## cr18314-colombiadar ## Source details **Canonical URL:** [cr18314-colombiadar](https://www.imf.org/-/media/files/publications/cr/2018/cr18314-colombiadar.pdf) ## Other formats - [Markdown version](/-/media/files/publications/cr/2018/cr18314-colombiadar.pdf.md) - [Structured JSON version](/-/media/files/publications/cr/2018/cr18314-colombiadar.pdf.json) --- ### EXECUTIVE SUMMARY — Key findings - Onsite visit: June 5 to 22, 2017. - Main scope: assessment of Colombia’s AML/CFT measures against the FATF 40 Recommendations (2012 FATF Recommendations using the 2013 Methodology; onsite visit June 5 to 22, 2017). - Country understanding of ML/TF risks relies on the 2013 and 2016 National Risk Assessments (NRAs); 2016 NRA produced reasonable findings but had scope and data limitations. - Main ML threat: proceeds-generating criminal activity of domestic organized armed groups (Grupos Armados Organizados—GAOS); primary sources: drug trafficking and other criminal activities. - UIAF (Financial Analysis and Information Unit): produces high-quality operational and strategic analysis; UIAF disseminations upon FGN request are a key input to investigations, but spontaneously disseminated reports resulted in fewer ML cases and no TF cases. - Supervisory and preventive regime: significant legal/regulatory gaps and implementation deficiencies, especially in CDD, BO, DNFBP coverage and risk-based supervision outside the SFC. - Confiscation and asset forfeiture: prioritized and effective; asset forfeiture (extinción de dominio) applied with important results; Colombia has robust systems (FRISCO and SAE) to manage seized/confiscated property. - TFS and PF: legal framework for TF-related TFS exists but PF-related TFS has technical and operational deficiencies. - International cooperation: timely, good quality, proactive; constructive mutual legal assistance (MLA) and extradition; BO availability limitations affect some international responses. *Source: EXECUTIVE SUMMARY — Colombia AML/CFT detailed assessment, onsite visit June 5 to 22, 2017.* ### RISKS, NATIONAL CONTEXT, AND ECONOMIC MATERIALITY - Geography and demographics: - Land area: 1,038,700 km2. - Population: 49,210,124 (2017 estimate). - Official currency: Colombian peso (COP). - Economic figures: - GDP: US$292.1 billion as of 2015. - Gross National Income per capita: around US$8,000. - Economic composition: service activities (56 percent), manufacturing industry (38 percent), agriculture (6 percent). - ML/TF risk overview: - Authorities’ estimate of money laundered: 5.4 percent of GDP. - World Bank study estimate of assets laundered: 7.5 percent of GDP. - Domestic coca production estimated value: around US$2 billion annually. - Distribution of Colombian-produced cocaine: 55 percent to North America; remainder to Europe. - Reported extortion cases (FGN) 2008–2014: 33,225 cases. - Estimated share of cash to GDP increased from 4.49 percent to 5.58 percent in 2011–2015. - Informal sector employment decreased from 51.30 percent to 47.20 percent between 2011 and 2015. - Sectors most vulnerable per NRAs: banking, gold mining, lawyers, real estate, accountants, statutory auditors (revisores fiscales), auditors, the real sector. ### ASSESSMENT OF RISK GOVERNANCE, COORDINATION AND NRAs (IO.1; R.1, R.2, R.33) - NRA process and limitations: - 2016 NRA assesses ML/TF threats as of December 2016; main ML threats: drug trafficking, corruption, illegal mining, smuggling, human trafficking. - Limitations: insufficient coverage of tax evasion, SAS corporate vehicle misuse, informal sector vulnerabilities, foreign-origin threats, cross-border flows; heavy reliance on qualitative inputs and limited quantitative/statistical analysis. - Participation gaps: limited or no participation by DIAN or SFC in certain areas; some sectoral assessments (UIAF 2017) show disconnects with 2016 NRA. - National coordination: - CCICLA designated lead for AML/CFT policy; UIAF acts as CCICLA technical secretariat; CONPES 3793 (December 2013) sets national AML/CFT policy. - Operational coordination: improved since 2008 but remains fragmented; no effective mechanism demonstrated to translate 2016 NRA results into specific mitigation measures at time of report. - Immediate Outcome 1 effectiveness: - Overall conclusion: Colombia achieved a substantial level of effectiveness for IO.1. ### FINANCIAL INTELLIGENCE — UIAF (IO.6; R.29–32) - Access and inputs: - UIAF direct/indirect access to STRs, cash transaction reports, foreign currency transaction reports, remittances, threshold reports, BOs registered with Chambers of Commerce, notarial operations, monthly transactions of gold import/export entities and foundries. - Since 2002 DIAN sends cross-border currency and BNI reports to UIAF every three months (not real-time). - STRs and outputs: - STRs received increased: 7,615 in 2011 to 10,002 in 2016. - STRs by sector (selected totals): - Banks total (2011–2016): 23,255. - Notaries total (2011–2016): 5,730. - Fiduciary companies total (2011–2016): 1,723. - Postal transfer operators total (2011–2016): 2,183. - Casinos total (2011–2016): 79. - Law firms and accounting firms: total 0 (2011–2016). - Dealers in precious metals/stones: total 0 (2011–2016). - Of 10,002 STRs in 2016: cash 208,318,240; foreign currency 678,940; wire transfers 8,196,118; remittances 48,614,198. - UIAF case dissemination and impact: - July 2012–August 2017: 422 cases disseminated to FGN (334 spontaneous; 88 on request). - Of 422 cases: FGN started 242 criminal proceedings; 151 preliminary inquiries; 27 current investigations; 16 convictions; 111 used in asset forfeiture processes. - From 2011–2016 UIAF disseminated 51 TF cases to FGN; none triggered TF investigations (used in asset forfeiture only). - Operational tools and constraints: - Since 2015 STRs received through electronic system “SIREL” with automated classification; UIAF uses big data and data mining. - Factors limiting effectiveness: poor STR quality from some reporting entities; low reporting by DNFBPs; suspension of IEROS feedback reports since 2014; UIAF lacks timely access to DIAN cross-border data and BO from some DNFBPs. - Timeliness: - UIAF standard reply time to LEA requests: usually 10 days. - Information Requests Sent to UIAF (2012–2016): FGN 1,185; National Police 807; Other 84; Total 2,076. - Immediate Outcome 6 effectiveness: - Overall conclusion: Colombia achieved a substantial level of effectiveness for IO.6. - Recommended priority actions (IO.6): - Improve feedback from UIAF to supervisors/reporting entities on STR quality. - Expand UIAF access to DIAN declarations and BO information from DNFBPs. - Develop TF-specific STR guidance and typologies. ### ML INVESTIGATIONS, PROSECUTIONS AND ASSET RECOVERY (IO.7 & IO.8) - ML investigations and prosecutions (IO.7): - FGN prosecutions and LEAs have resources and legal tools; most ML cases involve simple schemes and low amounts, primarily linked to illegal drug trafficking. - Number of FGN ML investigations: 2012 311; 2013 345; 2014 283; 2015 377; 2016 450. - ML indictments and convictions (2012–2016): Indictments total 320; Convictions total 216 (some convictions from prior indictments). - ML convictions by type (2014–2016): Money Laundering 38, 41, 38 respectively. - Immediate Outcome 7 effectiveness: assessed as Low. - Asset forfeiture and confiscation (IO.8): - Asset forfeiture prioritized; AFL (Law 1708 of 2014) introduced procedural simplifications reducing average investigation time from 7 years to 1.5 years. - FGN reported (2011–2016): 292 legal decisions forfeiting 1,405 assets. - FGN reported (2014–May 2017): 13,941 assets subject to provisional measures amounting to Col$17,002,618,979.074 (around US$5,620,000,000). - FGN reported (January–June 2017): final asset forfeiture of 166 assets for Col$376,615,632,908 (around US$133,853,223). - FRISCO (by June 2017) managing property seized and confiscated for approximately US$1,620,377,460 (includes forfeited US$319,409,092 and provisional measures around US$1,300,968,368). - Table 27 summary (preserved figures): - Total (Forfeited) — Number: 7,675; Value in Col$: 910,169,072,678; in US$: 318,559,175. - Total (Under a Provisional Measure) — Number: 87,099; Value in Col$: 3,702,794,340,375; in US$: 1,295,978,019. - Exchange rate note: US$1.00 = Col$2,843.36. - Seizure orders (FGN, 2012–2016): 2012 507; 2013 401; 2014 496; 2015 438; 2016 521; Total 2,363. - Confiscation outcomes: asset forfeiture highly used and effective; sharing/repatriation to/from foreign counterparts limited (one final repatriation case at time of visit). - Immediate Outcome 8 effectiveness: Colombia achieved a substantial level of effectiveness for IO.8. - Recommended priority actions (IO.7 & IO.8): - Allocate resources to FGN for larger/complex ML investigations; pursue parallel financial investigations for serious proceeds-generating crimes; establish criminal liability for legal persons. - Enhance confiscation of property derived indirectly from crimes; increase repatriation/sharing with foreign counterparts; improve criminal confiscation statistics. ### TERRORIST FINANCING, TFS AND PF (IO.9–11; R.5–8) - TF risk and prosecution (IO.9): - High domestic TF risk; main TF threat from proceeds-generating activities of GAOS. - TF offense investigated/prosecuted to a limited extent; number of standalone TF investigations and prosecutions small relative to threat. - NPO sector: registration regime exists but no risk-based supervision or identification of FATF-defined at-risk subset. - Immediate Outcome 9 effectiveness: Low. - Targeted Financial Sanctions — TF (IO.10 / R.6): - Legal mechanism exists to apply TFS related to TF; freezing ordered by prosecutor under AFL judicial proceedings; banks routinely check UN lists; awareness lower in DNFBPs. - Authorities had not received notifications relating to assets/funds belonging to persons designated pursuant to UNSCRs and had not designated any person under UNSCRs 1267 or 1373. - Immediate Outcome 10 effectiveness: Moderate. - Targeted Financial Sanctions — PF (IO.11 / R.7): - PF-related TFS obligations limited and operationally deficient: - AFL freezing is tied to judicial asset forfeiture and applies only where assets linked to criminal offenses; cannot be applied merely due to UNSCR PF designation. - Reporting obligations to monitor lists limited to UNSCRs on terrorism/TF; no clear obligation for private sector to check PF UNSCRs. - Immediate Outcome 11 effectiveness: Low. - Recommended priority actions (TF/PF): - Investigate, prosecute and convict using TF offense consistent with risk profile; do not rely solely on alternative measures. - Require all natural and legal persons, including DNFBPs, to apply TFS for TF and PF without additional judicial conditions. - Identify subset of NPOs falling under FATF definition and implement focused proportionate measures; engage NPO sector on CFT. ### PREVENTIVE MEASURES, CDD, BENEFICIAL OWNERSHIP, AND DNFBPs (IO.4; R.9–23) - Preventive regime — overview: - SARLAFT and equivalent systems required for many FIs; SFC Circular 55/2016 effective March 31, 2017 for SFC-supervised entities. - Significant gaps: no legal overarching obligation to conduct CDD in primary legislation; PTOs not explicitly listed as reporting entities by law (subject to MINTIC Regulation 2564/2016); shortcomings in BO identification/verification across sectors. - CDD and BO specifics (preserved assessment conclusions): - CDD legal/regulatory gaps: no explicit legal requirement in some laws; CDD elements required largely by circulars/regulations rather than law. - BO identification: - SFC-supervised FIs required to identify BO (Circular 55/2016) and BO defined (e.g., natural persons owning 5 percent or more), but exemptions exist (listed companies). - Savings and loans cooperatives and notaries not obliged to identify/verify BO when establishing a business relationship. - No requirement to collect BO information in all cases; processes inconsistent with FATF standards. - Timing, ongoing monitoring and existing customers: - Identity and BO verification required before business relationship for SFC-supervised FIs; currency exchange firms and PTOs silent/unclear on timing and verification. - No obligation to apply CDD to existing customers based on materiality and risk (Criterion 10.16 Not Met). - Wire transfers and originator/beneficiary information: - Circular 55/2016 requires originator and beneficiary information to accompany transfers but no requirement to include account numbers or a unique transaction reference; batching and intermediary/beneficiary institution scenarios not fully addressed. - DNFBPs coverage and STR filing: - Many DNFBPs remain out of scope or subject to high revenue thresholds under Supersociedades SAGRLAFT (e.g., lawyers, accountants, real estate agents, dealers in precious metals/stones). - STR reporting by DNFBPs low or negligible; law firms and accounting firms reported zero STRs 2011–2016. - Notaries: RON reports and STR obligations exist but have an exception when a legal entity supervised by SFC is involved (intended to be amended). - Casinos better covered; Coljuegos supervises licensed casinos (383 licensed; 2,500 establishments). - Supervisory frameworks and effectiveness (IO.3; IO.4): - SFC: more advanced RBA and offsite tools; staff ML/TF Risk Division: 33; 142 onsite inspections over six years ending 2016. - Other supervisors (SES, DIAN, MINTIC, Supersociedades, SNR, Coljuegos): RBA evolving or limited; scope limitations constrain supervision. - Fit-and-proper and licensing: robust for Colombian nationals; less stringent for foreign beneficial owners. - Enforcement: greater reliance on corrective plans and warnings than proportionate/dissuasive fines in many sectors. - Key supervisory and regulatory statistics preserved: - SFC sanctions 2011–2017 (May) totals: Recommendations 28; Corrective plan 50; Monetary fine total 22; Total measures/sanctions Grand Total 103. - DIAN fines 2012–2015: around Col$4,398,000,000 (about US$1.5 million) applied against 1,094 firms; updated to March 2017 fines equivalent about US$2.8 million for AML/CFT violations and US$3.9 million for unlicensed activities (total about US$6.7 million; some 1,200 cases). - Immediate Outcome 4 effectiveness: - Colombia achieved a moderate level of effectiveness for IO.4. - Recommended priority actions (Preventive measures & Supervision): - Fully extend AML/CFT requirements to sectors out-of-scope (unregulated lenders, internet casinos, real estate intermediaries, lawyers, accountants, dealers in precious metals and stones). - Establish a legal obligation for CDD across sectors; require BO identification and a mechanism to maintain accurate, up-to-date BO information accessible to authorities. - Reinstate STR quality feedback (IEROS) from UIAF and provide supervisors with STR-quality feedback tools. - Fully implement RBA supervisory systems for all financial institutions and DNFBPs including onsite inspections and cross-border supervision. ### TRANSPARENCY OF LEGAL PERSONS AND ARRANGEMENTS (IO.5; R.24–25) - Legal persons: - Public registries (Chambers of Commerce, RUES) hold basic information and annual updates; bearer shares not allowed. - Simplified Joint Stock Companies (SAS): 54 percent of commercial companies are SAS (11,807 SAS among total approx. 86,705 entities); SAS creation requires only a simple private document — ML/TF risks from SAS not analyzed by authorities. - Shareholder information: accessible via public registries, books of shareholders, supervisors’ databases; BO information partially available, adequate for simple structures but limited for complex structures and foreign ownership. - Sanctions: criminal proceedings and administrative sanctions have been applied for false information to registries (Supersociedades sanctions and Chambers of Commerce penal complaints). - Legal arrangements (fiduciae/trusts): - Fiduciae: about 23,244–23,200 fiduciae under administration; only licensed fiduciary companies (26) provide services and are supervised by SFC. - Fiduciary companies must register and update all fiducia contracts with the SFC; BO of settlors/beneficiaries must be identified per SARLAFT but implementation in early phase (2017). - FRISCO and SFAM management and SFC supervisory access: SFC holds detailed fiducia data; UIAF lacks on-line access to SFC fiducia information. - Immediate Outcome 5 effectiveness: - Colombia achieved a moderate level of effectiveness for IO.5. - Recommended priority actions (IO.5 / R.24–25): - Establish mechanism to ensure adequate, accurate, timely BO information on all legal persons and arrangements accessible to competent authorities. - Assess ML/TF risk of SAS and consider AML/CFT measures for high-risk company types. - Adopt specific risk-based measures for high-risk fiduciary services (real estate fiduciae, fiduciae under warranty, administration fiduciae). ### INTERNATIONAL COOPERATION, MLA, EXTRADITION AND FIU EXCHANGE (IO.2; R.36–40) - MLA and extradition: - DGI received 2,351 MLA requests from 45 countries (2012–June 2017). Primary senders: Ecuador 332; Peru 295; Spain 255; United States 237; Panama 209; Mexico 172. - DGI sent 1,546 requests to 58 countries; primary recipients: United States 553; Spain 163; Ecuador 130; Panama 125; Venezuela 107. - Incoming extradition requests 2011–2017: total 1,415; executed 1,125 (average 80 percent). Incoming extradition main source: United States 837 requests. - Average MLA response time by 2016: six months (five months for ML requests); some fast replies in less than 30 days. - UIAF international activity: - UIAF signed 545 MOUs with foreign counterparts; Egmont Group member since 2000. - UIAF information exchanges (2012–June 2017): Requests to Colombia total 573; Requests from Colombia total 245. - UIAF received 560 information requests from foreign counterparts (2012–June 2017) and sent 21 spontaneous disclosures during same period. - Operational cooperation and platforms: - National Police: extensive international networks; over 167,000 messages via INTERPOL since 2010. - Colombia participates in RRAG (GAFILAT Assets Recovery Network) and other regional platforms; FGN made 17 active RRAG requests by 2016. - Limitations: - DIAN internal procedures for international cooperation were inadequate at time of onsite visit (post-visit DIAN approved Procedure PR-IC-0356). - BO information limitations affect timely responses to specific foreign requests for BO. - Immediate Outcome 2 effectiveness: - Colombia achieved a substantial level of effectiveness for IO.2. - Recommended priority actions (IO.2 / R.36–40): - Strengthen DIAN procedures for processing international cooperation requests and safeguarding confidentiality. - Strengthen DIAN capacity to provide international cooperation on BO information. ### EFFECTIVENESS RATINGS (Immediate Outcomes) - IO.1 Risk, policy and coordination: Substantial - IO.2 International cooperation: Substantial - IO.3 Supervision: Moderate - IO.4 Preventive measures: Moderate - IO.5 Legal persons and arrangements: Moderate - IO.6 Financial intelligence: Substantial - IO.7 ML investigation and prosecution: Low - IO.8 Confiscation: Substantial - IO.9 TF investigation and prosecution: Low - IO.10 TF preventive measures and financial sanctions: Moderate - IO.11 PF financial sanctions: Low ### TECHNICAL COMPLIANCE RATINGS (selected) - R.1 – LC - R.2 – LC - R.3 – C - R.4 – LC - R.5 – LC - R.6 – C - R.7 – C - R.8 – PC - R.9 – C - R.10 – PC - R.11 – C - R.12 – PC - R.13 – LC - R.14 – LC - R.15 – PC - R.16 – PC - R.17 – PC - R.18 – PC - R.19 – LC - R.20 – PC - R.21 – LC - R.22 – PC - R.23 – NC - R.24 – LC - R.25 – PC - R.26 – LC - R.27 – LC - R.28 – LC - R.29 – C - R.30 – LC - R.31 – LC - R.32 – PC - R.33 – PC - R.34 – LC - R.35 – LC - R.36 – LC - R.37 – PC - R.38 – PC - R.39 – LC - R.40 – LC ### PRIORITY ACTIONS (preserved) - Extend NRA scope to analyze tax evasion, foreign threats, cross-border flows, SAS misuse, and other high-risk issues. - Articulate a national AML/CFT policy with objectives, timeline, responsibilities, monitoring mechanism and comprehensive statistics. - Improve implementation of risk-mitigating measures and fully extend AML/CFT requirements to sectors out-of-scope or partly out-of-scope (unregulated lenders, internet casinos, real estate intermediaries, lawyers, accountants, dealers in precious metals and stones). - Fully implement risk-based supervisory systems for all financial institutions and DNFBP sectors, including onsite inspections and cross-border supervision. - UIAF to support LEAs’ ML/TF investigations to a greater extent and systematically provide STR quality feedback. - Establish mechanism to maintain accurate and updated BO information accessible to competent authorities. - Widen ML investigations beyond drug trafficking to include other high-risk predicate offenses identified in NRAs. - Enhance use of legal measures to combat TF and require natural/legal persons (not only reporting entities) to implement UNSCRs on TF and PF for WMD. - Strengthen capacity to provide international cooperation on BO information. *Source: Detailed Assessment Report (evaluation based on the 2012 FATF Recommendations using the 2013 Methodology; onsite visit from June 5 to 22, 2017).* ### EXECUTIVE SUMMARY __________________________________________________________________________ 9 ### EXECUTIVE SUMMARY ### KEY FINDINGS - This report summarizes the AML/CFT measures in place in Colombia as at the date of the onsite visit (June 5 to 22, 2017). It analyzes compliance with the Financial Action Task Force (FATF) 40 Recommendations and the effectiveness of Colombia’s AML/CFT system, and provides recommendations to strengthen the system. - Colombia has an reasonable understanding of its main domestic money laundering/terrorist financing (ML/TF) risks. The country’s understanding of risks relies particularly on the results of the 2013 and 2016 National Risk Assessments (NRAs). - The 2016 NRA has yielded reasonable findings with respect to the identification of the main ML threats and vulnerabilities. - The AML/CFT supervisory systems and tools are not entirely in line with the risk-based approach (RBA), and there are significant gaps in the supervision of designated non-financial businesses and professions (DNFBPs). - Colombia investigates and prosecutes ML effectively, but not in a manner that is commensurate with its ML risks. - The main TF threat in Colombia is the proceeds-generating criminal activity of domestic organized armed groups (Grupos Armados Organizados—GAOS). The primary source of funds for domestic criminal organizations are drug trafficking and other criminal activities. - The financial intelligence produced by the Financial Analysis and Information Unit (Unidad de Información y Análisis Financiero—UIAF) is generally a key input to initiate investigations regarding predicate offenses and tracing assets, specially such financial intelligence generated upon the request of the Fiscalía General de la Nación (FGN—Public Prosecutor ́s Office). However, while the FGN uses most of the UIAF’s disseminations for preliminary inquiries, the financial intelligence disseminated spontaneously by the UIAF has led to less ML cases and no TF cases. - There are significant deficiencies in the customer due diligence (CDD) framework and its implementation, as well as the enhanced risk mitigation measures under the existing AML/CFT framework that negatively impact the overall effectiveness of preventive measures. - The UIAF can accede to various types of financial information that allows it to produce financial intelligence of good quality. - Overall, financial institutions have a reasonable understanding of ML risks and of AML obligations. DNFBPs, except for casinos, have a lower level of awareness of ML/TF risks and obligations than financial institutions. - Confiscation and asset forfeiture are pursued as a priority policy objective. Law enforcement agencies (LEAs) are well trained and have adequate skills and resources to trace and recover proceeds of crime (POC). Asset forfeiture (extinción de dominio) is being applied with important results. Colombia has an effective system for managing the POC as well. - Colombia has a legal framework to apply targeted financial sanctions (TFS) related to TF, but its framework for TFS related to the financing of proliferation of weapons of mass destruction (WMD) has technical and operational deficiencies. - While basic information of legal persons is updated annually and accessible in the public registries and supervisors´ databases, the authorities have difficulty obtaining accurate and up-to-date information on the beneficial ownership (BO) of complex corporate structures and when there is foreign ownership or control involved. - Overall, Colombia provides timely, good quality, and constructive mutual legal assistance (MLA) and extradition. Its approach to international cooperation is proactive and collaborative. Constructive international cooperation is provided timely both upon request and spontaneously. ### RISKS AND GENERAL SITUATION - Colombia’s main ML threat comes from organized crime groups. - The most vulnerable sectors are: - banking, - gold mining, - lawyers, - real estate, - accountants, - statutory auditors (revisores fiscales), - auditors, - the real sector. - Overall, financial institutions (banks, securities, and insurance firms, as well as savings and loans cooperatives) have a good understating of ML risks. - DNFBPs generally have a lower level of understanding of ML risks than financial institutions, while both appear to have less understanding of TF risks. - An RBA to AML/CFT supervision has been applied to varying degrees, and is the most advanced in the case of the Financial Superintendent of Colombia (Superintendencia Financiera de Colombia—SFC). Other supervisory agencies are still in the process of developing adequate supervisory frameworks and cannot yet demonstrate effectiveness in mitigating risks. - The main TF threat in Colombia is the proceeds-generating criminal activities of GAOS. GAOS have used drug trafficking, kidnapping, extortion, and other crimes as sources of income. - While the authorities deem the risk for TF as medium to high, the assessment of TF risk in the NRA is insufficient. - While there is better understanding of TF risks by LEAs, the TF factor is not sufficiently considered by supervisory agencies and awareness of TF risks affecting their sectors is generally low. ### ASSESSMENT OF RISKS, COORDINATION AND POLICY SETTING (Chapter 2—IO.1; R.1, R.2, R.33) - The report assesses Colombia’s risk identification, coordination, and policy-setting framework against Immediate Outcome 1 and Recommendations 1, 2, and 33, drawing on the 2013 and 2016 NRAs as primary inputs. - Key issues identified include gaps in supervisory alignment with the RBA, limited DNFBP supervision, and insufficient integration of TF risk into supervisory practices. *Source: EXECUTIVE SUMMARY — Colombia AML/CFT detailed assessment, onsite visit June 5 to 22, 2017.* ### 16. Colombia has made significant efforts to identify, asses, and understand its ML/TF risks. ### 16. Colombia has made significant efforts to identify, asses, and understand its ML/TF risks. ### Overview of ML/TF risk assessment and national coordination - The main agencies responsible in the fight against ML/TF have a good understanding of the main threats that Colombia faces. - The country's understanding of the risks is mainly based on the results of the 2013 and 2016 NRAs, which broadly address the main threats and vulnerabilities. - The NRAs confirmed authorities’ view on the main domestic ML/TF threats but: - did not factor in other relevant threats nor properly assess other existing risks in the country (i.e., risks associated with simplified joint stock companies (sociedades anónimas simplificadas—SAS), tax evasion, threats derived from the informal sector, and threats of foreign origin, among others). - National coordination and cooperation on AML/CFT at a policy level has improved since the last mutual evaluation in 2008 and is relatively sound; operational cooperation is partially fragmented and inadequately coordinated. - AML/CFT policies include an articulated strategy to strengthen the AML/CFT regime and broadly address the main ML/TF risks, but specific measures based on the 2016 NRA had not yet been implemented at the time of the report. ### Financial intelligence (UIAF) — IOs 6–8; R.3–4, R.29–32 - The UIAF conducts high-quality operational and strategic analysis and supports LEAs, spontaneously and upon request. - Despite collaboration, spontaneously disseminated financial intelligence has resulted in a limited number of ML and predicate crime investigations and none for TF. - UIAF supports LEAs in asset forfeiture cases and existing ML investigations. - UIAF capabilities: - Access to a wide range of information sources. - Authority to request any information from reporting entities and other relevant authorities regarding ML/TF. - Effective process for prioritizing and analyzing suspicious transaction reports (STRs). - Factors limiting efficient use of financial intelligence: - Poor quality of STRs from certain reporting entities. - Inexperience of certain reporting entities regarding reporting obligations. - Insufficient reporting by some DNFBPs. - UIAF makes significant effort to verify and analyze STR information along with its own databases. ### ML investigation and prosecution (IO.7) - Authorities can investigate and prosecute ML through a wide range of legal tools and well-resourced investigative bodies. - Most cases involve simple ML schemes comprising low amounts of funds. - Most ML cases investigated and prosecuted are related to illegal drug trafficking; few involve ML originating from other predicate crimes. - The number of ML investigations and prosecutions is rising but remains insufficient given Colombia’s ML risk profile. ### Confiscation and asset forfeiture (IO.8) - Colombia has a robust legal framework for confiscating and forfeiting POC; confiscation is a priority policy objective. - LEAs are skilled, trained, and sufficiently resourced for tracing and recovering instrumentalities and POC. - Common ML technique: physical transportation of proceeds of drug trafficking such as cash and bearer negotiable instruments (BNIs). - Nondeclared and nondisclosed cross-border currency is routinely seized and confiscated. - Authorities pursue proceeds and instrumentalities through criminal confiscation and asset forfeiture mechanisms. - Asset forfeiture is applied effectively with important results; proceedings are autonomous and independent from criminal prosecution. - Areas for improvement: - Confiscation of proceeds moved to other countries. - Repatriation of assets. - At time of onsite visit, no cases of sharing confiscated proceeds with foreign counterparts. - Colombia has an effective system for managing POC and seizes currency falsely declared or not disclosed during cross-border movements. ### Terrorist financing (TF) and proliferation financing (PF) — IOs 9–11; R.5–8 - High domestic TF risk indicated by significant number of terrorist acts. - TF offense investigated and prosecuted to a limited extent; some significant TF convictions exist but number of standalone TF investigations and prosecutions is small relative to threat magnitude. - NPOs: - Registration regime established. - Risk-based supervision or monitoring for CFT is lacking. - Colombia has not identified the subset of organizations falling under the FATF definition nor the features/types of NPOs likely at risk for TF abuse. - Sanctions and freezing: - Legislation requires circulation of UN sanctions lists and freezing through judicial proceedings under the Asset Forfeiture Law (AFL). - Authorities had not received notifications relating to assets/funds belonging to persons designated pursuant to UNSCRs and had not designated any person under UNSCRs 1267 or 1373. - AFL can only be applied to assets linked to criminal offenses; cannot be applied to assets of persons/entities designated by the UN in PF lists. ### Preventive measures (IO.4; R.9–23) - Significant gaps in the legal framework negatively impact effective implementation of preventive measures. - Postal transfer operators (PTOs) are not explicitly listed as reporting entities and thus not legally required to apply AML/CFT measures, including CDD. - Shortcomings regarding identification and verification of beneficial owners; no requirement to collect BO information in all cases. - Regulatory framework shortcomings exist, yet many financial institutions and DNFBPs classified as reporting entities generally apply adequate risk mitigating measures for: - PEPs, correspondent banking, new technologies, wire transfer rules, and TFS related to TF. - Financial institutions generally understand obligations under SARLAFT or equivalent systems, including enhanced due diligence and record-keeping. - Shortcomings identified with respect to reporting attempted transactions among financial institutions and DNFBPs. - Several DNFBP categories are not considered reporting entities and are not subject to AML/CFT obligations. ### Supervision (IO.3; R.26–28, R.34–35) - Supervisors’ understanding of ML/TF risks is evolving; most are well informed of main ML threats but less aware of TF risks. - None of the risk-based supervisory models specifically assess exposure to TF; most supervisors emphasize domestic threats and inadequately account for foreign-sourced risks. - Licensing regime including fit and proper checks is robust for Colombian nationals but less stringent for foreign beneficial owners. - Scope limitations in AML/CFT legal framework for financial institutions and most DNFBP sectors constrain supervisors’ understanding and effectiveness. - Many lawyers, accountants, real estate agents, and dealers in precious metals and stones (except for gold) are outside AML/CFT scope. - Application of proportionate and dissuasive sanctions across sectors is generally weak; greater reliance on warning letters than on more stringent administrative sanctions and fines. - SFC has improved its risk-based framework for offsite and onsite AML/CFT supervision; other supervisors are still developing systems. - Supervisors face challenges adapting to integration of ex-FARC members into the formal financial system, including control of credit unions. ### Transparency of legal persons and arrangements (IO.5; R.24–25) - Basic information of all legal persons held by registries is publicly available and updated every year by legal entities. - Back-up documents kept by registries are not public but are easily obtained by authorities when requested. - Shareholder information of legal persons is easily and timely obtained by authorities using public registries, books of shareholders, and supervisors’ databases. - BO information: - Partially available: authorities can obtain BO information for simple corporate structures, but face limitations for complex corporate structures and when foreign ownership or control is involved. - Measures adopted to prevent misuse of legal persons include strict regulations, supervision, powers of supervisors, and easy access to information of legal persons. - Bearer shares are not allowed. - Currently, 54 percent of the commercial companies are SAS, which only require a simple private document for creation. - ML/TF risks arising from SAS have not been analyzed by authorities. - Fiduciae: - Important financial market; only licensed fiduciary companies (26) can provide fiduciary services. - All information on participants and terms of fiduciae must be updated in SFC registries. - Fiduciary services face a high ML risk, but there are no requirements for enhanced AML/CFT mitigation measures specific to this sector beyond regular obligations for financial institutions; specific measures depend on internal rules of each fiduciary company. ### International cooperation (IO.2; R.36–40) - Colombia has a robust legal and institutional framework allowing competent authorities to provide constructive, good quality, and timely MLA and extradition. - Approach to international cooperation is proactive and collaborative; cooperation provided upon request and spontaneously. - LEAs’ procedures for protecting information, prioritizing, and executing international cooperation requests are in place and adequate. - Colombia regularly submits extradition requests relating to ML, TF, terrorism, and asset forfeiture. - Financial supervisory authorities, UIAF, and other LEAs exchange information with foreign counterparts and implement confidentiality protection measures. - Implementation of international cooperation procedures of DIAN could be further improved. - Colombia can identify and exchange basic information on domestic legal persons and arrangements; shortcomings in BO availability limit ability to respond timely to specific foreign requests for BO information. ### Priority Actions - Extend the scope and approach of the NRA to provide for a more in-depth ML/TF threat and vulnerability analysis to cover additional areas (e.g., tax evasion, foreign threats, and cross-border financial flows, among others). - Articulate a national AML/CFT policy with clear objectives, timeline, and allocation of responsibilities, as well as a mechanism to monitor/measure progress, and maintain more comprehensive statistics. - Improve implementation of risk mitigating measures, including for enhanced measures, and fully extend AML/CFT requirements to sectors that are completely or partly out-of-scope, including unregulated lenders, internet casinos, real estate intermediaries, lawyers, accountants, and dealers in precious metals and stones. - Fully implement the risk-based supervisory systems for all financial institutions and DNFBP sectors, including with respect to onsite inspections and cross-border supervision of financial groups. - The UIAF should support the requirements of LEAs for ML/TF investigations to a greater extent. - The UIAF should systematically provide feedback to supervisors and reporting entities regarding the quality of STRs. - Establish a mechanism to maintain accurate and updated information on beneficial owners readily available to competent authorities. - Colombia should widen the scope of ML investigations to extend to cases where the underlying criminal activities are different from drug trafficking, at least to those indicated as a high risk in the NRA. - Enhance the use of available legal measures to combat TF offense and not rely only on alternative judicial measures to tackle TF activities. - Require physical and legal persons, not only reporting entities, to implement the UNSCRs on TF and PF for WMD. - Colombia should strengthen its capacity to provide international cooperation on BO information. ### Effectiveness Ratings (High, Substantial, Moderate, Low) - IO.1 Risk, policy and coordination: Substantial - IO.2 International cooperation: Substantial - IO.3 Supervision: Moderate - IO.4 Preventive measures: Moderate - IO.5 Legal persons and arrangements: Moderate - IO.6 Financial intelligence: Substantial - IO.7 ML investigation and prosecution: Low - IO.8 Confiscation: Substantial - IO.9 TF investigation and prosecution: Low - IO.10 TF preventive measures and financial sanctions: Moderate - IO.11 PF financial sanctions: Low ### Technical Compliance Ratings (C, LC, PC, NC) - R.1 – Assessing risk and Applying Risk-Based Approach: LC - R.2 – National Cooperation and Coordination: LC - R.3 – Money Laundering Offence: C - R.4 – Confiscation and Provisional Measures: LC - R.5 – Terrorist Financing Offence: LC - R.6 – Targeted Financial Sanctions—Terrorism and Terrorist Financing: C - R.7 – Targeted Financial Sanctions—Proliferation: C - R.8 – Non-Profit Organizations: PC - R.9 – Financial Institution Secrecy Laws: C - R.10 – Customer Due Diligence: PC - R.11 – Record Keeping: C - R.12 – Politically Exposed Persons: PC - R.13 – Correspondent Banking: LC - R.14 – Money or Value Transfer Services: LC - R.15 – New Technologies: PC - R.16 – Wire Transfers: PC - R.17 – Reliance on Third Parties: PC - R.18 – Internal Controls and Foreign Branches and Subsidiaries: PC - R.19 – Higher-Risk Countries: LC - R.20 – Reporting of Suspicious Transactions: PC - R.21 – Tipping-off and Confidentiality: LC - R.22 – DNFBPs: Customer Due Diligence: PC - R.23 – DNFBPs: Other Measures: NC - R.24 – Transparency and BO of Legal Persons: LC - R.25 – Transparency and BO of Legal Arrangements: PC - R.26 – Regulation and Supervision of Financial Institutions: LC - R.27 – Powers of Supervision: LC - R.28 – Regulation and Supervision of DNFBPs: LC - R.29 – Financial Intelligence Units: C - R.30 – Responsibilities of Law Enforcement and Investigative Authorities: LC - R.31 – Powers of Law Enforcement and Investigative Authorities: LC - R.32 – Cash Couriers: PC - R.33 – Statistics: PC - R.34 – Guidance and Feedback: LC - R.35 – Sanctions: LC - R.36 – International Instruments: LC - R.37 – Mutual Legal Assistance: PC - R.38 – Mutual Legal Assistance: Freezing and Confiscation: PC - R.39 – Extradition: LC - R.40 – Other Forms of International Cooperation: LC *Source: Detailed Assessment Report (evaluation based on the 2012 FATF Recommendations using the 2013 Methodology; onsite visit from June 5 to 22, 2017).