How to Comply with AML Regulations in Colombia—the Fourth Economy in Latin America

Colombia is the fourth largest economy in Latin America by GDP, attracting international investment and new entrepreneurs. Moreover, it’s the first country in South America to legalize online gambling. Against this backdrop, Colombia plans to implement a new KYC law allowing the use of more technology in AML programs. 

So while Colombia is seeing impressive economic growth (expected to reach 6.1% this year), the country still has inherent risks related to money laundering and other financial crimes, including the illicit cocaine and heroin trade. Therefore, local regulators are on high alert, which means companies entering the Colombian market need a reliable KYC/AML solution. 

Colombia and the FATF

Colombia is a member of the Financial Action Task Force of Latin America (GAFILAT) and therefore has to comply with FATF standards.

According to the Sixth Enhanced Follow-Up Report and First Technical Compliance Re-rating Report of Colombia of 2022, Colombia has improved its compliance with the FATF standards since their 2018 mutual evaluation. As a result, Colombia has been re-rated from partially compliant to compliant on the five following FATF Recommendations:

• Recommendation 13 requires additional measures (like understanding the nature of businesses) to be applied to cross-border correspondent banking relationships, in addition to performing the customer due diligence (CDD) and enhanced due diligence (EDD) measures.
• Recommendation 16, also known as the Travel Rule, requires countries to collect identifying information from the originators and beneficiaries of domestic and cross-border wire transfers to create a suitable AML/CFT audit trail. An audit trail is a date and time-stamped record of the history and details around a financial transaction, or trade deal, etc.
• Recommendation 19 states that financial institutions should be required to apply EDD measures to business relationships and transactions with individuals/entities from countries for which this is called for by the FATF;
• Recommendation 33 advises that countries should maintain comprehensive statistics on matters relevant to the effectiveness and efficiency of their AML/CFT systems;
• Recommendation 34 advises competent authorities to establish guidelines, and provide feedback, which will assist financial institutions and designated non-financial businesses in applying national measures to combat ML/TF.

Out of 40 FATF recommendations, Colombia is “compliant” with 13, “largely compliant” with 15 and “partially compliant” with 10, according to the Sixth Follow-up Report.

The country still has one “non-compliant” rating on Recommendation 24, which states that “countries should take measures to prevent the misuse of legal persons for ML/TF. Countries should ensure that there is adequate, accurate and timely information on the beneficial ownership and control of legal persons that can be obtained or accessed in a timely fashion by competent authorities.”

Sanctions and money laundering risks in Colombia

There are no international sanctions currently in force against Colombia.

Colombian legislation demands that, before concluding any contract for the sale or purchase of goods or services, the names of businesses, partners and/or service providers should be checked in the international lists issued by the UN Security Council, foreign institutions, and other restrictive lists issued by the Colombian authorities.

Some local institutions, such as the National Police, and the National Controller’s Office, have their own “restrictive lists” in which businesses and individuals are included due to:

• Failure to comply with legal and contractual obligations in relation to public contracts
• Contractual sanctions or revocations of contracts executed with governmental entities
• Fiscal or disciplinary responsibility before Colombian authorities, etc. 
• Convictions for crimes such as money laundering.

A person/client on a restrictive list is considered to be associated with criminal risks, especially money laundering activity.

Indeed, money laundering is still a significant problem in Colombia. It causes inflation (which is currently more than 9%) and creates unfair competition when front businesses offer products and services at artificially low prices.

According to Colombia’s Financial Information and Analysis Unit (UIAF)—the country’s main AML watchdog— as much as $20 billion in financial operations was tied to money laundering between 2019 and mid-2022. This is more than 6% of Colombia’s annual GDP.

The UIAF has found some 570 channels through which illicit money was laundered—including fake or inflated invoices, currency trading, exports and crypto-currencies.

Who is affected by AML regulations?

The following sectors are obliged to have an AML compliance program:

1. Customs brokers;
2. Exchange houses (or home exchange);
3. Foreign exchange organizations;
4. Foreign trade;
5. Financial organizations;
6. Gambling industry;
7. Gold traders;
8. Health sector;
9. High-net-worth companies;
10.  High-value cargo transportation;
11.  Insurance businesses;
12.  Land freight forwarding companies;
13.  Money orders services;
14.  Notaries;
15.  Solidarity sector;
16.  Sports betting companies;
17.  Stock market;
18.  Vehicle sale and purchase.

According to the Colombian National Risk Evaluation Report conducted by the UIAF, the highest money laundering threats came from public corruption, drug trafficking, and trade, which are currently prioritized by local authorities in their prosecutions.

What are the main regulations?

Colombia’s Penal Code outlines 66 types of crimes tied to money laundering, including drug and arms trafficking, customs fraud and people smuggling.

The main AML regulations are as follows:

Law 526 of 1999 established Colombia’s Financial Information and Analysis Unit (Unidad de Información y Análisis Financiero or UIAF), which is the country’s key AML watchdog.

Law n. 1121 of 2006, Art. 27—Identification of the customer

Businesses must fully identify the natural and legal entities that enter into a contracted business relationship, as well as the origin of their funds in order to prevent criminal activity.

C.E. 100-005 Art. 5.2, a):

In order to secure  the KYC process, the obliged entities need to verify, when possible:

• the origin of the resources;
• the identity of the client;
• their address and telephone number;
• request the certificate of existence and legal representation in the case of legal persons; 
• any other additional information that is considered pertinent.

Check out the rest of the laws in Sumsub’s special guide. In this edition, you’ll find Colombia’s legal requirements for customer identification, verification, and due diligence measures for non-face-to-face business relations.

Who is the main regulator?

