Colombia Anti-Corruption Laws: Complete 2026 Guide for Foreign Businesses

We work with foreign businesses operating in Colombia across every sector — from manufacturing and services to public procurement contractors and multinational subsidiaries. Anti-corruption compliance is one of the most consequential legal areas we handle, and it's genuinely more complex than most foreign business owners initially realize. Colombia has robust anti-corruption legislation, sophisticated enforcement mechanisms, and — critically — a corporate criminal and administrative liability framework that creates real exposure for both companies and their officers.

The honest reality this guide addresses: Colombia's anti-corruption regime has substantially matured since the 2011 Estatuto Anticorrupción, and 2026 represents a significant inflection point with the Superintendencia de Sociedades' July 2, 2026 Circular Externa 100-000020 that unified the SAGRILAFT (anti-money laundering) and PTEE (Transparency and Business Ethics Program) frameworks into a Sistema Integral de Autocontrol y Gestión de Riesgos. Foreign businesses face compliance obligations that intersect with US Foreign Corrupt Practices Act (FCPA), UK Bribery Act, and other extraterritorial legislation. Sanctions are substantial — administrative fines up to 200,000 SMMLV (~$91 million USD in 2026), individual imprisonment of 6-15 years, prohibition from public contracting up to 20 years, and even cancellation of legal personality for the most severe cases.

Whether you're a foreign multinational establishing Colombian operations, a small foreign-owned business considering public procurement participation, an established Colombian subsidiary of a foreign parent, or a foreign investor with Colombian holdings, understanding the anti-corruption landscape is essential.

The 30-Second Answer

If you're operating or planning to operate a business in Colombia in 2026:

The layered legal framework:

• Ley 1474 de 2011 (Estatuto Anticorrupción) — foundational corruption prevention framework
• Ley 1778 de 2016 (Estatuto Anticorrupción Empresarial) — corporate administrative liability for transnational bribery
• Ley 2195 de 2022 — enhanced framework including beneficial ownership requirements
• Código Penal — specific criminal offenses (cohecho, contratación indebida, peculado)
• OECD Convention (Colombia adherent since 2012)

2026 game-changing development:

• Circular Externa 100-000020 (July 2, 2026) — Superintendencia de Sociedades unified SAGRILAFT + PTEE into new Sistema Integral de Autocontrol y Gestión de Riesgos (SIACGR)
• Circular Externa 100-000019 (July 2, 2026) — additional accounting circular provisions
• Modernized supervision framework with unified risk management

Key regulatory bodies:

• Superintendencia de Sociedades — administrative sanctions, compliance oversight
• Fiscalía General de la Nación — criminal prosecution
• Procuraduría General de la Nación — disciplinary sanctions
• Contraloría General de la República — fiscal control
• Secretaría de Transparencia de la Presidencia — policy coordination

Sanctions:

• Administrative fines: up to 200,000 SMMLV = ~$91 million USD in 2026
• Individual imprisonment: 6-15+ years with aggravants
• Prohibition from public contracting: up to 20 years
• Cancellation of legal personality (business termination)
• Business closure for repeated violations
• Reputational damage in Colombian and international markets

Compliance program obligations (PTEE):

• Required for companies meeting specific thresholds
• International transactions ≥ 100 SMMLV (2026: ~$45,000 USD)
• Combined with SAGRILAFT under new unified framework
• Compliance officer required
• Risk assessment, policies, training, whistleblower channels

The critical FCPA intersection:

• Colombian companies with US ties face both regimes
• February 10, 2025 — Trump administration paused new FCPA investigations (180 days)
• June 9, 2025 — DOJ redefined FCPA enforcement approach
• Colombian anti-corruption laws remain fully active regardless
• Effect on foreign multinationals in Colombia

The Layered Legal Foundation

Colombian anti-corruption law has developed through multiple statutes creating an increasingly comprehensive framework. Understanding how these laws layer together clarifies compliance obligations.

Ley 1474 de 2011: The Foundational Estatuto Anticorrupción

Ley 1474 de 2011 established Colombia's foundational anti-corruption framework, addressing prevention, investigation, and sanction of corruption.

Ley 1778 de 2016: Corporate Criminal Liability

Ley 1778 de 2016 represented a paradigm shift by establishing corporate administrative liability for transnational bribery. This was a fundamental change because Colombia historically maintained the civil law principle that only individuals could commit crimes.

Key provisions: Article 2 makes legal entities administratively liable when their employees, contractors, directors, administrators, or associates offer, give, or promise money or things of value to foreign public officials for obtaining or retaining business. Administrative sanctions include fines up to 200,000 SMMLV (~$91 million USD in 2026), prohibition from receiving subsidies or incentives, and public disqualification from contracting with Colombian public entities (up to 20 years).

