic activity registered in the commercial registry is identified with one of the following CIIU codes: 6120, 6130, 6190, 6209; and

As of December 31, 2025, has obtained total revenues equal to or greater than 3,000 minimum monthly legal wages (COP $4.270.500.000) or total assets equal to or greater than 5.000 minimum monthly legal wages (COP $7.117.500.000).

2.3.F Trade of vehicles, their parts, pieces and accessories sector

That its economic activity registered in the commercial registry is identified with one of the following CIIU codes: 4511, 4512, 4530 and G4541; and

As of December 31, 2025, has obtained total revenues equal to or greater than 3,000 minimum monthly legal wages (COP $4.270.500.000) or total assets equal to or greater than 5.000 minimum monthly legal wages (COP $7.117.500.000).

 

2.3.G Financial services auxiliary activities sector

Its economic activity registered in the commercial registry is identified with CIIU code: 6619 and

As of December 31, 2025, has obtained total revenues equal to or greater than 3,000 minimum monthly legal wages (COP $4.270.500.000) or total assets equal to or greater than 5.000 minimum monthly legal wages (COP $7.117.500.000).

All the entities obliged in accordance with the above-mentioned criteria, must send an official letter to the Superintendence of Companies within 15 working days following the expiration of the term for the adoption of the PTEE, no later than June 23, 2026, informing about their status as obliged subject.

All Companies that have acquired the condition of being obliged to implement the PTEE and/or SAGRILAFT, as of December 31, 2025, must submit Report 75 within the following deadlines, based on the last two (2) digits of the Tax Identification Number (NIT) of the Obligated Entity:

 

LAST TWO DIGITS OF THE NIT WITHOUT VERIFICATION DIGIT

DEADLINE FOR SUBMITTING INFORMATION

01 – 10

Eleventh business day of July

 

11 – 20

Twelfth business day in July

 

21 – 30

Thirteenth business day of July

 

31 – 40

Fourteenth working day of July

 

41 – 50

Fifteenth working day of July

 

51 – 60

Sixteenth working day of July

 

61 – 70

Seventeenth working day of July

 

71 – 80

Eighteenth working day of July

 

81 – 90

Nineteenth working day of July

 

91 – 00

Twentieth business day in July

 

 

Companies monitored or controlled by the Superintendence of Companies that as of December 31, 2024, comply with any of the following requirements, must implement a SAGRILAFT by May 31, 2026:

 

4.1 Any economic sector

Having obtained total income or total assets equal to or greater than 40,000 legal monthly minimum wages (COP $56,940,000,000).as of December 31, 2025.

 

4.2 Real Estate Agents

    • Assets or Total Income as of December 31, 2025, equal to or higher than 30,000 minimum monthly legal wages (COP$705.000.000).

     

    • Having within its corporate purpose the possibility of undertaking real estate activities (rendering intermediation services in the purchase, sell, barter or lease of real estate), and

     

    • That in 2025 had undertaken businesses or transactions related with real estate activities for an amount equal or higher to 100 minimum monthly legal wages (COP$350.000).

4.3 Commercialization of precious metals and precious stones

 

  • Assets or Total Income as of December 31, 2025, equal to or higher than 30,000 minimum monthly legal wages (COP $705.000.000).

 

  • Had regularly undertaken activities in the commercialization of precious metals and precious stones.

 

4.4 Legal Services

  • Assets or Total Income as of December 31, 2025, equal to or higher than 30,000 minimum monthly legal wages (COP $705.000.000).
  • That its economic activity registered at the Chamber of Commerce, or the activity that generates most income, correspond to the one identified with the code 6910 (CIIU Code Rev. 4 A.C.).

 

4.5 Accounting services

  • Assets or Total Income as of December 31, 2025, equal to or higher than 30,000 minimum monthly legal wages (COP $705.000.000).
  • That its economic activity registered at the Chamber of Commerce, or the activity that generates most income, correspond to the one identified with the code 6920 (CIIU Code Rev. 4 A.C.).