* ### 27. Colombia is situated northeast of South America and with a land area of 1,038,700 km ### 27. Colombia ### Geography and Demographics - Land area: 1,038,700 km2 - Borders: Caribbean Sea, North Pacific Ocean; neighbors Brazil, Ecuador, Panama, Peru, and Venezuela. - Population: 49,210,124 (2017 estimate) - Official currency: Colombian peso (COP) - Political-administrative structure: unitary republic organized in 32 districts beside the capital city of Bogota. - Legal system: civil law jurisdiction. ### Governance and Institutional Framework - Executive: President elected by direct popular vote for a one four-year term on a single ticket with his vice president; president is head of government and chief of state and appoints ministers and directors of departments. - Legislature: Bicameral — Senate and House of Representatives directly elected to four-year terms. - Judiciary: Judicial power vested in four high courts: - Supreme Court of Justice (14 judges for civil and criminal matters) - Constitutional Court (9 magistrates) - Council of State (31 members for administrative law) - Superior Judiciary Council (13 magistrates) ### Overview of ML/TF Risks - Prime ML threat: organized crime groups operating inside the country and abroad, including proliferation of Colombian organized crime groups that commit crimes for hire (e.g., assassinations, kidnappings, and terrorist acts) and “oficinas de cobro” (collecting agencies). - Main predicate offenses for ML identified in the 2016 NRA: illegal drug trafficking, smuggling, human trafficking (i.e., smuggling of migrants), illegal gold mining, corruption, and extortion. - Criminal organizations referenced: GAOS, criminal drug trafficking networks, criminal gangs (bandas criminals—BACRIM), and others. - Sectors facing the highest risks for ML (2016 NRA): banking, real estate, gold mining, lawyers, notaries, accountants, and auditors. Key quantified estimates and findings - Authorities’ estimate of money laundered: 5.4 percent of GDP. - World Bank study estimate of assets laundered: 7.5 percent of GDP. - Domestic coca production estimated value: around US$2 billion annually (mainly from growers selling coca paste or base to regional terrorist groups). - Distribution of Colombian-produced cocaine: 55 percent goes to markets in North America, and the remaining goes to Europe. - The 2,219 km2 Colombia–Venezuela border region noted as a center for black market product movement. - Reported extortion cases (FGN) during 2008–2014: 33,225 cases. International and cross-border ML/TF channels highlighted - Use of casinos, postal money order market, bulk cash smuggling, wire transfers, remittances, electronic currency, and prepaid debit cards to repatriate illicit proceeds to Colombia. - International trade used for counterfeiting and smuggling; counterfeit and smuggled goods available in well-established black markets in most major Colombian cities. - Smugglers resort to bribes to facilitate transport across borders. Terrorist financing (TF) and resource sources - Main TF threat: proceeds-generating criminal activities from the two largest GAOS. - Illegal mining (gold, emeralds, tungsten) identified as a key income source for GAOS; value of illegal gold exports said to exceed the value of cocaine exports. - Authorities’ estimate: roughly 50percent of Colombian mines are illegal and many dominated by various armed groups. - GAOS and BACRIM involvement: most areas where illegal gold mining takes place. - TF facilitated through ML in areas controlled by GAOS and organized criminal groups. - Extortion identified as rising and a main source of income for GAOS, BACRIM, and common criminals. ### Country Risk Assessment and Scoping of Higher-Risk Issues - Colombia updated its NRA following a four-month exercise concluded in December 2016; 2016 NRA led by UIAF, the Minister of Justice, and the University of Rosario; approved in January 2017 by the Inter-Agency Coordination Committee for the Control of ML (CCICLA). - 2016 NRA utilized a revised methodology based on the one implemented in 2013; complemented by a sectoral level assessment finalized in early June 2017. - TF risks: addressed through other national confidential policies by national intelligence agencies; assessment team did not have access to these policy documents. - Dissemination of NRA findings: shared with exercise participants; only the executive summary shared with broader private sector community. - No evidence at time of onsite assessment that concrete policies and implementation actions were taken to address identified ML/TF risks. Assessment team priorities (issues given increased attention) - Efforts to prevent and combat laundering of proceeds of drug trafficking, corruption and tax evasion as a criminal offense. - Exposure of the Colombian economy to risks from cross-border ML and TF transactions, including through: cash smuggling, wire-transfers, remittances, and domestic PEPs transferring funds out of Colombia. - Effectiveness of supervision, adequacy of tools, and scope of supervisory work, particularly for banks, foreign currency houses, real estate sector and money remitters. - Degree to which Colombia has been successful at combating TF. Lower-risk sectors - Insurance and securities sectors assessed as lower risk and not a priority focus. ### Materiality and Economic Context - Colombia is Latin America's fourth largest economy measured by GDP. - GDP: US$292.1 billion as of 2015. - Gross National Income per capita: around US$8,000. - Economic composition as percent of GDP: service activities (56 percent), manufacturing industry (38 percent), and agriculture (6 percent). - Natural resource and export profile: - Substantial oil reserves. - Major producer of gold, silver, emeralds, platinum and coal. - World's fourth largest coal exporter and Latin America's fourth largest oil producer. - Economy heavily dependent on energy and mining exports. Financial system and inclusion metrics - Financial system assets: rose from about 60 percent percentpercentof GDP in 2000 to about 160 percent of GDP in 2016. - Credit granting institutions (mostly banks) account for about half of financial system assets; non-banks (largely private pension funds, trust companies, and insurance companies, among others) hold the balance. - Market concentration: Three domestic complex conglomerates hold about 80 percent of total financial sector assets. - Financial institutions count: 23 commercial banks; other institutions include 4 financial corporations, 22 finance companies, 6 cooperatives, and 11 special official institutions. - State role: official financial institutions are second-tier banks and account for seven percent of gross financial system assets. - Financial inclusion: reached 72.5 percent in 2014; sustained increase since 2011. - Informal sector employment: decreased from 51.30 percent to 47.20 percent between 2011 and 2015. - Share of cash to GDP: increased from 4.49 percent to 5.58 percent in 2011–2015 period, reflecting increased availability of cash. Real estate and DNFBP exposure - Real estate sector asset value: around US$18.6 billion (Superintendence of Companies). - Residential property price increases (2005–mid-2016) in Bogota, Cali, Medellin: around 200 percent in nominal terms (110 percent in real terms). - Real estate transactions present a high ML risk; potential facilitation by criminally inclined real estate brokers, lawyers, notaries, and accountants. - Professional counts: around 1,000 real estate firms, 280,000 lawyers, 900 notaries, and 250,000 accountants. ### Structural Elements, Background, and Other Contextual Factors - Structural elements for AML/CFT: most present in Colombia — stable democratic institutions, clear division of powers, political and institutional stability, accountability, transparency, and rule of law. - Improvements: remarkable improvement of internal security over past 15 years, extended state presence across territory. - Challenges: optimal operation of courts undermined by corruption and extortion; corruption compromises fight against drug trafficking and other crimes. - Informal economy dimension: - High levels of employment in informal sector: 47 percent of workers conducting activities outside governmental regulation (est. 2015). - Financial inclusion sustained increase since 2011, reaching 75 percent in 2015. - Cash to GDP rose from 4.49 percent to 5.58 percent in 2011–2015. Risks related to FARC demobilization and other armed groups - Risk of FARC members becoming criminal organizations after demobilization appears very high. - 2016 peace agreement objective: major reduction in terrorist and associated organized criminal activities; concern that dissident FARC members could continue crimes from transition camps. - Other criminal groups replacing FARC in control of coca fields, illicit gold mines, and other criminal activities. - Curtailment of coca cultivation has made it more profitable. - Integration of former FARC members into formal sector poses compliance and risk management challenge for financial institutions, DNFBPs, and supervisors. - ELN reportedly continues criminal activities despite exploratory peace talks. ### Box 1 — Implications of FARC Peace Process - Special Jurisdiction for Peace (Jurisdicción Especial para la Paz): - Will exercise judicial functions as part of the Integral System of Truth, Justice, Reparation, and Non-Repetition. - FARC members cannot be sentenced to more than eight years if they fully cooperate with investigations and acknowledge their criminal responsibilities. - Those failing to come forward and subsequently declared guilty by the Tribunal for Peace will be convicted to prison terms of up to twenty years in ordinary enforcement conditions. - FARC assets and reparation of victims: - FARC will provide an inventory of all assets to representatives of the national government with full information disclosure. - Such assets will be used to provide material reparation to victims within the framework of the integral reparation measures. - FARC drug trafficking and political crime considerations: - Earnings from drug trafficking used to fund rebellion considered a political crime; extradition requests may be refused by the Colombian government. - Each drug trafficking case will be reviewed separately to confirm funds were deployed in the rebel cause and not for personal enrichment. - Any cases of personal enrichment will be tried under normal criminal jurisdiction. - Those involved in drug trafficking must disclose all routes, contacts and inner workings to qualify to be tried under the Special Jurisdiction for Peace. - Amnesties and pardons: - Colombia’s Constitution allows granting amnesties or pardons for the political crime of rebellion and certain crimes related to it. - An Amnesty Law will determine behaviors not eligible for amnesty based on criteria including: (i) Crimes specifically related to advance the rebellion; (ii) Crimes in which the passive subject of the conduct is the State; and (iii) Behaviors aimed at facilitating, supporting, financing or concealing the rebellion. *Source: IMF country assessment text for Colombia (excerpts provided).* ### 44. Corruption in Colombia is a pervasive problem. ### 44. Corruption in Colombia is a pervasive problem. ### Corruption and its impact - Large patronage networks are particularly established in the public contracting sector. - The government has generally implemented anti-corruption laws effectively, but there have been some instances of impunity reported. - The justice system is undermined by corruption and extortion as irregular payments and bribes are often exchanged to obtain favorable court decisions. - The Constitutional Court and the Supreme Court are perceived to act independently. - Corruption compromises Colombia’s fight against drug trafficking and other crimes. - Proceeds from corruption are thought to be around US$7.5 billion every year, which is almost 10p ercent of the government’s 2017 budget. - In the 2016–2017 Global Competitiveness Index, the World Economic Forum noted that corruption was the second most problematic factor in doing business in Colombia. ### Overview of AML/CFT strategy and policy documents - Policies and objectives are established in the National Development Plan (2014–2018). - CONPES document 3793—the National Anti-Money Laundering and Counter-Terrorism Financing Policy—was approved in December 2013 and establishes guidelines to strengthen prevention, detection, investigation, and prosecution of ML and TF. - Key aims of CONPES 3793: - (i) increasing the participation of the public sector as reporting entities to the UIAF; - (ii) increasing the protection of the real sector of the economy; - (iii) improving the quality of information, data and statistics, particularly in the field of financial intelligence; - (iv) strengthening research capacity and the effectiveness of the judiciary; - (v) strengthening the regulations and supervisory frameworks; - (vi) promoting cultural values in favor of legality. - The CONPES policies address in general terms the ML/TF risks identified in the 2013 NRA. Although all activities included in the CONPES Action Plan have been completed, the policies remain in effect until a new AML/CFT policy is approved. ### Legal and institutional framework — ministries and coordinating committees - Inter-Agency Coordination Committee for the Control of ML (CCICLA) leads public policy processes related to AML/CFT; chaired by the Minister of Justice and Law; Technical Secretariat carried out by the UIAF. - CCICLA’s mandate includes supporting relevant agencies with AML/CFT responsibilities and ensuring effective cooperation and coordination among agencies. - Ministry responsibilities: - Ministry of Justice and Law (MINJUS): public policy relating to the legal system, justice, legal security, asset forfeiture rules, and destination of seized and forfeited assets. - Ministry of National Defense: participates in national defense and security policy definition and execution. - Ministry of Information and Communication Technologies (MINTIC): regulates and supervises PTOs in relation to postal payment services. - Ministry of Foreign Affairs (MINREX): publishes lists of entities and persons associated with terrorist organizations and proliferation of WMD. ### Criminal justice and operational agencies - National Intelligence Directorate (DNI): main intelligence agency; successor to DAS; tasks include gathering and analyzing intelligence for national security, prevention, detection, monitoring, and control of ML and TF. - Public Prosecutor’s Office (FGN): initiates criminal proceedings; includes the National Unit of Asset Forfeiture and Against the Laundering of Assets; central authority for UN conventions on criminal matters and bilateral criminal treaties. - Financial Analysis and Information Unit (UIAF): country’s financial and economic intelligence unit; member of the Egmont Group of Financial Intelligence Units. - National Police: coordinates investigations; specialized investigative directorates include DIJIN, DIPOL, Anti-Narcotics Directorate, POLFA; includes Investigative Group for Asset Forfeiture and ML. ### Financial sector supervisors and DNFBP supervisors - National Tax and Customs Office (DIAN): supervises currency exchange firms to detect unusual/suspicious transactions; NPOs must register with DIAN for tax purposes. - Financial Superintendent of Colombia (SFC): regulates and supervises banks, insurance companies, securities firms, fiduciary (trust) companies, exchange intermediation and special financial services companies, financial cooperatives and other financial entities. - Superintendent of Solidarity-Based Economy (SES): supervises financial cooperatives that conduct savings and loans business only with their members. - Superintendent of Companies (Supersociedades): attached to Ministry of Commerce, Industry and Tourism; supervises commercial companies. - Superior Judiciary Council (CSJ): conducts administrative and disciplinary role of the Judiciary; regulates lawyers and maintains national registry of lawyers; CSJ was eliminated by constitutional reform 2015 with transitional functions continuing until new bodies are designated; Council is not a designated AML/CFT supervisor. - Superintendent of Notaries and Registry (SNR): inspects, monitors, and controls notaries; investigates and sanctions disciplinary offenses by notaries. - National Superintendent of Health (Supersalud): regulates and supervises NPOs related to the health sector. - Coljuegos: supervises casinos and other legal persons exploiting gaming professionally at the national level. - Coldeportes: registers and supervises professional sport clubs, leagues, and federations. - Confederación Colombiana de Cámaras de Comercio (Confecámaras): private body conducting delegated public functions, including maintaining the Single Business and Company Registry (RUES). ### Overview of financial sector and DNFBPs — counts and assets - More than 1,800 different entities are subject to the AML/CFT framework. - The SFC is an omnibus regulator responsible for all the core principles financial institutions and most other non-bank financial institutions and fiduciary (trust) companies, totaling some 418 entities. - These financial institutions account for most of the financial assets in the system. - Selected figures from sectoral tables: - Total Financial Institutions: 391; Assets in Col$ 370,625,802,832.82; Assets in US$ 129,613,749.47 - Total (including Trust Companies): 418; Assets in Col$ 370,626,831,776.88; Assets in US$ 489,461,625.47 - Banks: 25; Assets in Col$ 193,698,500,147.83; Assets in US$ 67,739,317.37 - Bank of the Republic (Central Bank): 1; Assets in Col$ 60,707,052,389.15; Assets in US$ 21,230,181.37 - Pension and Unemployment Fund Management Companies: 4; Assets in Col$ 83,838,494,175; Assets in US$ 29,319,540.29 - Financial Cooperatives: 5; Assets in Col$ 1,013,302,800.65; Assets in US$ 354,377.73 - Other reporting entities by sector (Table 2) — total 1,418: - Fiduciary companies 2/: 26 - Casinos, bingos, sports betting agencies and virtual races (2015): 394 - Notaries (2016): 902 - Real estate agencies (2016) 3/: 28 - Mining and quarrying (2016) 3/: 49 - Legal Services (2016) 3/: 10 - Accounting services companies (2015) 3/: 9 - The SFC reports some 23,244 trusts under administration which excludes civil trusts. ### Preventive measures and legal persons - AML/CFT preventive measures are established by various legal provisions by reporting entity (examples): - Banks, Insurance, Securities intermediaries, Mutual funds, Pension fund managers, Fiduciary companies, Finance companies, other financial institutions: EOSF; SFC Circular 55/2016 (SARLAFT). - Savings and loans cooperatives: EOSF; SES Circular 4/2017; SES Circular 4/201-76. - Postal transfer operators: MINTIC Regulation 2564/2016. - Professional currency exchange firms: DIAN Circular 13/2016. - Real estate agencies, Law firms, Accounting firms: Supersociedades Legal Basic Circular—SAGRLAFT. - Notaries: SEN Administrative Instruction No. 17 of 2016. - Casinos: EOSF; Law 641/2001; CNJSA Agreement No. 317–2016; Coljuegos Resolution 20161200032334. - Types of legal persons that can be established in Colombia include: Joint Stock Company (Sociedad Anónima), Simplified Joint Stock Company (Sociedad Anónima Simplificada), Limited Liability Company (Sociedad de Responsabilidad Limitada), Limited Partnership with shares (Sociedad en Comandita por Acciones), Limited Partnership (Sociedad en Comandita Simple), Single Corporation (Empresa Unipersonal), General Partnership (Sociedad Colectiva), Civil Partnership (Sociedad Civil), Foundation (Fundación) and Association (Asociación). - The SAS (Simplified Joint Stock Company) is the preferred type of business entity; it requires only one director and shareholder who can be an individual or legal entity, of any nationality and residence. - Number of entities registered as of May 2017 (Table 4): - Joint Stock Companies (Sociedades anónimas): 5,431 - Foreign branches (Sucursales extranjeras): 615 - Limited liability companies (Sociedades de Responsabilidad Limitada): 2,832 - Limited partnerships (Sociedades en Comandita Simple): 399 - Limited partnership with shares (Sociedad en Comandita por acciones): 732 - General partnerships (Sociedad Colectiva): 8 - Single-Person Companies (Empresa unipersonal): 66 - Simplified Joint Stock Companies (Sociedad Anónima Simplificada): 11,807 - Civil Partnerships (Sociedades Civiles): 24,373 1/ - Foundations (Fundaciones): 17,822 1/ - Associations (Asociaciones): 22,620 1/ - Total: 86,705 (approx.) - 1/ Denotes number of entities registered with the DIAN. - Fiducia: Colombian law includes the fiducia (arrangement similar to common-law trust); there are some 23,244 fiduciae under administration. Fiduciary companies provide asset management services; most common use for fiduciae is for construction and real estate. ### Supervisory arrangements and sector coverage - SFC: omnibus financial sector supervisor for 418 institutions including banks, insurance companies, securities intermediaries, and other non-bank financial institutions. - SES: lead supervisor for 181 savings and loans cooperatives that only conduct business with their members. - MINTIC and DIAN supervise other financial institutions: MINTIC supervises five domestic payment operators (two can engage in cross-border business); all eight operators conduct business through 112 agents and around 27,800 customer service centers. DIAN supervises 1,263 licensed currency exchange firms. - Coljuegos supervises 383 licensed casinos and other games of chance at the national level; online casinos and betting operators are not yet under its full regulatory and supervisory control. - SNR supervises 902 notaries. - Superintendencia de Sociedades is designated supervisor for all registered companies and is responsible for AML/CFT supervision of a small number of legal and accounting firms, dealers in precious metals and real estate firms; only legal entities with annual revenues above relatively high thresholds are subject to the AML/CFT regime and supervision by Supersociedades. - New AML/CFT regulations for these DNFBPs will not come into full effect until end-2017. ### National AML/CFT policies and coordination — Key findings - The Colombian authorities have a reasonable understanding of the country’s main domestic ML/TF risks, which is evolving in the right direction. - The 2016 NRA has yielded reasonable findings with respect to the identification of the main threats and vulnerabilities, though its approach and scope could have been more comprehensive to provide a holistic picture of ML/TF risks, both domestic and foreign. - AML/CFT policies are informed by ML/TF risks identified by the authorities and generally track the risks identified in the 2013 NRA. - National coordination and cooperation on AML/CFT issues at a policy level has improved since the 2008 mutual evaluation and is strong; operational coordination could be further improved for some agencies. - Understanding of ML/TF risks is more advanced in the case of the SFC and uneven for other supervisory agencies. - The UIAF demonstrates an appropriate level of understanding of risks and has aligned its activities with its sectoral assessment. - LEAs and prosecutors have a good understanding of risks, but their activities are only partially aligned with identified ML/TF risks. - DNFBPs have a lower level of understanding of ML risks than financial institutions. - The level of understanding of TF risks is mixed across stakeholders: good among LEAs, less developed among financial institutions, DNFBPs, and most supervisory agencies. - On TF, activities and priorities of the responsible authorities (FGN with support from other relevant agencies) are broadly consistent with identified risks but have not yet achieved the expected results. ### Recommended actions - Continue to develop understanding of risks to provide a more in-depth ML/TF threat and vulnerability analysis covering additional areas such as tax evasion, all types of legal persons, overseas threats, cross-border financial flows, terrorism, TF risks associated with cash-intensive businesses, ML risks associated with corporate vehicles, and misuse of certain DNFBPs activities. - Set up a mechanism or process to act upon the results of the 2016 NRA and develop AML/CFT policies or strategies informed by the ML/TF risks recently identified. - Establish a system to enhance national AML/CFT coordination and cooperation at an operational level, including with respect to NPOs and the PF of WMD. - Ensure a robust system is in place to monitor progress and measure the effectiveness of the AML/CFT framework to facilitate prioritization of key risks and strategic allocation of resources. - Ensure activities and objectives of all relevant AML/CFT agencies are consistent with identified ML/TF risks and adjusted in line with evolving risks. - Strengthen communication and information sharing by competent authorities to ensure a better understanding of ML/TF risks by DNFBPs. - Increase the level of understanding of TF risks among financial institutions, DNFBPs and supervisory agencies. ### Assessment note - The relevant Immediate Outcome considered and assessed in this chapter is IO.1. The recommendations relevant for the assessment of effectiveness under this section are R.1–2. *Source: CR18314 — “44. Corruption in Colombia is a pervasive problem.”* ### 73. Colombia has made significant efforts to identify, assess and understand its ML/TF risks. ### cr18314-colombiadar - 73. Colombia has made significant efforts to identify, assess and understand its ML/TF risks. ### Overall assessment of ML/TF risk understanding - Colombia has made significant efforts; main AML/CFT agencies have a good understanding of the main threats affecting Colombia. - The country’s understanding of risks relies primarily on the results of the 2013 and 2016 NRAs. - Limitations identified: - Approach and scope used for a comprehensive/holistic ML/TF risk picture were limited. - Data gaps and lack of participation by some relevant agencies impacted the overall understanding of ML/TF risks. ### 2016 NRA: scope, findings, and limitations - Scope and primary findings: - The 2016 NRA assesses ML and TF national threats and vulnerabilities as of December 2016. - Main national ML threats identified: drug trafficking, corruption, illegal mining, smuggling, and human trafficking. - The report focused mainly on domestic predicate crimes and paid less attention to ML/TF risks arising from offenses committed abroad. - Methodology and participation: - The 2016 NRA involved government agencies and the private sector; a two-tiered coordination system was used (a “coordinating working group” with input from four thematic working groups). - Some key stakeholders had limited involvement (e.g., no participation from the DIAN or SFC in ML threat identification; limited participation in anti-corruption area). - In some instances the NRA reads as a collection of individual competent authority opinions rather than a single collective view. - Specific limitations and inconsistencies: - Sectoral assessments by the UIAF in 2017 show disconnects with the 2016 NRA (e.g., firearms trafficking identified by UIAF but not by 2016 NRA; migrant trafficking identified by 2016 NRA but not by UIAF sectoral assessment). - TF assessment in the NRA is not very developed; authorities consider TF risk as medium/high and intelligence agencies have addressed TF in confidential documents. - The NRA summarized numerical weights/scores assigned to threats, vulnerabilities, and sectors but did not properly justify assigned scores nor identify all high-risk activities, products, services, or delivery channels. ### Data, sources, and analytical gaps - Heavy reliance on qualitative information (private sector input, expert judgement) and insufficient quantitative analysis. - Uneven use of statistics relevant to ML; limited reliance on reliable and varied data sources. - Insufficient consideration of strategic analysis, law enforcement input, intelligence reports, operational cases, expert views, perception surveys, statistics on international cooperation or financial transactions. - Specific areas insufficiently examined: - Tax evasion and cash-intensive informal sector vulnerabilities. - Certain types of legal persons such as SAS and certain DNFBPs. - Threats from high-risk jurisdictions, cross-border financial flows, unregulated lenders, gatekeepers, complex corporate structures, misuse of DNFBP activities. - UIAF demonstrates appropriate understanding but focuses on its own sectoral findings rather than addressing all 2016 NRA risks (e.g., UIAF pays little attention to migrant trafficking, despite NRA identification). ### National policies, implementation, and exemptions - Institutional roles: - CCICLA is responsible for policy setting and national coordination for AML/CFT and risk assessment (UIAF acts as CCICLA technical secretary; CCICLA chaired by the Minister of Justice). - CCICLA elaborated jointly with CONPES the AML/CFT national policies. - Policy frameworks: - CONPES 3793 sets AML/CFT policies and strategy. - 2013 NRA and CONPES were developed simultaneously; CONPES 3793 could not consider all 2013 NRA results. - National Development Plan 2014–2018 and National Intelligence Plan include AML/CFT elements; FGN adopted a Prioritization Plan in 2015 addressing some TF risks. - Implementation status: - CONPES Action Plan activities have been completed, but current policies remain until a new AML/CFT policy is approved. - Specific measures based on the 2016 NRA have not yet been put in place due in part to recent report adoption and dependence on broader government decisions. - Some recommendations from 2013 NRA acted upon (e.g., UIAF sectoral assessment, Attorney General strategic plan 2016–2020, regulatory amendments), while other areas received little or no attention. - Exemptions and coverage gaps: - Colombia applies the AML/CFT framework to some non-standard sectors (freight transport, games of chance, transport of valuables, mining, car dealers, health, football teams, among others) but these applications do not appear to be based on risk assessments. - The AML/CFT framework does not apply to all DNFBPs; lawyers, accountants, and real estate agents are subject to AML/CFT only under limited circumstances; dealers in precious metals and stones are out of scope. - These exemptions are not supported by a risk assessment and constitute gaps given NRA findings. - Risk-based and simplified measures: - The SFC allowed financial institutions to apply simplified CDD measures under Circular 55/2016 for prescribed client categories, locations, and products; the analysis supporting simplified measures is based on an internal SFC ML/TF risk assessment driven by financial inclusion considerations. - Colombia has not formally identified any high-risk scenario requiring enhanced measures, although higher risk scenarios exist (e.g., high risk from cross-border linkages to domestic transfers, high-risk currency exchange firms, unregulated money lenders). ### Operational alignment, supervision, and sectoral responses - Operational focus and targeting: - Authorities are still focusing on some risks from the 2016 NRA; measures taken since 2013 include UIAF sectoral assessment and strengthening of preventive measures. - Day-to-day activities of relevant authorities appear partially targeted toward identified risks but often follow agency priorities rather than risk-based national priorities (see references to IO.3, IO.6, IO.7). - Supervisory landscape: - Risk-based approach (RBA) to AML/CFT supervision is evolving with varying implementation across supervisory agencies. - SFC shows a more advanced understanding and more robust risk-based supervisory tools for offsite supervision. - Other financial institution supervisors show uneven understanding; some DNFBP supervisors are developing RBA frameworks while others have not commenced. - Law enforcement and prosecutorial focus: - Agency plans focus more on combating predicate crimes; LEAs and prosecutors are mainly focused on certain offenses (primarily drug trafficking) with insufficient evidence of pursuing ML derived from other major predicate crimes. - TF-specific actions: - Responsible authorities (FGN with support from others) have a vast understanding of TF risks but their activities and priorities suggest alternative measures are applied. - No action yet to address risks associated with NPOs, MVTS, or cash couriers. - The Peace Agreement with the FARC is noted as potentially mitigating TF risk. ### Coordination, cooperation, and private sector awareness - National coordination: - CCICLA is the overarching coordination body but does not include other relevant authorities (i.e., supervisory agencies); it functions as a policy rather than operational coordination body. - Other coordinating mechanisms in practice: GILFOT; C3FTD; Inter-Agency Commission to combat smuggling; Committee to combat human trafficking. - Operational-level coordination is challenging due to many agencies with AML/CFT responsibilities; responses can be fragmented with agencies pursuing individual priorities. - No mechanism to monitor or measure effectiveness of coordination arrangements. - Interagency cooperation: - Effective communication and coordination between UIAF and LEAs. - Collaboration between UIAF and financial sector and DNFBP supervisors needs improvement to enhance STR quality. - Coordination on terrorism and TF is effective overall; FGN Prioritization Plan improved understanding and cooperation. Coordination on financing of WMD is less evident. - Private sector awareness and engagement: - Private sector representatives participated in the 2016 NRA; an executive summary of the 2016 NRA was published on the UIAF website and shared with participating entities. - Results were disseminated to private sector participants via UIAF meetings in May 2017. - Level of understanding among regulated private sector is uneven: - Most financial institutions and DNFBPs indicated participation in the NRA, but only the executive summary was made available, limiting understanding of underlying sources, causes, and detailed findings. - Some private entities found the NRA useful overall; others demonstrated little understanding of ML/TF risks present in the country. - Some entities consider fiduciary sector risks to be very high although the 2016 NRA identifies vulnerabilities without fully reflecting those concerns. *Source: cr18314-colombiadar - 73. Colombia has made significant efforts to identify, assess and understand its ML/TF risks.* ### 108. As far as the financial sector is concerned, overall, financial institutions are aware of ML ### 108. As far as the financial sector is concerned, overall, financial institutions are aware of ML ### Awareness of ML/TF risks and risk management systems - Financial institutions (banks, securities and insurance firms, and savings and loans cooperatives) have developed risk management systems in line with SARLAFT to identify, measure, control and monitor ML risks. - There is no supporting documentation that the measures developed and implemented by financial institutions are effectively mitigating the identified risks. - DNFBPs generally have a basic level of awareness of ML risks, partly due to recent regulations requiring risk management systems that came into effect at the end of September 2017. - Some DNFBP participants were only recently made aware of the results of the 2016 NRA. - Both financial institutions and DNFBPs appear to have little understanding of TF risks. - Additional time is needed for the private sector to establish mitigating measures in line with the 2016 NRA findings. ### Overall conclusion on Immediate Outcome 1 - Colombia has achieved a substantial level of effectiveness for IO.1. ### Immediate Outcome 6 — Financial intelligence: key findings - Financial intelligence is generally a key input to initiate predicate crime investigations and asset tracing, especially when generated at the request of the FGN; however, while the FGN uses the majority of UIAF disseminations in preliminary inquiries, it has conducted less ML cases and no TF cases. - The UIAF has access to a wide range of information sources and authority to request any information from reporting entities and other appropriate authorities regarding ML/TF, but additional efforts are needed to obtain timely access to information collected by the DIAN and from real estate agents, notaries, law firms, accounting firms, and BO information. - Limited and poor-quality reporting of suspicious transactions by DNFBPs—including by higher risk sectors—diminish the effectiveness of financial intelligence produced by the UIAF. ### Immediate Outcome 7 — Investigations and prosecutions: key findings - Colombia has the resources and legal provisions to investigate and prosecute ML effectively, but does not apply them commensurate with its ML risks; most pursued cases involve simple ML schemes with low amounts of funds, inconsistent with Colombia’s risk profile. - Current cases generally involve the predicate offense of illegal enrichment of individuals (illicit enrichment of nonpublic officials) with no evidence that investigations seek to trace the illicit activity behind this offense. - Limited experience exists in pursuing the ML component of other predicate crimes. - Some cases result in complex investigations conducted in coordination among different LEA agencies including the UIAF. - Most ML convictions have involved low amounts and simple ML schemes with proportionate and effective sanctions in those cases. - While authorities investigate and prosecute some officials for corruption, they do not appear to be pursuing corruption-related ML activities. - Legal persons are frequently misused in ML schemes, but the legal framework prevents them from being held criminally liable. - Colombia relies, with limited success, on alternative criminal justice measures to target financial structures of organized criminal activities. ### Immediate Outcome 8 — Confiscation and asset recovery: key findings - Confiscation is pursued as a priority policy objective. Competent authorities pursue proceeds through criminal confiscation and asset forfeiture mechanisms. - LEAs are skilled, well trained, and sufficiently resourced to trace and recover POC. - Asset forfeiture is being applied effectively with important results and is the most prevalent instrument used to deprive criminals of their assets. - There is room for improvement regarding conviction-based confiscation of property derived indirectly through the commission of an offense. - Positive and constructive cooperation exists between the FGN and LEAs, with periodic task forces and working groups to coordinate asset forfeiture proceedings. - Colombia has a sound legal framework allowing international sharing of assets, but there have been no cases involving sharing of confiscated proceeds with foreign counterparts. - Colombia seizes, forfeits, and confiscates currency falsely declared or not disclosed during cross-border movements; competent authorities have statistics on currency seized and currency moved across borders and apply effective, proportionate, and dissuasive sanctions for falsely or undeclared cross-border transactions of currency. - Colombia has effective systems for managing POC: Fondo para la Rehabilitación, Inversión Social y Lucha contra el Crimen Organizado (FRISCO) and Sociedad de Activos Especiales, SAS (SAE) manage a large number of assets of different nature and high value with important results; statistics maintained are comprehensive. - Confiscation generally aligns with the country’s risk profile for main threats but needs improvement regarding other high-risk offenses (extortion, smuggling, and illegal mining). - Available statistics on forfeited assets are comprehensive; statistical information on criminal confiscation is more limited. ### Recommended actions — Immediate Outcome 6 - Improve feedback mechanisms between UIAF and LEAs, and enhance UIAF’s capability to provide effective and proactive operational assistance to FGN and other LEAs so disseminated financial intelligence can serve as a key input to investigations and prosecutions of ML/TF and predicate offenses. - Expand UIAF’s access to relevant financial information sources such as information collected by the DIAN regarding written declarations of cross-border transportation of currency and BNIs, information regarding lawyers, accountants and real estate companies, as well as BO information. - Develop guidance and warning signs for reporting entities for STR on TF. - Provide feedback to supervisors and reporting entities regarding the quality of STRs and other relevant information sent to the UIAF to improve private sector capacity to report STRs effectively and improve UIAF’s capacity to produce financial intelligence. ### Recommended actions — Immediate Outcome 7 - Allocate adequate resources to the FGN. The FGN should focus ML investigations on larger and more complex ML schemes related to major organized crime organizations operating in the country. - Pursue a concerted policy of conducting parallel financial investigations, especially for all serious proceeds-generating crimes, including those with an international dimension, to increase the number of investigations and prosecutions of ML activities in line with Colombia’s risk profile, including all threats detected by the NRA. - Establish criminal liability for legal persons. ### Recommended actions — Immediate Outcome 8 - Further efforts by the FGN and the Judiciary to enhance confiscation of property derived indirectly through the commission of an offense. - The FGN should make further efforts to obtain repatriation of proceeds moved to other countries; international sharing of assets should be further sought. - Colombia should further pursue confiscation of proceeds related to other high-risk offenses (extortion, smuggling, and illegal mining). - Colombia should improve statistical information on confiscation. ### UIAF: use of financial intelligence and information access - The UIAF is an administrative FIU producing financial intelligence from STRs, cash transaction reports, foreign currency transaction reports, remittances transaction reports and threshold reports. - The UIAF has direct and indirect access to a wide range of information from Colombian intelligence agencies, law enforcement, and supervisory authorities. - Since 2002, the DIAN has been sending reports on cross-border transportation of currency and BNIs to the UIAF every three months. - The FGN and LEAs can request financial information available at the FIU for use in ML/TF and underlying crime investigations and trace of criminal proceeds. - The UIAF produces intelligence products (financial reports, typologies, strategic analysis studies) and collaborates through committees (e.g., Joint Intelligence Committee) for TF analysis, but the UIAF’s focus on TF risk analysis is low and there is little awareness-raising to reporting entities on TF. - Few typologies on TF risks exist for financial and DNFBP sectors; the NRA did not cover TF risks comprehensively. ### Timeliness and requests for information - The UIAF regularly receives requests from the FGN, National Police, military authorities, and the DIAN. From 2012 to 2016, requests remained relatively stable. - The standard time for a reply is usually 10 days, which in urgent cases could impact LEAs’ ability to collect timely financial intelligence for ongoing ML/TF investigations. - Table 6. Information Requests Sent to the UIAF (2012–2016): - FGN 1,185 - National Police 807 - Other 84 - Total 2,076 ### UIAF information access (examples) - Indirect Access: - Cash and BNI transportation reports - Annual tax returns of natural and legal persons and legal arrangements 1/ - Foreign trade information (import and exports) - Law enforcement information - Names of authorized and certified lawyers and accountants - Migration information of Colombian residents abroad - Direct Access: - STRs, reports on cash transactions, currency transaction, wire transfers, remittances, and other relevant reports submitted to UIAF - BOs registered with the Chambers of Commerce - Information on trusts for development of public infrastructure - Statistics and data published by other authorities - Notarial Operations - Monthly transactions of gold mining import/export entities and gold foundries, casinos, cargo transportation companies, vehicle dealers - 1/ During the onsite visit (June 2017), authorities informed that since September 2017, the UIAF will have direct access to this information due to a collaboration agreement signed between the UIAF and the DIAN. ### UIAF outputs and case dissemination - Authorities highlighted UIAF’s collaboration and good quality of financial information; intelligence was used for evidence development and asset tracing in ongoing predicate investigations and a smaller number of ML investigations. - From July 2012 to August 2017, 422 cases were disseminated to the FGN: - 334 were spontaneous reports - 88 were reports submitted on request - Of the 422 cases, the FGN started 242 criminal proceedings - 151 are under the stage of preliminary inquiry - 27 are current investigations - 16 convictions - Of the remaining 180 cases submitted to the FGN, 111 were used in asset forfeiture processes - 20 percent (88) of the 422 cases disseminated were elaborated upon request from the FGN ### Gaps in BO and cross-border information - UIAF could benefit from more accurate BO and cross-border transportation of currency and BNI information; some cross-border reports lack precise information and total declared amounts are not always available. - The 2016 NRA did not comprehensively analyze vulnerability of the cross-border declaration system, but noted that—from 2011 to 2015—the use of cash payments increased from 4.49 percent to 5.8 percent. - Reliance on cash is an important TF vulnerability since cash constitutes an important financing source for subversive groups conducting terrorist activities (these groups are not internationally recognized as terrorist groups and were never listed under UNSCRs). ### STR quality, volumes, and limitations - Despite poor quality of some STRs, the UIAF verifies and analyzes STR information along with its own databases, analyzing all natural and legal persons identified in an STR to detect trends, possible illegal origin of resources and links with criminal organizations. - UIAF can obtain some legal persons information from public registers, shareholder books and supervisory databases, but BO information may not always be accurate, complete, useful or updated in a timely manner. - Lack of comprehensive statistics is a weakness identified in the 2013 and 2016 NRAs. In 2016, the UIAF designed a statistical system to be completed with information sent by the FGN, LEAs, and MINREX, but these authorities send information only on an annual basis, affecting UIAF’s STR analysis. ### STRs received and reporting sector breakdown - The number of STRs submitted to the UIAF increased from 7,615 in 2011 to 10,002 in 2016. - Table 7. Reports Received from Financial and DNFBP Sectors (selected columns): - Year / STRs / Cash / Foreign Currency / Wire Transfers / Remittances - 2011 7,615 157,497,624 435,487 9,651,110 n/a - 2012 7,051 170,832,070 459,670 10,087,193 1,621,210 - 2013 6,937 187,265,488 482,732 10,803,576 3,530,187 - 2014 7,584 193,220,402 554,553 8,776,268 17,293,181 - 2015 8,595 199,665,243 584,541 7,877,594 42,189,130 - 2016 10,002 208,318,240 678,940 8,196,118 48,614,198 - Financial institutions generally understand and comply with reporting obligations; deficiencies exist in low reporting by some DNFBPs, particularly casinos, law firms, accounting firms, real estate agents, and dealers in precious metals and stones (besides gold import/export entities and gold foundries)—sectors both NRAs confirmed as highly vulnerable to ML/TF. - Low number of STRs from DNFBPs limits UIAF’s ability to produce useful financial intelligence. - The majority of STRs are ML related, but 3,704 were TF related. Reporting entities report supervisors do not provide sufficient TF guidance, affecting quality of TF-related STRs. - Colombia designated mining sector, sports clubs, hydrocarbon sector, and health sector as reporting entities not covered by the FATF standard; some entities were unaware of the obligation to send STRs to UIAF and of AML/CFT obligations or associated ML/TF risks. Sports clubs, mining, and health sectors submit minimal STRs of poor quality. ### STRs received by main reporting entities (Table 8 totals) - Banks: 2011 4,310 | 2012 3,879 | 2013 3,785 | 2014 3,472 | 2015 3,747 | 2016 4,062 | Total 23,255 - Money and currency exchange: 2011 19 | 2012 8 | 2013 4 | 2014 10 | 2015 15 | 2016 12 | Total 68 - Insurance companies: 2011 440 | 2012 333 | 2013 357 | 2014 364 | 2015 364 | 2016 377 | Total 2,235 - Stock exchange: 2011 498 | 2012 392 | 2013 307 | 2014 252 | 2015 175 | 2016 239 | Total 1,863 - Currency exchange: 2011 114 | 2012 93 | 2013 162 | 2014 154 | 2015 416 | 2016 663 | Total 1,602 - Postal transfer operators: 2011 71 | 2012 251 | 2013 270 | 2014 424 | 2015 438 | 2016 729 | Total 2,183 - Savings and loans cooperatives: 2011 0 | 2012 0 | 2013 0 | 2014 0 | 2015 0 | 2016 0 | Total 0 - Casinos: 2011 0 | 2012 1 | 2013 66 | 2014 44 | 2015 45 | 2016 23 | Total 79 - Law firms: 2011 0 | 2012 0 | 2013 0 | 2014 0 | 2015 0 | 2016 0 | Total 0 - Accounting firms: 2011 0 | 2012 0 | 2013 0 | 2014 0 | 2015 0 | 2016 0 | Total 0 - Notaries: 2011 849 | 2012 742 | 2013 595 | 2014 1,236 | 2015 1,246 | 2016 1,062 | Total 5,730 - Fiduciary companies: 2011 341 | 2012 276 | 2013 277 | 2014 224 | 2015 206 | 2016 399 | Total 1,723 - Real estate agents: 2011 0 | 2012 0 | 2013 0 | 2014 0 | 2015 11 | 2016 11 | Total 22 - Gold import/exporters/foundries: 2011 55 | 2012 2 | 2013 0 | 2014 3 | 2015 44 | 2016 18 | Total 32 - Dealers in precious metals/stones: 2011 0 | 2012 0 | 2013 0 | 2014 0 | 2015 0 | 2016 0 | Total 0 - Others (including the DIAN): 2011 968 | 2012 1,074 | 2013 1,174 | 2014 1,441 | 2015 1,938 | 2016 2,417 | Total 9,012 *IMF assessment text (colombia) contained in the chapter on Immediate Outcomes IO.6–8.