Andrés Eduardo Jiménez

Partner

[email protected]

With the enactment of Law 1778 of 2016, which established rules on the liability of legal entities for transnational bribery, Colombia introduced an administrative sanctions regime for companies as an alternative to recognizing criminal liability for legal entities.

Subsequently, Law 2195 of 2022 expanded the scope of administrative liability for legal entities to include acts of domestic corruption, extending the regime to other offences against public administration, environmental crimes, offences against the economic and social order, terrorism financing, and offences provided for under Law 1474 of 2011.

The law establishes three conditions for corporate liability to arise: (i) a final criminal conviction or a final opportunity principle agreement involving a director, officer or employee of the legal entity for any of the offences listed above; (ii) the legal entity must have obtained a benefit from the unlawful conduct; and (iii) the company must have consented to or tolerated the conduct through action or omission, taking into account the effectiveness of its risk management and compliance controls.

On 18 December 2025, the Colombian Superintendence of Companies published for public consultation a draft External Circular intended to replace the current Legal Basic Circular in its entirety. As of March 2026, the final version of the regulation had not yet been issued.

One of the most significant changes proposed is the consolidation into a single chapter of the provisions governing anti-money laundering compliance—currently regulated under Chapter X (SAGRILAFT)—and anti-corruption compliance programmes, currently contained in Chapter XIII relating to the Business Transparency and Ethics Programme (PTEE).

Although this may initially appear to be a mere exercise in regulatory consolidation and simplification, the draft Circular introduces changes that will require companies to reassess their exposure to a broader range of criminal risks.

Under the proposed Circular, the Superintendence requires companies to incorporate into their risk assessments not only money laundering and corruption risks, but also environmental offences, crimes against the economic and social order, offences established under Law 1474 of 2011, and even electoral crimes. These are precisely the categories of offences incorporated by Law 2195 of 2022 as triggering events for the administrative liability of legal entities.

From a legal perspective, this means that companies will now be expected to implement preventive measures addressing criminal risks that extend well beyond traditional anti-money laundering and anti-corruption compliance programmes.

If a final criminal conviction or opportunity principle agreement is issued in relation to any of these offences involving a company's directors, officers or employees, inadequate management of these newly identified criminal risks may satisfy the third element required to establish administrative liability. Conversely, an effective compliance programme addressing these risks may constitute the company's principal defence against administrative sanctions.

The potential consequences are substantial. Administrative fines may reach up to 200,000 statutory monthly minimum wages (SMLMV). Based on the 2026 minimum wage, this represents approximately COP 350 billion (around USD 95 million), providing companies with a compelling incentive to strengthen the management of their criminal compliance risks.