4.6 Construction of buildings and civil engineering projects

  • Assets or Total Income as of December 31, 2025, equal to or higher than 30,000 minimum monthly legal wages (COP $705.000.000).
  • That its economic activity registered at the Chamber of Commerce, or the activity that generates most income, correspond to the ones identified with the codes 4111, 4112, 4219, 4220 (CIIU Code Rev. 4 A.C.).

4.7 Virtual Assets services

  • Total Income as of December 31, 2025, equal to or higher than 3,000 minimum monthly legal wages (COP $270.500.000), or Assets equal or higher to 5,000 minimum monthly legal wages (COP $7.117.500.000).

 

  • That undertakes, in its on behalf or on behalf of other individuals or Companies any of the following activities or operations for a value (individually or jointly) equal or higher to 100 minimum monthly legal wages (COP$142.350.000):

A) Trade of virtual assets and fiat coins.

B) Trade of one or more forms of virtual assets.

C) Transfer of virtual assets.

D) Custody or management of virtual assets or instruments that allows control over virtual assets.

E) Participate and providing of financial services related with the offer to an issuer or sell of a virtual asset.

F) In general, services related with virtual assets.

 

4.8 Special surveillance sectors or regimes

The provisions applicable to the following sectors are found in Chapter IX of the Basic Legal Circular of the Superintendency of Companies:

  • Management Companies of commercial self-financing plans.
  • Companies that operates payment orders, under the surveillance of the Superintendence of Companies.
  • Companies that undertake multi-level marketing activities.
  • Livestock funds.
  • Companies that undertake factoring activities, under the surveillance of the Superintendence of Companies.

 

4.9 Companies that receive capital contributions in virtual assets

Companies that as of December 31, 2025, had received one or more contributions of virtual assets equal to or higher (individually or jointly) than 100 minimum monthly legal wages (COP $142.350.000).

Companies that meet the following criteria as of December 31, 2025, must implement the minimum measures regime no later than May 31, 2026: 

5.1 Have obtained as of December 31, 2025, total income equal to or greater than 3,000 SMLMV (COP $4.270.500.000) or had assets equal to or greater than 5,000 (COP $7.117.500.000). 

5.2 Belong to one of the following sectors of the economy: 

5.2A Real Estate Agent

That on a regular basis render intermediation service in the purchase or selling of real estate in favor of its clients. 

5.2B Commercialization of precious metals and precious stones

That on a regular basis trade or commercialize precious metal and stones. 

5.2.C Legal services

That its economic activity registered in the Chamber of Commerce, or the activity that produces the highest income, corresponds to the one identified with CIIU code 6910. 

5.2.D Accounting services  

That its economic activity registered in the Chamber of Commerce, or the activity that produces the highest income, corresponds to the one identified with CIIU code 6920.

6.1. ROS: Entities obliged to implement SAGRILAFT and/or Minimum Measures Regime, in whose operation a Suspicious Transaction materializes, must submit a Suspicious Transaction Report to the UIAF immediately after becoming aware of it.

6.2. AROS: The entities obliged to implement SAGRILAFT and/or Minimum Measures Regime in whose operation a Suspicious Transaction has not materialized, must submit to the UIAF, a Suspicious Transaction Absence Report, within the first 10 calendar days of the months of January, April, July and October.

The SAGRILAFT Compliance Officer or the person in charge of the Minimum Measures Regime shall submit for approval of the Board of Directors, or failing that, of the General Assembly of Shareholders, a report on his/her management during the year 2025, which shall refer, at least, to the following aspects:

 7.1 Evaluation and analysis of the efficiency and effectiveness of the system and, if applicable, propose the respective improvements.

7.2 They must reflect the results of the management of the compliance officer and of the company’s administration in the compliance with the implemented prevention system.