* ### 128. Supervisors and reporting entities shared with the assessment team that since 2014 the ### 128. Supervisors and reporting entities shared with the assessment team that since 2014 the ### Feedback to reporting entities and STR quality - Since 2014 the UIAF ceased providing feedback reports named “IEROS,” related specifically to the quality of financial information submitted by reporting entities through STRs. - Authorities explained the suspension was to work on improving the system and that other kinds of feedback were provided to reporting entities. - The UIAF has an electronic system that blocks reporting entities from submitting incomplete STRs. - Interruption of the “IEROS” feedback mechanism may be affecting the quality of some STRs submitted to UIAF, as stated by many reporting entities. - Reporting entities indicated they need more precise feedback on how they submitted reports to UIAF. - The UIAF focuses mainly on sharing ML threats and gives little attention to the sharing of its views on TF threats; this affects the ability of reporting entities to understand and identify TF. ### UIAF authority to request additional information and response statistics - The UIAF has authority to request additional information from reporting entities; most requests are addressed to financial entities and the information is used to extend financial analysis and strengthen ML/TF cases disseminated to the FGN. - Table 9. UIAF Requests of Additional Information (as presented) - Year 2012 — Average Response Time (days) 8 — Number 1,841 - Year 2013 — Average Response Time (days) 16 — Number 2,060 - Year 2014 — Average Response Time (days) 72 — Number 1,217 - Year 2015 — Average Response Time (days) 9 — Number 1,166 - Year 2016 — Average Response Time (days) 8 — Number 1,089 - Total — Number 7,373 ### Operational analysis, prioritization, and analytical techniques - Since 2015 all STRs are received through an electronic system called “SIREL” and are analyzed by a computerized automated system that: - classifies STRs according to financial information of natural and legal persons reported; - identifies if an STR has relevant information according to alerts, parameters and UIAF’s criteria; - determines whether further analysis from UIAF’s operational area is needed. - Analysts review STRs selected by the automated system; if there is reason to believe an STR points to possible ML/TF and predicate offenses, the UIAF opens a case. - The Deputy Director of Operational Analysis forms a tactical committee with two analysts, a member of the Strategical Analysis area, and a representative of the General Directorate to decide if a case is relevant and if an intelligence report should be disseminated to the FGN. - Since 2013 the UIAF has used big data and data mining techniques to detect complex criminal networks, including: - identifying links among STRs, persons within criminal networks, and international financial transactions with high-risk countries; - comparing subjects’ tax declarations with information provided by DIAN; - identifying regions of the country representing higher ML/TF risk. - UIAF provided recent cases related to corruption and gold dealers where big data and data mining were used. ### Limitations from weak reporting and coverage gaps - Weak quality of some reports limits UIAF’s ability to produce and disseminate precise financial intelligence to the FGN and LEAs. - Main source of UIAF intelligence is the STR database and other threshold reports (cash transactions reports, currency transaction reports, wire transfer reports and remittances transactions reports). - Minimal reporting by some DNFBPs, such as casinos. - Lack of reporting by lawyers, accountants, real estate agents, and dealers in precious metals and stones because these entities are not subject to the AML/CFT regime. - According to NRA 2013 and 2016 and sectoral assessment 2017, DNFBPs represent a prime ML/TF threat for Colombia as they are frequently used by organized crime. - Other issues affecting STR quality: feedback between UIAF, supervisors and reporting entities; modest level of training and awareness for reporting entities on ML/TF risks in their sectors. ### STRs leading to UIAF cases and case outcomes - UIAF reported a substantial decrease in the number of STRs that led to opening a case within UIAF from 2012 to 2016; authorities stated this was due to a revision in UIAF’s procedures to ensure ML/TF cases are only initiated when there are clear suspicions. - UIAF implemented a new analysis and case initiation strategy in 2017 focused on big criminal networks and financial cases related to crimes identified as major ML/TF risks in the National Intelligence Plan; these strategies have not led to substantially more financial investigations and convictions (see IO.7). - Table 10. STRs Leading to UIAF Cases (as presented) - Year 2012 — STRs Received 7,071 — ML Cases Initiated 102 — STRs Associated with a Case 4,538/44 - Year 2013 — STRs Received 6,973 — ML Cases Initiated 97 — STRs Associated with a Case 3,340/34 - Year 2014 — STRs Received 7,602 — ML Cases Initiated 50 — STRs Associated with a Case 1,187/23 - Year 2015 — STRs Received 8,629 — ML Cases Initiated 60 — STRs Associated with a Case 892/14 - Year 2016 — STRs Received 10,036 — ML Cases Initiated 59 — STRs Associated with a Case 620/10 ### Strategic products and support to LEAs and FGN - From 2011 to 2016, UIAF produced strategic analysis studies which reporting entities found useful but focused on sectors/issues not necessarily related to major risks identified in NRAs 2013 and 2016. - UIAF organizes working sessions with national intelligence community authorities to discuss ongoing investigations, NRA results, and national intelligence documents. - UIAF spontaneously disseminates to the FGN: - financial intelligence reports with ML/TF cases; - financial reports elaborated jointly by the Strategic and Operational Departments. - UIAF responds to FGN’s information requests and coordinates working sessions to assist the FGN in ongoing ML investigations; during working sessions, UIAF shares all information available in its databases and other sources. - In 2017 the FGN requested UIAF support for discussion of 22 cases related to ML associated with drug trafficking, corruption, and human trafficking crimes. - According to the FGN, between 2015 and 2016 cooperation requested to the UIAF led to the dismantling of 102 criminal organizations. - UIAF and the FGN work jointly at an early stage of investigations; UIAF provides linkages with other STRs, cash transactions, and accessible data on legal persons and real properties. - Information shared by the UIAF is sometimes inaccurate or out of date, which limits its added value to FGN and LEAs, though other cases showed effective collaboration (Box 2: “Loco Barrera” case). ### Case dissemination and progression to judicial process - Of 422 ML cases disseminated between 2012 and 2017, only 27 led to a judicial process. - Table 11. Number of Cases Disseminated to the FGN (as presented) - 2012 86 - 2013 97 - 2014 50 - 2015 60 - 2016 59 - 2017 70 - TOTAL 422 - UIAF disseminated 422 cases to the FGN during 2012–2017, of which 353 resulted in criminal proceedings; among these there were 111 asset forfeiture processes. ### Notable case example (UIAF Case “Loco Barrera”) - UIAF identified relations among six ML cases disseminated to the FGN and collaborated closely with the FGN from the early investigation stage. - Principal information sources: STRs database, information exchanged between national authorities and international counterparts, open information sources. - Financial analysis identified networks, logistics/aviation companies used to transport cocaine abroad, and laundering through livestock farming and the same companies. - As a result of the case, UIAF identified 306 natural persons, 88 legal persons, and 2,843 properties with a total value of approximately US$439 million. - UIAF was awarded the Best Egmont Case Award (2013) for its participation in this investigation. ### Terrorist financing (TF) cases and UIAF contribution - From 2011 to 2016, UIAF disseminated 51 TF cases to the FGN; none triggered TF investigations, but information from these cases was used in asset forfeiture processes. - Of the few prosecutions and convictions related to TF in Colombia, there have been no cases involving the provision of money to terrorist networks, which is a major concern. - UIAF provides little added value for TF investigations because the FGN coordinates TF investigations and information exchange between relevant authorities. - Major efforts are needed by the UIAF to identify and disseminate useful TF cases to the FGN. ### Cooperation and information exchange with national authorities - UIAF cooperates and exchanges financial information with national competent authorities, including Colombia’s intelligence community; these meetings facilitate sharing operational information for cases under investigation by the FGN. - LEAs, particularly the FGN, can request UIAF support and technical assistance to understand financial information and financial intelligence; the FGN can request meetings to review confidential UIAF database information. - Table 12. Working Sessions Between UIAF and FGN (as presented) - Year 2013 — Number of Sessions 57 - Year 2014 — Number of Sessions 113 - Year 2015 — Number of Sessions 143 - Year 2016 — Number of Sessions 224 - Year 2017 — Number of Sessions 36 - Total 573 - From 2014 to 2016, the UIAF and the FGN organized 573 operational meetings; between 2015 and 2017 the UIAF developed and delivered 24 files of information. - Twenty-two information exchange agreements were signed with LEAs, supervisors, migration authorities and self-regulated bodies to exchange information regularly. - Regardless of agreements, UIAF has authority to request information from any authority or reporting entity. - Concerns: numerous national committees with similar functions composed of the same authorities may duplicate efforts and lead to inefficient coordination. - UIAF exchanges information with customs authorities for ongoing predicate-offense investigations. - UIAF needs to strengthen collaboration with national anticorruption authorities on policy development given the heightened ML risk related to corruption identified in the 2016 NRA. - An agreement between the FGN and the UIAF was signed in May 2017 to increase collaboration on ML investigations related to corruption; due to recent adoption, effective implementation was not verified by the assessment team. ### Confidentiality and access protocols - Mechanisms and protocols exist to guarantee confidentiality of information received from national authorities and international counterparts. - A mechanism designed only for information exchange between UIAF and national authorities (VPN-FTP) exists. - Systems and protocols include security measures to specify persons with permitted access to authorities’ databases. - Staff of competent authorities are aware of the importance of confidentiality and understand administrative and legal consequences of disclosure. - The only authority that can request access to the original UIAF’s classified information stored at its database is the judiciary with judicial authorization. ### Overall effectiveness conclusion for IO.6 - Colombia has achieved a substantial level of effectiveness for IO.6. *Source: cr18314-colombiadar — excerpts from the UIAF assessment chapter (IMF).* ### 154. The FGN oversees investigation and prosecution of ML and its predicate offenses. The ### 154. The FGN oversees investigation and prosecution of ML and its predicate offenses. The ### Institutional framework, resources, and financial intelligence sharing - The FGN is supported by both, the Judicial Police and the National Police to carry out investigations on ML and organized crime. Both the Judicial Police and the National Police have the necessary resources (legal, operational and financial) to carry out their duties, and can carry out complex ML investigations and use special investigative techniques. - LEAs do not have direct access to the UIAF’s database; prosecutors can formally request the UIAF for all financial intelligence they need; requests are normally processed within 10 days. The 10-day processing period impacts the LEAs’ ability to collect relevant financial intelligence in a timely manner. - The UIAF disseminates financial intelligence reports to the FGN and processes financial information requests to support the operational needs of competent authorities. UIAF disseminations are used mainly in ongoing investigations and in general do not trigger new cases. ### Case prioritization, complexity, and alignment with threats - Colombia has established policies and allocated resources to identify and prioritize ML cases. Nevertheless: - Most cases pursued are not linked to complex investigations of predicate offenses or to investigations involving large sums of money, but rather on those that do not impact greatly on criminal organizations. - Complex cases are being pursued in only in limited instances. - According to information provided, convictions on complex cases involving large amounts of funds are gradually increasing. - The total number of investigations conducted by LEAs with participation of the FGN are in line with the threats faced by the country and while many result in asset forfeiture, most do not lead to ML convictions. - The FGN approved a 2016/20 Strategic Plan which calls for focusing investigations on criminal organizations that operate in more than one jurisdiction within the country, rather than on small local criminal operations. The Plan notes that public efforts "have not been able to significantly affect the flows of illegal funds or services (particularly those of illegal drugs and firearms trafficking)" and that criminal organizations "have learned and mutated their structures which are now more diffuse and difficult to identify." ### Predominant predicate offenses, gaps, and sectoral focus - According to information provided, illegal mining and drug trafficking are amongst the main sources of illicit money. Corruption was also highlighted as a main predicate offense. - Authorities could not present comprehensive statistics identifying the predicate offense involved in ML cases. Authorities presented information about predicate crimes in a sample of 82 cases (not sentenced) from over more than 200. - In most ML cases investigated the predicate offenses were illicit enrichment of individuals and criminal associations, with connections mostly to drug trafficking activities. This was corroborated by analysis of all ML convictions of 2016 and part of 2017. - Investigations and convictions related to other main predicate offenses (e.g., corruption, trafficking of arms and of migrants) are not carried out in numbers commensurate with the ML risk. Corruption and other non-drug trafficking predicate crimes have been identified as major threats in the NRA, yet there has been a low number of ML investigations and prosecutions based on these predicate offenses. - Some complex ML cases involving high amounts of funds originated from ML derived from seeking tax refunds combined with smuggling and "captacion masiva y habitual de recursos" (generally linked to Ponzi schemes). DMG and CITITEX cases are cited as examples. ### Types of ML cases pursued and convictions patterns - Colombia can investigate and prosecute all kinds of ML cases, including those involving foreign predicate offenses, third-party laundering, self-laundering, and as a stand-alone offense. - Most ML convictions in 2016 and 2017 have been for the illicit enrichment of individuals predicate offense. Such cases do not require a conviction on the illicit activity that increases the wealth of the accused. - Almost all convictions have been obtained through a plea bargain agreement. - All ML cases analyzed by the assessment team are self-laundering cases that include the conviction for the predicate offense; in practice, analyzed sentences include a concurrent conviction for the predicate crime due to charging practices. - Only two ML convictions in the last three years were achieved based on a foreign predicate offense. - Statistics provided by authorities do not differentiate between different types of ML (e.g., third-party laundering, stand-alone, or predicate offenses involved). Authorities reported an increase in indictments but a drop in the conviction rate, attributed to growing complexity of the cases. ### Selected statistics and case counts - Table 13. Number of FGN ML Investigations - Year 2012 2013 2014 2015 2016 - Number 311 345 283 377 450 - Two complex cases in 2014, four in 2015, and seven in 2016.29 - Box 3 — Cash Couriers and ML - With more than 25 interventions, prosecutions were mainly under ML from illicit enrichment of individuals. - Couriers were found carrying usually more than US$100,000 or its equivalent in Colombian pesos or euros. - More than US$5 million were confiscated between 2014 and July 2017 and over Col$41 billion (approx. US$13 million) during the same time. - Two notable 2016 complex laundering cases: - Radicado 1100107040005200800 2016: assets derived from drug trafficking by one of FARC’s front companies; shell companies, cattle dealers, and a telephone-remittance service company used to launder proceeds. - Radicado 76001007003291012: two important MVSP companies laundered money through a check-cashing operation. - Table 14. Convictions by Type of Offense - Offense/Convictions 2014 2015 2016 - Financing and Administration of Terrorist assets 10 10 9 - Conspiracy 1,050 1,681 2,901 - Smuggling (including oil) 17 23 24 - Illicit Enrichment of Individuals 1 11 21 - Illegal Mining 19 51 41 - Extortion 999 1,171 1,193 - Extortive Kidnapping 93 102 135 - Testaferrato 1 2 4 - Migrant smuggling 18 12 47 - Human Trafficking 6 9 21 - Total 2,214 3,072 4,396 - Money Laundering 38 41 38 - Drug Trafficking, Fabrication or possession 1/ 12,547 12,381 10,979 - Firearms Trafficking, Fabrication or possession 6,287 7,779 7,881 - 1/ Statistics on offenses on firearms and illicit drugs, included also possession (which is not a predicate offense), and it was not possible to disaggregate them; therefore, it was not possible to separate important offenses that might be linked to a potential ML from those that are not. - Table 15. ML Indictments and Convictions - Year Indictments Convictions 1/ - 2012 38 44 - 2013 31 35 - 2014 45 38 - 2015 90 41 - 2016 116 58 - TOTAL 2/ 320 216 - 1/ Some convictions are from indictments in previous years. - 2/ Five ML sentences informed for 2017 at the time of the onsite visit. - Table 16. Illicit Enrichment vs. Testaferrato - Year Offense Convictions - 2012 Illicit enrichment 7 Testaferrato 2 - 2013 Illicit enrichment 7 Testaferrato 0 - 2014 Illicit enrichment 6 Testaferrato 1 - 2015 Illicit enrichment 12 Testaferrato 1 - 2016 Illicit enrichment 22 Testaferrato 5 - Total Illicit enrichment 54 Testaferrato 9 ### Organizational alignment and institutional incentives - The ML unit of the FGN is part of the Prosecutor’s Drug Trafficking office. ML investigations arising from other predicate crimes can be conducted by other offices within the FGN. - The decision to assign ML investigations to the same office in charge of drug trafficking cases has likely led to the crowding out of ML investigations involving other predicate offenses. - Decree (898 of May 29, 2017) establishes a change in the structure of the FGN (to come into force after the onsite visit) dividing investigations and prosecution into units (Organized Crime, Financial Crime, and Citizen Security). The Financial Crimes unit will comprise (i) a Specialized Anti Money Laundering Office, (ii) a Specialized Asset Forfeiture Office, and (iii) a Financial Investigations Office. The Financial Investigations Office will pursue various forms of fraud committed through the financial system. The Specialized Anti Money Laundering Office will adopt measures to overcome impunity of money laundering derived from organized crime. This administrative separation aims to separate prosecution of ML from drug trafficking. ### Effectiveness, proportionality, and dissuasiveness of sanctions - ML is sanctioned in the Criminal Code (CC) from 10 to 30 years of imprisonment. These sanctions are among the highest in the CC. - In practice cases result in applying a lower penalty, but authorities believe sanctions are adequate and dissuasive. Examples: - Even though most ML cases brought to court are minor, they have resulted in heavy sanctions. - Most cases end in a plea bargain; sentences have been imposed for terms longer than five years of imprisonment. - In cases without a plea bargain, terms of imprisonment have risen to more than 10 years. - In 2016 and 2017, of the last 42 judgments, only one imposed a sentence of less than four years. - Authorities state the actual period of imprisonment in these cases exceeds two-thirds of the penalty imposed. - Fines established in the CC range from Col$1,000 to Col$50,000 minimum wages (between US$230,000 and US$11,490,885). Typical practice: - A five-year imprisonment sanction is followed by a fine of Col$500 minimum wages. - A ten-year conviction is followed by a fine of Col$1,000 minimum wages. ### Legal persons, corporate liability, and alternative measures - Legal persons cannot be held criminally liable for ML in Colombia; only accessory penalties can be applied once the individual has been convicted. The judge can suspend the legal person and later order termination if it was involved fully or partially in illegal activity (Art. 91 of the PCC). - In convictions analyzed, accessory sanctions against legal persons have rarely been imposed, except in some complex cases where the judge ordered extinction of the legal person. - Given frequent misuse of legal persons in ML schemes and gaps in timely access to beneficial ownership (BO) information, the lack of criminal corporate liability is an impediment to greater sanctions effectiveness. - Colombia relies on pursuing other offenses to combat ML, notably “illicit enrichment of individuals,” testaferrato, and conspiracy to undertake ML activities; in many cases these investigations can be more effective than direct ML investigations. *Source: Excerpt from cr18314-colombiadar (IMF country report).* ### 177. Every major ML investigation triggers a parallel asset forfeiture investigation. One of the ### cr18314-colombiadar - 177. Every major ML investigation triggers a parallel asset forfeiture investigation. One of the ### Asset forfeiture as a strategic priority - Colombian authorities place a high priority on asset forfeiture and seek to recover proceeds, instrumentalities, and property of corresponding value as a policy objective. - The FGN’s Strategic Plan 2016–2020 establishes strategic objective No. 1 “to strongly impact organized crime” by pursuing criminal finances and increasing asset forfeiture. - Asset forfeiture is the predominant mechanism to recover illegal assets; it is an autonomous procedure independent of criminal proceedings and does not require a predicate offense or criminal conviction. - The dynamic burden of proof applies in asset forfeiture proceedings: the party in the best position to demonstrate a fact must bring the evidence (owners must demonstrate legal origin to refute authorities’ evidence). - The AFL (Law 1708 of 2014, entered into force July 2014) introduced procedural simplifications and the possibility of early disposal of assets, reducing average investigation time from 7 years to 1.5 years. ### Coordination, capacity, and specialized structures - The FGN, UIAF, National Police (DIJIN and DIPOL), Judicial Police, and other LEAs periodically establish task forces and working groups to coordinate asset forfeiture, ML, and high-impact drug cases; large-scale investigations often open parallel asset forfeiture investigations. - Specialized units and resources: - National Division for Asset Forfeiture: 76 prosecutors, 90 percent of whom have received specialized training. - Special Division on Asset Forfeiture of the Judicial Police: 32 investigators. - PEF (created 2014): 130 agents from multidisciplinary fields providing technical assistance, typologies, and strategic studies. - Special Judicial Police on Asset Forfeiture (since 2014); DIJIN special section for asset forfeiture (created 2015); GILFOT in DIPOL to trace assets from terrorist organizations and armed groups. - LEAs are described as well resourced, trained, and skilled for tracing and recovering instrumentalities and POC. ### Effectiveness, outcomes, and empirical results - Overall assessment: Colombia achieved a low level of effectiveness for IO.7 (Immediate Outcome 7). - Asset forfeiture vs. criminal confiscation: - Asset forfeiture is frequently used and often results in ML sentences not including confiscation because assets have already been forfeited; this can affect decisions to prosecute ML. - Asset forfeiture is more expeditious and effective in recovering instrumentalities, proceeds, and property of corresponding value. - Judicial decisions on asset forfeiture (CSJ, 2012–2016): Total 1,334 decisions, yearly breakdown: - 2012: 205 - 2013: 298 - 2014: 386 - 2015: 223 - 2016: 222 - FGN reported (2011–2016): 292 legal decisions forfeiting 1,405 assets. - FGN reported (2014–May 2017): 13,941 assets subject to provisional measures amounting to Col$17,002,618,979.074 (around US$5,620,000,000). - FGN reported (January–June 2017): final asset forfeiture of 166 assets for an amount of Col$376,615,632,908 (around US$133,853,223). - Under former procedure (Law 793/2002): 891 positive results and 585 negative results (positive in 60.37percent of cases). - Under AFL (Law 1708/2014) procedure: 286 positive results and 43 negative results (positive in 86.93 percent of cases). - Judicial decisions based on procedures (summary tables): - Former proceedings (Law 793 of 2002) total decisions: 235; total assets: 1,121 (2011–2016). - Current procedure (AFL–Law 1708 of 2014) total decisions: 57; total assets: 344 (2015–2016). - Assets under provisional measures in asset forfeiture proceedings: - No.: 2014: 3,055; 2015: 1,567; 2016 (May): 6,449; 2017: 2,870; Total: 13,941 - Value in Col$: 3,500,000,000,000; 5,882,238,665,593; 5,100,000,000,000; 2,520,380,313,481; Total: 17,002,618,979.074 - Value in US$: 1,160,000,000; 1,900,000,000; 1,700,000,000; 860,000,000; Total: 5,620,000,000, - Asset forfeiture proceedings with positive and negative results (2011–2017 aggregate): - Total cases at lower court: 3,078; Cases assigned: 3,178; Law 793/2002 positive cases: 891; negative: 585; Law 1708/2014 positive cases: 286; negative: 43. - Ongoing proceedings for asset forfeiture by May 2017: - Law 793/2002: 1,317 - Law 1708/2014 (AFL): 2,175 - Total: 3,492 - Seizure orders to ensure confiscation of proceeds (FGN, 2012–2016): - Seizure orders by year: 2012 507; 2013 401; 2014 496; 2015 438; 2016 521; Total: 2,363 - Requests to obtain suspension of disposal power over assets by year: 2012 293; 2013 505; 2014 539; 2015 472; 2016 470; Total: 2,279 - Confiscation application: analysis of ML convictions for 2016–2017 indicates confiscation mostly applied to instrumentalities and proceeds arising directly from the crime; assessment suggests Colombia could make further efforts to confiscate property derived indirectly from crimes. - International aspects: - At onsite visit, only one case of repatriation of assets with a final legal decision had been completed. - Provisional measures for repatriation of assets located abroad had been obtained in several cases but were pending. - No cases involving sharing of confiscated proceeds with foreign counterparts had occurred to date. ### High-value case examples (asset forfeiture successfully applied) - Case Enilce López, alias “La Gata”: asset forfeiture initiated May 2014 affecting 1,384 assets amounting around US$366,000,000. - Case “Ignacio Álvarez Meyendorff”: asset forfeiture against 210 real estate properties, 30 commercial companies, a real estate office and a service station; illegal assets amounted around Col$1,000,000,000,000 (approx. US$340,000,000). - Case “El Papero”: forfeiture of 141 assets valued in Col$300,000,000 (approx. US$100,000). - Case “Loco Barrera”: judiciary forfeited 11 vehicles, 4 real estate properties, and shares of a company amounting around Col$5,365,000,000 (approx. US$1,877,750). ### Management of seized and confiscated assets - Two mechanisms for managing criminal proceeds, depending on whether assets were confiscated under criminal or asset forfeiture proceedings. - Proceeds confiscated under criminal confiscation are managed by the “Special Fund for Assets Management” (SFAM) of the FGN (Articles 82–86 of the CPC). The fund has broad powers to manage and dispose of property. - SFAM holdings (by November 30, 2015): - TOTAL property managed: 53,205 items; Value in Col$: 287,836,553,336.25; Value in US$: 95,945,517.78 - Confiscated: 6,489 items; Value in Col$: 104,941,700.636.17; Value in US$: 34,980,566.88 - Seized: 46,716 items; Value in Col$: 18,894,852,700.08; Value in US$: 60,964,950.9 - SFAM foreign currency holdings (by November 30, 2015): - U.S. Dollars: 1,423,831 → 4,459,367,500 (conversion into Col$) - Euros: 1,084,000 → 3,596,863,760 (conversion into Col$) - Lempiras: 344 → 48,568 (conversion into Col$) - Total in Col$: 8,056,279,829 - Breakdown of seized property managed by SFAM (by November 30, 2015): - Real estate property: Number 6; Value in Col$ 1,230,089,601.63; Value in US$ 410,029.87 - Vehicles: Number 39,099; Value in Col$ 172,144,416,323.30; Value in US$ 57,381,472.11 - Marine transport: Number 37; Value in Col$ 1,452,413543.00; Value in US$ 484,137.85 - Air transport: Number 6; Value in Col$ 740,616,000.00; Value in US$ 246,872.00 - Artworks: Number 2; Value in Col$ 3,000,000.00; Value in US$ 1,000.00 - Jewelry: Number 167; Value in Col$ 60,660,362.00; Value in US$ 20,220.12 - Other assets: Number 7,399; Value in Col$ 7,263,656,870.15; Value in US$ 2,421,218.96 - Total seized: Number 46,716; Value in Col$ 182,894,852,700.08; Value in US$ 60,964,950.90 - Breakdown of confiscated property managed by SFAM (by November 30, 2015): - Real estate property: Number 59; Value in Col$ 77,184,912,520.00; Value in US$ 25,728,304.17 - Vehicles: Number 5,973; Value in Col$ 24,472,841,827.76; Value in US$ 8,157,613.94 - Marine transport: Number 2; Value in Col$ 110,000.00; Value in US$ 36.67 - Air transport: Number 3; Value in Col$ 3,079,177,400.00; Value in US$ 1,026,392.47 - Artworks: Number 5; Value in Col$ 410,000.00; Value in US$ 136.67 - Jewelry: Number 89; Value in Col$ 50,781,611.00; Value in US$ 16,927.20 - Other assets: Number 358; Value in Col$ 153,467,277.41; Value in US$ 51,155.76 - Total confiscated: Number 6,489; Value in Col$ 104,941,700,636.17; Value in US$ 34,980,566.88 ### Identified gaps and policy-relevant observations - Alternative criminal measures and asset forfeiture produce important results, but cannot replace the pursuit of ML convictions; alternative measures should be used only where it is not possible, for justifiable reasons, to secure a ML conviction. - Observed practice: many ML sentences do not include confiscation because assets were already forfeited; this can affect the decision to prosecute ML in some cases. - Data limitations: - No detailed national statistics were maintained concerning confiscation (property confiscated across the country or numbers on value-based confiscation). - FGN was developing an information system (testing phase at onsite visit) to improve statistical information on asset forfeiture and confiscation cases and outcomes. - International cooperation and asset repatriation: - Limited repatriation and international sharing to date; Colombia could benefit from further efforts to repatriate proceeds moved abroad and to obtain international sharing of assets. - Use of asset forfeiture is effective and prioritized, but Colombia could increase efforts to confiscate property derived indirectly from crime and to pursue more ML prosecutions rather than relying solely on forfeiture. *International Monetary Fund — COLOMBIA (excerpts from Immediate Outcome 8: Confiscation).* ### 208. In turn, proceeds seized and confiscated under an asset forfeiture proceeding are ### cr18314-colombiadar - 208. In turn, proceeds seized and confiscated under an asset forfeiture proceeding are ### Management of seized and confiscated proceeds (FRISCO) - Proceeds seized and confiscated under an asset forfeiture proceeding are managed by the Fund for Rehabilitation, Social Investment and Fight against Organized Crime (FRISCO, its acronym in Spanish), as set out by Chapter VIII of the AFL and Decree 2136/2015. - FRISCO is located under the Ministry of Finance and Public Credit (MEF) and is managed by the SAE. - FRISCO is granted broad management and disposal powers. ### Assets managed by FRISCO (by June 2017) — key statistics - By June 2017, FRISCO was managing property seized and confiscated for approximately US$1,620,377,460. - This includes assets forfeited for an amount of US$319,409,092 and assets under provisional measures amounting around US$1,300,968,368. - Table 27 (summary figures preserved exactly as presented): - Property (Forfeited) — Number: 3,155; Value in Col$: 591,477,648,815; in US$: 207,017,177 - Property (Under a Provisional Measure) — Number: 18,351; Value in Col$: 2,577,877,931,181; in US$: 902,257,276 - Property 2/ (Forfeited) — Number: 942; Value in Col$: 317,577,406,863; in US$: 111,152,092 - Property 2/ (Under a Provisional Measure) — Number: 3,485; Value in Col$: 1,094,530,400,224; in US$: 383,085,640 - Vehicles (Forfeited) — Number: 1,893; Value in Col$: 1,114,017,000; in US$: 389,906 - Vehicles (Under a Provisional Measure) — Number: 10,641; Value in Col$: 30,386,008,970; in US$: 10,635,103 - Artworks (Forfeited) — Number: 732; Value in Col$: N/A; in US$: N/A - Artworks (Under a Provisional Measure) — Number: 132 - Others (Forfeited) — Number: 953; Value in Col$: N/A; in US$: N/A - Others (Under a Provisional Measure) — Number: 54,490 - Total (Forfeited) — Number: 7,675; Value in Col$: 910,169,072,678; in US$: 318,559,175 - Total (Under a Provisional Measure) — Number: 87,099; Value in Col$: 3,702,794,340,375; in US$: 1,295,978,019 - Exchange rate note: US$1.00 = Col$2,843.36. - Footnote: 2/ Property owned by companies. - Table 28 (Legal Entities) — figures preserved: - Companies (Forfeited) — Number: 321; Value in US$: N/A - Companies (Under a Provisional Measure) — Number: 1,386; Value in US$: N/A - Value in Col$: 2,428,333,264; Value in US$: 849,917 - Value in Col$ (Under a Provisional Measure): 14,258,140,662; Value in US$ (Under a Provisional Measure): 4,990,349 - Exchange rate note: US$1.00 USD = Col$2,843.36. ### Assessment of FRISCO and asset management effectiveness - Colombia has a robust system for managing property confiscated and forfeited. - Both funds (implied: FRISCO and other funds) have experience managing assets of different nature and companies in activity. - The high value of assets under management is highlighted as evidence of effectiveness in asset forfeiture and in measures to use proceeds efficiently. ### Cross-border declaration system, seizure and confiscation (currency and BNI) - Colombia has a declaration system for all incoming and outgoing cross-border transportation of currency and BNI, applying to all natural and legal persons by air travel or through mail and cargo. - Declaration threshold: US$10,000 (written declaration required). - DIAN authority: - Can seize currency or BNI only when there is a false declaration or a failure to submit the declaration. - Upon discovery of a false declaration/failure to declare, DIAN can require additional information regarding the person, the carrier and the falsely declared assets. - Failure to comply constitutes an administrative infringement and eventually an offense. - DIAN is supported by POLFA when performing controls. - Controls are conducted according to a risk profile built on migratory information, flight information, luggage, currency declarations, and other inputs. - Procedures: - If amount exceeds US$10,000, or if false declaration/failure to declare, DIAN seizes currency or BNIs and starts an administrative proceeding for sanctioning the alleged infringement. - If there is a ML/TF suspicion, POLFA starts proceeding for capturing the suspected person and the case is referred to the FGN for criminal investigation. - FGN can request DIAN to send currency and BNI to serve as evidence; if case is pursued, funds are transferred to the FGN. - DIAN has a specific division collaborating with FGN on cross-border currency/BNI cases. ### DIAN currency seizure statistics (2013–2017) — Table 29 figures preserved - Entry / Exit breakdown: - US$ currency — Entry: 14,901,323; Exit: 1,475,381 - EUR currency — Entry: 4,959,819; Exit: 1,266,179 - Other (in US$) — Entry: 2,777,669; Exit: 62,632 - BNI — Entry: 669,805; Exit: 0 - Totals (by currency columns): - Total amount columns: 15,571,128; 1,475,381; 4,959,819; 1,266,179; 2,777,669; 62,632 - Grand totals reported: US$17,046,509; €6,225,998; US$2,840,301 ### DIAN administrative sanctions for false declaration/failure to declare (2013–March 2017) — Table 30 figures preserved - Overall: From 2013 to March 2017, DIAN applied 1,207 sanctions for Col$13,251,180,870, amounting US$4,732,756 (note table total differs slightly in US$ figure: Total row shows Value in US$: 4,732,564). - Yearly breakdown: - 2013 — Sanctions: 262; Value in Col$: 2,247,363,136; Value in US$: 802,629 - 2014 — Sanctions: 326; Value in Col$: 1,388,264,122; Value in US$: 495,808 - 2015 — Sanctions: 320; Value in Col$: 5,103,243,541; Value in US$: 1,822,586 - 2016 — Sanctions: 299; Value in Col$: 3,618,345,498; Value in US$: 1,292,266 - 2017 (March) — Sanctions: 78; Value in Col$: 893,964,573; Value in US$: 319,273 - Total (table): Sanctions: 1,285; Value in Col$: 13,251,180,870; Value in US$: 4,732,564 - Observation: There was no information on the amount finally confiscated or forfeited in criminal proceedings related to these administrative cases. ### Observations and potential improvements on cross-border controls - There are cases of non-declared or non-disclosed cross-border currency being seized and confiscated. - Colombia could benefit from improving controls over cross-border movements of BNIs. - Colombia maintains statistics regarding the amount of currency moved across the borders. ### Case example — “Azafatas” Case (Box 5) - Source: Information received from the US Immigration and Customs Enforcement. - Investigation: Criminal organization devoted to ML stemming from cross-border illegal currency trafficking using airline personnel from Colombia, Spain, Mexico, and the United States. - Actions and results: - 19 raids took place, 7 of which involved seizures of currency. - The group moved U.S. dollars and Euros with an approximate value of Col$8,500,000,000. - In March 2016, 13 persons were arrested, including flight attendants; charged with ML, illicit enrichment of individuals and conspiracy. - Five accused persons made an agreement with the prosecutor and were convicted to 75 months of imprisonment. ### Consistency of confiscation results with ML/TF risks and national AML/CFT priorities - Predicate offenses identified as higher risk in 2013 NRA: drug trafficking, corruption, extortion, and migrant smuggling. - 2016 NRA included illegal mining and smuggling. - Division on Asset Forfeiture of the FGN breakdown (asset forfeiture cases): - Drug trafficking: 57 percent of cases. - ML: 8 percent. - Corruption: 4 percent. - Conspiracy: 3 percent. - Table 31 — Breakdown of underlying offenses in asset forfeiture cases (2011–May 2017) — totals preserved: - Total number of asset forfeiture cases (2011–May 2017): 3,079 - Selected totals (preserved exactly): - Drug trafficking: 1,756 - ML: 238 - Corruption: 125 - Conspiracy: 83 - Terrorist financing: 27 - To be determined: 569 - Others and specific offenses listed with annual counts as shown in the source table. - Assessment: - Asset forfeiture aligns with the country’s risk profile in terms of main threats. - Positive results regarding drug trafficking, ML, and corruption cases. - Asset forfeiture also occurred for conspiracy, extortion, illicit enrichment of individuals, kidnap for ransom, and weapons trafficking. - Room for improvement regarding other high-risk offenses such as extortion, smuggling, and illegal mining. - Statistics coverage: - Available information on asset forfeiture is comprehensive overall. - Statistics regarding criminal confiscation are more limited: no breakdown of underlying offenses for assets recovered by means of confiscation. - Recommendation: Colombia could benefit from further strengthening the statistical system related to criminal confiscation. ### Immediate Outcomes on Terrorist Financing (IO.9–11) — Key findings and recommended actions - Immediate Outcome 9 — Key findings: - Colombia faces a high TF risk mainly domestic, with drug trafficking and other illegal activities conducted by domestic organizations (GAOS such as FARC or the ELN) as main sources. - Authorities rely heavily on judicial alternative measures to target TF, particularly by pursuing the crime that generates the illicit funds. - The TF offense has been used only in limited domestic cases to prosecute persons who do not belong to a terrorist organization. - The risk of foreign terrorism and its financing is low; no investigation or judicial procedure involving foreign TF has taken place. - CFT efforts are adequately coordinated. - Results obtained in pursuing illegal sources of domestic TF are noteworthy but not commensurate with the high TF risk; the number of stand-alone TF investigations and prosecutions is small relative to the magnitude of the threat. - Immediate Outcome 10 — Key findings: - Colombia has a legal system to apply TFS on TF that allows for freezing of terrorist assets. - Banks regularly check UN lists; awareness is lower in other sectors. - Freezing is ordered by a prosecutor after assessing AFL requirements and determining probable link of funds/assets with illegal activity. - Authorities have not received notifications related to assets/funds belonging to persons designated pursuant to UNSCR 1267 or 1373. - Authorities have not designated any person or entity domestically under UNSCR 1373. - Colombia has not identified the subset of organizations that fall under the FATF definition nor identified NPOs likely at specific risk for TF abuse. - Competent authorities have not engaged with NPO sectors on CFT matters. - Immediate Outcome 11 — Key findings: - AFL freezing measures described for IO.10 could not be adopted for assets of designated persons/entities in PF UNSCRs because AFL is a judicial process applicable only for assets linked to criminal offenses or activities for which a law expressly provides AFL measures. - Only AML/CFT reporting entities are required to monitor UN lists and inform authorities in case of match; awareness higher in FIs, DNFBPs not classified as reporting entities do not check lists. - Recommended Actions — Immediate Outcome 9: - Investigate, prosecute, and convict using the TF offense in line with Colombia’s risk profile, including for large scale cases of TF. - Investigate identified TF activities with the objective to charge an individual or an organization for TF. Only where it is not practicable to secure a TF conviction should authorities use alternative measures to disrupt potential TF. - Recommended Actions — Immediate Outcomes 10 and 11: - Establish and implement freezing mechanisms on TF and PF TFS in line with the standards; mechanisms should: - require all natural and legal persons, including all DNFBPs, not only AML/CFT reporting entities, to apply TFS; - require freezing all funds and assets of the listed persons/entities without additional conditions, such as links to illegal activities; - ensure that UNSCRs immediately apply regardless of additional investigations or assessments by authorities. - Use tools provided by UNSCR 1373 to combat TF in line with the country’s risk profile. - Identify the subset of NPOs falling under the FATF definition and the features/types of NPOs likely at specific risk for TF abuse; apply focused and proportionate measures to such NPOs in line with the risk-based approach. - Reach out to the NPO sector to increase understanding and mitigation of TF risks; provide further guidance regarding CFT measures and trends. - Raise awareness of Colombian authorities and natural and legal persons on application of TFS related to PF; increase coordination among authorities. - Ensure that all financial institutions and DNFBPS are subject to monitoring and sanctions for infringements on TF and PF UNSC Resolutions. *Source: cr18314-colombiadar (IMF staff report text provided).