Ley 2195 de 2022: The Enhanced Framework

Ley 2195 de 2022 (Transparency, Prevention, and Fight Against Corruption Law) substantially enhanced Colombian anti-corruption framework with multiple important provisions:

• Chapter I — Strengthened Legal Entity Liability
• Chapter II — Asset Management and Forfeiture
• Chapter III — Beneficial Ownership Requirements (mandatory registration)
• Chapter IV — Information Exchange and interagency coordination
• Chapter V — Corruption Prevention Pedagogy and training
• Chapter VI — Administrative Strengthening of enforcement

Código Penal: Specific Criminal Provisions

Colombian Criminal Code (Ley 599 de 2000) contains specific corruption-related offenses:

• Article 397 (Peculado por Apropiación) — 6-15 years for embezzlement by appropriation
• Article 405 (Cohecho Propio) — 5-8 years for direct bribery to public officials
• Article 407 (Cohecho por Dar u Ofrecer) — 5-8 years for those who give or offer bribes — applies to businesspeople
• Article 408-410 — Improper contracting and conflicts of interest (4-12 years)
• Article 412 (Enriquecimiento Ilícito) — 6-12 years for unjust enrichment
• Article 323 (Lavado de Activos) — 10-30 years for money laundering

The 2026 Game-Changing Development: Circular Externa 100-000020

On July 2, 2026, the Superintendencia de Sociedades issued Circular Externa 100-000020, fundamentally reshaping compliance obligations.

What the Circular Does

It creates unified Sistema Integral de Autocontrol y Gestión de Riesgos (SIACGR) that integrates:

• SAGRILAFT — Anti-money laundering, terrorism financing, proliferation financing
• PTEE — Anti-corruption and anti-transnational bribery
• Enhanced governance requirements
• Sustainability reporting recommendations (new Chapter XI)

Expanded Scope

The new framework expands to include chambers of commerce, foreign non-profit entities with permanent operations, broader corporate governance coverage, and specific guidance for SAS (Sociedades por Acciones Simplificadas).

What This Means Practically

For businesses subject to Superintendencia supervision:

• Integrated risk management approach — no longer separate SAGRILAFT and PTEE systems
• Single Compliance Officer may oversee both areas (with proper qualifications)
• Unified policies and procedures
• Comprehensive risk assessment methodology
• Integrated training programs

For foreign subsidiaries and multinational operations: Global compliance programs must be adapted to the new Colombian framework, with documentation of integration, enhanced board-level oversight, and unified reporting obligations.

Corporate Criminal and Administrative Liability

Understanding when companies (versus just individuals) face legal exposure is essential for foreign business risk management.

The Two Liability Tracks

Administrative Liability (Ley 1778 de 2016): Applies to legal entities, with Superintendencia de Sociedades as primary enforcement authority, administrative sanctions including substantial fines, and public disqualification consequences.

Criminal Liability: Applies to individuals (officers, directors, employees, agents), with Fiscalía General de la Nación as prosecution authority, imprisonment and fines, and personal liability that cannot be shifted to company.

When Companies Face Administrative Liability

Companies face administrative liability when employees, agents, or contractors offer, give, or promise benefits to foreign public officials for obtaining, retaining, or securing business advantage, when the conduct benefits the company, and when the company failed to prevent the conduct despite reasonable efforts.

The Compliance Program Defense

Effective compliance programs provide legal defense: They serve as a mitigating factor in sanction determination, evidence of good faith efforts to prevent violations, potential exemption for adequately implemented programs, and enable cooperation credit with authorities.

The FCPA and UK Bribery Act Intersection

For foreign businesses with US or UK operations or ownership, Colombian anti-corruption compliance must integrate with these extraterritorial regimes.

US Foreign Corrupt Practices Act (FCPA)

FCPA applies to Colombian operations when: US-listed parent companies operate through Colombian subsidiaries, US citizens or residents work in Colombian operations, US-based decision-making occurs for Colombian activities, or US financial system is used for corrupt payments.

Recent 2025 Developments: February 10, 2025, Trump administration ordered 180-day suspension of new FCPA investigations. June 9, 2025, Deputy Attorney General issued resolution redefining FCPA enforcement priorities toward transnational criminal threats and national security implications, reducing enforcement against foreign business acquisitions.

Practical implications: Colombian legal obligations remain fully in force. Ley 2195 de 2022 enforcement continues regardless of US changes. UK Bribery Act remains unaffected. OECD Convention obligations continue.