7.3 Number of unusual operations detected.

7.4 Number of suspicious operation reports.

7.5 Number of Absence of Suspicious Operations Reports (AROS) sent to the UIAF.

7.6 Complaints or internal investigations.

7.7 Training carried out.

Meet our team

BRANCHES OF FOREIGN COMPANIES

There are 7 main obligations

Section 2.3 from Chapter V of the Legal Circular issued by the Superintendence of Industry and Commerce, establishes that every year between January 2nd and March 31st updates to the National Data Base Registry must be performed.

The mentioned updates must include any change that the data base has suffered within the previous year, i.e., if the number of data subjects included in the data base changed, if there was any change on the corporate name of the data controller, among others.

Please note that substantial changes, such as those related with the purposes to handle data, the data processor, the attention lines, classification and types of personal data, and international data transfers and transmissions, must be reported within the first 10 business days of the month in which the changes took place.

If by the time of the annual update there are any substantial changes that have not been registered those should be registered at the annual update.

Please note that when a new data base is created, it must be registered within the National Data Base Registry within the following two (2) months in which it was created.

Also, it is necessary to perform the corresponding report of claims presented by data subjects in the previous semester; such report must be performed at the National Data Base Registry and shall be complemented every semester during the first fifteen (15) business days of February and August; therefore for year 2025 the first report on claims (positive or negative) presented by data subjects must be filed no later than on February 21st  2025 in which the claims performed by data subjects during the previous semester (July to December 2024) must be reported. Also, note that the second report of claims performed by data subject, must be filed on the first fifteen (15) business days of August and therefore this year it must be performed no later than on August 25th, 2025 (in this case it is necessary to report the claims received from January to June 2025).

At last, it is important to remind you that the companies that must comply with the registry obligation are those with assets of more than 100.000 UVT (for 2025 COP $4.979.900.000, approx. USD$1.137.742). However, all the entities that perform any data handling activity (i.e. collect, use, storage) must comply with all of the other obligations established in the data protection regulation.

2.1. Branches under surveillance of the Superintendence of Companies that (i) as of December 31, 2024, has carried out any kind of business or transactions directly or through a third party, through subordinate Branches or a branch, with foreign individuals or legal entities, equal to or greater than 100 minimum monthly legal wages (COP $130,000,000); and (ii) as of December 31, 2024, has had total income or total assets equal to or greater than 30,000 minimum monthly legal wages (COP $30,000,000,000), must implement a PTEE to identify and evaluate Transnational Bribery

2.2. Branches supervised by the Superintendence of Companies that (i) as of December 31, 2024, directly or indirectly (through consortiums, joint ventures or any other figure permitted by law), has entered into contracts with state entities with an amount equal to or greater than 500 minimum monthly legal wages (COP $650,000,000); and (ii) as of December 31, 2024, has obtained total revenues or have total assets equal to or greater than 30,000 minimum legal wages (COP $39.000,000,000), must implement a PTEE to identify and evaluate Corruption

2.3. Supervised Branches that (i) as of December 31, 2024, directly or indirectly (through consortiums, temporary unions or any other figure allowed by law), has entered into contracts with State Entities equal to or greater than 500 minimum monthly legal wages (COP $650,000,000); (ii) as of December 31, 2024, has obtained total revenues equal to or greater than 3,000 minimum monthly legal wages (COP $3,900,000,000) or total assets equal to or greater than 5.000 minimum monthly legal wages (COP $6,500,000,000) and; (iii) Belong to any of the sectors indicated below, must be obliged to identify and evaluate the Corruption Risks:

2.3.A. Pharmaceutical Sector

Its economic activity registered in the commercial registry must be identified with one of the following CIIU codes: 2011, 2100, 3250 and 4645.

2.3.B. Infrastructure and Construction Sector

Its economic activity registered in the commercial registry is identified with any of the following CIIU codes: 4111, 4112, 4210, 4220 or 4290.