Cases of money laundering are investigated and prosecuted by the above-mentioned Financial Intelligence Unit of Colombia, which operates under the Ministry of Treasury and Public Credit. 

As established by Law 526, the functions of the UIAF are as follows:

• Examine economic activities to detect and prevent money laundering and terrorist financing transactions; 
• Collect, centralize and analyze reports from financial organizations and individuals;
• Report to the Superintendence of Finance, the Tax Administration and the Prosecutor’s Office, when applicable; 
• Conduct research on money laundering and provide AML best practices for the sectors and economic operations exposed to money laundering;
• Make suggestions on new AML mechanisms.

According to the IMF, the UIAF has an effective process for prioritizing and analyzing suspicious transaction reports (STRs). However, a few factors negatively impact efficiency:

– poor quality of STRs from certain reporting entities,

– inexperience of certain entities in their reporting activities.

Colombian law on simplified KYC

In April 2019, Jorge Castaño Gutiérrez, superintendent of the Financial Superintendency of Colombia (SFC), announced that Colombia’s anti-money laundering regulations were being updated to allow more technology to be used for “Know Your Customer” (KYC) and “Customer Due Diligence” (CDD) processes.

As Gutiérrez advised, Colombia was making changes to its risk management system for money laundering and terrorism financing (known as SARLAFT), and KYC/CDD is a key area of interest.

The new rule should allow for the use of more technology in financial institutions’ AML programs, which should help facilitate document verification and due diligence processes, while complying with the criteria set out by the FATF on KYC/CDD programs.

By moving to digital platforms, financial institutions are implementing digital solutions that simplify customer identification and enable creating centralized databases. These technologies also enable more secure reporting and enhance transaction monitoring.

For companies with multiple branches, KYC/CDD technology can lower costs and help maintain a standardized risk management framework, enhancing monitoring and AML processes. 

How to stay compliant

Customer Due Diligence

Providers of the above-mentioned services (financial institutions, gambling and betting operators, notaries, etc.) have to perform Customer Due Diligence (CDD) for their customers and counterparts.

In any case, the business must obtain adequate knowledge of their clients, including: 

• their nature and source of funds,
• the markets in which they/their partners operate,
• the true beneficiaries in control of them/their partners.

Restrictive lists issued by national and foreign authorities related to Colombians must be consulted permanently (e.g. lists issued by Colombia’s National Police, National Prosecutor’s Office, or the National Controller’s Office. Please see “Sanctions and money laundering risks in Colombia” above for more details).

Other basic activities must be carried out for CDD, if the nature of the operation allows them, including: 

1. Check of the origin of the resources by any legal means;
2. Verification of client’s identity;
3. Verification and confirmation of contact information;
4. Verification of the client’s economic activity; 

Any additional documentation may also be requested, when appropriate.

Enhanced Due Diligence

In Colombia, there are special measures for certain types of clients, like politically exposed persons (PEPs). This is called Enhanced Due Diligence (EDD), because it demands more controls. 

The approval of operations and business with PEPs should be approved by an authority higher than the one in charge of the ordinary due diligence process.

EDD also applies to any client that, according to internal alerts, requires a higher level of scrutiny (e.g. clients from high-risk jurisdictions or high-risk sectors, like gambling).

Reporting

According to the Circular Externa 100-005, public and private entities from the financial and insurance sectors are obliged to report to the UIAF. 

Corporations under the “Superintendencia de Sociedades” which have a monthly income superior to 160,000 minimum wages (approx. 40,000,000.00$) are also obliged to report to the UIAF.

Fines and penalties

Money laundering is punishable by 10 to 30 years of imprisonment, with a fine ranging from 650 to 50,000 minimum monthly wages. 

For crimes committed via exchanges, the maximum punishment is up to 40 years of imprisonment.

Article 324 of the Penal Code sets specific aggravating circumstances for money laundering for which the above mentioned penalties are increased by 50%, if the crime is committed by a legal person or an organization dedicated to money laundering.

The penalties are increased by 75% if they are incurred by the heads of such institutions.

However, the sentence cannot exceed 50 years for one crime, or 60 years in case of multiple offenses.

Conclusion

Despite slow progress, Colombia’s AML legislation continues to develop and is taking the right steps to fight money laundering. 

By 2022, Colombia improved its level of compliance with the FATF recommendations, as shown in a recent FATF follow-up report. Colombia was also the first South American country to legalize online casinos, therefore generating interest from new gambling companies.

The country is also planning to simplify KYC procedures, allowing more technology to streamline verification processes in fintech and other sectors.

As a result, more businesses are planning to enter the Colombian market, and they need to stay up to date with all the recent regulations in the country while using reliable KYC technology.

FAQ

• Are risks of money laundering high in Colombia?

  Colombia has improved its level of compliance with the FATF Recommendations. However, the US State Department categorizes the country as a major money-laundering jurisdiction.

• Is Colombia currently sanctioned?

  Colombia is not sanctioned.

• Is gaming/gambling legal in Colombia?

  Some forms of online gambling were legalized in Colombia in 2016, through the country’s eGaming Act. Before 2016, only land-based casinos were regulated properly by Coljuegos (the Colombia Gambling Authority). In 2021, the country’s gambling industry was expanded with online bingo, instant games and digital scratch cards.

• What are Colombia’s AML regulations for gaming/gambling?

  Measures against money laundering, which affect online gambling/gaming operators, include:

  • The Colombian Gambling Act, Law 643 of 2001;
  • Resolution 20195100044514 of 2019—AML requirements for operators;
  • Coljuegos Resolution 20215000012784 of May 2021;
  • Decree 830 of 2021—expands the list of politically exposed persons (PEPs) and complements the KYC due diligence process.