* ### 228. Finally, Colombia explained that some TF cases could be covered by investigations and ### cr18314-colombiadar - 228. Finally, Colombia explained that some TF cases could be covered by investigations and ### TF criminalization and legal framing - Colombia uses the crimes of “rebellion and illegal association or conspiracy” to cover some TF cases; the rebellion offense is the crime usually used to prosecute members of a GAOS or a BACRIM. - Case law has extended the interpretation of rebellion to cover persons who support these organizations without wearing a uniform or carrying a weapon. - Although the use of the rebellion crime enables prosecution of TF activities, only 175 persons have been convicted for this crime in the last five years (mostly GAOS combatants). - The rebellion crime requires political will to overthrow the government or the constitutional system — a condition not required by the international definition of TF and which might impede international cooperation because double criminality between rebellion and TF might not be configured. ### TF identification and investigation practices - The same prioritization and investigation processes used for GAOS and BACRIM criminal activities are applied to TF activities (as analyzed under IO.7). - LEAs and the FGN have identified and targeted larger criminal groups operating across the country; the UIAF has proactively disseminated some TF cases to the FGN. - TF activities are being identified and investigated, but frequently not prosecuted as TF. - When a person is a member of a GAOS and provides material support, prosecution is typically for membership in the organization rather than for committing TF. - TF is mostly prosecuted where the supporter is not part of the subversive/criminal organization. - Investigated TF cases: - Vary between a few major cases and a larger number of small cases. - Relate to support of subversive/criminal organizations by providing materials, information, or any other kind of support. - Include no cases involving the provision of money. - Identify the specific role played by the terrorist financier. ### Consequences of the prosecution approach - The number of prosecutions and convictions specifically for TF is very low despite high internal TF threats. - Proceeds of many other crimes are channeled to GAOS and therefore finance terrorism, but these activities are prosecuted for the underlying crime generating the funds rather than for TF. ### Case example: providing weapons to the FARC (Box 6) - During 2009 and 2010, a person sold arms to a FARC front; police found illegal arms destined for the FARC based on information obtained mainly by legal wiretapping. - The court considered FARC a group that executes terrorist acts and that providing weapons to the FARC constitutes TF (providing assets and supporting an organization committing terrorist acts). - The UIAF’s reports helped prove buyers were FARC members and established the accused’s relationship with those members through financial operations analysis. - The seller, not a FARC member, was sentenced to 13 years in prison for a TF offense. - He was also fined 1,300 official minimum wages; in August 2016, this would be roughly equivalent to a fine of US$300,000. ### TF investigation integrated with—and supportive of—national strategies - All investigative and prosecutorial counter-terrorism efforts are closely related to national strategies for combatting finances of criminal or subversive groups committing terrorist acts. - The FGN has a strategy to directly attack the funding sources of these groups; coordination exists among the FGN, the FIU, competent ministries, and supervisory agencies. - Financing of criminal/subversive groups is directly linked to crimes such as drug trafficking, illegal mining, and theft of fuel and oil; investigations are integrated to attack illicit fund sources. - The FGN has signed collaboration agreements with Ecopetrol and the National Police to strengthen investigative and prosecutorial capacity related to source crimes. - In 2015, the FGN approved a Prioritization Plan of the Directorate of Terrorism to prioritize cases more effectively. - The strategy does not include systematic use of the TF offense to support it. ### Sources of financing and investigative focus - Authorities focus on combatting GAOS at various levels (structure, armed combatants, support networks, areas of influence) to achieve dismantling. - Different GAOS exploit offenses depending on regional economic activities; sources of income include extortion, ransoms for kidnapping, cattle theft, illegal mining, and primarily direct participation in the drug trafficking chain. - Illegal mining, particularly gold extraction, has increasingly financed criminal organizations; authorities have directed significant resources to tackle illegal mining. ### Use and effectiveness of the TF offense and sanctions - Investigations specifically pursuing the TF offense have been relegated to some specific cases and thus have not been used to support national counter-terrorism strategies and terrorist investigations. - Sanctions for TF crimes reviewed range from 6 to more than 10 years of imprisonment; these are assessed as effective, dissuasive, and proportional. - Analysis of domestic TF cases from 2014–2016 showed convictions on average entailed over 10 years of imprisonment, and fines imposed are near the minimum range (US$300,000). - Even in plea-bargained cases, penalties imposed exceed seven years of imprisonment for the cases analyzed. - Legal persons are not criminally liable under Colombian legislation, but penalties for legal persons can be applied upon conviction of a natural person (Per Article 91 of the PCC); such penalties are not frequently imposed. - Supersociedades reported imposing administrative sanctions in many cases on corporations linked to GAOS. - For the FARC, the number of forfeited assets from 2012 to 2016 amounts to 1,798 assets with an approximate value of US$268.4 million, of which US$158.9 million resulted from actions carried out in 2016 alone. ### Alternative measures and asset forfeiture - Colombia uses measures to disrupt TF activities without securing a TF conviction, including prosecuting the underlying illegal activity, using rebellion and conspiracy offenses, and applying asset forfeiture mechanisms. - The FGN provided information on several cases where GAOS and BACRIM were deprived of high-value assets through asset forfeiture — an expeditious way to recover illegal assets without proving a criminal act. - Coordinated work exists within FGN specialized units (National Division on Asset Forfeiture and Directorate of Specialized National Prosecutor against Terrorism); they coordinate investigations and exchange information. - The National Division on Asset Forfeiture developed a specific strategy and working group to pursue assets related to illegal armed groups, trace assets, analyze information, and coordinate with military intelligence. - The assessment team’s view: there is no impediment to applying the TF offense in parallel with other approaches; pursuing TF would add value and increase sanctions imposed. ### Convictions by offense for persons related to terrorist organizations (2012–2016) — Table 32 - Conspiracy (Article 340, CC): 952 - Illicit Enrichment of individuals (Article 327, CC): 1 - Illicit Enrichment of Public Officials (Article 412, CC): 2 - Extortion (Article 244 CC): 215 - Guns and ammunitions related crimes (Articles 365 and 366, CC): 483 - Money Laundering (Article 323, CC): 8 - Rebellion (Article 467, CC): 472 - Kidnapping (Article 169, CC): 18 - Terrorism (Article 343, CC): 111 - Testaferrato (Article 326, CC): 7 - Drug related crimes (Article 376, CC): 72 - Illegal mining (Article 338, CC): 85 - Oil theft (Article 327, CC): 283 - Total: 2,709 ### Assessment of results and recommendations - Positive results have been achieved using measures to disrupt finances (pursuing source criminal activity, use of rebellion and conspiracy offenses, asset forfeiture). - Despite efforts, more should be done regarding financing: need to prosecute the TF offense to address more complex cases and a wider scope of financing/support of terrorist networks. - The limited pursuit of the TF offense and reliance on alternative measures are not significantly impacting GAOS and BACRIM. - The TF risk requires a larger number of TF investigations and prosecutions to increase convictions for this crime. ### Overall conclusion on Immediate Outcome 9 - Colombia has achieved a low level of effectiveness for IO.9. *Source: cr18314-colombiadar - 228. Finally, Colombia explained that some TF cases could be covered by investigations and* ### 261. Colombia has achieved a moderate level of effectiveness for IO.10. ### 261. Colombia has achieved a moderate level of effectiveness for IO.10. ### Immediate Outcome 11 (PF Financial Sanctions) — Implementation of Targeted Financial Sanctions Related to Proliferation Financing without Delay - The mechanisms for identification of funds/assets described for IO.10 partially apply for IO.11. - Legal reporting obligations to monitor lists and inform authorities/UIAF are limited to “international lists of persons and entities associated with terrorist organizations,” i.e., designations by UNSCRs related to terrorism and TF, and make no reference to an obligation for the private sector to check UNSC designations on PF. - TFS obligations on PF differ by type of entity depending on enforceable regulations issued by supervisors: - For financial institutions under the SFC (not all the financial institutions), obligations on PF-WMD are laid down in the Basic Legal Circular, SARLAFT. The Inter-Administrative Cooperation Agreement contains the obligations for the SFC. - For other reporting entities, obligations are set out in instructions and circulars recently issued by Supersociedades, SNR, and Coljuegos. - For individuals and entities not classified as reporting entities, such as most DNFBPs, there are no specific obligations regarding designated persons on PF-WMD Resolutions. - None of the instructions include any obligation to freeze funds or assets of designated persons on PF-WMD; reporting entities must receive an order of precautionary measure issued by the Prosecutor Office, FGN, pursuant to the AFL judicial process to adopt any freezing action (see R.7 and IO.10 discussion). - AFL freezing measures can only apply to goods and assets linked to criminal offenses or to activities that a Colombian law expressly sets that “deteriorate social morality or cause damage to the Public Treasury” (Constitutional Court 1708-2014, January 20). Being listed by UNSCRs on PF is not a crime and does not imply a link to any criminal offense; there are no legal provisions authorizing AFL measures for listed persons/entities in the PF UNSCR. ### Identification of Assets and Funds Held by Designated Persons/Entities and Prohibitions - No identification of assets/funds held in Colombia under PF or under any other UNSCR was reported. - No information was received on any case of request for transfer or sale of conventional weapons and related material or material articles, equipment, goods, and technologies related to the PF-WMD programs indicated in the UNSCRs. - Financial and trade flows with Iran and DPRK are not economically relevant (example: US$1.2 million exports to Iran in 2015); exposure to PF risks does not appear significant. - Colombian law permits freezing of funds/assets: - That are directly or indirectly proceeds of an “illegal activity” or form part of an unjustified equity increase when there are grounds to prove they come from illegal activities. - Freezing measures may extend to lawful assets only when specific causes listed in the AFL occur: when licit assets are used to conceal goods of illicit origin, when licit assets are mixed with goods of illicit origin, and when licit assets have an equivalent value to that of illicit goods that cannot be located. - Consequently, freezing cannot include all funds/assets owned or controlled by designated persons/entities in all circumstances because possible freezing of assets with licit origin is limited to the specific circumstances listed in the AFL. ### Financial Institutions and DNFBPs’ Understanding of and Compliance with Obligations - During the onsite visit, some financial institutions, mainly banks, appeared aware of obligations to routinely monitor UNSCR lists, including PF, but no persons/entities were identified at the time of the visit. - Awareness is lower in other sectors, especially DNFBPs, because monitoring UNSCR lists is only required for those classified as reporting entities under Colombia’s AML/CFT legislation; many DNFBPs are not classified as reporting entities and do not check UN lists. - Authorities reported a TFS simulation exercise involving many financial institutions and relevant authorities; a one-day workshop was held in 2016 on freezing funds and assets including elements on TFS. - No specific guidance has been released for any sector to facilitate application of PF UNSCRs TFS in the country. - Following SAGRLAFT, Supersociedades may design templates for TFS matters for supervised entities, adjustable by industry sector, but at the time of the onsite visit nothing had been issued by the supervisors. ### Competent Authorities Ensuring and Monitoring Compliance - Multiple authorities are involved: - MINREX, through the Directorate of Multilateral Political Affairs, disseminates PF UNSCR information among national authorities (UIAF, SFC, Supersociedades, and others), though some communications were not timely. - Trade restrictions monitored and authorized by the Ministry of Defense and Industria Militar (Indumil), DIAN (customs controls), Ministry of Commerce, Maritime General Directorate, Civil Aviation Directorate, among others. - Legal prohibitions and restrictions exist for importation of goods from countries subject to UNSC measures; foreign trade operators need PF prevention and risk management mechanisms determined by DIAN to obtain customs authorizations. - Institutional arrangements: - March 2011: Inter-Institutional Committee established to review, monitor and promote compliance with UNSCRs related to PF-WMD; acted as centralized unit for consultation, information exchange and technical advice. - Since 2015: sectoral commission National Authority for Prohibition of Development, Production, Storage and Use of Chemical Weapons created with participation of several ministries. - Supervisory responsibilities: - DIAN oversees monitoring PF trading obligations and sanctioning infringements. - SFC monitors financial institutions’ compliance with checking PF lists as part of AML/CFT inspection based on SARLAFT, but there are no specific supervisory activities on PF and no specific instructions have been issued. - Other reporting entity supervisors have no monitoring activities related to TFS obligations on PF. - Most DNFBPs supervised by Supersociedades are not included as reporting entities and are not monitored for AML/CFT obligations. - Supervisors can supervise and sanction compliance with monitoring lists and notification obligations but cannot sanction infringements on freezing obligations ordered by prosecutors under AFL (these are judicial processes); breaches of prosecutors’ orders could only be supervised and sanctioned by the Prosecutor’s Office. - Authorities were not aware of changes to the regime of the UNSC sanctions of Iran contained in UNSCR 2231 according to documents provided to the assessment team at the onsite visit. ### Overall Conclusions on Immediate Outcome 11 - Colombia has achieved a low level of effectiveness for IO.11. --- ### PREVENTIVE MEASURES — Key Findings (section A) - Overall, financial institutions have a reasonable understanding of the ML risks and AML obligations. DNFBPs, except for casinos, have a lower level of awareness of ML risks and obligations compared to financial institutions. - Colombia has brought most categories of DNFBPs under the existing AML/CFT framework. However, law firms, accounting firms, the real estate sector, and dealers in precious metals and stones (except for gold dealers) are not covered. - There are significant legal and regulatory gaps as well as serious deficiencies in implementation of CDD and enhanced risk mitigation measures under the existing AML/CFT framework that negatively impact effectiveness of preventive measures by reporting entities. - Implementation of CDD and risk mitigating measures, including for BOs, within most financial institutions appears low. MVTS are not consistently maintaining records of information and documentation obtained to identify and verify the identity of the customer. - Financial institutions and DNFBPs have established risk management systems in line with SARLAFT or equivalent systems considering size, complexity, and other factors. - While most financial institutions subject to the core principles seem to comply with requirements to report suspicious transactions, the volume of reporting by DNFBPs, including high-risk categories, is negligible because of lack of awareness. - Financial institutions and DNFBPs seem reluctant to, and in some cases unaware of, the obligation to report to the UIAF attempted transactions when they cannot match customer information to the government-issued identity card during CDD. ### PREVENTIVE MEASURES — Recommended Actions (section B) - Work closely with the financial sector and DNFBPs to increase awareness and understanding of potential ML and TF risks, and improve the volume of STRs. - Revise the existing framework to: - Establish the obligation to conduct CDD in law. - Fully extend AML/CFT obligations to the real estate sector, all law firms, accounting firms, and dealers in precious metals and stones. - Explicitly designate in the law the PTOs as reporting entities subject to all AML/CFT obligations. - Establish an obligation on savings and loans cooperatives and notaries to identify and verify the identity of the BO when establishing a business relationship. - Enhance the process for determining the BO in line with the standard. - Address other technical shortcomings identified in the Technical Compliance Annex. - Place additional supervisory efforts to ensure financial institutions and DNFBPs understand obligations and implement enhanced risk mitigation measures when needed. - Ensure risk management systems developed, adopted, and implemented by real estate agents, lawyers, accountants, and professionals engaged in the purchase and sale of foreign currency are adequate, consider the results of the 2016 NRA, and include comprehensive AML/CFT measures in line with inherent sector risks. - The relevant Immediate Outcome considered and assessed in this chapter is IO.4. Recommendations relevant for effectiveness under this section are R.9–23. ### Immediate Outcome 4 (Preventive Measures) — Understanding of ML/TF Risks and AML/CFT Obligations (section C) - Financial institutions have a reasonable understanding of ML risks and AML/CFT obligations under the existing legal/regulatory regime; DNFBPs’ understanding is basic. - SARLAFT (established by the SFC) applies to institutions under SFC supervision and consists of two phases: risk prevention and control environment. Institutions must consider at least customers and users, products, distribution channels, and jurisdictions. - Financial institutions provided documentation of risk management systems comprising identification, measurement/evaluation, control, and monitoring of ML/TF risks; systems include customized policies, procedures, recordkeeping, organizational structures, management committees, technological infrastructure, disclosure procedures, risk-rating criteria and heat maps, and training programs. - TF coverage in risk management for DNFBPs is low; TF understanding limited to implementation of UNSCR and OFAC lists. Authorities considered TF in Colombia an internal rather than international threat. - During the recent NRA exercise, many financial institutions participated and validated threats and vulnerabilities (drug trafficking, corruption, illegal mining, and smuggling). - Common practice for determining customer risk profiles uses the International Standard Classification System (CIIU) as the first step; additional criteria applied for final inherent risk (products, channels, jurisdictions). - External sources used for geographic risk include: (i) national police report on predicate offenses within the 32 municipalities in Colombia; (ii) UNODC reports related to drug zones; (iii) countries listed by the FATF and reports published by the UIAF; (iv) information from the national security agency; and (v) information from the Attorney General’s Office. - SARLAFT and equivalent systems using CIIU have generated many customer categories classified as “high risk,” commonly including: mining, casinos, real estate (including real estate developers/construction), cash intensive businesses, currency exchange businesses, businesses involved in the buying/selling of arms, businesses involved in the creation of web pages, adult entertainment businesses, telecommunications, gaming, former FARC members, money remitters, pawnshops, political action committees (PACs), notaries, lawyers, chemical companies, politically (and publicly) exposed persons, NPOs, and embassies. - Institutions have developed various risk-rating systems (from three levels to up to eight levels); preventive measures, including simplified and enhanced CDD, are implemented in line with assigned risk categories, but additional calibration, guidance and training are needed for consistency and uniformity. - DNFBPs’ awareness of ML risks and AML/CFT obligations is lower than financial institutions; casinos are an exception with greater awareness. - Low DNFBP awareness is linked to enhancements to AML/CFT regulations established end-December 2016, some not in force until September 2017. *IMF assessment excerpt: cr18314-colombiadar - 261. Colombia has achieved a moderate level of effectiveness for IO.10.* ### 284. Regulations addressing risk management systems like the SAGRLAFT imposed by the ### 284. Regulations addressing risk management systems like the SAGRLAFT imposed by the ### DNFBPs, recent regulations, and NRA participation - Supersociedades regulations in December 2016 on real estate companies, law firms, accounting firms, professionals engaged in the purchase and sale of foreign currency are too recent to adequately assess effectiveness. - CIIU is considered by some DNFBP representatives as the first step for categorizing customers and assigning a customer risk profile, in line with financial institutions’ approach. - Additional oversight is needed to ensure revisions to obligations, risk management systems, and policies are developed in line with the four risk factors and effectively implemented when regulations come into effect. - Several DNFBP categories are not considered reporting entities under the existing AML/CFT framework until financial activities surpass a pre-determined threshold; these DNFBPs generally do not understand ML/TF risks and AML/CFT obligations in Colombia. Examples include: - real estate sector - lawyers - accountants - dealers in precious metals and stones (not designated as AML/CFT reporting entities) - None of these DNFBPs participated or contributed to the NRA exercise process. - Understanding of TF is limited and focused mainly on internal threats and obligations related to implementation of the UNSCRs and OFAC lists. - Colombia has designated additional high- to medium-risk non-financial institutions as reporting entities beyond FATF Recommendations, subject to AML/CFT obligations only after surpassing established income thresholds: games of chance (lottery, permanent betting, and equestrian betting), mining and quarrying, car dealers and football clubs. ### Application of risk mitigating measures and SARLAFT implementation - SARLAFT and equivalent risk management systems require financial institutions to develop, adopt, and establish: policies, procedures, documentation requirements, organizational structure, control mechanisms, technological infrastructure, mechanisms for disseminating information, and training. - SARLAFT/equivalent systems provide a general framework; specific policies, procedures, controls, IT, risk criteria and heat maps, platforms and training programs differ among financial institutions. - Private sector reporting: institutions have invested significant resources (time, IT systems, human resources) and are calibrating systems for changes in operations, products, jurisdictions, and regulatory revisions. - Regulatory timing note: AML/CFT regulations requiring risk management systems and obligations were established at the end of 2016, and some will not be in force until, on or around September 2017, which appear also to affect the level of reporting of suspicious transactions. ### Supervisory inspections sample and risk profiles - Authorities provided a sample of 22 inspection reports used to assess implementation and risk perception; these institutions were selected because authorities assessed them as having high to medium-high ML/TF risk exposures. - Table 33. Risk Profiles of Financial Institutions (as provided) - Type of Institution — Risk Profile Assigned by the Authorities — Internal Risk Profile Assigned by the Institution - Banks — Mostly Medium-High (one rated High) — Various ratings: Low, Medium, Medium-High - Securities intermediaries — Medium-High — High/Medium-High - Insurance companies — Medium-High — Medium - Fiduciaries — Medium-High — High - Micro-finance companies — Medium-High — Medium - Bonded warehouses — Medium-High — Medium ### Common supervisory findings and corrective actions - Review of inspection reports revealed shortcomings in several areas of preventive regimes; authorities implemented corrective measures and formal action plans with specific actions and timelines. No indication sanctions were imposed on inspected institutions. - Table 34. Findings of Supervision of Financial Institutions (summary) - Type of Institution — Areas with shortcomings - Banks — 1, 2, 3, 4, 5, 6 - Securities intermediaries — 1, 2, 3, 5, 6 - Insurance companies — 1, 2, 5, 6 - Fiduciaries — 1, 2, 3, 6 - Micro-finance companies — 1, 2, 6 - Bonded warehouses — 1, 2, 5, 6 - List of shortcomings: 1—implementation of the SARLAFT or equivalent risk management system 2—implementation of CDD measures (including customer information updates) 3—internal audit 4—compliance officer 5—detection, analysis of unusual transactions and/or reporting suspicious transactions 6—IT systems (including limitations with respect to UNSC lists’ consultations) - Assessors’ view: financial institutions have developed and established comprehensive risk management systems per SARLAFT, but adequate and effective implementation of risk mitigation measures needs improvement. - Recent December 2016 modifications to obligations imposed on DNFBPs came into effect after the assessment visit; those sectors were not able to effectively implement enhanced risk mitigating measures during the period under review. - Many private sector participants only read the “Executive Summary” of the 2016 NRA and thus have not fully updated policies, internal controls, and programs to reflect NRA findings and recommendations. ### Customer Due Diligence (CDD) and Beneficial Ownership (BO) - 2016 NRA identified regulatory gaps: no overarching legal obligation to conduct CDD; requirements are found in regulations and circulars issued by each supervisory authority. - PTOs conducting domestic transfers through the postal system are not explicitly designated by law as reporting entities; sectoral Law 1369/2009 broadly requires PTOs to comply with AML/CFT requirements; transfer operators are subject to all AML/CFT requirements under MINTIC’s Resolution 2567/2016. - Despite absence of a formal CDD obligation, financial institutions generally do not view this as an impediment to identifying customers or BO(s) and conducting adequate CDD. - Additional shortcomings affect BO identification and verification: - savings and loans cooperatives, and notaries are not obliged to identify and verify the BO when establishing a business relationship. - general lack of awareness that if no natural person is identified, the identity of the natural person who holds the position of senior managing official must be obtained. - no requirement to collect BO information in all cases. - Inspection reports did not disclose issues with respect to adequately applying CDD measures to BO, but both financial institutions and DNFBPs need to enhance knowledge on BO identification when no natural person is identified as required by the standard. - Banks, securities firms, insurance companies, currency exchange firms, and savings and loans cooperatives reported customer acceptance forms require disclosure of the BO; until BO is identified, business relationships are not accepted/established or any transaction executed/performed. - Representatives from banks, securities firms, insurance companies, and money remitters did not report concerns or obstacles to sharing customer information including among and between financial groups. ### Record-keeping - Most reporting entities have a good understanding of documentation requirements. - Record retention practice: set at five years for AML/CFT matters, with a maximum of 10 years as set in the Commercial Code. - Money remitters and PTOs were the only reporting entities not consistently maintaining or archiving documentation supporting identity of the customer or BO and related documentation. - Inspection reports revealed deficiencies related to insufficient information obtained during CDD and deficiencies in maintaining customer information and records up to date; these were addressed via action plans and corrective actions. ### Enhanced or specific CDD: PEPs, high-risk countries, and targeted financial sanctions - Politically Exposed Persons (PEPs) - In practice, banks, securities, insurance companies, and fiduciaries apply enhanced CDD measures to foreign PEPs, domestic PEPs, and publicly exposed persons and officials from international organizations. - Customer acceptance forms require disclosure/identification of the person, BO, family members, or associates as PEPs. - Many reporting entities subscribe to and apply the World Check application when establishing business relations. - DNFBPs apply enhanced CDD mostly to domestic PEPs; some DNFBPs were not aware obligations extend to foreign PEPs and officials from international organizations. - Inspection reports highlighted shortcomings in CDD measures and documentation for PEPs and lack of enforcement of enhanced CDD; these were addressed through action plans and corrective actions. - Higher-risk countries - High-risk countries, including those listed by the FATF, are considered under the “jurisdictions” component in SARLAFT/equivalent systems. - Enhanced CDD measures are applied for business relationships, transactions, or customers from high-risk jurisdictions; many representatives indicated business relationships are not established or transactions are subject to enhanced scrutiny for customers from high-risk jurisdictions. - Inspection reports did not reveal shortcomings or noncompliance related to conducting business with high-risk countries. - Targeted Financial Sanctions (TFS) - Financial institutions and DNFBPs indicated awareness of obligations under SARLAFT/equivalent systems regarding UNSCRs linked to TF and proliferation of WMDs and UN sanctions lists; some also check the U.S. OFAC list. - None of the institutions met indicated having customers identified, reported, or acted against in line with TFS obligations. - Inspection reports revealed IT system limitations could prevent timely and effective identification against the UN list; deficiencies were addressed via action plans and corrective actions. ### Correspondent banking, wire transfers, and new technologies - Correspondent banking - Regulatory obligations for correspondent banking relationships (CBRs) are not fully in line with the FATF standard, but banking representatives did not report challenges with their correspondent banking activities. - Banks indicated they obtain sufficient documentation to comply with R.13 requirements and do not allow “payable through accounts”; internal policies prohibit relationships with shell banks. None of the interviewed institutions maintained correspondent relationships with shell banks. - Wire transfers - Technical shortcomings exist in regulations for wire transfers, domestic and international. - Banks’ internal policies for originating/receiving international wire transfers (via SWIFT) include obligations to obtain the originator and/or beneficiary account number linked to the transaction; banks will not conduct transactions if unable to verify originator/beneficiary and consider filing an STR with the UIAF. - Inspection reports indicated shortcomings in effective application of mitigating measures for wire transfers; addressed via action plans and corrective actions. - Money remitters and PTOs obtained originator and beneficiary information in practice but did not consistently maintain copies of identity documentation; incomplete information often led to rejection of payment but not to reporting the attempted transaction to the UIAF. - New technologies - Reporting entities indicated that for new technologies, new products, or modifications, they follow requirements in their SARLAFT/equivalent risk assessment system and consult competent supervisory authorities. ### Reporting obligations, tipping-off, and STRs - Reporting entities subject to Core Principles generally seem to comply with STR obligations; entities under SFC supervision filed most STRs received by the UIAF. - Gaps identified: - Some institutions were not aware of the requirement to report attempted transactions. - Instances where biometric (fingerprint) mismatch prevented establishing a business relationship or conducting a transaction did not consistently result in filing an STR with the UIAF. - Reporting by DNFBPs (some high risk) and PTOs is far less in volume compared to core financial institutions. - Inspection reports revealed deficiencies in IT systems/software for monitoring unusual transactions and UNSC lists; limitations in generating alerts or identifying potential unusual transactions could impair identification, review, and reporting of suspicious transactions, possibly resulting in a low volume of STRs. - Overall conclusion: shortcomings identified in onsite inspections were addressed through action plans and corrective actions imposed by the authorities, but effective implementation and IT system capabilities require improvement. *cr18314-colombiadar - 284. Regulations addressing risk management systems like the SAGRLAFT imposed by the* ### 308. Based on the statistical information related to STRs provided by the authorities, banks, ### cr18314-colombiadar - 308. Based on the statistical information related to STRs provided by the authorities, banks, ### STR reporting and sector coverage - Most STRs are submitted by banks, reporting entities (including the DIAN), notaries, insurance companies, PTOs, securities intermediaries, fiduciaries, and money and currency exchanges (see Table 10 in the IO.6 section). - Reporting by lotteries, casinos, real estate agents, dealers in gold, lawyers, and accountants is at the lowest levels despite these sectors being considered high risk in Colombia. - Limitations in IT and software and a low level of ML/TF risk understanding have contributed to the low level of STRs. - Some DNFBPs (lawyers, accountants, real estate agents, dealers in precious metals and precious stones) were not subject to AML/CFT obligations in certain cases. ### Tipping off, internal controls, and compliance practices - Financial Institutions and DNFBPs are aware they should avoid tipping off; supervisors and LEAs did not report tipping off as a key concern. - Financial institutions interviewed had internal controls, policies, and procedures for AML/CFT compliance; many sectors reported controls adequate to size, risk level, and scope of operations. - Financial institutions with a presence abroad reported adopting corporate/group-level policies and procedures and conducting verification of effectiveness through onsite inspections of subsidiaries abroad. - Sample inspection reports of cross-border visits revealed shortcomings in development and application of SARLAFT and implementation of risk-mitigating measures; deficiencies were addressed through action plans and corrective actions imposed by authorities. ### Licensing, registration, and fit-and-proper controls across sectors - SFC supervised entities: market entry controls are generally robust for banks, securities intermediaries, and insurance companies; SFC conducts background checks using police, judicial, and other agency data (e.g., DIAN). - Due diligence on nonresidents (including BOs and/or PEPs) is less extensive due to limited access to foreign background data. - No institutionalized formal policy/system for post-licensing ongoing fit and proper due diligence except name checks against official lists (e.g., OFAC and UN lists); enhanced measures are not applied when PEPs are involved in ownership/control. - Unregulated money lenders are excluded from the AML/CFT regime (see R.26 and R.27); sector believed to be very large and a systemic vulnerability. One website was identified advertising as a corporation “Somos una corporación debidamente constituida y registrada, sometida a inspecciones y vigilancias económicas”. - DIAN supervises about 1,263 currency exchange firms: 1,156 individuals and 107 legal entities. - Informal cash-based economy estimated to exceed 50 percent of the Colombian economy, involving more than US$100 billion in cash transactions annually. - DIAN applies fit and proper requirements including police records; on average DIAN approves about 70 percent of license applications and regularly applies sanctions for unauthorized operations. - No systematic processes to verify source of wealth and foreign exchange (cash) used for business operations at licensing or thereafter. - Banks generally do not accept currency exchange firms as clients due to categorization as very high ML/TF risk; yet more than 1,200 licensed currency exchange firms remain without a policy on licensing/delicensing for those unable to open bank accounts. - MINTIC supervises domestic money transfer operators: - Five licensed postal payment operators operating through 112 agents and about 27,700 customer service centers (subagents); a single large operator can have about 7,000–8,000 customer service outlets. - Agents are not licensed and MINTIC has not established fit and proper systems for subagents. - Two operators authorized for cross-border remittance business; onsite inspections outsourced to consultants. - Volume of fund transfers growing about 15 percent annually. - MINTIC conducts due diligence on shareholders holding five percent or more, and on top managers and directors, reviewing tax returns, police and other background records; no post-licensing monitoring system for fit and proper issues other than noting adverse news reports. - SES supervises 181 savings and loans cooperatives (other than five supervised by the SFC); largest cooperative has around US$600 million in assets. SES conducts due diligence on elected senior officials prior to their administrative activities and claims ongoing monitoring through complaints and onsite inspection results. - SNR supervises 902 notaries; accreditation council reviews police, judicial, and professional disciplinary background checks and uses professional examinations and interviews. - Supersociedades and legal professions: - Colombia has around 280,000 lawyers. Under the current regime (2016 SAGRLAFT to go into effect in September 2017), Supersociedades will supervise only about 10 law firms based on a total revenue threshold of about US$7 million. Licensing of lawyers as individuals is conducted by the CSJ, which is not a designated AML/CFT supervisor for lawyers. - About 250,000 accountants are licensed by the Central Board of Accountants; only nine firms meet Supersociedades criteria for AML/CFT supervision. SAGRLAFT came into effect on September 30, 2017 and effective application commenced at the end of 2017. - Real estate agents: estimated 1,093 real estate firms (includes construction firms); only about 28 real estate agents registered as legal entities will be subject to SARLAFT and Supersociedades supervision (US$12 million equivalent annual gross revenue threshold). No adequate fit and proper procedures for the sector. - Dealers in precious metals and stones: - Dealers in precious stones (emeralds) are excluded from AML/CFT regime. - Only legal entities selling precious metals that meet revenue thresholds are covered: wholesalers threshold about US$38 million (about five firms) and mining operations threshold about US$14 million (about nine firms). - No firm estimates on the number of retail dealers; could be in the thousands. There are 49 mines and quarries and 879 companies engaged in this business. - Coljuegos supervises about 383 licensed casinos operating through 2,500 establishments for AML/CFT purposes. - Unauthorized and unsupervised online/internet casinos operating in Colombia; March 2017 press reports referenced more than 300 online betting websites. - Licensing/regulatory regime established September 2016; at time of onsite assessment no internet casino license had been issued. Post-mission, eight licenses had been issued; operations of unlicensed internet casinos operating in or from within Colombia were terminated. ### Supervisory understanding, scope limitations, and effectiveness - Colombia achieved a moderate level of effectiveness for IO.4. - Key findings on supervisors’ understanding and capacity: - Understanding of ML/TF risks by supervisors is still evolving; most supervisors are well informed of main ML threats but less aware of TF threats. - SFC more advanced in ML/TF risk understanding; other six supervisors have lower understanding and less experience applying risk-based supervisory systems. - Most supervisors focus on domestic threats and do not sufficiently account for foreign-sourced risks. - SFC’s risk-based framework does not adequately account for risks from financial institutions (mainly banks) with substantial operations in higher risk countries and regions. - The 2016 NRA reinforced awareness of domestic threats but generally did not provide new specific information to recalibrate risk-based supervisory systems and tools. - Scope limitations in the AML/CFT framework for financial institutions and most DNFBP sectors constrain supervisors’ understanding of institutional and sectoral risks and their effectiveness. - DNFBP sectors including lawyers and accountants are only minimally covered by the AML/CFT regime, representing systemic gaps. - SFC improved offsite risk-based framework but has not sufficiently extended it for onsite inspections; other supervisors are still developing offsite risk identification and assessment systems. - Resource limitations, particularly for non-core principles financial institutions supervised by DIAN and MINTIC, limit effective supervision. - Integration of ex-FARC members into the formal financial system is an emerging supervisory challenge; as of onsite visit no formal consistent supervisory policy had been articulated. - Licensing regime and fit and proper checks appear robust for Colombian nationals but less stringent for foreign BOs. - Cooperation and exchange of information with foreign supervisory agencies in licensing are not the norm across all sectors; post-market-entry monitoring of fit and proper criteria is not institutionalized, especially for non-SFC supervised entities. - Deficiencies in financial institutions’ SARLAFT have been addressed mainly through action plans and corrective actions and less through financial penalties. - UIAF ceased dissemination of feedback reports on STR quality in 2014, leaving insufficient information to assess whether supervisors’ actions positively affect risk mitigation and compliance over time. ### Recommended actions (as presented) - Enhance assessment and understanding of TF risks by specifically incorporating TF elements in sectoral risk assessment models. - Strengthen assessment and understanding of ML and TF risks arising from cross-border financial institution subsidiaries and affiliates, particularly operating in Central America and offshore centers. - Extend scope of AML/CFT regime to nonregulated money lenders and DNFBP sectors including, but not limited to, lawyers and accountants. - Fully implement a comprehensive licensing (in process) and supervisory regime for all internet-based casinos. - Extend the offsite risk-based supervisory framework to all onsite inspections for all sectors. - Formalize and articulate a supervisory policy for managing ML/TF risks associated with integration of ex-FARC members into formal financial and DNFBP sectors. - Strengthen fit and proper licensing procedures for nonresidents and institutionalize a post-licensing system for ongoing monitoring compliance with fit and proper eligibility criteria. - Review and, as appropriate, enhance sanctioning practices to ensure proportionate and dissuasive sanctions are more consistently applied, especially for high-risk and high-profile cases (e.g., corruption). - Reinstate the STR quality assessment and feedback reporting system by the UIAF to support AML/CFT supervision and compliance by financial institutions and DNFBPs. *Source: cr18314-colombiadar - 308.