2.3.C. Manufacturing Sector

Its economic activity registered in the commercial registry is identified with one of the following CIIU codes: 1020, 1030, 1040, 1051, 1063, 1071, 1072, 1081, 1082, 1083, 1084, 1089, 1090, 1391, 1399, 1410, 1420, 1430, 1512, 1521, 1522, 1701, 1640, 2013, 2014, 2030, 2219, 2410 y 2651, 2826. 

2.3.D. Mining-energy sector

Its economic activity registered in the commercial registry is identified with any of the following CIIU codes: B05, B07, 4662.

2.3.E. Information and communication technology sector

Its economic activity registered in the commercial registry is identified with one of the following CIIU codes: 6120, 6130, 6190, 6209.

2.3.F. Trade of vehicles, their parts, pieces and accessories sector

That its economic activity registered in the commercial registry is identified with one of the following CIIU codes: 4511, 4512, 4530 and G4541.

2.3.G. Financial services auxiliary activities sector

Its economic activity registered in the commercial registry is identified with CIIU code: 6619.

All the entities obliged in accordance with the above-mentioned criteria, must send an official letter to the Superintendence of Companies within 15 working days following the expiration of the term for the adoption of the PTEE, no later than June 24, 2024, informing about their status as obliged subject.

All Companies that have acquired the condition of being obliged to implement the PTEE and/or SAGRILAFT, as of December 31, 2024, must submit Report 75 within the following deadlines, based on the last two (2) digits of the Tax Identification Number (NIT) of the Obligated Entity:

 

LAST TWO DIGITS OF THE NIT WITHOUT VERIFICATION DIGIT

DEADLINE FOR SUBMITTING INFORMATION

01 – 10

Eleventh business day of July

 

11 – 20

Twelfth business day in July

 

21 – 30

Thirteenth business day of July

 

31 – 40

Fourteenth working day of July

 

41 – 50

Fifteenth working day of July

 

51 – 60

Sixteenth working day of July

 

61 – 70

Seventeenth working day of July

 

71 – 80

Eighteenth working day of July

 

81 – 90

Nineteenth working day of July

 

91 – 00

Twentieth business day in July

 

 

Branches monitored or controlled by the Superintendence of Companies that as of December 31, 2024, comply with any of the following requirements, must implement a SAGRILAFT by May 31, 2025:

4.1 Any economic sector

Assets or Total Income as of December 31, 2022, equal to or higher than 40,000 minimum monthly legal wages (COP$ 52,000,000,000).

4.2 Real Estate Agents

  • Assets or Total Income as of December 31, 2024, equal to or higher than 30,000 minimum monthly legal wages (COP$000.000.000).

 

  • Having within its corporate purpose the possibility of undertaking real estate activities (rendering intermediation services in the purchase, sell, barter or lease of real estate), and

 

  • That in 2024 had undertaken businesses or transactions related with real estate activities for an amount equal or higher to 100 minimum monthly legal wages (COP$130,000,000).

 

4.3 Commercialization of precious metals and precious stones

  • Assets or Total Income as of December 31, 2024, equal to or higher than 30,000 minimum monthly legal wages (COP$39,000,000,000).
  • Had regularly undertaken activities in the commercialization of precious metals and precious stones.

 

4.4 Legal Services

  • Assets or Total Income as of December 31, 2024, equal to or higher than 30,000 minimum monthly legal wages (COP$39,000,000,000).
  • That its economic activity registered at the Chamber of Commerce, or the activity that generates most income, correspond to the one identified with the code 6910 (CIIU Code Rev. 4 A.C.).

 

4.5 Accounting services

  • Assets or Total Income as of December 31, 2024, equal to or higher than 30,000 minimum monthly legal wages (COP$39,000,000,000).
  • That its economic activity registered at the Chamber of Commerce, or the activity that generates most income, correspond to the one identified with the code 6920 (CIIU Code Rev. 4 A.C.).