UK Bribery Act 2010

UK Bribery Act applies to: UK-incorporated companies wherever they operate, foreign companies with UK operations, and UK residents wherever they operate.

Key distinctions from FCPA: Broader scope including commercial bribery, strict liability for corporate failure to prevent bribery, no facilitation payment exception, and adequate procedures defense available.

The Practical Integration Challenge

Foreign businesses must operate under multiple regimes simultaneously: Facilitation payments are permitted under FCPA (with limits), prohibited under UK Bribery Act, and prohibited under Colombian law. Gifts and hospitality have varying threshold rules. Political contributions have different restrictions. Charitable donations have varying scrutiny standards. Third-party payments require varying due diligence.

Our recommendation: Adopt the strictest applicable standard as your compliance baseline, then document rigorously.

Mandatory Compliance Programs: PTEE Requirements

Who Must Have a Compliance Program

Companies must implement PTEE when they meet specific thresholds:

• International transactions ≥ 100 SMMLV in preceding year (~$45,000 USD in 2026)
• Total revenue exceeding specified thresholds (varies by category)
• Total assets above specified thresholds (progressive requirements)
• Public contracting participation of specified values
• Foreign subsidiaries or branches operating in Colombia

Elements of an Adequate Compliance Program

Under the unified SIACGR framework, compliance programs must include:

1. Risk Assessment — corruption risk mapping, money laundering analysis, terrorism financing assessment, regular updates, documented methodology
2. Policies and Procedures — written anti-corruption policy, gift and hospitality policy, third-party due diligence procedures, political contribution restrictions, facilitation payment prohibition, whistleblower protection
3. Compliance Officer (Oficial de Cumplimiento) — independent and qualified, direct reporting to board or senior management, adequate resources and authority, free from operational conflicts
4. Training and Communication — regular training at all levels, documented completion, enhanced training for high-risk positions, new employee onboarding, ongoing refresher training
5. Third-Party Due Diligence — screening of business partners, anti-corruption clauses in contracts, ongoing monitoring of high-risk relationships, termination rights for violations, documentation of due diligence
6. Internal Controls — financial controls preventing corrupt payments, approval hierarchies, segregation of duties, audit trails, documentation retention
7. Whistleblower Channels — anonymous reporting mechanisms, multiple reporting channels, non-retaliation policies, investigation procedures, feedback to reporters
8. Investigation and Enforcement — prompt investigation of allegations, independent investigators, documentation of findings, disciplinary action for violations, remediation and prevention
9. Monitoring and Testing — regular effectiveness reviews, internal audits, external assessments where appropriate, corrective action plans, continuous improvement
10. Board and Senior Management Oversight — regular board reporting, senior management accountability, documented board decisions, compliance in strategy, cultural leadership from top

Sanctions and Penalties in Detail

Administrative Sanctions Under Ley 1778 de 2016

For transnational bribery — legal entities:

Fines: Up to 200,000 SMMLV (~$91 million USD at 2026 SMMLV of 1,750,905 COP), calculated based on benefit obtained or intended, enhanced by aggravants, reduced by mitigants (voluntary disclosure, compliance program, cooperation).

Non-monetary sanctions: Prohibition from public contracting up to 20 years, prohibition from receiving public benefits/subsidies/incentives, publication of sanctions in national newspaper and Superintendencia records.

Criminal Penalties Under Código Penal

For individuals (executives, employees, agents):

• Cohecho por Dar u Ofrecer (Article 407) — paying bribes: 5-8 years imprisonment, fines up to 150 SMMLV, 33-50% increase for aggravating circumstances
• Enriquecimiento Ilícito (Article 412) — 6-12 years imprisonment, fines up to 500 SMMLV
• Contratación Sin Requisitos Legales (Article 409) — 4-8 years imprisonment, fines and disqualification
• Peculado por Apropiación (Article 397) — 6-15 years imprisonment, fines up to 50,000 SMMLV, extended for aggravated cases
• Lavado de Activos (Article 323) — 10-30 years imprisonment, substantial fines, asset forfeiture

Public Procurement Anti-Corruption Specifics

Public procurement is one of the highest-risk areas for corruption issues, with specific compliance requirements under Ley 80 de 1993, Ley 1150 de 2007, and Ley 2069 de 2020.

Companies bidding on Colombian public contracts must: Have adequate compliance program for contract value thresholds, provide anti-corruption declarations, disclose beneficial ownership, certify no active investigations, provide transparency documentation.

Prohibited in public procurement: Bribery of any kind to public officials, collusion with other bidders, providing false information in bids, conflict of interest situations, post-award contract modifications through corrupt means.