* ### 327. Most financial and DNFBP supervisors participated in the NRA process that was ### cr18314-colombiadar - 327. Most financial and DNFBP supervisors participated in the NRA process that was ### NRA participation and overall findings - Most financial and DNFBP supervisors participated in the NRA process completed during the first quarter 2017 and have recently received reports on the NRA results. - Most supervisors did not identify substantive new ML/TF threats and vulnerabilities affecting their institutions; the NRA confirmed and refined prior understanding of sectoral threats and vulnerabilities. - NRA helped hone understanding of national geographic risks, particularly related to illicit mining activities and smuggling. - Little new risk information gained with respect to domestic TF, nor of foreign-sourced ML and TF risks. - No supervisor could point to new TF-specific risk factors related to inherent institutional and sectoral vulnerabilities other than geographic locations. - Assessors view some limitations as related to the NRA model scope rather than supervisors’ participation. ### Key high-risk sectors and systemic supervision gaps - Currency exchange firms and domestic payment operators identified as two of the most important risk areas due to: - Principal business with customers operating in the informal cash economy. - Large numbers of agents and sub-agents that make effective supervision challenging. - Downstream contagion risk effects for banks and other financial institutions. - With respect to DNFBPs: - Except for licensed trust (fiduciary) companies, at time of mission most DNFBP sectors were not subject to effective AML/CFT supervision. - Sectors significantly or fully out of scope posed systemic gaps and risks, notably unregulated lenders and internet casinos (internet casinos were being licensed post-mission and will be subject to supervision going forward). ### Superintendencia Financiera de Colombia (SFC) — risk understanding and RBA implementation - Pre-2016 NRA main source for ML/TF risk understanding: SFC’s risk-based framework to AML/CFT supervision, incrementally applied across sectors and started during 2013–2014 as part of the prudential Integrated Supervision Framework (Marco Integral de Supervision—MIS). - Application status up to end-2016: framework applied to 114 entities out of 418 (including banks, stock brokers, insurance companies). - Inherent risk analysis approach: - Based on reporting financial institutions’ selection of vulnerable products and services, complemented with client statistical data on volume and geographic location. - Cross-border geographic risk assessment described as overly complex and difficult to update periodically. - No periodic sectoral risk profiles (heat maps) produced to date for all sectors. - SFC developments: - Developing improved reporting and analytical framework for banks to better integrate AML/CFT RBA with broader prudential MIS. - Starting to develop consolidated financial group risk analysis, including ML/TF, into a domestic consolidated risk matrix. - To date, no specific assessment conducted for TF despite decades of terrorism acts — identified as a significant limitation. - Supervisory methods and shortcomings: - Understanding of risk management primarily based on questionnaire responses, supporting documentation (audit/compliance reports), and onsite inspections for SARLAFT implementation. - Risk profiling model assesses inherent risks associated with clients, products and services, economic sectors, geographic location; controls assessed via questionnaire for institutions scheduled for inspections. - Two main SARLAFT-related shortcomings: - Risk profiling used mainly for onsite planning and not for ongoing supervision; limits formulation of risk-based institutional and sector-wide strategies. - Inherent risk assessments rely on institutions’ internal assessments and do not allow in-depth analysis of FATF-indicated inherent risk factors. - Offsite risk analysis not fully integrated into inspection plans and onsite activities; inspection objectives often do not take specific account of institutional risk profiles. - Cross-border supervision: - SFC conducted five overseas onsite visits in Central America during 2016; participates in supervisory colleges. - No visits to Paraguayan banking affiliates beyond a 2016 familiarization visit; none to banks in offshore centers. - SFC may lack access to customer files of downstream subsidiaries/affiliates in offshore financial centers (e.g., The Bahamas and Cayman Islands). - According to SFC, none of its banks have been de-risked by foreign correspondents over the last three years. - Staffing and inspection statistics: - SFC ML/TF Risk Division staff: 33. - SFC supervises some 418 entities. - During the six-year period ending in 2016, SFC conducted 142 onsite inspections (on average about 24 inspections per year). An additional 15 inspections were conducted up to end-May 2017. - Inspections can last more than one month depending on size/complexity. - Table 35 (Onsite Inspections, Update 2016) totals: Total inspections by type and year culminating in a Total of 155 (End-May 2017); specific category totals include Banks: 55, Stock brokers: 45, Insurance companies: 19, Trustees: 12, Others as listed in the table. (Note: one currency exchange entity was inspected in 2014 and 2016.) ### MINTIC (domestic payment operators) - Understanding of ML/TF risks still evolving; primarily based on analysis of monthly financial flows to/from domestic geographic regions rated as high risk (including illicit mining, extortion, kidnapping). - Onsite inspection reports since 2016 generate risk matrices for inherent and residual risk based on customer/transactional risk and reporting obligations. - Offsite analysis adequate for customer risk (e.g., non-residents and PEPs). - No clear understanding of risks from cross-border linkages to domestic transfers, high-risk currency exchange firms, and unregulated money lenders. ### SES (cooperatives supervision) - SES risk understanding similar to MINTIC and partly based on 2016 NRA. - Focus based on domestic geographic exposure of cooperatives; licensing and ongoing supervision do not specifically consider risks tied to insurgent groups, coca regions, etc. - SES not familiar with ML risks associated with back-to-back loans, third-party loan repayments, and internet-based services. - No specific TF risk assessment by SES. - SES developments: - Introducing new risk profiling tools. - Formulated a supervision policy in May 2017 expected to improve understanding of institutional and sectoral risks. - In May 2017, conducted 33 of the 54 planned inspections for 2017; inspections lasted on average less than one day each. - Developed a preliminary risk heat map focused on likelihood and impact of ML, geographic exposure, and asset size; client and product risks not part of current framework; framework does not consider vulnerabilities related to quality of risk management systems and compliance. ### DIAN (currency exchange firms) - Banks and some financial institutions reportedly de-risked currency exchange firms due to contagion concerns; this encouraged operation in informal market, increasing sectoral risk. - DIAN lacks information on volume of transactions between these firms and informal cash-based economy, and on sector vulnerability to ML/TF; DIAN estimates vulnerability score should be high, but NRA rated this sector (sub-group 8) as far less vulnerable. - DIAN has developed a risk-based system and general supervision policy that includes currency exchange firms but has not formulated an explicit AML/CFT RBA supervision policy. - DIAN’s main supervisory focus: policing the perimeter (ensuring business not conducted by unlicensed firms). - DIAN does not know the source of foreign currency underpinning these firms’ businesses; currently analyzing the issue. Private sector indicates some firms source foreign currency from wholesale money brokers within and outside Colombia. - DIAN did not know how many currency exchange firms and clients operate in specific high-risk areas (e.g., ex-FARC and ELN areas). - No risk/vulnerability analysis where a currency exchange firm acts as intermediary correspondent agent; post-mission DIAN indicated it was not aware of any currency exchange firm acting as a correspondent agent. ### Coljuegos (casinos and gaming) - Coljuegos understands ML risks associated with casinos are high; view shared across financial institutions, DNFBPs, and supervisors. - Early 2017: developed a risk assessment matrix; implementation for AML/CFT still evolving. - Risk matrix focuses on large and foreign currency transactions, reporting to UIAF, and geographic vulnerability; does not take account of specific client and service risk factors. - No specific supervisory focus on vulnerabilities related to issuance of winning certificates to customers. - Absence of effective supervision of internet casinos at time of onsite visit limited understanding of sectoral risks; acknowledged by Coljuegos with recent licensing and supervision regime development. - Coljuegos staffing constraint: 30 staff (post-mission, 13 were reported as being negated in review of SIPLAF requirements) conduct general supervision, limiting offsite and onsite capacity and risk assessment. ### Supersociedades and SNR (notaries) - Supersociedades: Significant scope limitations in AML/CFT application to DNFBPs under supervision reduce capacity to understand sectoral ML/TF risks. Individuals not covered; only legal entities above very high revenue thresholds subject to requirements. Legal requirements implementation comes into effect at end 2017; no onsite AML/CFT inspections had taken place by mission. - SNR (Superintendencia de Notariado y Registro): - Supervises some 902 notaries; NRA rated notaries sector as moderately vulnerable to ML/TF. - Recognizes significant notarial business in real estate transactions, company formation, and corporate legal services; NRA found those sectors highly vulnerable. - SNR receives monthly revenue reports from notaries but no data on cash transaction volumes, foreign clients, or other inherent ML/TF risk factors. - Notaries required to submit periodic threshold reports (Reportes de Obligaciones Notariales—RONs) to the UIAF; SNR was not aware of areas or activities of risk. - No risk-based framework for supervision; focus mostly on SIPLAF compliance. ### Risk-Based Supervision of Compliance with AML/CFT Requirements — summary observations - SFC: - AML/CFT supervision incorporated within broader MIS; AML/CFT component largely based on SARLAFT. - AML/CFT risk-based framework does not specifically address TF risk. - Offsite risk analysis appropriately used for planning onsite inspections but not fully integrated for ongoing supervision. - Inspection scope largely focused on SARLAFT compliance verification; stated inspection objectives not consistently achieved in practice. - SES: - Implementation of risk-based supervisory system still evolving. - May 2017 general policy on risk-based supervision is first phase; to be followed by three other phases including issuance of risk management regulations for cooperatives, formulation of risk profiles, institutional strengthening, and consolidation of RBA with prudential supervision. - No systematic cooperation arrangement with SFC for cooperatives supervised by both. *cr18314-colombiadar - 327. Most financial and DNFBP supervisors participated in the NRA process that was* ### 351. During 2016, the SES developed a supervisory plan based on a sectoral risk matrix ### cr18314-colombiadar - 351. During 2016, the SES developed a supervisory plan based on a sectoral risk matrix ### Supervisory risk frameworks and methodology - SES developed a supervisory plan in 2016 based on a sectoral risk matrix analysis of inherent risk. - Determinants of inherent risk in the matrix: (a) probability of ML/TF based on the national geographic location of financial cooperatives; (b) impact of ML/TF based on asset size. - The analysis does not take account of customer, product/services, and distribution channel risk (e.g., online internet based services and use of correspondents). - The risk assessment methodology does not consider the quality of risk management and controls; therefore, no residual risk analysis is conducted. - There is no specific TF risk assessment. - MINTIC - Is developing and integrating a RBA to AML/CFT supervision. - Receives data on domestic payment volumes and direction of flows to/from various geographic regions. - Has developed a rudimentary analytical framework that assesses inherent and residual risk and the probability of ML/TF based on geographic location of payment operators. - The framework does not take sufficient account of customer and delivery channel risk (e.g., use of agents and customer service centers). - There is no specific TF risk assessment. - DIAN - Does not have a specific policy of AML/CFT supervision for currency exchange firms. - Its understanding of risk, especially regarding the source of foreign currency, is negligible. - Supervision considers geographic risk factors based on the location of firms, but not their customers. - Inherent risk analysis of currency exchange firms is negligible with respect to customer and product/service factors and no assessment is conducted with respect to source/sale of foreign exchange. - Coljuegos - States it has developed a risk-based approach largely founded on geographic risk exposure with a numerical scoring risk rating matrix. - The methodology does not provide clear correlation with a broader set of ML/TF risk factors or vulnerabilities. - Framework claimed in place since 2014 but implementation appears to have commenced only in 2017; not yet used for monitoring and planning inspections. - No procedures yet for ongoing supervision of online casinos. - SNR - Has not developed a risk-based offsite or onsite supervision framework. - Supersociedades - New SAGRLAFT for sectors did not come into effect until end of September 2017, with effective implementation to commence end of 2017. - Scope limitations and the CIIU used limit the application of FATF requirements and related supervision. - Onsite inspections planned to commence during the first quarter of 2018; none specific procedures developed yet. ### Onsite inspections, staffing, and practice - SES - Has 20 staff dedicated to offsite and onsite supervision for both prudential and AML/CFT purposes. - Conducted 120 onsite visits during 2011–2016 as follows by year: 2011: 27; 2012: 17; 2013: 10; 2014: 10; 2015: 23; 2016: 33; Total: 120. - For 2017, SES planned 54 inspections (out of a total 181 financial cooperatives) and conducted 41 inspections; of these it carried out 38 AML/CFT specific visits, all during May 2017. - Inspections generally lasted on average 2.5 days involving about three staff members. - Sample 2015 inspection reports showed focus mainly on regulatory compliance; assessment of internal risk management systems was sparse. - No link between rudimentary offsite risk assessment and onsite inspections planning and execution. - Based on 102 onsite inspections during 2011–2016, up to 34 percent of cooperatives were found to be in breach of various AML/CFT obligations. - Main enforcement action was informing institutions of findings; warnings issued to 4 institutions during this period. - During 2016, SES sanctioned 6 cooperatives totaling 619 official minimum wages (about US$142,224). - MINTIC - Onsite inspections generally outsourced to consultants. - Conducts semi-annual visits for prudential and AML/CFT purposes to each of the five operators; each visit lasts about six days with one of four staff dedicated to reviewing compliance with the SARLAFT. - Other than 2014 when only four inspections were conducted, each operator was inspected twice per year in 2015 and 2016. For 2017, all had been inspected up to April 2017. - A 2016 sample inspection report indicated inspection objectives did not explicitly cover AML/CFT compliance and were not based on pre-inspection risk analysis; nevertheless the onsite inspection reviewed internal controls relating to customer transactions (10 topics) and reporting obligations and generated a risk matrix for inherent and residual risk concluding implemented internal controls comply 100 percent with regulations and are effective. - DIAN - Total staff of 170 of which about 121 conduct onsite inspections that last between two to three days. - About three persons participate in each inspection. - Relies on quarterly statistical information submitted online for offsite monitoring but does not generate risk profiles for individual firms or the sector. - Focus of inspections often on identification and enforcement/sanctions against unauthorized currency exchange operations and retention of foreign currency in breach of exchange regulations. - Coljuegos - Has nine staff dedicated to general supervision that includes an AML/CFT component. - For 2017 plans to visit all casinos including 60 percent of their establishments totaling some 1,561 onsite visits. - Reported onsite visit counts during 2014–2016: 2014: 395; 2015: 426; 2016: 477; Up to May 2017: 93. - Very few inspection reports produced: 16 for 2016 and 6 for 2017. - SNR - Around 10 inspectors; by law must conduct annual onsite visits to all notaries but states it conducts between 60–70 onsite visits per year. - Duration of onsite visits is three to four days of which about half a day is devoted to SIPLAFT compliance. - No AML/CFT sanctions applied (one firm in process for a STR violation). ### Remedial actions, sanctions and enforcement statistics - SFC sanctions by type (2011–2017 (May)) — annual counts and total: - Recommendations: 0, 5, 3, 11, 2, 7, 0 — Total: 28 - Corrective plan: 14, 9, 10, 6, 3, 8, 0 — Total: 50 - Warning: 2, 0, 0, 0, 1, 0, 0 — Total: 3 - Monetary fine: 5, 5, 1, 2, 1, 4, 4 — Total: 22 - Total measures/sanctions per year: 21, 19, 14, 19, 7, 19, 4 — Grand Total: 103 - SFC sanctions by amount: - 2011 Col$435,000,000 US$ equivalent $150,000 - 2012 Col$838,837,000 US$ equivalent $289,000 - 2013 Col$60,000,000 US$ equivalent $20,700 - 2014 Col$182.500.000 US$ equivalent $62,900 - 2015 Col$45,000,000 US$ equivalent $15,500 - 2016 Col$740,000,000 US$ equivalent $255,000 - 2017 (May) Col$270,000,000 US$ equivalent $93,000 - Total Col$2,571,337,000 US$ equivalent $886,100 - DIAN - During 2012–2015, DIAN fined currency exchange firms around Col$4,398,000,000 or about US$1.5 million applied against 1,094 firms. - Updated statistics to March 2017: fines equivalent to about US$2.8 million for various violations of AML/CFT requirements and US$3.9 million for unlicensed activities, totaling about US$6.7 million; these involved some 1,200 cases. - MINTIC - Statistics on remedial measures provided for 2016 and year-to-date 2017: five breaches of biometric client identification by three operators with remedial action required; for 2017 two operators were cited once for similar breaches. - Coljuegos - Reported that to date it has not applied any sanctions for AML/CFT issues. - SNR - No sanctioning provisions for notary firms for AML/CFT; sanctions can be applied for professional breaches by individual notaries. - Supersociedades - Applied monetary penalties against six DNFBPs for failure to report on progress in implementing new AML/CFT requirements coming into effect in September 2017. - Post mission reported fines on average about 30 million Colombian pesos or about US$11,000. ### Impact of supervisory actions on compliance - Recent entry into force of new requirements and supervisory approaches makes impact assessment difficult. - None of the FI and DNFBP supervisors have developed formal systems to monitor the effectiveness of supervisory activities on compliance. - Remedial action and sanctions statistics may provide an indirect and partial measure of supervisory effect; current trends suggest enforcement is unlikely to have a significant impact on compliance going forward. - Recommendation in text: develop a more systematic manner of tracking effects of supervisory activities on compliance over time at institutional and sectoral levels to improve targeting of onsite examinations and inform risk-based monitoring and inspections. ### Promoting understanding, training, and awareness-raising - SFC conducted sector-specific training totaling 149 events during 2011–2016 (including banks: 26; stock brokers: 20). - SES involved in 51 awareness events during 2014–2017 with about 9,666 persons participating. - DIAN issued a guide for suspicious transaction reporting to its staff and held sensitization events in 2015 and 2016 with about 1,000 persons participating; issued AML/CFT and counter smuggling risk management models for currency exchange professionals and for foreign trade developed with UNODC assistance. - MINTIC conducted “Congreso LAFT America 2016” attended by payments operators (no training statistics provided). - SNR conducted a training event every year during 2012–2016 (no specific details provided). - Supersociedades: - Conducted three AML/CFT awareness events in 2015 with 303 participants and four events in 2016 with 455 attendants; total participants in 2015–2016: 758 (59 from DNFBPs subject to its supervision). - Posts AML/CFT information on its website and disseminates UAIF-generated ML/TF sectoral information. - UAIF e-learning portal usage during 2013–2016: 55,307 registered users and 25,997 graduates. *International Monetary Fund — CR18314 (Colombia DAR) — Extracted content unit* ### 382. Colombia has achieved a moderate level of effectiveness for IO.3. ### 382. Colombia has achieved a moderate level of effectiveness for IO.3. ### A. Key Findings - Information on the types and creation of legal persons and arrangements is easily accessible. - Basic information of legal persons is duly registered and annually updated in the public registries. This information is publicly available and accessible online. - There is no assessment of the ML/TF risks arising from legal persons, not even the SAS, which represent 54 percent of all companies in Colombia. - There is an assessment of the ML/TF risks arising from legal arrangements, which are rated as highly vulnerable sector. - Colombia has in place several measures that help to prevent the misuse of legal persons and arrangements for ML/TF purposes. - Authorities obtain updated information of the shareholders of companies, but BO information of legal persons is only partially available through various sources, all of which have limitations. - Fiduciary services are only offered by financial institutions (most of them subsidiaries of banks) specifically registered and licensed for this activity, and supervised by SFC. - Fiduciae are under very strict prudential regulation and adequate and up to date information on each fiducia is registered in the SFC and accessible to other authorities. - Some types of fiduciae are highly vulnerable for ML, but the authorities have not approved specific instructions or enhanced risk based AML/CFT mitigation measures for this sector. - Criminal and administrative sanctions have been applied when the information registered or provided to authorities is false or not up to date. - There is no information on sanctions imposed for failure to comply with providing BO information. ### B. Recommended Actions - Establish a mechanism to ensure that adequate, accurate, and up-to-date BO information on all types of legal persons is available to authorities which may access in a timely manner. - Adopt specific risk-based AML/CFT measures to mitigate the risks arising from the types of fiduciary services that are exposed to the high ML/TF risk (real estate fiduciae, fiduciae under warranty, and administration fiduciae). - Assess the ML/TF risk of legal persons, mainly SAS, and consider possible further AML/CFT measures for those that have higher exposure to ML/TF risks. - Initiate outreach to reporting entities to improve awareness on obligations on BO, including BO identification according to the standards. ### C. Immediate Outcome 5 (Legal Persons and Arrangements) Public Availability of Information on the Creation and Types of Legal Persons and Arrangements - Information on the creation and types of legal persons is publicly available. Guidelines and instructions on the procedures of creation can be found in the websites. - The creation of all legal persons is completed when the required information is registered in one of the 57 Chambers of Commerce. Only registered entities acquire legal personality. - Required registration information includes funds, assets, real estate owned; amounts invested; persons authorized to manage the business and their powers, and credit institutions used for transactions. Changes to internal governance must be immediately updated in the Commercial Registry. Every year, legal persons need to update the license information. - The creation process for all legal entities also includes registration before the DIAN, their supervisors, and the Supersociedades. - The most common legal persons in Colombia are SAS, civil partnerships, and foundations. 54 percent of the commercial companies in Colombia are SAS. - The SAS does not require public deeds for creation, just the authentication of a simple private document that can be signed directly in the Registry. - The most relevant legal arrangement is the fiducia of which there are 23,200. - There are several types of fiduciae and the requirements for creation vary by type. Fiduciary services can only be provided by financial institutions under SFC regulation that obtain a specific license. Currently there are 26 fiduciary companies, most of them are subsidiaries of banks. - All contracts of fiducia are registered in the SFC by each Fiduciary company. - The fiduciary sector is the second largest institutional investor in the financial system. The 2015 Annual report of the Association of Fiduciae (Asofiduciarias) shows an investment portfolio of Col$183.43 trillion (approx. US$62 billion), which represents a 33.34 percent share of the total investment balance. Identification, Assessment and Understanding of ML/TF Risks and Vulnerabilities of Legal Entities - The 2016 NRA does not include a ML/TF risk analysis on the different types of companies. Due the huge increase of the number of SAS in the last years and the authorities’ objectives of easing and encouraging formalization of economic activities and new entities, SAS could represent a higher risk for ML/TF purposes. - Judicial investigations and prosecutions on ML and illicit enrichment regularly include legal persons with simple corporate structures (trading companies and MVTS) used as tools for ML activities. In such cases, the legal owners and BO of the companies are the same natural persons. - LEAs have referred only a few ML judicial investigations, prosecutions or convictions where there was misuse of complex corporate structures for ML purposes and subsequent BO investigations. Examples cited include DMG Holding S.A. (2011), Odebrecht, Estraval S.A., and Interbolsa. - Authorities, financial institutions, and fiduciary companies perceive fiduciae as a sector of high risk for ML/TF purposes. The 2016 NRA assessed the ML/TF risks of legal arrangements and rated the ML/TF risks of different types of fiduciary services as very high (from 0,0—lowest risk to 1,0—highest risk): - real estate fiduciae (0,81) - fiduciae under warranty (0,7) - fiduciae of administration (0,75) - Administration fiduciae represent 28 percent of the resources managed by the sector (102.28 billion—13,631 fiduciary agreements). - Despite this high level of risk, no specific instructions or enhanced AML/CFT mitigation measures have been issued beyond the regular AML/CFT obligations for the FIs approved by SARLAFT. Mitigation currently relies on internal rules of each fiduciary company. - The “Civil fideicomiso” (Civil Code Articles 793–822) is not common but is vulnerable to ML risks. Authorities were not aware of vulnerabilities and had not analyzed ML/TF risks related to this arrangement. Low practical use and lack of LEA cases suggest low ML/TF risk. Mitigating Measures to Prevent the Misuse of Legal Persons and Arrangements - Colombia has approved several regulatory requirements that help prevent misuse for ML/TF purposes, including stricter controls, increased prudential supervision, and improved mechanisms to access information. - All legal persons are registered; basic information is public and annually updated. Public registries maintain a System for Preventing Fraud (SIPREF) to control false information and documents. Cases of false information have been taken to Court by the Chambers of Commerce and criminally sanctioned. - Companies subordinated to a central company must declare and register the name of the controller in the RUES. To be considered “controller,” the legal or natural person shall have 50 percent of the capital, or the minimum majority for decision making or dominant influence. In 2016, Supersociedades imposed 84 sanctions to entities for not registering control situation. - Bearer shares are not allowed. Companies keep a “book of shareholders” with identity of shareholders, shares owned, new shares issued, transfers, embargoes, lawsuits, and other limitations. This information is not public but is obtained in a timely manner by the DIAN, FGN, and Supersociedades and can be certified by internal tax auditors. - Registration before the respective supervisor and the DIAN, through the RUT, is mandatory, with annual updating of financial, accounting and legal information. Entities without a natural supervisor are supervised by Supersociedades. - 19,000 legal persons have an internal tax auditor: including companies over US$1,100,000 of gross assets or US$700,00 of gross income, all joint-stock companies, and all branches of foreign companies. The tax auditor issues certificates of activity, accounts and legal situation, and cooperates with authorities exercising inspection and surveillance. - Fiduciary services are heavily prudentially regulated and can only be provided by licensed fiduciary companies supervised by the SFC. All information on the participants and terms of each fiducia must be immediately registered and updated in the SFC by the fiduciary company. - Financial institutions and DNFBPs must inquire whether fiduciary companies are acting on behalf of their customers in operations or contracts. Fiduciary companies cannot disclose this information without authorization due to the Habeas Data principle; if information is not provided, the FI or DNFBP will not initiate the business relationship or transaction due to CDD obligations. - SFC supervises compliance of fiduciary companies with AML/CFT obligations. However, no sector-specific risk-based instructions or enhanced measures beyond the regular AML/CFT regime for FIs have been issued; mitigation relies on each fiduciary company’s internal rules. - The DIAN and the Superintendence of Industry and Commerce (SIC) closely monitor entities that could be used for smuggling-related activities and send a quarterly report to the UIAF with "the list of investigations of the entities related to the matters of competence of the UIAF." - Colombian authorities provide guidance, typologies, and best practices to reporting entities to prevent misuse for ML/TF purposes, including “Practical guidance on the regime of matrix and subordinated companies.” Timely Access to Adequate, Accurate, and Current Basic and Beneficial Ownership Information on Legal Persons - Basic information of legal persons is adequate, accurate, and annually updated in the public registries. The registries provide official public information consolidated in the RUES, which is public and available through www.rues.org.com. - Information is provided by legal persons through the Single Corporate and Social Register form. Documents and back up records kept in the registries are not public but are easily obtained by authorities. - Authorities easily access shareholder information held by public registries, supervisors, DIAN, Supersociedades database, and Books of shareholders. However, neither public registries nor official databases contain information on the beneficial owners of legal persons. - Companies are not obliged to obtain and keep information on their beneficial owners. - BO information of legal persons is only partially available through other sources, which all have limitations: i. RUES contains public information on owners and first partners/founders and, additionally, financial groups must identify and register the “financial controller” which may be another legal person. RUES may contain BO information for simple ownership structures, but it does not contain updated information on shareholders. Information is available at www.rues.org.com; documents and backup records are not public but are easily available to authorities. ii. “Books of shareholders” held by companies contain information on shareholders, number, percentage, and types of shares. BO information may be obtained only when shareholders are natural persons, not when they are legal persons or when foreign ownership is involved. This information is not publicly available but can be obtained by judicial authorities, prosecutors, DIAN or supervisors when requested and is used for tax purposes, police investigations and supervisions. iii. DIAN, supervisors and Supersociedades database information on shareholders: the Supersociedades database contains information of all shareholders, the percentage of shares belonging to each shareholder and the financial statements and accounting of 27.000 main domestic legal entities. BO information of fully Colombian-owned legal persons may be obtained by tracing through legal shareholding information in the Supersociedades database. This may, in some cases, allow LEAs and other authorities to determine BO in a timely manner, but it is not feasible when legal persons are not included in the database, when foreign legal persons or arrangements are involved in the ownership/control chain, and it is only updated on an annual basis. - Obtaining BO information in the CDD process is a very recent obligation for financial institutions and DNFBPS which came into effect in 2017. Each supervisor has a different definition of BO and the obligations set for obtaining BO information through the CDD process do not fully meet the standard. - Financial Institutions and DNFBPs were not aware that if no natural person is identified as the BO, the identity of the relevant natural person who holds the position of senior managing official must be obtained. This rule is not included in SARLAFT nor in SAGRLAFT. - As this obligation is currently in the initial phase of implementation, LEAs do not seek BO information from reporting entities because these do not necessarily have accurate information available. Timely Access to Adequate, Accurate, and Current Basic and Beneficial Ownership Information on Legal Arrangements - Adequate basic information of each fiducia is registered in the SFC by the fiduciary company and duly updated in case of modifications to the terms of the contract. - Other authorities, such as LEAs and the DIAN, may access the CDD information and terms of each fiducia held by the SFC. - Fiduciary companies follow the same new CDD obligations, enforced in March 2017, on BO identification for FIs which include BO information of the legal and natural persons participating in each fiducia. - Fiduciary companies generally use adapted corporate CDD programs of their financial groups. BO identifications of the settlor and the beneficiary of each fiducia and possible changes to this information are registered in the SFC with other required fiducia information. Other authorities may access this information, but the BO obligation was recently approved, is in an initial phase of implementation and does not fully meet the Standards. Effectiveness, Proportionality, and Dissuasiveness of Sanctions - Colombia has several supervisors and different types of sanctions for failing to comply with information requirements. - Legal persons that fail to renew their commercial registration in the public registries within the three month period established by law face economic penalties imposed by the SIC up to Col$12,500,000 (approx. US$4,200). - Additional failures on renewal obligations may include temporary or permanent closure of facilities. *IMF staff summary of "382. Colombia has achieved a moderate level of effectiveness for IO.3."* ### 411. Some criminal proceedings have taken place in Courts for providing false information to ### cr18314-colombiadar - 411. Some criminal proceedings have taken place in Courts for providing false information to ### Criminal proceedings and administrative sanctions - Chambers of Commerce filed penal complaints for falsification of private documents in cases of providing false information to the Commercial Register. (Paragraph 411) - Supersociedades imposes economic sanctions to legal persons for transparency-related infringements: (Paragraph 412) - For irregularities in the books of commerce (accounting, shareholders) and for failing to provide information related to these books: 25 sanctions were reported in 2016 and 2017 for Col$818,000,000—approx. US$270,000—(maximum fine of US$34,100). - For failing to present annual financial information more than 1,000 entities are sanctioned every year (1,401 in 2016) with an annual average of US$1,300,667. - For not complying with the registering obligations 144 entities were sanctioned in 2015 and 2016 for a global amount of US$1,616,445. - Supersociedades supervises and sanctions cases where subordination among entities or situation of control within a group is not duly reported and registered (60/84 sanctions in 2015/2016). ### Overall conclusion on Immediate Outcome 5 - Colombia has achieved a moderate level of effectiveness for IO.5. (Paragraph 413) ### INTERNATIONAL COOPERATION — Key findings (IO.2) - Colombia provides timely, good quality, and constructive mutual legal assistance (MLA) and extradition. (Paragraphs A Key Findings) - Colombia has a robust framework to respond to foreign requests and seek assistance from foreign counterparts. - The Colombian approach to international cooperation is proactive and collaborative; cooperation is provided both upon request and spontaneously. - Case management and prioritization of international cooperation requests are effective and ensure AML and extradition requests are executed in a timely fashion. - UIAF and law enforcement agencies (LEAs) maintain an important global network of liaison and are proactive in exchanging information. - Competent authorities take part in relevant platforms for exchanging information and implement adequate measures for protecting information, prioritizing, and executing international cooperation requests. - Colombia provides constructive and timely international cooperation regarding basic information of legal ownership of legal persons, but issues noted in IO.5 on BO availability would impact timely responses to specific BO requests. ### Recommended actions - The DIAN should implement internal procedures for adequately processing international cooperation requests and for safeguarding the confidentiality of the information. - Strengthen DIAN capacity to provide international cooperation on BO (see IO.5). - The recommendations relevant for the assessment of effectiveness under this section are R.36–40. (Paragraph B) ### Immediate Outcome 2 — Providing constructive and timely MLA and extradition - International cooperation is important given Colombia’s risks and context; competent authorities expressed high-level commitment. (Paragraphs 414–415) - The FGN is the central authority for receiving, analyzing and processing MLA requests. MLA requests are managed by the DGI through the ORFEO and SIPRAIN systems, which allow monitoring of status and procedures. DGI reviews requests, facilitates communication, and provides guidance to prosecutors. Requests related to enforcement/execution of foreign judgments within Colombia should be conducted through MINREX, which refers the matter to the CSJ. (Paragraph 417) - DGI maintains statistics and follows Directive FGN 002/2015 for case prioritization (objective, subjective, complementary criteria). (Paragraph 418) ### MLA requests received (2012–June 2017) — scope and primary senders - DGI received 2,351 requests from 45 countries. Primary countries sending MLA requests to Colombia were: Ecuador (332), Peru (295), Spain (255), the United States (237), Panama (209), Mexico (172), Venezuela (134), Chile (133), Holland (92), Brazil (75), and Argentina (69). (Paragraph 419) - Passive MLA requests received from 2012 to June 2017 involved: (Paragraph 420; Table 40) - ML: total 728 (2012: 123; 2013: 133; 2014: 140; 2015: 183; 2016: 134; 2017: 15) - Asset forfeiture: total 104 (2012: 40; 2013: 37; 2014: 26; 2015: 1; 2016: 0; 2017: 0) - Terrorism: total 77 (2012: 17; 2013: 10; 2014: 17; 2015: 18; 2016: 14; 2017: 1) ### Timeliness and quality of responses - Average time of response by 2016 was six months (five months for ML-related requests). Response times vary with complexity. Some countries reported receiving good quality responses in less than 30 days. (Paragraph 421) ### MLA on special investigative techniques and joint operations - Colombia provides MLA regarding undercover operations and controlled delivery. From 2012 to October 2016, 135 operations took place in drug trafficking and ML investigations; 133 of these 135 cases were carried out with the United States. (Paragraph 422; Table 41: yearly counts 2012: 36; 2013: 17; 2014: 11; 2015: 29; 2016 (Oct.): 42; Total: 135) ### Extradition practice and statistics - Colombia cooperates fully with extradition requests. The system requires a favorable opinion from the Supreme Court of Justice (SCJ) and a final decision by the Executive Branch. MINREX and MINJUS play roles in processing requests; SCJ bases opinions on formal validity, identity, dual criminality, existence of a formal accusation, and constitutional limitations. (Paragraphs 423–424) - Incoming extradition requests 2011–2017: 1,415 requests from 19 countries; main sources: the United States (837), Spain (125), Venezuela (42), Argentina (25), Peru (24). 