 

4.6 Construction of buildings and civil engineering projects

  • Assets or Total Income as of December 31, 2024, equal to or higher than 30,000 minimum monthly legal wages (COP$39,000,000,000).
  • That its economic activity registered at the Chamber of Commerce, or the activity that generates most income, correspond to the ones identified with the codes 4111, 4112, 4219, 4220 (CIIU Code Rev. 4 A.C.).

 

4.7 Virtual Assets services

  • Total Income as of December 31, 2024, equal to or higher than 3,000 minimum monthly legal wages (COP$3,900,000,000), or Assets equal or higher to 5,000 minimum monthly legal wages (COP$6,500.000,000).

 

  • That undertakes, in its on behalf or on behalf of other individuals or Branches any of the following activities or operations for a value (individually or jointly) equal or higher to 100 minimum monthly legal wages (COP$130,000,000):

 

1.Trade of virtual assets and fiat coins.

2.Trade of one or more forms of virtual assets.

3.Transfer of virtual assets.

4.Custody or management of virtual assets or instruments that allows control over virtual assets.

5.Participate and providing of financial services related with the offer to an issuer or sell of a virtual asset.

6.In general, services related with virtual assets.

 

4.8 Special surveillance sectors or regimes

The provisions applicable to the following sectors are found in Chapter IX of the Basic Legal Circular of the Superintendency of Companies:

  • Management Branches of commercial self-financing plans.

 

  • Branches that operate payment orders, under the surveillance of the Superintendence of Companies.

 

  • Branches that undertake multi-level marketing activities.

 

  • Livestock funds.

 

  • Branches that undertake factoring activities, under the surveillance of the Superintendence of Companies.

 

Regulation applicable to these sectors, can be found in Chapter IX of the Legal Basic Circular Letter of the Superintendence of Companies.

 

4.9 Branches that receive capital contributions in virtual assets

Branches that as of December 31, 2024, had received one or more contributions of virtual assets equal to or higher (individually or jointly) than 100 minimum monthly legal wages (COP $130,000,000).

Branches that meet the following criteria as of December 31, 2024, must implement the SAGRILAFT minimum measures regime no later than May 31, 2024:

5.1 Have obtained as of December 31, 2024, total income equal to or greater than 3,000 SMLMV (COP $3,900,000,000,000) or had assets equal to or greater than 5,000 (COP $6,500,000,000).

5.2 Belong to one of the following sectors of the economy:

5.2.A Real Estate Agent

That on a regular basis render intermediation service in the purchase or selling of real estate in favor of its clients.

5.2.B Commercialization of precious metals and precious stones

That on a regular basis trade or commercialize precious metal and stones.

5.2.C Legal services

That its economic activity registered in the Chamber of Commerce, or the activity that produces the highest income, corresponds to the one identified with CIIU code 6920.

 5.2.D Accounting services

That its economic activity registered in the Chamber of Commerce, or the activity that produces the highest income, corresponds to the one identified with CIIU code 6920.

6.1. ROS: Branches obliged to implement SAGRILAFT and/or Minimum Measures Regime, in whose operation a Suspicious Transaction materializes, must submit a Suspicious Transaction Report to the UIAF immediately after becoming aware of it.

6.2. AROS: The Branches obliged to implement SAGRILAFT and/or Minimum Measures Regime in whose operation a Suspicious Transaction has not materialized, must submit to the UIAF, a Suspicious Transaction Absence Report, within the first 10 calendar days of the months of January, April, July and October.

The SAGRILAFT Compliance Officer or the person in charge of the Minimum Measures Regime shall submit for approval of the Board of Directors, or failing that, of the General Assembly of Shareholders, a report on his/her management during the year 2024, which shall refer, at least, to the following aspects:

 7.1 Evaluation and analysis of the efficiency and effectiveness of the system and, if applicable, propose the respective improvements.

7.2 They must reflect the results of the management of the compliance officer and of the company’s administration in the compliance with the implemented prevention system.