Colombian authorities focus enforcement on: Public contracting participants, large infrastructure projects, health sector procurement, defense procurement, state-owned enterprise contracts.

Practical Compliance Program Development

For foreign businesses building or enhancing compliance programs, practical steps make the difference.

Step 1: Comprehensive Risk Assessment

Identify geographic risks, sector risks (public procurement, healthcare, extractives higher risk), third-party risks, transaction risks, and political risks.

Step 2: Policy Framework

Develop comprehensive anti-corruption policy, gifts and hospitality policy, third-party due diligence policy, political contribution policy, facilitation payment prohibition, and whistleblower protection.

Step 3: Implementation Systems

Deploy approval workflows for high-risk transactions, third-party screening databases, training platforms, whistleblower channels, documentation repositories, and compliance monitoring tools.

Step 4: Training and Communication

Build compliance culture through board and senior management training, employee training at all levels, regular refresher training, situation-specific training for high-risk roles, and third-party training where appropriate.

Step 5: Third-Party Due Diligence

Screen business partners through background checks on principals, beneficial ownership verification, adverse media screening, sanction list screening, reputational analysis, and ongoing monitoring.

Step 6: Internal Controls

Prevent corrupt payments through segregation of duties, approval hierarchies, financial controls, audit procedures, and documentation requirements.

Step 7: Monitoring and Testing

Verify effectiveness through regular internal audits, compliance metrics tracking, external assessments periodically, continuous improvement, and board reporting.

Common Compliance Mistakes We See

Mistake 1: Assuming home country compliance suffices — localize global program to meet specific Colombian requirements.

Mistake 2: Underestimating the 2026 Circular changes — adopt integrated SIACGR approach immediately.

Mistake 3: Inadequate third-party due diligence — implement risk-based comprehensive due diligence program.

Mistake 4: Assuming facilitation payments are acceptable — maintain strict prohibition.

Mistake 5: Weak whistleblower systems — implement robust anonymous reporting with follow-through.

Mistake 6: Board disengagement — ensure genuine board engagement with regular substantive review.

Mistake 7: One-time training — build continuous compliance culture reinforcement.

Mistake 8: Poor documentation — maintain comprehensive documentation of compliance decisions.

Mistake 9: Ignoring cross-border implications — manage Colombian compliance integrated with FCPA/UK Bribery Act.

Mistake 10: Reactive rather than preventive — invest proactively in compliance before problems emerge.

Quick Checklist

1. Layered framework: Ley 1474, Ley 1778, Ley 2195, Código Penal work together.
2. 2026 game-changer: Circular Externa 100-000020 unified SAGRILAFT + PTEE into SIACGR.
3. Administrative liability for legal entities under Ley 1778 (transnational bribery).
4. Criminal liability for individuals under Código Penal.
5. Maximum fines: 200,000 SMMLV (~$91M USD in 2026).
6. Prison sentences: 5-30 years for various offenses.
7. Public contracting bans: Up to 20 years.
8. PTEE mandatory for companies meeting thresholds.
9. Compliance officer required with independence and qualifications.
10. FCPA + UK Bribery Act intersection requires integrated approach.
11. Third-party due diligence essential — companies liable for partners.
12. Facilitation payments prohibited under Colombian law.
13. Board oversight genuinely required — not just formal.
14. February 2025 US changes don't affect Colombian obligations.

Why Stanford Baker & Associates for Anti-Corruption Compliance

Colombian anti-corruption compliance requires specialized legal work at the intersection of corporate law, criminal law, and administrative law. The stakes are substantial — administrative fines can reach $91 million USD, individuals face potential imprisonment, and companies can lose access to public contracting for decades.

Services specifically for anti-corruption compliance:

• PTEE and SAGRILAFT program development under new 2026 unified framework
• Compliance officer support and advisory
• Risk assessment methodology and execution
• Policy and procedure development aligned with Colombian and international standards
• Third-party due diligence on business partners
• Training program design and delivery
• Whistleblower system implementation
• Investigation of internal allegations
• Defense against Superintendencia investigations
• Coordination with foreign counsel on multi-jurisdictional matters
• Board and executive advisory
• Merger and acquisition anti-corruption due diligence

Founded by foreigners, for foreigners. We understand the specific challenges foreign businesses face when navigating Colombian anti-corruption requirements alongside their home country obligations.

Bilingual team. All advice, documentation, and communications handled in English (and Spanish), ensuring clear understanding of complex regulatory frameworks.

National coverage. Legal services available in Bogotá, Medellín, Cartagena, Cali, Barranquilla, Pereira, Manizales, Armenia, Santa Marta, Bucaramanga, Cúcuta, and Villavicencio.