1,125 out of 1,415 requests were executed (average 80 percent). In 204 of these 1,125 executed requests the underlying offense was ML. (Paragraph 425) - Reasons for non-execution (20 percent) include withdrawal by requesting country, inability to capture the person, death of requested person, request still processed, extradition deferred, among others. (Paragraph 425) - Incoming extradition requests per year (Table 42): 2011: 324; 2012: 178; 2013: 212; 2014: 173; 2015: 216; 2016: 219; 2017: 93; Total: 1,415. (Paragraph 425; Table 42) - Executed incoming extradition requests per year (Table 43): 2011: 146; 2012: 230; 2013: 159; 2014: 184; 2015: 168; 2016: 195; 2017: 43. ML-related executed requests by year: 2011: 24; 2012: 40; 2013: 51; 2014: 23; 2015: 31; 2016: 29; 2017: 6. (Paragraph 425; Table 43) - FGN case management (ORFEO) and DGI (32 officials) oversee analysis and processing; ordinary extradition average: one year and three months; simplified extradition average: seven months. Colombia provides extraditions on a timely basis. (Paragraph 426) ### Colombia seeking MLA and active extraditions - DGI sent 1,546 requests to 58 foreign countries (2012–June 2017). Primary recipients: United States (553), Spain (163), Ecuador (130), Panama (125), Venezuela (107), Mexico (82), Peru (38), Argentina (31), Costa Rica (29), Brazil (26), Italy (24), Chile (18). (Paragraph 427) - MLA requests sent involved: (Paragraph 428; Table 45) - ML: total 339 (2012: 50; 2013: 43; 2014: 72; 2015: 82; 2016: 79; 2017: 13) - Asset Forfeiture: total 153 (2012: 58; 2013: 35; 2014: 28; 2015: 19; 2016: 5; 2017: 8) - Terrorism: total 25 (2012: 5; 2013: 7; 2014: 4; 2015: 2; 2016: 5; 2017: 2) - DGI monitors response times and engages requested countries when delays are unreasonable. (Paragraph 429) - Colombia made 179 extradition requests to 22 countries (2011–2017); primary targets: Spain (58), Venezuela (33), United States (25), Argentina (13), Brazil (11), Panama (7), Ecuador (6). Of these 179 requests, 12 involved ML charges, two TF and one terrorism. (Paragraph 430; Table 46) ### Asset recovery and international platforms - FGN is part of GAFILAT’s Assets Recovery Network (RRAG); by 2016 it made 17 active requests to eight foreign countries via RRAG: Panama (4), United States (3), Spain (3), Argentina (2), Chile (2), Switzerland (1), France (1), Italy (1). (Paragraph 431) - Colombia has a sound legal framework for sharing assets internationally. At the time of the onsite visit there was only one case where proceeds were repatriated from a third country; provisional measures to repatriate proceeds located abroad were ongoing. (Paragraph 433) ### Other forms of international cooperation and operational networks - Colombian authorities regularly use informal inter-agency cooperation, joint networks/platforms, working groups, and joint task forces with foreign counterparts. (Paragraph 434) - Representative cooperation activities include partner investigations, training coordination, asset forfeiture partnerships, and expert exchanges. (Paragraph 435) - UIAF is a proactive Egmont Group member since 2000; uses Egmont Secure Web; UIAF won the Best Egmont Case Award in 2013 and was a finalist in 2015 and 2016. (Paragraph 436) - UIAF international activity (2012–June 2017): UIAF sent 235 information requests to foreign counterparts; primary recipients: Panama (57), United States (53), Venezuela (17), Spain (14), Holland (8), British Virgin Islands (8), Argentina (7), Switzerland (7). UIAF received 62 spontaneous disclosures. (Paragraph 437) - National Police international networks and cooperation: main partners include United States, France, Argentina, Brazil, Chile, Ecuador, Costa Rica, Jamaica, Mexico, Paraguay, Dominican Republic, El Salvador; significant cooperation from Europol; uses RRAG and AMERIPOL; exchanged more than 167,000 messages via INTERPOL since 2010. (Paragraphs 438–439) - DIJIN participates in international working groups under 19 agreements on ML, terrorism, and asset forfeiture. (Paragraph 439) - National Police receives support from U.S. Special Investigation Unit and regional intelligence cooperation from CLACIP and SEISOCO. (Paragraphs 440–441) ### Notable case example: "Loco Barrera" - Daniel Barrera (“El Loco Barrera”) captured September 18, 2012 in Venezuela in an operation coordinated by the National Police from Washington, D.C., with aid of Venezuela and Britain. UIAF, with national and foreign intelligence and a European FIU, consolidated a case revealing use of front companies to hide assets. (Box 7) - UIAF detected 629 immoveable goods for possible asset forfeiture, up to a total value of Col$146,294,000,000 (approx. US$82,000,000). Information submitted to FGN for prosecution and forfeiture. (Box 7) - In December 2016, the judiciary forfeited 11 vehicles, four real estate properties, and shares of a company amounting around Col$5,365,000,000 (approx. US$1,877,750). (Box 7) *Source: cr18314-colombiadar - 411. Some criminal proceedings have taken place in Courts for providing false information to (cr18314-colombiadar - 411. Some criminal proceedings have taken place in Courts for providing false information to)* ### 443. In addition, through the National and International Cooperation Unit for Prevention, ### cr18314-colombiadar - 443. In addition, through the National and International Cooperation Unit for Prevention, ### International cooperation: UIAF and information exchanges - UIAF has signed 545 MOUs with foreign counterparts and is an active member of the Egmont Group since 2000, providing financial intelligence via the Egmont Secure Web. - From 2012 to June 2017, UIAF received 560 information requests from foreign counterparts; primary countries sending requests to Colombia (number of requests): United States (69), United Kingdom (69), Peru (52), Bolivia (44), Argentina (41), Panama (29), Holland (24), Spain (17), Chile (15). - During the same period, UIAF sent 21 spontaneous disclosures of information to foreign counterparts. - Feedback from FATF delegations: UIAF is proactive in sending spontaneous information in drug-related cases and produces extremely detailed high-quality disseminations; responses to international cooperation requests contain information of good quality, including financial transactions. - Table 47. UIAF—Information Exchanges (2012–June 2017) - Year / Requests to Colombia / Requests from Colombia - 2012 / 146 / 30 - 2013 / 118 / 70 - 2014 / 111 / 25 - 2015 / 72 / 56 - 2016 / 84 / 37 - 2017 / 42 / 27 - Total / 573 / 245 - Table 48. UIAF—Spontaneous Disclosures of Information (2012–June 2017) - Year / Received / Sent - 2012 / 6 / 1 - 2013 / 15 / 2 - 2014 / 1 / 9 - 2015 / 4 / 8 - 2016 / 23 / 1 - 2017 / 11 / 0 - Total / 60 / 21 - UIAF provides information to Europol and the U.S. National Security Agency and can conduct inquiries based on requests made by foreign counterparts, including requesting information from reporting parties to share with requesting foreign counterparts. ### Law enforcement and prosecutor international cooperation - LEAs (FGN and National Police) proactively share information spontaneously and regularly use the RRAG platform for international cooperation. - By December 2016, the FGN received 41 information requests through RRAG; time of response reported as 30 to 45 days. - Countries sending requests to Colombia via RRAG and counts: Spain (20), Argentina (6), Ecuador (6), Chile (5), Guatemala (1), France (1), Costa Rica (1), Paraguay (1). - FATF delegations reported fluent and constant communication through RRAG. ### National Police international networks and capacity - National Police membership and cooperation networks: Interpol, Europol, Ameripol, CLACIP, SEISOCO; regularly uses these platforms and more than 120 international agreements to provide cooperation. - Internal procedures for the National Police (including international cooperation) achieved ISO 9,001 certification; DIPOL achieved ISO 27,001 certification, establishing best-practice information security processes. - The National Police has specialized training centers where 1,875 officials from around 50 countries have been trained in fields including drug trafficking and asset forfeiture. - Through DIPOL, the National Police provides technical assistance to 14 countries in the region and actively works with 86 foreign counterparts; DIPOL has chaired the Community of Intelligence of Latin America for 12 years, comprising 32 intelligence agencies from 28 countries of Latin America and the Caribbean. ### Customs, tax, and supervisory international cooperation - DIAN (customs) has signed bilateral agreements and multilateral arrangements with CAN, CARICOM, MERCOSUR, Central-America Triangle, EFTA, European Union, Alianza Pacífico, and exchanges information via COMALEP. - DIAN also has bilateral tax agreements including specific clauses and gateways for providing information; from 2015 to 2017, DIAN received 24 requests from foreign counterparts. - At the time of the onsite visit, DIAN lacked adequate internal procedures for receiving, ensuring confidentiality, prioritizing and responding to requests for assistance from foreign counterparts. (Footnote: After the onsite visit the DIAN approved relevant internal procedures establishing measures to execute international cooperation requests and to protect the confidentiality of information (Procedure for exchanging information PR-IC-0356).) - SFC is part of IOSCO, ASSAL, and ASBA; SFC signed 24 MOUs and regularly provides information mainly for supervision purposes, including meetings with OFAC. - From 2012 to 2017 SFC chaired 14 supervisory colleges in the framework of the Basel Committee. - DIAN provides information to the United States in the framework of FATCA and CRS. ### Exchange of basic and beneficial ownership (BO) information - Basic information and legal ownership information about legal persons operating in Colombia is available online through the Confecámaras web site and is easily accessible to any person, including foreign competent authorities; Colombian authorities share this information with foreign counterparts when requested through available international cooperation channels. - Regarding BO information, authorities reported they cannot identify specific cases where foreign competent authorities have requested BO information. Issues noted in IO.5 on availability of BO information would impact Colombia’s ability to respond in a timely manner to specific international cooperation requests for BO information. ### Immediate Outcome 2 (IO.2) conclusion - Colombia has achieved a substantial level of effectiveness for IO.2. ### Annex I — Selected findings on Recommendation 1 (Assessing Risks and Applying a Risk-Based Approach) - Criterion 1.1 – (Mostly Met) - Colombia conducted its first NRA in 2013 and updated it in December 2016; 2016 NRA led by UIAF, MINJUS, and the University of Rosario with participation from many public agencies and the private sector. - 2016 NRA assessed ML/TF national threats and vulnerabilities as of December 2016, focusing on main sources: drug trafficking, smuggling, corruption, extortion, migrant trafficking, illegal mining. Drug trafficking identified as the main source, followed by smuggling, illegal mining, corruption and extortion. - DNFBPs identified as presenting higher levels of risks, followed by the banking sector; within DNFBPs, lawyers, accountants, statutory auditors, auditors, and real estate agents identified as higher ML/TF risks. NPOs, persons involved in mining activities, and dealers in precious metals also present higher ML/TF risks. - 2016 NRA involved four thematic working groups and 21 government agencies plus private sector representatives; sectoral analysis in 2016/2017 covered six geographical regions but had limited coverage (overall response rate was approximately 30 percent). - Criterion 1.2 – (Met) - CCICLA is designated national authority for developing and coordinating national AML/CFT policies and coordinating actions to assess risks; 2016 NRA coordinated by UIAF acting as CCICLA’s technical secretariat with MINJUS and the University of Rosario. - Criterion 1.3 – (Met) - Second NRA conducted in 2016 and approved by CCICLA in January 2017; updated procedure and templates introduced. - Criterion 1.4 – (Met) - Results of the 2013 NRA presented to CCICLA members and relevant competent authorities; executive summary published on UIAF’s website; 2016 NRA adopted January 2017 and disseminated to private sector May 2017. - Criterion 1.5 – (Mostly Met) - CCICLA elaborated recommendations with Departamento Nacional de Planeamiento under the CONPES document. The 2013 NRA did not fully inform national AML/CFT policies; 2016 NRA findings have not yet been translated into specific mitigation measures due to recent adoption. Authorities still need a mechanism to act on NRA results. - Criterion 1.6 – (Not Met) - All financial institutions are subject to the AML/CFT framework, but scope limitations exist: many DNFBPs (lawyers, accountants, real estate) identified as most vulnerable are not subject or only under limited circumstances. Dealers in precious metals and stones are out of scope despite high-risk rating in NRA. - Criterion 1.7 – (Partly Met) - Colombia has not applied enhanced CDD measures in response to higher risk categories identified in the NRA broadly. SFC- and SES-supervised institutions are required to take enhanced measures (Circular 55/2016, section 4.2.1.4 and SES 4/2017, section 2.1.1). DIAN- and MINTIC-supervised institutions lack requirement to perform ECDD where ML/FT risks are higher. Expansion of AML/CFT framework to other sectors was not informed by risk assessments. - Criterion 1.8 – (Met) - 2016 NRA did not identify low ML/TF risk categories permitting simplified measures generally. SFC allows simplified measures for certain low-risk customers/products/transactions (Circular 55/2016, sections 4.2.2.1.7 and 4.2.2.1.6) to ensure financial inclusion; other supervisors have not provided for simplified measures; DNFBPs are not allowed simplified measures. - Criterion 1.9 – (Partly Met) - Financial institutions and DNFBPs have designated supervisory authorities. AML/CFT supervisors generally have adequate inspection powers and sanctions available. SFC supervision is risk-based; other non-core financial institution supervisors (SES, DIAN, MINTIC) do not apply risk-based supervision. Some DNFBPs are not subject to AML/CFT requirements and supervision of DNFBPs is poor. - Criterion 1.10 – (Partly Met) - Financial institutions required to apply SARLAFT (SFC-Circular 55/2016, section 4; SES-Circular 4/2017, section 2; DIAN-Circular 13/2016, sections 6 and 7; MINTIC-Resolution 2564/2016, Articles 4–6). DNFBPs required to implement SIPLAFT or SAGRLAFT with varying coverage (Instruction 17/2016 for notaries; Circular of Superintendence of Companies for lawyers, accountants, real estate). Coljuegos (casinos) and dealers in precious metals and stones not fully covered; Instruction 17/2016 for notaries and some circulars do not incorporate all 1.10 elements. - Criterion 1.11 – (Partly Met) - As part of SARLAFT, financial institutions required to have policies, controls and procedures (approved by senior management) to document process for managing and mitigating ML/TF risks, and to monitor implementation (SFC-Circular 55/2016, section 4; SES-Circular 4/2017, section 2, DIAN-Circular 13/2016, sections 6 and 7, MINTIC-Resolution 2564/2016, Articles 4–6). (Assessment continues in source.) *Source: COLOMBIA — INTERNATIONAL MONETARY FUND (excerpts from cr18314-colombiadar).* ### section 4; SES-Circular 4/2017, section 2.2.3, DIAN-Circular 13/2016, section 7.1; and MINTIC- ### cr18314-colombiadar - section 4; SES-Circular 4/2017, section 2.2.3, DIAN-Circular 13/2016, section 7.1; and MINTIC- ### Risk assessment, measures for FIs and DNFBPs, and Criterion 1 conclusions - Enhanced measures to manage and mitigate higher risks are required only for financial institutions under the supervision of the SFC and the SES (Circular 55/2016, section 4.2.1.4 and SES 4/2017, section 2.1.1). - For DNFBPs, except for Coljuegos, the Circular of the Superintendence of Companies and Instruction 17/2016 for notaries address requirements under C.1.11 (a) and (b) but fall short in addressing (c). - Criterion 1.12 – (Partly Met): Simplified measures are only permitted by the SFC under Circular 55/2016, section 4.2.2.1.7 where low risks have been identified (see C.1.8). Criteria 1.9-1.11 are not adequately addressed. - Weighting and conclusion: - The risk assessments of 2013 and 2016 broadly address the main ML/TF threats and vulnerabilities, despite some data gaps and lack of participation of some relevant agencies. - National AML/CFT policies were established under the CONPES document to address main priorities of the national AML/CFT system. - Not all risks in the 2013 and 2016 NRAs have been addressed in AML/CFT policies; other public policies address parts of the risks. - Main authorities have broadly applied a risk-based approach based on their understanding of risks. - Some criteria related to FI and DNFBP obligations are partially met. - Recommendation 1 is rated largely compliant. ### Recommendation 2 — National cooperation and coordination - Historical context: - In its 2008 MER Colombia was rated largely compliant regarding requirements on former Recommendation 31 (para. 6.1.3); deficiency related to effective coordination and information exchange between AML/CFT authorities. - Criterion 2.1 – (Mostly Met): - CONPES 3793 (December 2013) sets national AML/CFT policies and an action plan; includes main 2013 NRA results and recommendations (November 2013). - Authorities state 2013 NRA and CONPES 3793 were designed simultaneously; CONPES 3793 could not have taken into consideration all NRA results. - AML/CFT national policies are also included in the National Development Plan 2014–2017 and the National Intelligence Plan. - Given adoption of new NRA in December 2016, there remains a need to address emerging risks. - National Intelligence Plan is confidential; assessment team could not establish that 2016 NRA risks were considered. - Criterion 2.2 – (Mostly Met): - Since 1995, Decree 950 and amendments assign CCICLA to organize, design, and implement Colombia’s AML/CFT regime. - CCICLA coordinated the 2013 NRA and was engaged in 2016 NRA (led by the UIAF). - CCICLA approves NRA results before dissemination. - CCICLA is not sole national AML/CFT policy body; multiple authorities discuss these issues and coordination mechanisms are unclear. - Criterion 2.3 – (Mostly Met): - CONPES 3793 describes CCICLA as coordinator for collaboration among national authorities. - CCICLA works through four internal committees; three relevant for AML/CFT with collaboration of 24 appropriate authorities (UIAF, LEAs, supervisors, policy makers, among others): Operational Committee of AML Culture, Operational Committee for Prevention, and Detection and Operational Committee for Investigation and Prosecution. - CCICLA is supported by other working groups and committees. - Authorities report coordination arrangements between UIAF and LEAs. - Unclear whether cooperation agreements between supervisors and other national authorities are implemented and address AML/CFT deficiencies. - Agreement for information sharing between UIAF and DIAN signed November 2016 is not implemented yet; concerns exist regarding its scope. - Criterion 2.4 – (Partly Met): - Proliferation financing coordination falls within Ministry of Foreign Affairs, General Prosecutor Office, UIAF, and Superintendence of Financial Issues. - Four authorities signed an agreement on November 2015 to implement actions for compliance with Article 20 of Law 1121 (2006). - Article 20 of Law 1121 does not contemplate specific actions against proliferation financing, only actions against TF in general; scope of the agreement and government actions related to UNSCRs and FATF proliferation financing standards are unclear. - Weighting and conclusion: - National AML/CFT policies appear in several documents (National Development Plan 2014–2017, National Intelligence Plan) drafted based on main risks. - Given the new NRA in December 2016, some risks remain to be addressed. - National committees and mechanisms exist to coordinate AML/CFT matters, but inter-institutional collaboration between UIAF and supervisors and between UIAF and customs authorities needs strengthening. - Unclear how national mechanisms coordinate policies against proliferation financing. - Recommendation 2 is rated largely compliant. ### Recommendation 3 — Money laundering offense and predicate offenses - Background: - Colombia was rated largely compliant on Recommendation 1 in the 2008 MER. Deficiencies related to range of predicate offenses and doubts about autonomy of the ML offense. - Criterion 3.1 – (Mostly Met): - Article 323 of the Criminal Code (CC) criminalizes activities related to laundering of assets, aligned with Vienna and Palermo Conventions; Article modified in 2015 to include new predicate offenses. - Some required categories of offenses remain not covered (see Criteria 3.2 and 3.3). - Article covers acquisition, securitization, investment, transport, transformation, storage, conservation, custody, or management of assets of mediate or immediate origin in listed predicate offenses that give them appearance of legality, conceal true nature, origin, location, destination, movement or rights over those assets. - Absence of possession and utilization verbs required by the Palermo Convention is notable; many verbs in the definition (invest, transform, administrate, transport) cover some but not all such situations. - Criteria 3.2 and 3.3 – (Mostly Met): - ML offense comprises a list of predicate offenses with no threshold or combined approach. - Colombia’s predicate offenses include: human trafficking, extortion, illegal enrichment, kidnapping, arms trafficking, TF and management of resources related to terrorist activities, drug trafficking, offenses against the financial system, offenses against the public administration (corruption, bribery and tax crimes), smuggling of oil, smuggling or facilitation of smuggling, and conspiracy. - Not covered explicitly: sexual exploitation, counterfeiting and piracy of products, environmental crimes, murder or grievous bodily injury, robbery or theft; some of these may be covered via illegal enrichment of individuals, which establishes a wider scope of predicate activities. - Tax evasion: only predicate offense of tax evasion of indirect taxes per Article 402 exists; sanction applies to evading taxes but not to failing to declare them. Criminal action is extinguished by payment of the tax debt according to the CC. - A voluntary tax compliance program is in place; criminalization of direct tax evasion will begin in [text ends here in source]. - Overall rating note: - Several elements of the ML offense and range of predicate offenses have been strengthened but gaps remain; Criterion assessments for Recommendation 3 are mainly "Mostly Met." *Source: cr18314-colombiadar, section 4 (excerpts).* ### 2018. Though the are some missing predicate offenses, the illicit enrichment of individuals can ### cr18314-colombiadar - 2018. Though the are some missing predicate offenses, the illicit enrichment of individuals can ### Recommendation 3 — Money laundering (ML) criminalization and related elements - Criterion 3.4 – (Met) - ML offense is extended to any kind of property, explicitly includes property having their direct or indirect origin in the listed predicate offenses. - General elements in the CPC, Article 82 on confiscation: ML extends to assets and resources that directly or indirectly related to the crime, whether mixed or concealed within assets of lawful origin. - Criterion 3.5 – (Mostly Met) - Legislation requires a criminal conviction for assets to be considered the POC, making Article 323 of the CC an incomplete criminalization on strict legal analysis. - Supreme Court case law (CSJ 30762 2008) establishes it is not necessary that a person be convicted of a predicate offense to prove that property is POC; case law is applied extensively. - Criterion 3.6 – (Met) - Article 323: ML punishable even when activities are carried out, wholly or partly abroad. - Criterion 3.7 – (Met) - Article 323 refers to products of illegal activities and does not refer to the author of the predicate offense; inference and case law (CSJ 30762 2008) permit pursuing the same person for both offenses, including self-laundering. - Criterion 3.8 – (Met) - Supreme Court case law (CSJ 32872, 2010) permits proving intent and knowledge for ML via objective circumstances, including circumstantial evidence. - Criterion 3.9 – (Met) - Sanctions for ML: prison sentence of "ten (10) to thirty (30) years and a fine of one thousand (1,000) to fifty thousand (50,000) Colombian pesos legal minimum monthly wages." - Maximum penalty allowed is sixty (60) years; ML penalties may reach that limit in simultaneity with other crimes. - Aggravating factors can carry penalties of forty-five (45) and fifty-two (52) years. - Fines: "1,000 to 50,000 Colombian pesos official minimum wages," which in August 2016 would be roughly equivalent to a fine between US$230,000 and US$11,490,885. - Criterion 3.10 – (Not Met) - Colombian criminal framework does not include criminal liability of legal persons for ML; legal persons are sanctioned accessory to a main criminal sanction imposed on a natural person. - Law 1778/ 2016 criminalizes legal persons for acts of transnational bribery but not for ML. - Administrative sanctions possible for legal persons if there is a conviction of a person involving a legal person. - Criterion 3.11 – (Met) - Colombian criminal law includes ancillary offenses: participation, conspiracy, attempt (CC, Articles 30 and 340). - Weighting and Conclusion - Article 323 covers most standard requirements complemented by relevant case law; some predicate offenses not directly covered and no criminal liability for legal persons for ML. - Recommendation 3 is rated largely compliant. ### Recommendation 4 — Confiscation and provisional measures - Background - In its 2008 MER Colombia was rated compliant with former Recommendation 3; no technical deficiencies at that time. - Criterion 4.1 – (Met) - Two main mechanisms: i) criminal confiscation (section 82 of the Criminal Procedure Code CPC, Law 906/2004); and ii) asset forfeiture (section 34 of the Political Constitution and the AFL, Law 1708/2014). - Criminal confiscation: accessory to conviction; covers proceeds (direct and indirect) and instrumentalities used or intended for use in an offense, includes ML, predicate offenses, and TF; not applicable if statute of limitations has passed. - Asset forfeiture (AFL): constitutionally based, autonomous and independent from criminal proceedings; captures proceeds, instrumentalities, subrogate assets, property of corresponding value; not subject to statute of limitations. - Criterion 4.2 – (Met) - Subcriterion 4.2 (a) – (Met) - Legislation enables identification, tracing, evaluation of property subject to confiscation: powers of the FGN, Judicial Police, CPC Articles 205 and 244, AFL Articles 15, 16, 17, 18, 21; Decree 2136/2015; Regulatory Resolution 247/2013 created "National and International Cooperation Unit for Prevention, Investigation and Seizure of Assets" under CGR. - Subcriterion 4.2 (b) – (Met) - FGN can carry out provisional measures (freezing or seizing) to prevent disposal of property subject to confiscation; CPC Articles 83, 92, 93; AFL Articles 87 and 88. - Subcriterion 4.2 (c) – (Met) - CPC and AFL contain provisions to prevent or void actions prejudicing the country’s ability to freeze, seize, recover property (seizure and occupation, suspension of disposal power; CPC Articles 83 to 85; AFL section 88). - Subcriterion 4.2 (d) – (Met) - Legislative measures enable competent authorities to take investigative measures; investigative powers in Constitution Article 250, CPC, and AFL; further explained in R.29 and R.31. - Criterion 4.3 – (Met) - Rights of bona fide third parties protected in CPC Articles 82, 87, 99 and AFL Articles 3, 7, 22, 87, 124.4, 152, 212. - Criterion 4.4 – (Met) - Management and disposal mechanisms: CPC Articles 82 and 86 (confiscated property transferred to FGN through "Special Fund for Assets Management"; provisional measures managed for Special Fund). - AFL creates FRISCO with management and disposal powers; Decree 2136/2015 further regulates. - Weighting and Conclusion - Confiscation measures are comprehensive; all criteria met. - Recommendation 4 is rated compliant. ### Recommendation 5 — Terrorist financing (TF) offense - Background - Colombia was rated compliant with former Special Recommendation II in the 2008 MER. - Criterion 5.1 – (Mostly Met) - TF criminalized in Article 345 of the CC: punishes person "who directly or indirectly delivers, collects, receives, contributes goods or resources, or performs any act to promote, organize, or maintain illegal armed groups or terrorists, national or foreign, or finance their activities, or sustain their members economically." - Definition of Terrorism (Art.345) covers UN Conventions related to TF; described as any person "who provokes or keeps the population or a part of it in a state of distress or terror..." using means capable of wreaking havoc. - Criterion 5.2 – (Met) - Crime includes collection and provision of funds for supporting a terrorist organization, individual terrorist or activity; absence of link to a terrorist act covered. - Criterion 5.2 bis – (Mostly Met) - Financing of travel for individuals to perpetrate, plan, prepare or engage in terrorist acts or to provide/receive terrorist training is not explicitly included; offense broadly defined and would cover most such activities. - Some cases of financing travel for individuals not linked to any terrorist organization and who haven’t participated in terrorist activity could be argued not covered. - Criterion 5.3 – (Met) - Legislation does not distinguish sources of funds; draws no distinction between legal and illegal sources; "goods and resources" language broad enough to include sources. - Criterion 5.4 – (Met) - Crime does not require the terrorist act to be carried out; sufficient to finance individuals, activities, organizations or terrorists regardless of destination of funds. - Criterion 5.5 – (Met) - Case law: intent cannot be proved directly; must be proved through indirect evidence, circumstantial evidence. - Criterion 5.6 – (Met) - Sanctions: imprisonment of "(...) thirteen (13) to twenty (22) years and a fine of thirteen hundred (1,300) to fifteen thousand (15,000) minimum monthly wages" (US$298,763 and US$3,447,270). Considered effective, proportionate, dissuasive. - Criterion 5.7 – (Partly Met) - CC does not include criminal liability of legal persons for TF. CPC Article 91 establishes suspension and cancellation of legal personality as accessory sanction to a criminal penalty on a natural person. - Law 1778/ 2016 criminalizes legal entities for transnational bribery, but not for TF. - Criterion 5.8 – (Met) - Legislation includes sanctions for attempt (Article 27), accomplice/participation (Article 30), organizing/directing/contributing; all ancillary crimes including conspiracy covered. - Criterion 5.9 – (Met) - TF offense included as predicate offense of LA in Article 323 of the CC. - Criterion 5.10 – (Met) - TF includes financing of terrorist organizations, foreigners and nationals; financing in Colombia punishable regardless of where terrorist activity takes place. - Weighting and Conclusion - Article 345 provides basis for criminalizing TF per standards; deficiencies remain regarding financing of travel and criminal liability of legal persons. - Recommendation 5 is rated largely compliant. ### Recommendation 6 — Targeted Financial Sanctions (TFS) related to Terrorism and TF - Background - Colombia was rated partially compliant with former SR.III in 2008 MER; lacked procedures allowing freezing of terrorism-linked assets without delay. - Identifying and Designating - Criterion 6.1 – (Met) - Subcriterion 6.1(a) – (Met): Inter-Ministerial Agreement (Article 20, Law 1121 of 2006) gives FGN authority to propose designations under Resolutions 1267 and 1988; duty to inform MINREX. - Subcriterion 6.1(b) – (Met): Article 20 requires competent authorities to verify databases for presence/transit of persons on UNSC lists and related assets/funds. - Subcriterion 6.1(c) – (Met): FGN requests MINREX to activate designation procedure when reasonable grounds under UNSCRs 1267, 1988, 1718, or 1737 are met; request not conditioned on criminal proceeding. - Subcriteria 6.1(d) and (e) – (Met): MINREX must follow standard listing forms and include relevant information for designation. - Criterion 6.2 – (Met) - Subcriterion 6.2 (a) – (Met): FGN is authority to propose designation under UNSCR 1373; MINREX to request freezing to Corresponding states. - Subcriterion 6.2 (b) – (Met): Article 20 requires competent authorities to verify databases for persons/entities on UNSC lists. - Subcriteria 6.2 (c) and (d) – (Met): Analysis of proposals must be "without delay" and based on "reasonable criteria"; Attorney General applies immediacy principle. - Subcriterion 6.2 (e) – (Met): Law 1708/04 Articles 204 and 205 enable FGN to comply with International Conventions and conduct administrative or legal cooperation. - Criterion 6.3 – (Met) - Subcriteria 6.3 (a) and (b) – (Met): FGN has authority and procedures to collect/request information to identify potential designation targets or to operate ex parte. - Freezing - Criterion 6.4 – (Met) - Article 20, Law 1121 of 2006: FGN proceeds immediately to exercise competence and appoint a prosecutor to issue precautionary measures for freezing funds/assets upon positive match; AFL can freeze funds without criminal investigation but freezing tied to asset forfeiture process (precautionary measures adopted when prosecutor establishes sufficient evidence per Articles 29.1 and 88 of the AFL). - Criterion 6.5 – (Partially Met) - Subcriterion 6.5 (a) – (Partially Met): Law 1121 requires reporting of property related to designated persons to UIAF, but reporting entities are not required to freeze assets; UIAF informs FGN which orders freezing; process can take around three hours. - Subcriterion 6.5 (b) – (Not Met): Financial institutions and DNFBPs are not required to freeze assets/funds of designated persons. - Subcriterion 6.5 (c) – (Partially Met): No explicit prohibition for natural or legal persons to provide funds/assets/services to designated persons in agreement/AFL; Colombian nationals and persons/entities within Colombian jurisdiction effectively prohibited via TF prosecution under Article 345, but prohibition not strictly covered in agreement nor AFL. - Subcriterion 6.5 (d) – (Partially Met): Communication to financial institutions and DNFBPs is via dedicated email under Inter-Administrative Agreement; no specific guidance provided to them. - Subcriterion 6.5 (e) – (Partially Met): Reporting entities must report discovery of property related to terrorism to UIAF but not required to freeze it; no explicit provision to report measures taken after freezing order is issued. - Subcriterion 6.5 (f) – (Met): Procedure based on AFL and agreement includes protections of rights of bona fide third parties. - Delisting, Unfreezing, and Access - Criterion 6.6 – (Met) - Subcriteria 6.6 (a–f) – (Met): Agreement and AFL provide system to remove designated persons and unfreeze funds (clause references for Resolutions 1267, 1373, 1988). - Subcriterion 6.6 (g) – (Met): Communication of delisting/unfreezing to financial institutions and DNFBPs via dedicated email; FGN or judge in asset forfeiture proceedings shall communicate via judicial notice pursuant to Law 1708 of 2014. - Criterion 6.7 – (Met) - Measures for accessing funds for expenses included in the agreement and the AFL. - Weighting and Conclusion - AFL and inter-institutional agreement allow authorities to freeze funds/assets as precautionary measure. - Financial institutions and DNFBPs are not required to freeze assets/funds of designated persons. - Most TFS obligations are administrative in nature via an inter-institutional agreement rather than specified in legislation. - Recommendation 6 is rated partially compliant. ### Recommendation 7 — Targeted Financial Sanctions related to proliferation financing (PF) - Criterion 7.1 – (Not met) - Article 20, Law 1121 of 2006 procedure has no reference to UNSCRs related to prevention, suppression, disruption of proliferation of WMD and its financing; it only refers to persons/entities listed for links with terrorist organizations. - Some supervisors’ circulars and an Inter-Administrative Cooperation Agreement (30 November 2015) for SFC-supervised financial institutions include UNSCRs on proliferation of WMD but only require identifying and reporting to authorities those designated by the UNSCRs; no freezing obligations. - AFL and asset forfeiture framework: - AFL allows possible freezing only under precautionary measures of Asset Forfeiture Proceedings (judicial process, Article 9 AFL). - AFL defines Asset Forfeiture (Article 15) as consequence of illegal activities consisting of declaration in favor of the State by judicial sentence; AFL applies to assets linked to illegal activities criminalized in the Penal Code or activities deteriorating social morality expressly covered by law (Article 1). - AFL cannot apply to persons/entities merely because of UNSC designation; UN freezing actions are not envisioned as a declaration in favor of the State based on a judicial sentence. - Weighting and Conclusion - Procedure gaps and the absence of a compulsory freezing regime for proliferation-related UNSCR designations lead to Criterion 7.1 being Not met. - Recommendation 7 is impacted by these deficiencies. *International Monetary Fund — cr18314-colombiadar (2018)* ### 29.1 and 88), the precautionary measure will be adopted. In other words, freezing cannot be ### cr18314-colombiadar - 29.1 and 88), the precautionary measure will be adopted. In other words, freezing cannot be ### UNSCR asset freezing and Recommendation 7 — main findings and legal framework - Freezing is a precautionary measure in Colombia and cannot be applied directly by entities or persons until there is a freezing order issued as a precautionary measure by the prosecutor, after assessing that the requirements laid down in the AFL concur in the specific case (Article 26.1 AFL; procedure follows CPC). - The prosecutor is the singular authority responsible for UNSCR freezing orders in Colombia; freezing is safeguarded by elements of judgment to be determined by the Prosecutor Office (Article 29.1). - The Inter-Administrative Agreement requires the prosecutor to assess the relevance of list information (Article 2). - There must be sufficient evidence to consider a link with any of the illicit causes (Articles 29.1 and 88). - Penal Code and complementary provisions are observed to link precautionary measures with any possible illicit cause (Article 26.3 AFL). - The mechanism under the AFL differs from that established in R.7 and UNSCRs. ### Recommendation 7 — subcriteria assessments (explicit ratings) - Criterion 7.2 – (Not Met): prosecutor is singular authority; legal requirements (AFL) impose evidentiary assessments not aligned with UNSCRs. - Subcriterion 7.2 (a) – (Not Met): Agreement (clause 4.4) requires FIs under SFC to freeze only when Prosecutor orders precautionary measures per AFL and CPC; Article. 88.1: precautionary measure applied without prior notification but only after Prosecutor determines assets fall under Article.16 cases for asset forfeiture (Article.29.1). - Subcriterion 7.2 (b) – (Not Met): AFL allows freezing of goods/assets that are direct or indirect product of illegal activity, unjustified equity increases where elements of knowledge exist, and in certain cases lawful assets but only in cases listed in Article 16; AFL obligation does not include all funds/assets owned or controlled by designated persons/entities as required by R.7. - Subcriterion 7.2 (c) – (Not Met): Law 1121 (Article. 20) requires reporting presence of persons/property/funds listed in UNSCRs on “terrorist organizations,” but does not prohibit designated persons/entities from receiving funds or economic resources directly or indirectly or for their benefit as required by relevant UN Resolutions. - Subcriterion 7.2 (d) – (Partly Met): Procedures for communicating UNSC designations to reporting entities described in Cooperation Agreement and Circulars; MINREX→UIAF→SFC chain for entities under SFC; SFC Circular Letter No. 110 (December 30, 2015) Directives 1, 2, and 3 require immediate confrontation and reporting to Deputy General Prosecutor if match; supervisors for other reporting entities only request permanent monitoring of UNSCR lists; most entities under Supersociedades not classified as reporting entities and not obligated by SAGRLAFT; no guidance on NP freezing for reporting entities. - Subcriterion 7.2 (e) – (Not Met): No regulatory framework to inform authorities of assets frozen by entities following UNSC Resolutions because Colombian framework does not allow freezing until precautionary measure adopted by Prosecutor under AFL. - Subcriterion 7.2 (f) – (Met): Prosecutor must safeguard rights of third parties in good faith at time of issuing freezing resolution (Articles 87 and 31 AF). - Criterion 7.3 – (Partly Met): Persons/entities only required to monitor lists and inform authorities; SFC oversees for financial institutions; no specific rules on monitoring compliance for DNFBP supervisors; freezing must be ordered by prosecutor; breach of freezing order would be under judicial sanctioning proceedings. - Criterion 7.4 – (Partly Met): Delisting procedure exists for financial institutions in cases of homonymy/identification error (Clause 4.5, Inter-Administrative Cooperation Agreement); prosecutor forwards delisting requests to Director of Political Multilateral Matters (DPMM) of MINREX to inform UNSC; prosecutor may authorize access to frozen funds/assets and issue exemptions for basic expenses in accordance with UNSCRs 1718 and 1737 (reporting to DPMM); no provision on delisting for reporting entities not supervised by SFC; no mechanism to communicate delistings/unfreezing to reporting entities other than mechanism in 7.2(d); no guidance/public procedures on obligations for delisting/unfreezing. - Criterion 7.5 – (Not Met): No mechanism to permit addition of interests or other earnings on frozen accounts or payments due under contracts/obligations arising prior to listing; only specific procedure (Clause 4.5) to permit basic expenses requiring prosecutor to forward request to DPMM of MINREX to obtain Sanctions Committee permission; no mechanism for payments due under pre-listing contracts. - Weighting and Conclusion: Colombia does not meet criteria 7.1 and 7.5 and Subcriteria 7.2 a), b), c), and e). There are no laws/regulations that require individuals/entities to freeze goods/assets related to UNSC Resolutions on proliferation of WMD and its financing; only obligation to inform authorities under AML/CFT instructions. Freezing actions can only be applied after order by prosecutor as precautionary measure under AFL and only when link to a criminal offense exists. Recommendation 7 is rated not compliant. ### Nonprofit Organizations (Recommendation 8) — main findings - Historical context: 2008 MER rated Colombia non-compliant with former Special Recommendation VIII; subsequent steps included Decree 4530/2008 creating a Direction of Policies of fight against related activities. - Overall weighting and conclusion: Authorities can investigate NPOs and gather relevant information and a robust system exists to enable cooperation and information exchange on TF; however, Colombia has not identified which subset of organizations fall within FATF definition of NPOs, nor identified which NPO types/features are likely at specific risk of TF abuse; has not reviewed adequacy of AML/CFT regulations for relevant NPOs nor taken steps to promote effective supervision/monitoring demonstrating risk-based measures apply; there are no comprehensive and clear policies for FATF-defined NPOs; not all relevant NPOs, particularly religious and foreign NPOs, are subject to effective, proportionate and dissuasive sanctions. Recommendation 8 is rated partially compliant. ### Recommendation 8 — subcriteria assessments (explicit ratings and evidence) - Criterion 8.1 – (Partly Met): - Subcriterion 8.1 (a) – (Partly Met): Some steps to identify ML/TF risks of some NPO categories (typology on TF risk [2016], UIAF and SES ML/TF mutual and cooperative sector document [2016], UIAF study on some NPOs sectors [2017]); Colombia has not identified subset of organizations within FATF NPO definition or features/types likely at specific TF risk; 2013 NRA does not address NPO ML/TF risks; 2016 NRA addresses certain vulnerabilities in NPOs under Coldeportes, SES and Supersalud. - Subcriterion 8.1 (b) – (Partly Met): Reports produced are not comprehensive to cover threats posed by terrorist entities to at-risk NPOs and how they abuse those NPOs. - Subcriterion 8.1 (c) – (Partly Met): Colombia reviewed adequacy of AML/CFT regulations for NPOs under SES, Coldeportes and Supersalud, but not for subset of NPOs that may be abused for TF support as required. - Subcriterion 8.1 (d) – (Partly Met): Some steps taken (UIAF study [2017]) but Colombia does not periodically reassess sector to review new information on vulnerabilities. - Criterion 8.2 – (Partly Met): - Subcriterion 8.2 (a) – (Partly Met): All NPOs required to register (Decree 2150/1995 Articles 42 and 43; foreign NPOs register under Chamber of Commerce Article 48 Civil Procedure Code and Decree 019/2012; religious NPOs before Ministry of Interior Law 133/1994 and Decrees 782/1995, 1319/1998, 966/2001, 505/2003, 1066/2015; sport NPOs under Coldeportes Decree 407/1996; solidarity economy NPOs before SES Article 63 Law 454/1998; health NPOs under Supersalud). NPOs seeking tax exemptions must register before DIAN and submit financial/accounting information annually. Circular No. 11 of 2017 (Mayor's Office of Bogota) promoted integrity and AML/CFT policies at district level. Except for Bogota, no comprehensive clear policies to promote accountability, integrity, public confidence in NPO administration/management. - Subcriterion 8.2 (b) – (Partly Met): UIAF conducted outreach/training to raise awareness in some NPO sectors (Article 6 Law 526 (1999)); other relevant authorities did not conduct outreach/training for NPOs falling under FATF definition. - Subcriterion 8.2 (c) – (Mostly Met): UIAF Strategic Analysis Division conducts studies on ML/TF trends/typologies; Ministry of Justice, UNODC and NPO representatives produced "Money Laundering and Terrorism Financing Risk Assessment Model for Non-Profit Organizations" (2016). - Subcriterion 8.2 (d) – (Partly Met): Practice for tax-exemption NPOs uses financial system, but Colombia has not taken specific actions to encourage NPOs to conduct transactions via regulated financial channels wherever feasible. - Criterion 8.3 – (Not Met): Legal bases for general supervision powers exist for SES, Coldeportes, Supersalud and Mayor's Office of Bogota, but no information on NPOs registered at district level other than Bogota nor on religious and foreign NPOs; no steps to promote effective supervision or monitoring demonstrating risk-based measures apply to NPOs at risk for TF abuse. - Criterion 8.4 – (Partly Met): - Subcriterion 8.4 (a) – (Not Met): SES, Coldeportes, Supersalud have legal authority to supervise/monitor AML/CFT compliance in general but legal basis does not specifically establish power to supervise AML/CFT requirements; authorities do not actually monitor compliance with risk-based measures. - Subcriterion 8.4 (b) – (Partly Met): Relevant supervisors can apply a range of sanctions including fines and intervention; Article 47 and Article 50 of Administrative Procedure Code provide sanctioning framework/criteria; Mayor's Office of Bogotá publishes list of noncompliant NPOs and can commence suspension processes; not all relevant NPOs are subject to effective, proportionate and dissuasive sanctions. - Criterion 8.5 – (Met): Relevant authorities can investigate NPOs and gather relevant information. - Subcriterion 8.5 (a) – (Met): Robust cooperation and information exchange system; C3FTD created March 2016 by MOU (Ministry of National Defense, FGN, UIAF, DNI) with Intelligence and Judicial Committees; UIAF included in intelligence community by Law 1621; Decree 857/2014 sets coordination/cooperation functions; CCICLA established with Operational Committee for Prevention and Detection and Committee for Investigation and Prosecution (Decree 3420/2014); UIAF may request any public entity information (Article 1 Decree 1497/2002). - Subcriterion 8.5 (b) – (Met): FGN has specialized divisions including Division against Terrorism (Article 2 Decree 16/2014); CPC provides measures for investigations; Judicial Police and PEF support FGN. - Subcriterion 8.5 (c) – (Met): Authorities have legal powers to access NPO administration/management