7.3 Number of unusual operations detected.

7.4 Number of suspicious operation reports.

7.5 Number of Absence of Suspicious Operations Reports (AROS) sent to the UIAF..

7.6 Complaints or internal investigations.

7.7 Training carried out.

Meet our team

Entidades Nacionales sin Ánimo de Lucro

There are 2 main obligations:

Section 2.3 from Chapter V of the Legal Circular issued by the Superintendence of Industry and Commerce, establishes that every year between January 2nd and March 31st updates to the National Data Base Registry must be performed.

The mentioned updates must include any change that the data base has suffered within the previous year, i.e., if the number of data subjects included in the data base changed, if there was any change on the corporate name of the data controller, among others.

Please note that substantial changes, such as those related with the purposes to handle data, the data processor, the attention lines, classification and types of personal data, and international data transfers and transmissions, must be reported within the first 10 business days of the month in which the changes took place.

If by the time of the annual update there are any substantial changes that have not been registered those should be registered at the annual update.

Please note that when a new data base is created, it must be registered within the National Data Base Registry within the following two (2) months in which it was created.

Also, it is necessary to perform the corresponding report of claims presented by data subjects in the previous semester; such report must be performed at the NDBR and shall be complemented every semester during the first fifteen (15) business days of February and August; therefore for year 2026 the first report on claims (positive or negative) presented by data subjects must be filed no later than on February 20st  2026 in which the claims performed by data subjects during the previous semester (July to December 2025) must be reported. Also, note that the second report of claims performed by data subject, must be filed on the first fifteen (15) business days of August and therefore this year it must be performed no later than on August 25th , 2026 (in this case it is necessary to report the claims received from January to June 2026).

At last, it is important to remind you that the companies that must comply with the registry obligation are those with assets of more than 100.000 UVT (for 2026 COP $5.237.400.000, approx. USD$1,361.42). However, all the entities that perform any data handling activity (i.e. collect, use, storage) must comply with all of the other obligations established in the data protection regulation.

Pursuant to Circular No. 05 of 2025 issued by the District Legal Secretariat, non-profit entities (ESAL) subject to the inspection, surveillance, and control of the Mayor’s Office of Bogotá D.C. may voluntarily implement a PTEE, until the Administrative Department of the Presidency of the Republic (DAPRE) issues the corresponding guidelines, under the terms set forth therein.

The implementation and scope of the PTEE shall be determined based on the risk level of the ESAL, as follows:

2.1 Risk classification: 

A) Low risk: ESAL with annual revenues equal to or below 3,000 statutory monthly minimum wages (SMMLV) or total assets equal to or below 5,000 SMMLV.

B. Medium risk: ESAL meeting any of the following criteria:

  • annual revenues above 3,000 and up to 10,000 SMMLV, or
  • total assets above 5,000 and up to 15,000 SMMLV, or
  • engagement in international transactions, transactions with high-risk sectors, or transactions with government entities, provided that the total amount involved is equal to or below 1,000 SMMLV.

C) High risk: ESAL meeting any of the following criteria:

  • annual revenues above 10,000 SMMLV, or
  • total assets above 15,000 SMMLV, or
  • engagement in international transactions, transactions with high-risk sectors, or transactions with government entities, where the total amount involved exceeds 1,000 SMMLV or involves future fiscal commitments.

 

2.2 Minimum content of the PTEE according to the risk level 

A) Low and medium risk: ESAL classified under these risk levels shall adopt a PTEE that includes, at a minimum, the following elements:

  • A due diligence process.
  • A formal statement of zero tolerance toward corruption and/or transnational bribery (C/TB).
  • Appointment of an ethics and transparency officer, who may be the legal representative or a person designated by him or her.
  • A whistleblowing or reporting channel managed by the appointed ethics and transparency officer.
  • Annual dissemination of the PTEE.
  • Additionally, for medium-risk ESAL: annual training on ethics and prevention of corruption and transnational bribery risks.