information within investigations (FGN empowered by Article 250 Constitution and Article 114 Penal Code). - Subcriterion 8.5 (d) – (Met): Legal powers/mechanisms in place to exchange information promptly to take preventive/investigative action. - Criterion 8.6 – (Met): Effective points of contact for international requests related to NPOs; Colombia part of Europol, Interpol; member of GAFILAT’s RRAG; RRAG contacts are National Police and FGN; UIAF member of Egmont Group since 2000; FGN and DIAN can exchange information with foreign counterparts. ### Financial institution secrecy laws (Recommendation 9) — main findings and conclusion - Criterion 9.1 – (Met): FI secrecy laws do not inhibit competent authorities' access to information needed to combat ML/TF. - Article 15 NC enshrines privacy/habeas data but provides gateways for access in tax, judicial, inspection, or intervention matters. - Code of Administrative Procedure Article 27 provides gateway for access to confidential information by competent authorities. - Article 9 Law 526/1999 (as amended by Article 8 Law 1121/2006) allows UIAF access to information protected by banking, forex, securities or tax secrecy (except information reserved by Attorney-General). - Article 42 Law 1621/2013 grants similar powers to intelligence agencies. - Supervisors (SFC Decree 255/2009; DIAN Decree 4048/2008, Resolution 396/2005, Articles 8 and 9 Decree-Law 2245/2011; SES Article 36 Law 454/1998; MINTIC Law 1369/2009) can compel document production and request information from supervised entities. - SFC Article 326 EOSF (as amended by Article 45 Law 510/1999) allows exchange of supervisory information with foreign counterparts; SFC has 29 bilateral/multilateral arrangements for international cooperation. - Supersolidaria and MINTIC do not enter exchange of information agreements with foreign counterparts due to restrictions on savings and loans cooperatives and postal money operators. - Weighting and Conclusion: No legal obstacles to sharing information between financial institutions in circumstances required by Rs.13, 16, and 17. Recommendation 9 is rated compliant. ### Customer Due Diligence (Recommendation 10) — main findings and framework - Legal/regulatory framework relevant to CDD: EOSF (Chapter XVI Articles 102–107), Law 190/95, Law 1121/2006, Law 365/1997, Law 454/1998, Law 1369/2009; supervisory circulars/resolutions including SFC SARLAFT Circular 55/2016 (effective March 31, 2017) Part I Title IV Chapter IV applicable to banks, insurance and securities intermediaries, mutual funds, pension fund managers, fiduciaries, finance companies, financial cooperatives, money remitters, and other FIs; SES Circular 4/2017 (savings and loans cooperatives); MINTIC Regulation 2564/2016 for PTOs; DIAN Circular 13/2016 for currency exchange firms. - Scope gaps and observations: - PTOs: Law for PTOs does not explicitly designate them as reporting entities subject to all AML/CFT requirements but imposes AML/CFT obligations under Regulation 2564/2016. Unregulated lenders are out of AML/CFT scope. - Most financial institutions (except PTOs) must comply with Articles 102–107 EOSF which include broad AML/CFT obligations but do not expressly cover full CDD obligations as required by the standard. - Law 1369/2009 establishes PTO framework including obligation to comply with Law and Regulations but does not explicitly state PTOs are reporting entities required to conduct CDD, report suspicious transactions to UIAF, and maintain records as required by the standard. - Circular 55/2016 Article 2 lists some entities eligible for simplified CDD measures and exemptions from full AML/CFT obligations under Chapter IV. - Criterion 10.1 – (Met): No explicit prohibition on anonymous accounts or fictitious names; identification and verification requirements prevent anonymous/fictitious accounts for financial institutions under SFC supervision; criterion applies to SFC-supervised FIs and not to currency exchange firms and PTOs (which do not maintain accounts). - Criterion 10.2 – (Partly Met): - No explicit legal obligation in Law for FIs to apply CDD as specified in the standard; Article 102 EOSF obligation to understand customer's economic activity falls short of covering all CDD elements. - CDD addressed in circulars/regulations requiring FIs to implement SARLAFT risk management systems including CDD procedures; Circular 55/2016 requires customer identification prior to establishing business relationships (Article 4.2.2.2) and completion of mandatory CDD form, interview, supporting documents, and formal approval; requirement for personal interview and record-keeping of interviewer name, date, and results. - SES Circular 4/2017 section 2.2.2.3.1 obliges identification/verification when establishing business relationships for savings and loans cooperatives. - Framework does not expressly incorporate “occasional customer” concept; SFC and MINTIC include “users” (persons receiving a service without being a customer). Occasional transactions are subject to same CDD requirements regardless of amount; ambiguity under Circular 55/2016 as section 4.2.2.2.1 listing all CDD measures applies only to “customers” per section 1.4. - Wire transfer payment orders in circumstances identified under C.10.2 (see R.16) are subject to CDD measures regardless of any amount; no de minimis threshold established. - Applicable circulars silent on applying CDD in circumstances covered by C.10.2 (d) to (e). - Currency exchange firms Circular 13/2016 (DIAN) requires mandatory CDD form for any foreign exchange transaction but not verification of information. - Regulation for PTOs (Regulation 2564/2016 MINTIC) noted but text truncated in source. *Source: cr18314-colombiadar (PDF chapter/section) — https://www.imf.org/-/media/files/publications/cr/2018/cr18314-colombiadar.pdf* ### section 6.2.1), is silent with respect to when CDD is required. Similarly, the other elements of the ### section 6.2.1), is silent with respect to when CDD is required. Similarly, the other elements of the ### Required CDD Measures for All Customers - Criterion 10.3 – (Partly Met) - Financial institutions under the supervision of the SFC are required to identify and verify the identity of all customers, both existing and potential, by obtaining and verifying the information contained in the mandatory customer acceptance form (CDD form). - SARLAFT shall include procedures to obtain effective and timely knowledge of all customers and to verify the information and supporting documentation (section 4.2.2.2.1 of Circular 55/2016). - “Customer” defined as any natural or legal person with whom the institution establishes and maintains a contractual or legal relationship to supply any products pertaining to their commercial activity; definition does not expressly include legal arrangements. - Identification and verification required for customer—both natural and legal persons, including the BO—based on valid documents listed under the CDD form (section 4.2.2.2.1.3 of Circular 55/2016). Identification data under the CDD form is considered a reliable, independent source and constitutes the minimum data to be collected. - Savings and loans cooperatives: similar requirements to SFC-supervised financial institutions; obligation to identify member and customer and verify identity for natural and legal persons per Circular 4/2017 of the SES, section 2.2.2.3.1. For legal persons, requirement to check identity of shareholders with an ownership above five percent. - Professional currency exchange firms: required to identify the natural or legal person through a CDD process (Circular 13/2016 of the DIAN, section 5.2.1.1) but the provision is silent with respect to the need to verify the identity of the customer; a CDD form containing identification data should be implemented. - PTOs: need to identify and verify the identity of the customer, both natural and legal persons (no mention to legal arrangements), based on reliable independent documents listed under section 6.2.2 of Regulation 2564/2016. - Criterion 10.4 – (Partly Met) - SFC-supervised financial institutions must adopt a CDD form containing, as a minimum, the information listed under section 4.2.2.2.1.3 and complete it for any potential customer and any person purporting to act on behalf of the customer. - Financial institutions required to verify that the person is authorized to act on behalf of the customer; obtain full name and identification (ID) number of third party acting on behalf of the customer and the documents granting legal power. - Currency exchange firms and postal transfers operators (PTOs): require full name and ID number of legal representative purporting to act on behalf of a legal person (Circular 13/2016 of the DIAN; Regulation 2564/2016 of the MINTIC) but are silent with respect to natural person customers and there is no obligation to verify authorization to act on behalf. - Criterion 10.5 – (Partly Met) - SFC-supervised financial institutions required to identify the BO (section 4.2.2.2.1.4 of Circular 55/2016). Definition of BO set out under section 1. - Institutions should take reasonable measures to obtain name and identification number of BOs and consult, as minimum, the UNSC sanction lists in force for Colombia (section 4.2.2.2.1.1.1). - Mandatory CDD form addresses only one of three elements related to BO identification (natural person(s)/shareholder(s) who owns directly or indirectly five percent or more of the legal person). - Financial institutions exempted from identifying the BO when the customer owns more than five percent of a company listed in the stock exchange and subject to disclosure requirements. - For legal arrangements, financial institutions required to identify BO, including trustee and beneficiaries (section 4.2.2.2.1.1.1). - Savings and loans cooperatives: not required to identify and verify identity of the BO except for PEPs. PTO regulation silent on BO identification. - Currency exchange firms: BO defined under section 3 of Circular 13/2016 of the DIAN and in line with the standard but no explicit obligation to identify and verify BO; CDD form requires identification of the BO (section 5.2.1.1) but not verification. - Criterion 10.6 – (Not Met) - No obligation for financial institutions under the supervision of the SFC, DIAN, SES and MINTIC to understand or obtain information on the purpose and intended nature of the business relationship. - Criterion 10.7 – (Partly Met) - SFC-supervised financial institutions required to monitor on an ongoing basis customers’ transactions (Circular 55/2016, section 4.2.2.2.1.2) and to obtain information ensuring transactions are consistent with institution’s knowledge of the customer and business activity. - SARLAFT requires inclusion of alerts, risk factors ‘criteria, and follow-up of operations; monitoring through different risk factors (section 4.2.2.3.3.2) and monthly electronic consolidation of transactions required. - Required considerations include business activity, volume, frequency of transactions, amount, income, expenditures and capital. Section 4.2.2.2.1.8.1 requires confirmation and update at least once a year of customer data that could change (address, telephone, activity, source of funds, among others). - Currency exchange firms: because they do not maintain accounts, ongoing due diligence on business relationship including scrutinizing transactions is not applicable; Circular 13/2016, section 6.4 only requires monitoring the risk management system’s effectiveness. - Savings and loans cooperatives: required to monitor transactions on an ongoing basis and keep information to compare transactions with economic activity (Circular 4/2017, section 2.2.2.3.1); consolidate monthly electronically and update CDD form information at least once a year. - PTOs: required to monitor customers’ transactions on an ongoing basis and define a risk profile (Regulation 2564/2016, sections 6.2.2 and 6.2.3). No obligation to address all elements under C.10.7 (a) and no obligation under 10.7 (b). ### Specific CDD Measures Required for Legal Persons and Legal Arrangements - Criterion 10.8 – (Partly Met) - SFC-supervised financial institutions required to request information listed under mandatory CDD form to understand customers’ business (section 4.2.2.2.1.3 of Circular 55/16). - Required to understand ownership and structure, including identity of shareholders who directly or indirectly own five percent or more. - For legal arrangements, obligation limited to obtaining the type of assets establishing the trust. - Similar obligations set for savings and loans cooperatives (Circular 4/2017, section 2.2.2.3.1) and PTOs (Regulation 2564/2016, section 6.2.2). - Currency exchange firms: obligation to request information related to economic activity of customer and representative (Circular 13/2016, section 5.2.1.1) but no obligation to understand ownership and control structure. - Criterion 10.9 – (Partly Met) - Circular 55/2016, section 4.2.2.2.1.3 requires for legal persons: corporate name; legal form; name, identification number, address and telephone number of legal representative; business activity; identification of shareholders with ownership of five percent or more; source of funds; cash flows; other sources of revenues different from main activity; financial statements; forex activities; signature and fingerprints of person establishing relationship; application date; proof of existence and representative powers by a competent authority. - Circular does not include all elements of C.10.9 (b) (e.g., names of relevant persons having senior management position). - CDD form only requires identification of type of assets establishing the trust; financial institutions conducting business with trusts must identify the BO, including settlor and other beneficiaries (section 4.2.2.2.1.4.6). - All elements from C.10.9 (a) to (c) are missing for legal arrangements. - Savings and loans cooperatives: require name, legal form, address and proof of existence (Circular 4/2017, section 2.2.2.3.1); elements under C.10.9 (b) not required; legal arrangements not covered. - Currency exchange firms: elements under C.10.9 (a), except proof of existence, covered under Circular 13/2016, section 5.2.1.1; C.10.9 (b) missing; legal arrangements not covered. Same shortcomings apply to PTOs (Regulation 2564/2016, section 6.2.2). - Criterion 10.10 – (Partly Met) - BO for legal persons defined under C.10.5: natural person(s) who owns directly or indirectly five percent or more; or natural person who exercises control though not owning five percent; or natural person on whose behalf the transaction is conducted. - No elements covering situations where there is doubt as to who is BO, no natural person exercises control through ownership or other means, or ascertain identity of most senior management when no natural person is identified. - Circular applicable to currency exchange firms and Regulation applicable to PTOs do not cover elements under C.10 (a) to (c). - Savings and loans cooperatives: obligation to identify BO applies to PEPs. - Criterion 10.11 – (Partly Met) - Section 4.2.2.2.1.4.6 of Circular 55/2016: institutions conducting business with trusts (fiducia) must identify BO, including settlor and other beneficiaries. - Mandatory CDD form only requires identifying type of assets establishing the trust; circular silent on identifying trustees and any other natural person exercising ultimate effective control over the trust (including through chain of control/ownership) and taking reasonable measures to verify the information. - Criterion not applicable to financial institutions under supervision of SES, DIAN and MINTIC. ### CDD for Beneficiaries of Life Insurance Policies - Criterion 10.12 – (Partly Met) - Applicable only to financial institutions under supervision of the SFC (Circular 55/2016). - Intermediaries must obtain information to record existing relationships between insurance taker, insured, secured party and beneficiary; claims filed and indemnities received with respect to any insurer for the last two years; and an inventory of goods subject to insurance. - When insured, secured party and/or beneficiary is different than taker or underwriter, information shall be collected when establishing the business relationship. - If beneficiary cannot be identified when establishing the business relationship for justifiable reasons, intermediaries could accept the business relationship if required to identify the beneficiary before any claim is filed, expiration of the policy and payment of the certificate, or at time of payout. - If identity of beneficiaries of insurance contracts and trusts cannot be known at engagement time, information shall be obtained at time they are identified at payout. - Requirements are silent with respect to obligations set forth under C.10.12 (a) and (b). - Criterion 10.13 – (Not Met) - Circular 55/2016 does not consider the beneficiary of the life insurance policy as relevant risk factor in determining whether enhanced CDD measures are applicable. ### Timing for Verification - Criterion 10.14 – (Partly Met) - For SFC-supervised financial institutions, the identity of the customer and BO must be verified before entering a business relationship. - Regulatory framework does not contemplate “occasional customers” but includes concept of “user”; circular silent on timing of verification for “user”. - Exception for insurance sector under C.10.12 conditions where delayed verification may be permitted; elements (a) and (b) seem to be met implicitly as delayed verification occurs as soon as reasonably practicable and is essential not to interrupt normal business. - SARLAFT requires financial institutions to effectively manage ML/TF risks. - Savings and loans cooperatives: identification and verification of customer ID is precondition when accepting a member or customer (Circular 4/2017 of the SES, section 2.2.2.3.1); obligation does not cover identification and verification of BO. - Currency exchange firms and PTOs: respective circulars/regulations silent on timing for verification requirements. - Criterion 10.15 – (Partly Met) - Does not apply to SFC-supervised financial institutions and savings and loans cooperatives because they are not allowed to establish business relations before completing identification and verification. - Currency exchange firms and PTOs: no prohibition to utilize business relationship prior to verification but no obligation to adopt risk management procedures in line with C.10.15. ### Existing Customers - Criterion 10.16 – (Not Met) - No obligation for financial institutions under supervision of the SFC, SES, DIAN, and MINTIC to apply CDD requirements to existing customers based on materiality and risk. ### Risk-Based Approach - Criterion 10.17 – (Partly Met) - Except for PEPs and FATF-listed jurisdictions, only SFC-supervised financial institutions (section 4.2.1.4 of Circular 55/2016), SES (Circular 4/2017, section 2.2.1) and DIAN (Circular 13/2016, section 5.2.1.1) are required to apply enhanced measures for higher ML/TF risks. - No obligation for financial institutions under supervision of MINTIC to apply enhanced due diligence measures where ML/TF risks are higher. - Criterion 10.18 – (Partly Met) - SFC-supervised financial institutions can apply less stringent CDD measures for certain low-risk customers, products or transactions; extensive list under sections 4.2.2.1.7 and 4.2.2.1.6 of Circular 55/2016 based on SFC risk analysis for financial inclusion. - Simplified CDD requires only obtaining name, ID number and expiration date of ID document. - Category exempted from requirement to understand economic activity, characteristics, amounts and source of income and expenses; requirements applicable to PEPs and market knowledge. - For categories listed under section 4.2.2.2.1.6, institutions not required to complete mandatory CDD form nor conduct an interview; permitted to conduct CDD based on any information available. - Certain institutions already subject to SFC supervision, public administration of enterprises, pension schemes for employees, among others, are exempted from SARLAT application but required to apply obligations under Organic Statute (arts. 102-107). - Circulars/Regulations applicable to savings and loans cooperatives, currency exchange firms and PTOs are silent on simplified CDD measures. ### Failure to Satisfactorily Complete CDD - Criterion 10.19 – (Partly Met) - Section 4.2.7.2.1 of Circular 55/2016 requires reporting to the UIAF attempted transactions and those where institution is unable to complete CDD. - Savings and loans cooperatives under SES not allowed to commence a business relationship if unable to apply CDD measures (Circular 4/2007, section 2.2.1). Circular does not address requirement under C.10.19 (b). - Currency exchange firms (Circular 13/2016 of the DIAN): explicitly mention obligation to identify the customer prior to conducting a foreign exchange transaction but silent on verification; authorities assert identification is a pre-condition but absence of explicit obligation leaves situation unclear. Element under C.10.19 (b) not covered. - PTOs (Regulation 2564/2016 of the MINTIC): silent on timing for identification and verification and on situation where FI unable to complete CDD; unclear whether prohibition under C.10.19 (a) and requirement to consider filing an STR under 10.19 (b) apply. ### CDD and Tipping-Off - Criterion 10.20 – (Not Met) - No specific provision permitting SFC-, SES-, DIAN- and MINTIC-supervised financial institutions not to pursue CDD when they reasonably believe that performing such process will tip-off the customer. ### Weighting and Conclusion - Colombia meets criterion 10.1. - Partially meets criteria 10.2 to 10.5, and 10.7 to 10.10. - Criteria 10.6, 10.13, 10.16 and 10.20 are not met. - Colombia is partially compliant with most criteria under R.10. - Recommendation 10 is rated partially compliant. ### Recommendation 11—Recordkeeping (excerpt) - Historical context: In 2008 MER Colombia was rated largely compliant with former R.10 and Special Recommendation VII. For R.10 the only deficiency was absence of regulation establishing a retention period for documents for currency exchange firms supervised by DIAN. For SR.VII, rating was largely compliant since effectiveness of SARLAFT measures could not be established at the time. - Criterion 11.1 – (Met) - The Code of Commerce requires all merchants to keep documents for a period of 10 years. - Article 15 of the Colombian Constitution establishes that all documents, including private documents, must be delivered to competent authorities for judicial and administrative functions. - EOSF Article 96 establishes preservation of files and documents for a period of not less than five years. - SFC’s Basic Legal Circular Chapter I, Title IV part I, section 4.2.3 reinforces EOSF provisions including type of information to be kept in terms of ML/TF prevention. - DIAN’s SARLAFT Circular and the SES’ Basic Legal Circular of 2015 in number 8.3 referenced. *Source: https://www.imf.org/-/media/files/publications/cr/2018/cr18314-colombiadar.pdf* ### chapter XI of title II and the MINTIC Resolution 2564 of 2016, number 6.4, establish the details of ### chapter XI of title II and the MINTIC Resolution 2564 of 2016, number 6.4, establish the details of ### Record-keeping and Recommendation 11 - chapter XI of title II and the MINTIC Resolution 2564 of 2016, number 6.4, establish the details of the information which must be conserved for five years or more relative to the ML/FT risk management system. - Criterion 11.2 – (Met) - Pursuant to Article 15 of the Constitution, all records maintained by natural or legal persons in Colombia must be turned over to the competent authorities to exercise their functions. - Criterion 11.3 – (Met) - Numeral 4.2.3.1.3. of Chapter IV, Title IV, Part I of the Basic Legal Circular establishes that record-keeping by institutions supervised by the SFC must guarantee the integrity, timeliness, reliability and availability of the information contained therein. - For foreign exchange professionals, supervised by the DIAN, External Resolution 8 of 2000 issued by the Bank of the Republic in Article 3 establishes that they are required to keep the documents that prove the amount, characteristics and other conditions of the operation and the origin or destination of the currencies. - For savings and credit cooperatives and others supervised by SES, the SARLAFT Circular establishes in numeral 4.2.3, that records kept must ensure the integrity, timeliness, reliability and availability of the information contained therein. - Criterion 11.4 – (Met) - All these documents referred to in c.11.1 must also be available in electronic form in order to be made easily available to the competent authorities, when requested. - Weighting and Conclusion - The corresponding criteria in the 2013 Methodology are met. - Recommendation 11 is rated compliant. ### Politically Exposed Persons (Recommendation 12) — Overview - Colombia was rated partially compliant with former R.6 in the 2008 MER. - The FATF requirements have changed since 2008 and Colombia has amended its legal and regulatory framework to include new obligations. - Decree 1674/2016 provides a comprehensive list of individuals considered PEPs, which includes Heads of State or government, senior politicians, Ministers and Vice-ministers, senior government officials in line with the definition set forth under the standard. - The Decree only extends to domestic PEPs and applies for two years after the PEP has left the position. ### Criterion 12.1 — Assessment and gaps (Partly Met) - Financial institutions under the supervision of the SFC - Required to apply enhanced due diligence, pursuant to Circular 55/2016 with respect to the identification and monitoring of customers that are publicly exposed. - Required to put in place effective mechanisms to determine whether the customer or the BO is a PEP. - The obligation under the SFC Circular applies to domestic and foreign PEPs. - Financial institutions require a second level of approval (an instance or employee of higher hierarchy than the one that normally approves the relationship) before initiating business with a PEP, but it is not explicit that it be “senior management approval.” - If a customer or BO becomes a PEP, a notification to that higher instance or employee and to the person in charge of clients is required. There is no requirement for obtaining their approval. - The obligation under 12.1(c) is addressed under Section 4.4.4.4.1.3 of Circular 55/2016 (CDD mandatory form). - Enhanced monitoring in line with 12.1(d) is required under section 4.2.2.2.1.7 of Circular 55/2016. - DIAN and related rules - Section 3 of Circular 13/2016 of the DIAN defines PEPs as those persons listed under Article 1 of Decree 1674/2016 but falls short of considering foreign PEPs. - Section 5.2.1.1 in very general terms sets out the requirements for PEPs, which are limited to obtaining senior management approval before entering or continuing a business relationship with PEPs. The BO is not addressed. - The rest of the criteria under C.12.1 are not met. - Savings and loans cooperatives (SES supervision) - Requirements identical to those applicable to the financial institutions under the supervision of the SFC (Circular 4/2017, section 2.2.2.2.1). - Criterion 12(b) is covered and requires the board of directors’ approval. - For existing customers who become PEPs, the only requirement is to inform the board; no approval is required. - Required to establish the source of funds (not the source of wealth) and to conduct enhanced ongoing monitoring on the business relationship. - MINTIC Regulation 2564/2016 and PTOs - Article 3 of Regulation 2564/2016 of the MINTIC defines PEPs in line with the standard. - Article 6, section 6.2.4 establishes the obligations applicable to foreign PEPs. - PTOs are required to apply enhanced due diligence but there is no obligation to put in place a risk management system in line with C.12.1(a). - The requirement is silent with respect to the need to determine whether the BO is a PEP. - PTOs are required to obtain the approval with an employee with higher hierarchy before entering or continuing the business relationship with a PEP (which does not necessarily mean “senior management approval”) and to conduct enhanced monitoring on the relationship. *cr18314-colombiadar - chapter XI of title II and the MINTIC Resolution 2564 of 2016, number 6.4, establish the details of* ### Section 6.2.4 does not cover the obligation under C. 12.1 (c). ### cr18314-colombiadar - Section 6.2.4 does not cover the obligation under C. 12.1 (c) ### Politically Exposed Persons (PEPs) — Criteria 12.1–12.4; Weighting and Conclusion - Criterion 12.1 to 12.3: Colombia partially meets these criteria; Criterion 12.4: not met. - Recommendation 12 is rated partially compliant. - Key findings: - Section 6.2.4 does not cover the obligation under C. 12.1 (c). - Criterion 12.2 – (Partly Met): - For financial institutions under the supervision of the SFC, the same enhanced requirements set out for foreign PEPs apply to domestic PEPs and to legal representatives from international organizations, but this falls short of including other prominent functions (i.e., directors, deputy directors, and members of the board or equivalent function). - Regardless of the risks involved, the requirements under C. 12.1 (a) to (d), with the shortcomings identified under the previous criterion, apply also to domestic PEPs and the legal representatives of international organizations. - For savings and loans cooperatives, the enhanced requirements for foreign PEPs also apply to domestic PEPs and individuals entrusted with a prominent public function by an international organization; obligations cover both the customer and the BO. - Professional currency exchange firms (Circular 13/2016) must apply enhanced measures with respect to domestic PEPs but not for persons entrusted with a prominent function by an international organization; there is no obligation to determine whether the BO is a PEP. - Circular 13/2016 requires enhanced measures in cases of higher risk, with obligations under C. 12.1 (b) and (d), but no obligation to apply C. 12.1 (c). - Obligations for PTOs under Article 6, section 6.2.4 do not extend to persons entrusted with a prominent public function by an international organization and to the BO. - Criterion 12.2 (a) and (b) are only partially covered for domestic PEPs (same limitations as listed under 12.1 for foreign PEPs). - Criterion 12.3 – (Partly Met): - For SFC-supervised financial institutions, requirements under C. 12.1 and 12.2 (with stated limitations) apply to family members’ spouses, also common law spouses; and children. - Savings and loans cooperatives apply similar obligations (Circular 4/2017, section 2.2.2.2.1). - Obligations do not extend to close associates. - No requirements for currency exchange firms and for PTOs addressing C. 12.3 obligations. - Criterion 12.4 – (Not Met): - There are no requirements addressing the obligation set forth under C. 12.4. ### Correspondent Banking — Recommendation 13 - Historical context: - Colombia was rated partially compliant with former R.7 in the 2008 MER. The MER found no specific requirements for cross-border correspondent banking and no requirement for senior management approval to establish correspondent banking relationships. - Deficiencies were partly addressed through SARLAFT Circular 055 (section 4.2.2.2.1.4.5) of December 22, 2016 which came into effect on March 31, 2017. - Criterion 13.1 – (Partially Met): - Subcriterion 13.1 (a) (Not Met): No specific requirements to determine the reputation of the respondent institution and the quality of supervision. - Subcriteria 13.1 (b), (c) and (d) (Met): SARLAFT Circular 055 of 2016 requires banks to assess respondent institution’s AML/CFT controls, obtain prior approval from senior management before establishing new correspondent relationships, and understand respective AML/CFT responsibilities in cross-border correspondent banking relationships. - Criterion 13.2 – (Not Met): - Subcriterion 13.2 (a) (Not Met): Payable through accounts are not addressed by the new SARLAFT, which seems to confuse “payable-through accounts” with “shell banks.” - Subcriterion 13.2 (b) (Not Met): The CDD information requirement in SARLAFT refers to shell banks not payable through accounts. - Criterion 13.3 – (Partially Met): - No prohibitions to enter or continue banking relationships with shell banks; only procedures to verify that a respondent is not a shell bank and to verify that the respondent bank complies with KYC obligations. - Weighting and Conclusion: - Existing obligations require financial institutions to gather information to understand the nature of the respondent’s business and activities; however, no requirements to determine the quality of supervision, payable-through accounts are not addressed, and there are no explicit prohibitions on relationships with shell banks. - Recommendation 13 is rated partially compliant. ### Money or Value Transfer Services — Recommendation 14 - Historical context: - Colombia was rated compliant with former Special Recommendation VI in the 2008 MER. - Criterion 14.1 – (Met): - Money transfer services can only be offered by Exchange Market Intermediaries (EMIs) and PTOs, as provided by External Resolution 8 of 2000 and Law 1369 of 2009. - EMIs include commercial banks, mortgage banks, financial corporations, commercial financing companies, Financiera Energética Nacional (FEN), BANCOLDEX, financial cooperatives, brokerage firms, and exchange houses (Article 58, Res. 8 of 2000). - EMI must have registration and license by the SFC. DIAN monitors/supervises exchange regime activities per Decree 4048 of 2008. PTOs supervised by MINTIC require registration per Article No. 4 of Law 1369 of 2009. - Criterion 14.2 – (Met): - Article 4 of External Resolution 8 of 2000: SFC sanctioning power for EMIs; DIAN may impose sanctions under Decree 4048 of 2008; Article 40 of Law 1369 of 2009 provides sanctions for unauthorized postal money transfers. - Criterion 14.3 – (Met): - Article 102 of Decree 663 of 1993 (EOSF) requires SFC-supervised institutions to adopt controls to prevent ML/TF. - External Regulatory Circular DCIN-83 requires EMIs to conduct CDD. Article 5 of MINTIC Resolution 2564 of 2016 requires PTOs to establish minimum requirements and parameters for ML/TF and financing of proliferation of WMDs. - Criterion 14.4 – (Met): - Article 12 of MINTIC Resolution 3680 establishes information PTOs must submit about their agents, including internal control mechanisms for prevention and administration of risks, understood to include AML/CFT. - Criterion 14.5 – (Met): - Article 12 of MINTIC Resolution 3680: PTOs must supervise agent programs, including AML/CFT. MINTIC’s SARLAFT (Resolution No. 2564 of 2016, paragraph 6.2.8) requires PTOs to know their agent to prevent ML and TF. - Weighting and Conclusion: - All criteria are met. Recommendation 14 is rated compliant. ### New Technologies — Recommendation 15 - Historical context: - Colombia was rated Largely Compliant with former R.8 in 2008 MER. - Criterion 15.1 – (Partly Met): - Colombia conducted an NRA in 2016, but it does not reflect a specific review of ML/TF risks relating to new products, business practices, delivery mechanisms or new/developing technologies. - SARLAFT requires SFC- and SES-supervised financial institutions to identify and assess ML/TF risks in relation to development of new products/business practices, delivery mechanisms (encompasses new technologies). No requirement for PTOs. - Criterion 15.2 – (Partly Met): - For SFC- and SES-supervised financial institutions, SARLAFT obliges implementation of adequate systems to manage ML/TF risks. - Circular 55/2016 (section 4.1.1) and Circular 4/2017 (section 2.1.1) require identification of inherent ML/TF risks considering the four risk factors before launching products, modifying products, entering new markets, transacting in new jurisdictions, or establishing/modifying delivery channels (implicitly addresses technologies). - Resolution 2564 of the MINTIC applicable to PTOs addresses SARLAFT elements but lacks requirement for PTOs to undertake risk assessments prior to launching new products, business practices, or technologies. - Currency exchange firms: criterion does not apply given limitations on business (direct contact buying/selling of currency). - SARLAFT requires SFC- and SES-supervised institutions to adopt controls commensurate with identified risks in line with C. 15.2 (b); there are no requirements for PTOs. - Weighting and Conclusion: - Colombia partially meets criteria 15.1 and 15.2. Recommendation 15 is rated partially compliant. ### Wire Transfers — Recommendation 16 - Scope and general: - Requirements on domestic and international wire (SWIFT) transfers for financial institutions (banks, money remitters and other payment systems’ institutions—MVTS) are under SFC Article 5 of Circular 55/2016; PTO domestic transfers are governed by Regulation 2564/2016 (MINTIC). - Neither Circular nor Regulation establish a de minimis threshold for wire transfers. - Ordering Financial Institutions: - Criterion 16.1 – (Partially Met): - Article 5 of Circular 55/2016: for all wire transfers domestic and international, information related to originator and beneficiary must be obtained and maintained. - For international wire transfers, banks must obtain/maintain originator documentation including full name (first and last name), address, country, city and originating FI; beneficiary: full name (first and last name), address, country and city. Information must accompany transfer and be maintained through payment chain for originator(s) and BO(s). - Similar requirements for MVTS: full name (first and last name), country, city and originating FI/MVTS; beneficiary documentation required when payments are to non-customers. - No requirement to include account numbers for originator and beneficiary (or a unique transaction reference number where no account exists) which permits traceability. - No requirement to verify accuracy of originator’s information. - Criterion 16.2 – (Not Met): No requirements addressing wire transfers from a single originator when bundled in a batch file. - Criterion 16.3 – (Not Applicable): No de minimis threshold; all wire transfers subject to c.16.1. - Criterion 16.4 – (Partially Met): No requirement for financial institutions to verify customer information where there is a suspicion of ML/TF. - Criterion 16.5 – (Partially Met): - Financial Institutions and MVTS for domestic transfers must maintain originator and beneficiary information, but no requirement to obtain/maintain account numbers (or unique transaction reference number). - PTOs (Article 6.2.7, Regulation 2564/2016) must maintain extensive information for originator and beneficiary but likewise no requirement to include account numbers (or unique transaction reference number). - Criterion 16.6 – (Partially Met): All transfers must be accompanied by required information but major shortcomings in documentation and lack of account/reference number requirements. - Criterion 16.7 – (Met): Obligation to maintain all information and documentation for not less than five years; MINTIC-supervised institutions to maintain for five years or longer if related to SARLAFT risk management systems. - Criterion 16.8 – (Partially Met): Circular and Regulation require documentation but do not require account numbers or unique transaction reference number; absence of such information is not ground to refuse execution. - Intermediary Financial Institutions: - Criteria 16.9 to 16.12 – (Not Met): Requirements do not explicitly address instances where institution acts as intermediary, experiences technical limitations, lacks required information, or must apply risk-based policies in absence of information. Criterion does not apply to PTOs (they only originate/receive orders). - Beneficiary Financial Institutions: - Criteria 16.13 to 16.15 – (Not Met): Existing requirements do not explicitly address beneficiary institution instances lacking required originator/beneficiary information or required risk-based policies for execution/rejection/suspension or follow-up actions. - Money or Value Transfer Service Operators: - Criterion 16.16 – (Mostly Met): MVTS must maintain information accompanying transfer through payment chain, but no requirement to obtain originator’s account numbers or unique transaction reference number. PTOs have extensive documentation requirements but no requirement for account numbers or unique transaction reference number. - Criterion 16.17 – (Not Met): Neither Circular nor Resolution contain specific requirements when MVTS provider acts as originating entity and beneficiary of the transfer; no requirement for filing an STR. - Implementation of Targeted Financial Sanctions: - Criterion 16.18 – (Met): Financial institutions and PTOs conducting wire transfers subject to section 6 of Circular 55/2016 and Article 7 of Regulation 2564/2016, giving effect to UN Resolutions 1267, 1988, 1373, 1718, 1737, 2178, and successor resolutions. - Weighting and Conclusion: - Numerous gaps: no requirement to include account numbers or unique transaction reference number permitting traceability; no requirement to verify accuracy of originator’s information; batching of wires from single originator not addressed; no requirement for financial institutions to verify customer information where there is suspicion of ML/TF; intermediary and beneficiary institution instances not explicitly addressed; MVTS providers acting as both originator and beneficiary lack specific requirements and no STR-filing requirement. - Recommendation 16 is rated partially compliant. ### Reliance on Third Parties — Recommendation 17 - Historical context: - Colombia was rated compliant with former R.9 in the 2008 MER. - Criteria 17.1 to 17.3 – (N/A): - Colombian regime does not allow reliance on third parties; all FIs must conduct all elements of the CDD requirements directly themselves. - Weighting and Conclusion: - Reliance on third parties is effectively prohibited. Recommendation 17 is rated not applicable. ### Internal Controls and Foreign Branches and Subsidiaries — Recommendation 18 - Historical context: - Colombia was largely compliant with former R.15 and compliant with former R.22 in the 2008 MER. - 2009 follow-up: Superintendence adopted External Circular No. 007 of 2008; new Circular in 2015 for SIPLAFT. DIAN issued Circular 28 (December 9, 2011) and Circular No. 13 (December 26, 2016). SES issued new SARLAFT for financial cooperatives in January 2017. - Criterion 18.1 – (Met): - Requirements of c18.1 (a–d) met with respect to compliance, hiring staff, training and independent audit. - Financial institutions must develop SARLAFT (Article 102, EOSF) based on identification/evaluation of ML/TF risks in all processes, products and services provided. - Criterion 18.2 – (Met): - Requirements of c18.2 (a–b) met for provision of information at group level and information sharing for risk management, compliance, audit, and safeguards on data confidentiality. - Commercial Code requires c18.1 requirements apply to parent companies, branches and subsidiaries, including abroad. - SFC Basic Legal Circular (4.2.2.2.1. of Chapter IV, Title IV, Part I) requires CDD procedures incorporated in manuals/systems of subordinated entities abroad. - Savings and loans cooperatives, currency exchange firms and PTOs are not allowed to have subsidiaries abroad. - Criterion 18.3 – (Met): - Article 260 of the Code of Commerce: regulations apply to whole company, including branches and subsidiaries. - SFC regulations require entities to apply SARLAFT to entities abroad (paragraph 4.2.2.2.1). - No reported cases where host country does not permit application of home country equivalent requirements at authorization time; authorities have powers to apply additional risk management measures thereafter. - Weighting and Conclusion: - All criteria are met. Recommendation 18 is rated compliant. ### Higher-Risk Countries — Recommendation 19 - Historical context: - In the 2008 MER Colombia was rated LC with former R.21 due to low effectiveness by foreign exchange companies. - Colombia has introduced changes in applicable regulations. - Criterion 19.1 – (Mostly Met): - Financial institutions under supervision of the SFC are required to apply enhanced CDD procedures and enhanced monitoring to business relationships with natural and legal persons from countries identified as high-risk by the FATF (Circular 55/2016). *Source: cr18314-colombiadar - Section 6.2.4 does not cover the obligation under C. 12.1 (c).