B) High risk: ESAL classified as high risk shall implement an enhanced PTEE, which shall include, among others, the following elements:

  • Enhanced due diligence.
  • Appointment of an independent Compliance Officer.
  • A whistleblowing or reporting channel managed by the Compliance Officer.
  • Dissemination of the PTEE and training activities at least twice (2) per year.
  • Systems for the identification, management, detection, and reporting of corruption and transnational bribery risks.
  • Specific policies, as applicable, governing public procurement, donations, political campaign financing, gifts, travel, entertainment, and lobbying activities.
  • A Code of Ethics and a document retention and archiving protocol.

 

2.3 Implementation timeline for the PTEE 

Since the implementation of the PTEE is voluntary in nature, there is currently no mandatory deadline for its adoption by ESAL. However, entities must remain attentive to the issuance of guidelines by the DAPRE, which may establish mandatory requirements regarding scope, minimum content, and/or implementation timelines.

Meet our team

Entidades Extranjeras sin Ánimo de Lucro

There are 5 main obligations:

Section 2.3 from Chapter V of the Legal Circular issued by the Superintendence of Industry and Commerce, establishes that every year between January 2nd and March 31st updates to the National Data Base Registry must be performed.

The mentioned updates must include any change that the data base has suffered within the previous year, i.e., if the number of data subjects included in the data base changed, if there was any change on the corporate name of the data controller, among others.

Please note that substantial changes, such as those related with the purposes to handle data, the data processor, the attention lines, classification and types of personal data, and international data transfers and transmissions, must be reported within the first 10 business days of the month in which the changes took place.

If by the time of the annual update there are any substantial changes that have not been registered those should be registered at the annual update.

Please note that when a new data base is created, it must be registered within the National Data Base Registry within the following two (2) months in which it was created.

Also, it is necessary to perform the corresponding report of claims presented by data subjects in the previous semester; such report must be performed at the National Data Base Registry and shall be complemented every semester during the first fifteen (15) business days of February and August; therefore for year 2026 the first report on claims (positive or negative) presented by data subjects must be filed no later than on February 20st  2026 in which the claims performed by data subjects during the previous semester (July to December 2025) must be reported. Also, note that the second report of claims performed by data subject, must be filed on the first fifteen (15) business days of August and therefore this year it must be performed no later than on August 25th, 2026 (in this case it is necessary to report the claims received from January to June 2026).

At last, it is important to remind you that the companies that must comply with the registry obligation are those with assets of more than 100.000 UVT (for 2026 COP $5.237.400.000, approx. USD$1,361.42). However, all the entities that perform any data handling activity (i.e. collect, use, storage) must comply with all of the other obligations established in the data protection regulation.

Foreign Non-Profit Entities with permanent establishments in Colombia, supervised by the Superintendency of Companies, that, as of December 31 of the immediately preceding year, have obtained income equal to or greater than 9,000 SMMLV, must implement a PTEE focused on the risks of corruption and transnational bribery, no later than May 31, 2026.

According to External Circular 100-300000, the Superintendency of Companies excluded Foreign Non-Profit Entities with permanent establishments in Colombia, under its supervision, from the obligation to implement the SAGRILAFT, considering it disproportionate in relation to their operational and economic capacity.

Foreign Non-Profit Entities with permanent establishments in Colombia, under the supervision of the Superintendency of Companies, that, as of December 31 of the immediately preceding year, have obtained income equal to or greater than 9,000 SMMLV, must implement a Minimum Measures Regime no later than May 31, 2026.

ROS: Entities required to implement a Minimum Measures Regime, where a Suspicious Activity occurs in their operations, must submit a Suspicious Activity Report to the UIAF immediately upon becoming aware of it.

AROS: Entities required to implement a Minimum Measures Regime, where no Suspicious Activity has occurred in their operations, must submit an Absence of Suspicious Activity Report to the UIAF within the first 10 calendar days of January, April, July, and October.

Meet our team