* ### section 4.2.2.1.8). ### cr18314-colombiadar - section 4.2.2.1.8) ### Recommendation 19 — Countermeasures and International Cooperation - Professional currency exchange firms under the supervision of the DIAN are required to apply enhanced due diligence to transactions with natural and legal persons from countries for which this is called for by the FATF (section 5.5 of Circular 13/2016). - For savings and loans cooperatives, criterion 19.1 is addressed under section 2.2.2.2.3 of Circular 4/2017 of the SES. - For PTOs, section 6.2 of Regulation 2564/2016 of the MINTIC requires the adoption of stricter procedures for business relationships and transactions with customers from countries that do not apply the FATF recommendations. - Criterion 19.2 and 19.3 — (Not Met): There are no obligations in place incorporating the requirements set out under these criteria. - Weighting and Conclusion: - No requirement to apply countermeasures proportionate to the risks under C. 19.2 (a) and (b). - No measures in place to ensure that financial institutions are advised of concerns about weaknesses in the AML/CFT systems of other countries. - Recommendation 19 is rated partially compliant. ### Recommendation 20 — Reporting of Suspicious Transactions - Historical context: In its 2008 MER Colombia was rated largely compliant regarding these requirements on former R.13 and Special Recommendation IV (para. 3.7.3). Deficiencies were related to ineffective implementation by some financial institutions; these issues are not assessed under the 2013 Methodology. - Criterion 20.1 — (Mostly Met): - Financial institutions, national authorities and any appropriate private entity are required to promptly notify the UIAF of any suspicious transaction when these reporting entities suspect or know that the referred transaction may involve potential ML/TF or any other related illegal activity. - Reporting entities must analyze any unusual transaction inconsistent with the customer’s regular transactions or any behavior pattern with no apparent economic purpose. - Exception: PTOs are not required by law to report to UAIF. Law 1369/2009 establishes a framework for PTOs but does not establish that PTOs are reporting entities required to report STRs to the UIAF: Law 1369/2009, Articles 102–107 of the Financial System Organic Statute, 11 of Law 526, 1 and 2 of Decree 1497, 40 and 43 of Law 190 (1995), 1 and 3 Law 1121 (2006). - Criterion 20.2 — (Mostly Met): - General legal requirement for the financial sector to promptly report all attempted transactions regardless of the amount. - Currency exchange firms and PTOs do not explicitly have the obligation by law to report attempted transactions; obligation is set in secondary legislation or internal statutes issued by supervisors or the UIAF: Articles 4.2.7.2.1 of Rule 26 (2008) of the SFC, 2 of Resolution 059 (2013), 2.2.7.2.1 of SES (2017), 4 and 9 of Resolution 2679 (2016), 1 of Law 1121, and UIAF statute 13 (2016). - Weighting and Conclusion: - Colombia has addressed several deficiencies from its last MER related to this recommendation. - Remaining concerns on the scope of Colombia’s financial sector reporting obligations related to the requirement to report transactions and attempted transactions. - Recommendation 20 is rated largely compliant. ### Recommendation 21 — Tipping-Off and Confidentiality - Historical context: Colombia was rated compliant with former R.14 in the 2008 MER. - Criterion 21.1 — (Met): - Article 42 of Law 190 of 1995: entities and their managers or administrators are exempt from civil, criminal or administrative liability when reporting transactions they deem linked to any type of criminal activity to the UIAF. - Article 102 of the EOSF provides protective measures for those submitting STRs to the UIAF. - These provisions apply to financial institutions supervised by the SFC, entities supervised by the SES, DIAN, and MINTIC. - Criterion 21.2 — (Met): - Article 105 of the EOSF and Article 5 of Decree 1497 of 2002 prohibit disclosure of the fact that an STR or related information is being or has been submitted to the UIAF. - Weighting and Conclusion: - All criteria are met. - Recommendation 21 is rated compliant. ### Recommendation 22 — DNFBPs: Customer Due Diligence - Overview: - In 2008 MER, Colombia was rated partially compliant with former R.12 because the gambling sector lacked adequate CDD. - DNFBP sectors included per FATF list: casinos, real estate agents, notaries, lawyers, accountants, and fiduciary services. - Many persons and companies in these sectors are not classified as reporting entities due to three Supersociedades SAGRLAFT requirements: specific CIIU code, reaching a threshold of gross revenue in a single year (thresholds vary by sector), and being under permanent supervision and control of the Supersociedades. - Around a thousand companies were classified as reporting entities in December 2016. - Other non-FATF-listed nonfinancial institutions subject to AML/CFT requirements include: mining and quarrying (only when obtaining a gross revenue of US$15 million in a single year), car dealers, football clubs, and games of chance; all must comply with the three requirements to be classified as AML/CFT reporting entities. - Legal basis: Agreement No. 317–2016 of the National Council for Games of Chance and Article 5 of Law 641. AML/CFT regime of these entities regulated in Agreement No. 97 of 2014 of the CNJSA. - Criterion 22.1 — (Partially Met): - No explicit obligation in a Law to apply CDD as requested in the standard; CDD measures are set in resolutions and circulars issued by supervisors. - Subcriterion 22.1 (a) — Casinos: - Applicable regulations: Articles 102–107 of EOSF and Coljuegos Resolution 20161200032334. - Resolution Coljuegos 20161200032334 (Article 10): minimum requested information includes full name, type of identification and number, date and place of issuance; date and place of birth; address and phone number; professional activity; voluntary declaration of origin of funds; statement on PEP profile or public servant. - For operations equal to or above Col$5 million (approx. US$1,800), casinos must request identification per detailed list and keep this information. - Online gambling entities must guarantee customer identification and use a mechanism to validate the truthfulness of provided information. - Subcriterion 22.1 (b) — Real estate agents: - Annual revenue threshold to be classified as reporting entities is US$15 million. - Only those classified as reporting entities (28 out 3,004 in 2016) must comply with CDD provisions of the Basic Legal Circular, SAGRLAFT, which requires mechanisms to allow “adequate knowledge” of clients. - SAGRLAFT does not require specific activities to know the client but provides examples; transactions may be permitted when identification cannot be obtained “if the nature of the operation and activity so permits, e.g., in case of mass sales.” - BO identification obligations recently added to SAGRLAFT Circular, but BO process does not fully comply with requirements of the Interpretative Note for R.10. - Subcriterion 22.1 (c) — Dealers in precious metals and precious stones: - Not specifically included under Supersociedades supervision; generic provision could include them if they obtain gross revenue of 160,000 minimum wages (Col$737,717 in 2017) in a single year (approx. US$40 million). - No dealers in precious metals and precious stones classified as AML/CFT reporting entities. - Subcriterion 22.1 (d) — Lawyers, accountants, notaries: - To be classified as reporting entities under Supersociedades SAGRLAFT (modified December 2016), lawyers, other legal services, accountants, and collection and credit rating services must obtain gross revenue of 30,000 minimum wages in a single year (approx. US$7.5 million). - Most DNFBPs under Supersociedades are not classified as reporting entities and thus are not required to apply AML/CFT obligations. - Notaries have specific AML/CFT regulations on CDD (Administrative Instruction No.17 of 2016 of the Superintendence of Notaries Articles 4.3.1.2.1 and 4.3.1.2.4), but no specific measures require identification of BOs of clients or beneficiaries as required by c.10.5. - Subcriterion 22.1 (e) — Fiduciary services: - Must follow AML/CFT obligations established by Article 3 EOSF and SFC SARFLAT (Part 1, Title IV, Chapter IV, Article. 4.2.2.2.1 on customer identification). - Authorized fiduciary companies must comply with the CDD requirements set for financial institutions, including BO identification prior to establishing a “fiducia.” - Comments on R.10 for financial institutions also apply. - Criterion 22.2 — (Mostly Met): - Casinos must keep customer identification information, preserve documents and digital support of operations reported to the UIAF (Resolution Coljuegos 20161200032334 (Article 10.1 and 2 and Article 16) and Article 19 of Agreement 317-16 Coljuegos). - Conservation required for a minimum term of five years. - DNFBPs under Supersociedades must keep records with operation and client information and the name of the person who verified this information, including date and hour (Chapter X, Article 7E a) of the Legal Basic Circular of Supersociedades, SAGRLAFT). - All entities under Supersociedades’s supervision must also comply with record-keeping obligations in Article 28 of the Code of Commerce. - Notaries: client information and name of the person who received it must be recorded; records on the activities of the notaries are kept for, at least, 30 years (Administrative Instruction No. 17 of 2016 of the Superintendence of Notaries Articles 4.3.1.2.1). - Fiduciary companies follow SFC record keeping obligations for financial institutions. - Criterion 22.3 — (Partially Met): - (a) SIPLAFT Resolution for casinos contains a definition and a list of domestic PEPs but no reference to foreign PEPs (Article 10.1 last paragraph of Resolution Coljuegos 20161200032334). - CDD regime for PEPs requires approval of the legal representative of the operator to establish or continue commercial or legal relationships with high-risk counterparties, which is not aligned with standards and enhanced due diligence requirements. - No management risk systems in place to determine if client or BO is a PEP, to obtain senior approval, or to establish source of funds as required by R.12. - (b) For DNFBPs under Supersociedades, CDD for PEPs involves enhanced due diligence and greater controls; advisable to obtain senior management approval. No management risk systems in place to identify PEPs. - (c) Notaries: Instructions require adoption of control measures regarding PEPs and inclusion of a PEP declaration in the public deed, but Instructions do not include specific measures required by R.12 for higher-risk relations or for international PEPs (Instruction No. 17 2016; Instruction No. 8, 7 of April 2017). - Criterion 22.4 — (Partially Met): - Compliance regime for identifying and assessing ML/TF risks for new products/commercial practices/technological products differs by sector. - Casinos: concession regime only allows new elements that comply with expressly authorized online connection requirements; requests not complying with administrative specifications are rejected. - DNFBPs regulated by Supersociedades must assess related risks, including ML/TF, when entering new markets or offering new products (Article 7E); compliance officer analyzes and records analysis, supported by the person responsible for the new business or product. Assessment and measures to manage risks are set in Article 4A. - Criterion 22.5 — (N/A): - Reliance on third parties in Colombia remains substantially the same since the 2008 MER. - Supersociedades AML/CFT rules (art. 4 B b) prohibit contracting of functions to third parties. - Weighting and Conclusion: - Casinos, real estate agents, notaries, lawyers, accountants, and fiduciary services are AML/CFT sectors, but most persons and entities of DNFBP sectors regulated by Supersociedades do not meet high thresholds and thus are not classified as reporting entities. - Dealers in precious metals and precious stones are not classified as DNFBPs. - CDD obligations exist but are not set in law. - CDD and BO identification of DNFBPs under Supersociedades supervision are not in line with R.10 requirements. - Notaries’ CDD systems do not include specific measures to identify BO as defined in the standards. - CDD processes for PEPs need to follow the standards and require management risk systems. - Recommendation 22 is rated partially compliant. ### Recommendation 23 — DNFBPs: Other Measures (beginning) - Historical context: In 2008 MER, Colombia was rated partially compliant with R.16 due to lack of AML/CFT requirements for lawyers, accountants, dealers of metal and precious stones, and real estate agents, and low number of STRs from casinos and notaries. - Criterion 23.1 — (Partially Met): - STRs have different regulations for each DNFBP sector. - (a) Casinos have a mandatory regime for immediately reporting suspicious transactions to the UIAF (Article ...). [Text continues beyond supplied excerpt.] *Source: cr18314-colombiadar - section 4.2.2.1.8).* ### 10.2 of Resolution Coljuegos 20161200032334 and Articles 8g and 11 of Agreement 317-2016 ### 10.2 of Resolution Coljuegos 20161200032334 and Articles 8g and 11 of Agreement 317-2016 ### DNFBP reporting obligations and scope (R.23) - Casinos, notaries, and fiduciary companies have STR/STR-like obligations: - Casinos: STR obligations and conditions established in Agreement 317-2016 (Article 11) and Resolution Coljuegos 20161200032334. - Notaries: dual regime under Administrative Instruction No. 17 of the Superintendence of the Notaries (October 27, 2016): obligation to report all transactions to the UIAF (RON) and to immediately report any suspicious transaction according to Guidelines on AML/CFT for Notaries. Exception: “Notaries are not required to report STRs when a legal entity supervised by SFC is involved in the legal transaction.” (Article 7.2.2 of the Resolution). - Fiduciary companies: must follow STR requirements set in the SFC SARLAFT for financial institutions. - DNFBPs under Supersociedades supervision: must report suspicious transactions to the UIAF through the SIREL system and follow SIREL User Manual (Chapter X, Article 8 of Legal Basic Circular of Supersociedades, SAGRLAFT). Reporting obligations apply also to all companies obliged to have a tax auditor (Articles 207 and 203 of the Code of Commerce and Article 13 of Law 43-1990). - UIAF Resolution 363 of 2008: requires gold import/export companies, foundry houses, and international gold trading companies (not classified as AML/CFT reporting entities) to report suspicious transactions. - Gaps and limitations: - Not all DNFBPs are covered (e.g., dealers in precious metals and precious stones are not classified as DNFBPs). - Notaries’ reporting exception (when a legal entity supervised by SFC is involved) is not in the standards; Superintendence of Notaries informed assessors this rule will be amended. - Some DNFBP categories (lawyers, accountants, real estate agents under Supersociedades) are not uniformly required to report STRs. ### Internal controls and AML/CFT systems for DNFBPs (Criterion 23.2) - Casinos: - Required to have instruments for AML/CFT and internal control mechanisms (Articles 11–17 of Resolution Coljuegos 20161200032334 and Agreement 317-2016). - Must implement alert signals listed by regulations, technological monitoring tools, staff screening, code of conduct and training, internal SIPLAFT policies and procedures approved by the Board, officials in charge of internal controls or designate a compliance officer per requirements. - DNFBPs under Supersociedades: - Required to have detailed self-management and AML/CFT risk management systems for identification, measurement, evaluation, control, and/or monitoring of risks (Article 4 and Articles 7D–7G of the Legal Basic Circular of Supersociedades, SAGRLAFT). - Compliance officers, staff screening, and training mandated; no specific obligation for independent AML/CFT audits. - Supersociedades SAGRLAFT: when a business group has more than one required entity, “each one of them must adopt its own AML/CFT system” (Article.4) — not aligned with the standard on group-wide programs. - Notaries: - Must adopt internal control procedures: tools to identify unusual/suspicious transactions, approve risk control policies, designate a ML officer or coordinator, implement screening for hiring, and develop training activities. - Fiduciary companies: - Must follow internal control requirements set in the SFC SARLAFT for financial institutions (see R.18). - Assessment: - Criterion 23.2 — Partially Met. ### Enhanced CDD and high-risk jurisdictions (Criterion 23.3) - Casinos: - Specific obligation to apply enhanced CDD measures to clients from high-risk jurisdictions when called upon by the FATF (Article 14 of Coljuegos Agreement 317-2016). - DNFBPs under Supersociedades: - Should consider transactions with persons/entities from jurisdictions designated by FATF as non-cooperative as risk factors (Chapter X, Article 7D of SAGRLAFT). - No obligation to apply countermeasures for countries included in FATF Public Statements (required in R.19.2); such obligations can only be demanded of reporting entities as described in R.22. - Notaries: - Must apply enhanced CDD in transactions with natural and legal persons and financial institutions from countries for which the FATF makes a call (Article 4.3.1.2.5 of Administrative Instruction No. 17 of the Superintendence of the Notaries). - Intensified CDD measures must be effective and proportionate to risks. - Assessment: - Criterion 23.3 — Partially Met. ### Protection from liability for DNFBP staff (Criterion 23.4) - General: - For most DNFBPs, except fiduciary companies (regulated in OESF), there is no legal protection for directors, officers, and employees from criminal and civil liability for breaching restrictions on disclosure imposed by contract or by legislative/regulatory/administrative provision (required in C.21.1). - Specific protections: - Casinos: Coljuegos Resolutions provide confidentiality and state that reporting STRs cannot give rise to any responsibility (Article 10.2, para. 1 of Resolution Coljuegos 20161200032334 and Article 8 i)–k) of Agreement 317-2016). - Notaries: entity and compliance officer shall guarantee confidentiality of STRs sent to UIAF, which will not give rise to any responsibility (Article 7.2.2 Administrative Instruction No. 17). - DNFBPs regulated by Supersociedades: must guarantee confidentiality of suspicious transaction reports to UIAF (Article 8 Legal Basic Circular of Supersociedades, SAGRLAFT). - Assessment: - Criterion 23.4 — Partially Met. ### Weighting and conclusion (Recommendation 23) - Findings: - Casinos, notaries, and fiduciary services have STR obligations, but lawyers, accountants, and real estate agents under Supersociedades are not uniformly required to report STRs. - Dealers in precious metals and precious stones are not classified as DNFBPs. - Notaries should be required to report STRs even if a legal entity supervised by SFC is involved. - Groups should be required to implement group-wide AML/CFT programs for all branches and subsidiaries. - Legal protection for DNFBP staff for breaching restrictions on disclosure should be enacted. - Conclusion: - Recommendation 23 is rated partially compliant. --- ### Recommendation 24 — Transparency and Beneficial Ownership of Legal Persons #### Background and historical rating - In the 2008 MER Colombia was rated largely compliant with R.33 due to difficulty accessing accurate/up-to-date BO and controllers information. #### Corporate forms and registration (Criterion 24.1, 24.3–24.5) - Criterion 24.1 — (Mostly Met) - Types and formation of legal persons regulated by Code of Commerce (Articles 294–497), Law 222 of 1995 (sole proprietorship companies), Law 1258 of 2008 (SAS). Information is public and available. - No description of procedures for obtaining/recording BO information as defined by the standards—R.10 paragraph 5(b)(i). - Criterion 24.3 — (Met) - Basic information required in deed or private contract presented to Commercial Registry: name, document of incorporation, form/status, legal representative, address, basic regulatory powers, list of Directors/Administrators (Articles 110–114, Code of Commerce). Information held by Commercial Registry and publicly available (Article.26 C. Commerce). - Criterion 24.4 — (Met) - Initial registration must include shareholders/members, number of shares held, categories of shares, administration mechanisms, powers of associates; modifications must be registered (Articles 28.6 and 7 C. Commerce). - Companies must keep “book of shareholders” with updated records; this is not publicly available but can be required by DIAN, FGN, Supersociedades (195 C. Commerce) and certified by internal tax auditors when needed. Supersociedades and DIAN hold databases annually updated. - Criterion 24.5 — (Met) - Acts/documents subject to registration produce effects from registration date (Article 29.4 Code of Commerce). Annual renewal of commercial license required (Article 33 Code of Commerce). False information to registry punished with fines or criminal sanctions (Article 38 Code of Commerce). #### Coverage and risk assessment (Criterion 24.2) - Criterion 24.2 — (Partially Met) - NRA covers types already considered “reporting entities”: Financial Institutions, DNFBPs (gambling, real estate, mining, lawyers, accountants, notaries, football clubs, free trade zones, currency exchange, transporting companies, security companies, deposits, customs, airports, seaports). - Unclear how health sector and NPOs were scored. - NRA does not include ML/TF risk analysis on different types of commercial companies in EOSF and Code of Commerce. - ML/FT risks from SAS (54percent of the companies in Colombia) were not assessed. SAS regulated by Law 1258 of 2008 simplifies creation process; SAS do not require public deeds, only authentication of a private document signed in the Registry. #### Beneficial ownership information (Criteria 24.6–24.9) - Criterion 24.6 — (Not Met) - No specific regulation/mechanism to ensure companies obtain/hold up-to-date BO information at a specified location in the country; no mechanism ensures timely determination of BO by authorities. - BO information partially available from multiple sources: - Commercial Registry: may contain BO for simple structures, not for joint-stock companies. - “Book of shareholders”: updated info but BO obtainable only when shareholders are natural persons; limited when shareholders are legal persons or foreign ownership involved. - DIAN and Supersociedades databases: shareholders’ information only annually updated; after cascade identification process could identify ultimate owners who are not legal persons. - BO info via CDD by financial institutions and DNFBPs — CDD obligations recently set in SARLAFT and SAGRLAFT. - BO identification process not in line with standards; BO definitions differ by supervisor (e.g., SAGRLAFT does not require identification of natural persons for BO in CDD). SARLAFT External Circular 055 of 2016 (Dec 22) enforced on March 31, 2017; SAGRLAFT amendments approved Oct 25, 2016. - Criterion 24.7 — (Not Met) - No specific regulation requiring accurate/updated BO information. Article 631 of the Tax Statute requires BO identification for automatic exchange information on tax purposes for certain entities; applies only for tax purposes and BO definition (Article 631.5) not in line with standard. - Criterion 24.8 — (Partially Met) - Legal representatives and tax auditors must cooperate and submit updated company information on request to DIAN, Supersociedades, or FGN. Limitations persist due to differing BO definitions and data availability. - Criterion 24.9 — (Partially Met) - Legal entities must keep information, business correspondence, and records for at least ten years from closing activity or last entry (Articles 54 and 60 Code of Commerce). Liquidator must keep books/papers for five years (Article 134 Decree 2649 29 of December of 1993). Information to be kept does not include BO information as set in standards. #### Access, bearer shares, nominees, sanctions and information exchange (Criteria 24.10–24.15) - Criterion 24.10 — (Mostly Met) - LEAs and supervisors can request/analyze legal, accounting, economic, administrative information of any commercial company (Article 83 Ley 222 of 1995). Does not include BO information as set in standards. Access to FI-held information may provide BO details. - Criterion 24.11 — (Met) - No bearer shares since Decision 291-1990; bearer shares warrants have no effect (Article 654 Code of Commerce). - Criterion 24.12 — (Met) - No specific nominee regulations; Code of Commerce (Article 110) impedes nominees for company creation. Acts affecting ownership/administration must be registered to be effective against third parties (Article 28 Code of Commerce). Power of attorney rules for representation (Article 184 Code of Commerce). Fiduciae: book of shareholders must include fiduciary company as shareholder when shares delivered in fiducia (Article 2.3.2 Part II, Title II, Chapter I of Legal Basic Circular SFC, SARLAFT). - Criterion 24.13 — (Partially Met) - False data to Commercial Registry can be sanctioned under Penal Code; Chamber of Commerce required to file penal complaint (Article 38 Code of Commerce). Administrative sanctions possible (Article 58 Code of Commerce as amended by Law 1762-2015), fines between 10 and 1,000 official minimum wages (Col$737,717 x 1,000 = Col$737,717,000, i.e., approx. US$2,500 to US$250,000) — not dissuasive for bigger companies and groups. Draft law under parliamentary discussion to increase amounts. No specific sanctions for failing to hold/provide BO information per FATF standards. - Criterion 24.14 — (Mostly Met) - RUES information public and available via internet. Authorities (UIAF, National Police, FGN) can access back-up documents (not public) in registries and share with foreign counterparts. Shareholders’ info in supervisors’ databases exchangeable. “Book of shareholders” updated info directly available to each supervisor, DIAN, or via judicial order. No specific regulation requiring maintenance of accurate/updated BO information per standards. Article 631-4 Tax Statute: DIAN will establish by resolution which entities provide information for automatic exchange—limited to certain financial accounts. - Criterion 24.15 — (Not met) - No procedure to monitor quality of assistance received from other countries for basic and BO information or locating BO residing abroad. Only DIAN tracks info requests in tax matters which may include BO information. #### Weighting and conclusion (Recommendation 24) - Findings: - Significant steps taken: basic information must be registered and annually updated in Mercantile Registry and is publicly available; companies must update shareholders’ information in “book of shareholders,” DIAN, and Supersociedades database. - BO information only partially available to authorities; no processes to obtain or hold accurate and up-to-date BO information in a timely manner as set by standards. - Conclusion: - Recommendation 24 is rated partially compliant. --- ### Recommendation 25 — Transparency and Beneficial Ownership of Legal Arrangements #### Overview and scope (Criterion 25.1) - Colombia previously rated largely compliant with former R.34 in 2008 MER. - Most relevant legal arrangement: fiducia (Mercantile fideicomiso): 23,200 fiduciae. - Fiduciary services: - Can only be provided by fiduciary companies (Articles 1226–1240, Code of Commerce). - Fiduciary companies (26) are financial institutions authorized and supervised by the SFC (Article 3, Decree 663 of 1993; SFC Legal Basic Circular, SARLAFT Part II, Title II, Chapter I). - Fiduciary companies can only engage in fiduciae as exclusive business; most are bank subsidiaries. - Recording and supervision: - Information on constitution and updates of each fiducia must be recorded by fiduciary company and provided to SFC through online Business Registration Module for Fiduciae (External Circular SFC 065. 30-Dec._2008; Circular 45-2013; External Circular SFC 030 2015 among others). - Civil fideicomisos: - Permitted by Civil Code (Articles 793–822), mainly for inheritance cases; identification of parties and conditions must be included in a public deed under a notary and registered in the SNR. Funds/assets under this arrangement are protected from third parties’ claims until conditions met. - Subcriterion 25.1(a): - Fiduciary companies must comply with CDD obligations set for financial institutions by the SFC Legal Circular SARLAFT (SFC Legal Basic Circular, SARLAFT, Part 1, Title IV). *Italic source attribution line.* ### Chapter IV, Article 4.2.2.2.1 on CDD). They must identify all clients who deliver funds or assets in ### cr18314-colombiadar - Chapter IV, Article 4.2.2.2.1 on CDD). They must identify all clients who deliver funds or assets in ### Fiduciary services: customer due diligence, ownership and record-keeping - Fiduciary companies must: - Identify all clients who deliver funds or assets in fiducia (settlors) through a detailed mandatory application form. - Verify settlor information, have adequate knowledge of the economic activity and characteristics of transactions, and identify BO of the settlor and beneficiaries (Articles 4.2.2.2.1.1.1 and 4.2.2.2.1.4.6 of SFC Legal Basic Circular, SARLAFT). - Identify ownership structure of legal person clients, comprising identity of shareholders or associates who directly or indirectly have more than five percent of their capital, contribution, or participation (Articles 4.2.2.2.1.1.1 and 4.2.2.2.1.4.6). - Beneficiary identification: - Not required at act of constitution of the fiducia but must be possible and realized within the term of the fiduciary service so purposes can have full effect (Article 4.2.2.2.1.4.2 of SFC Legal Basic Circular SFC SARLAFT SFCSFC and Article 1229, Code of Commerce). - Agents/service providers: - No specific legal/regulatory obligation to hold basic information on agents or service providers; fiduciary companies nevertheless identify and keep information on service providers because they must present detailed reports on the management of assets delivered under fiduciary business. - Record retention: - Records and documents shall be kept for a period of not less than five years (Article 96 of the Organic Statute of the Financial System, as amended by Article 22 of Law 795 of 2003). - Record-keeping obligations: - Fiduciary companies must comply with record-keeping obligations in the Code of Commerce and the SFC SARLAFT (SFC Legal Basic Circular SARLAFT, Article 4.2.3 on record keeping), maintain accurate and updated information on all elements of the fiduciae, and provide this information to the SFC. - Exclusivity and identification: - Only fiduciary companies especially authorized by the SFC may have the status of fiduciary (Article 1226, Code of Commerce). ### Access to ownership/beneficial ownership information and supervisory access - Access by authorities: - Competent authorities (DIAN, SFC, and FGN) have access to all information held by fiduciary companies and financial institutions, including BO information obtained in the CDD process. - Financial authorities have on-line access to fiduciae information held by the SFC; the UIAF does not have on-line access. - Limitations and legal constraints: - The legal principle of “habeas data” (Law 1266-2008) impedes fiduciary companies from providing financial institutions and DNFBPs with information on the ownership of funds and assets of the fiduciae managed without authorization of the client. - BO information held by the SFC is obtained according to SARLAFT and may not be in line with the FATF standard. - Public registries: - Basic information of registries is public and available, but does not always contain information on the fiduciae (fiduciae information is held by the SFC and periodically updated by fiduciary companies). - Information sharing: - The EOSF permits SFC to share information with supervisors of other countries (Article 83, Law 964 of 2005, as amended by Article 22 of Law 1328 of 2009), potentially including basic and BO information available at the SFC. ### Sanctions and enforcement for fiduciary companies - EOSF sanctioning powers for fiduciary companies and their directors/managers (Articles 209–211, Decree 663 of 1993 Organic Statute of the Financial System, as amended by Article 45, Law 795 of 2003). - Possible SFC sanctions (Articles 102, 209 and 211.3, EOSF): - Warnings, admonitions, professional disqualification, managers/directors’ removal. - Fines up to Col$1,742,000,000 (approx. US$600,000). - Specific sanction for failing to grant timely access to information on the fiduciary company (Article 208 n) and ñ) EOSF): - Fine up to 10 official minimum wages (Col$737,717 x 10 = Col$7,377,170) (approx. US$2,500) — noted as not proportionate or dissuasive. ### Assessment and conclusion: Recommendation 25 - Strengths: - Most criteria rated met or largely met. - Regulation of fiduciary services is very wide and detailed. - Fiduciae can only be provided by fiduciary companies licensed and supervised by the SFC. - Information on each contract of fiducia must be recorded and provided to the SFC. - Relevant authorities have access to information held by fiduciary companies. - Deficiencies: - Some deficiencies on BO information obtained and on the proportionality/deterrence of sanctions for infringements. - Overall rating: - Recommendation 25 is rated largely compliant. ### Summaries of Recommendations 26–36: supervisory, operational, and institutional findings - Recommendation 26 — Regulation and Supervision of Financial Institutions - Criterion 26.1: SFC is AML/CFT supervisor for banks, securities and insurance institutions except currency exchange firms; SES supervises savings and loans cooperatives; DIAN supervises currency exchange firms; MINTIC supervises postal (domestic) transfer operators but Article. 18 excludes AML supervision. - Market entry (26.2): All Core Principles financial institutions subject to licensing by the SFC; licensing regime effectively precludes establishment/operation of shell banks. - Risk-based supervision (26.4–26.6): SFC conducts risk-based AML/CFT supervision and has methodologies (risk matrices); gaps exist for DIAN, SES, and MINTIC regarding formal risk-based frameworks and how risk profiles inform frequency/intensity of supervision. - Weighting and Conclusion: Supervisory approach of some supervisors is not risk-based. Recommendation 26 is rated largely compliant. - Recommendation 27 — Powers of Supervisors - Criteria 27.1–27.3: Except for MINTIC, supervisors have adequate powers to supervise entities under their jurisdiction. - Sanctions (27.4): Range of sanctions exists, but MINTIC lacks specific AML sanctions for PTOs. - Conclusion: Recommendation 27 is rated largely compliant. - Recommendation 28 — Regulation and Supervision of DNFBPs - Casinos (28.1): Administrative authorization/concession system exists; no obligation to identify BO of casino operators; supervision powers include monitoring and onsite inspections but sanctions for AML/CFT infringements are unclear. - Other DNFBPs (28.2–28.5): SNR oversees notaries; SFC supervises fiduciary services; Supersociedades oversees lawyers, accountants, real estate companies, but most companies in these sectors are not classified as reporting entities and therefore AML/CFT obligations are not mandatory or supervised. Dealers in precious metals/stones not specifically included. - Sanctions and powers: Supersociedades can fine up to 200 official minimum wages (Col$737.717 x 200 = Col$147,153.4, i.e., approx. US$50,000); SFC and other sanctioning regimes contain fines and removal powers but many sanctions are not proportionate or dissuasive and often do not extend to directors/managers. - Conclusion: Significant deficiencies in coverage and supervision of DNFBPs; Recommendation 28 is rated partially compliant. - Recommendation 29 — Financial Intelligence Units - UIAF functions: national center for receiving/analyzing STRs and other reports; authority to request additional information and exchange information domestically and internationally (Law 526 (1999), Law 1121 (2006), Law 1762 (2015)). - Limitations: UIAF does not have access to DIAN-collected information on cross-border transportation of currency and BNIs written declarations in real time; such information is submitted to UIAF every three months. - Operational capabilities: UIAF conducts operational and strategic analysis, disseminates results, ensures information security and confidentiality, is autonomous, and a member of the Egmont Group since 2000. - Conclusion: Since not all reporting entities are required by law to submit STRs and UIAF has limited access to customs information, Recommendation 29 is rated largely compliant. - Recommendation 30 — Responsibilities of Law Enforcement and Investigative Authorities - FGN responsible for investigations (Article 250 of the Constitution) with specialized divisions and police support. - Parallel financial investigations permitted; FGN responsible for tracing property subject to confiscation and is sole authority to carry out financial investigations. - Conclusion: All criteria met. Recommendation 30 is rated compliant. - Recommendation 31 — Powers of Law Enforcement and Investigative Authorities - FGN powers include obtaining documents, financial records, searches, subpoenas, seizures (Article 250 Constitution; Article 114 Penal Code). - Other powers: undercover agents (Articles 241 and 242 CC), interception after judicial order (Articles 233 and 235 Constitution), access to computerized systems (Article 236), controlled delivery under certain conditions (Article 243). - FGN can access confidential databases and UIAF data for investigations (Article 244 procedural code; Articles 34 and 35 Law 1621/13 for intelligence). - Conclusion: All criteria met. Recommendation 31 is rated compliant. - Recommendation 32 — Cash Couriers - Declaration system applies to all incoming/outgoing cross-border transportation of currency and full range of BNI (Article 5 Resolution (2013); Article 2 & 3 Resolution DIAN 63 (2016)). - Threshold: US$10,000 for written declaration (Articles 2 and 3 of Resolution 63, and 2 of Resolution DIAN 87 (2016)). - Sanctions for false/non-declaration: fine of 30percent of the value for incoming, 40percent for outgoing (Articles 13 and 14 of Resolution 63 and 3 of Decree 2245). - Gaps: UIAF lacks direct access to declaration system data; DIAN databases do not contain entire information collected; DIAN lacks authority to seize currency/BNI on suspicion of ML/TF (seizure authority limited to false/failure to declare), and coordination agreements with FGN not clearly in place. - Conclusion: Recommendation 32 is rated largely compliant. - Recommendation 33 — Statistics - Legal basis: CONPES 3793 requires UIAF to procure a statistic system; Decree 3420 requires quarterly reporting to UIAF by relevant authorities but does not apply to TF information. - Implementation gaps: Authorities are not complying with quarterly reporting obligations; competent authorities update investigation/prosecution/seizure/confiscation statistics only every 12 months; extradition and MLA statistics sent to UIAF every 12 months. - Conclusion: Recommendation 33 is rated partially compliant. - Recommendation 34 — Guidance and Feedback - Legal provisions for guidance exist for financial institutions (EOSF Article 325), notaries (Decree 2723 of 2014), and some DNFBP supervisors, but in practice no guidelines or feedback have been established or provided to financial institutions, currency exchange professionals, postal operators, casinos, or many DNFBPs. - Conclusion: Recommendation 34 is rated partially compliant. - Recommendation 35 — Sanctions - Financial institutions: full range of financial and administrative sanctions exists for most financial institutions except postal operations where linkage to AML/CFT is unclear. - DNFBPs: sanctions regimes vary; notaries limited to disciplinary actions; Supersociedades provides administrative fines but limited individual sanctions for directors/managers; sanctioning systems often not proportionate or dissuasive. - Conclusion: Recommendation 35 is rated partially compliant. - Recommendation 36 — International Instruments - Colombia is party to relevant conventions (Vienna Convention signed December 20, 1988; Palermo Convention signed November 15, 2000) and related domestic approvals are recorded. *Italic: International Monetary Fund — cr18314-colombiadar, Chapter IV (excerpts on fiduciary services, supervision, and AML/CFT assessments).* ### 2004. The Merida Convention was signed on October 31, 2003; it was approved by Law 970 in ### cr18314-colombiadar - 2004. The Merida Convention was signed on October 31, 2003; it was approved by Law 970 in ### Conventions and coverage - The Merida Convention was signed on October 31, 2003; it was approved by Law 970 in 2005 and entered force on November 26, 2006. - The Convention on the Suppression of Terrorist Financing Convention was signed on December 9, 1999; it was approved by Law 808 in 2003 and entered force on October 14, 2004. - The Inter-American Convention against Terrorism was signed on June 3, 2002; it was approved by Law 1108 in 2006 and entered force on June 24, 2008. - Not all conducts specified in the Vienna, Palermo, Merida, and TF Conventions are covered in Colombia (see Rs.3 and 5). ### Recommendation 36 — Conclusion and rating - Criterion 36.2 – (Mostly Met): Not all conducts specified in the Vienna, Palermo, Merida, and TF Conventions are covered in Colombia. - Weighting and Conclusion: Colombia is party to the conventions listed in the standard. However, not all conducts specified in the Vienna, Palermo, Merida and TF Conventions are covered in Colombia. - Recommendation 36 is rated largely compliant. ### Recommendation 37 — Mutual Legal Assistance (MLA) - Historical ratings: Colombia was rated compliant with former R.36 and largely compliant with Special Recommendation V in its 2008 MER. - Identified need: On Special Recommendation V the assessment team considered that Colombia should seek to implement the regulations and agreements with foreign jurisdictions related to investigation of ML/TF cases. Findings by criterion: - Criterion 37.1 – (Met) - The CPC regulates MLA dispositions applicable to criminal processes (Articles 484 to 517). - The AFL has provisions applicable to asset forfeiture proceedings (Title VI). - Article 484 CPC: investigative authorities shall comply with international cooperation requests made in accordance with the Political Constitution, international treaties and relevant legislation. - Article 208 AFL: allows implementation of investigative measures or injunctions to comply with international requests; sets forth execution in the shortest possible time. - Article 209 AFL: recognizes foreign judgments over assets located within the national territory. - Article 211 AFL: comprises requirements for execution of a foreign judgment. - Colombia has entered 39 bilateral treaties with foreign countries on MLA. - Criterion 37.2 – (Met) - Central authority for receiving MLA requests in criminal matters is the FGN (CPC Article 484). - FGN established the International Management Division to analyze and process MLA requests. - Division maintains statistics and follows prioritization parameters established by Directive FGN 002/2015. - MLA requests processed and managed through FGN systems ORFEO and SIPRAIN. - Requests related to execution of a foreign judgment within Colombia should be conducted through MINREX, which refers the matter to the SCJ as set out in CPC Article 517. - Criterion 37.3 – (Met) - MLA is specifically allowed in CPC (Articles 484 and 489) and in AFL (Title VI). - CPC provides a limitation for cases contrary to the values and principles established in the Political Constitution (Article 489); assessment team considers this limitation not unreasonable or unduly restrictive. - Criterion 37.4 – (Met) - CPC and AFL do not impose restrictions on MLA because the offense involves fiscal matters, nor on grounds of secrecy or confidentiality requirements on financial institutions or DNFBPs. - Criterion 37.5 – (Partly Met) - General provision in Article 18 of the CPC: procedures are public unless judge considers reasons (endangering victims, jurors, witnesses, experts, national security, or compromising investigation). - Authorities informed relevant information would be shared only with the prosecutor of the case. - No specific procedure or provision in place related to the duty to maintain confidentiality of MLA requests and information contained in them to protect investigation integrity. - Criterion 37.6 – (Met) - Dual criminality is not a condition for rendering MLA in Colombia (CPC Article 489). - Criterion 37.7 – (Met) - Dual criminality is not a condition for rendering MLA (CPC Article 489). - Criterion 37.8 – (Met) - Powers and investigative techniques required under R.31 are available for use in response to MLA requests (CPC Articles 484 and 486). - CPC Article 486: FGN can authorize presence of foreign officials to conduct measures within Colombian territory under direction and coordination of a prosecutor and with assistance of Procuraduría General de la Nación. Weighting and Conclusion for R.37: - Colombia has a sound legal basis to rapidly provide a wide range of MLA in relation to ML, predicate offenses, and TF. - Almost all criteria of R.37 are fully covered. - There is no specific procedure or provision related to the duty to maintain confidentiality of MLA requests to protect investigation integrity. - Recommendation 37 is rated largely compliant. ### Recommendation 38 — MLA: Freezing and Confiscation - Historical rating: Colombia was rated largely compliant with former R.38 in its 2008 MER; assessors indicated a law authorizing sharing of confiscated assets with third countries was needed. Findings by criterion: - Criterion 38.1 – (Met) - Colombia can take expeditious action to identify, freeze, seize, or confiscate: (a) laundered property from, (b) proceeds from, (c) instrumentalities used in, or (d) instrumentalities intended for use in, ML, predicate offenses, or TF; or (e) property of corresponding value. - Measures can be implemented in criminal process (CPC Articles 82, 83, 85, and 489) or during asset forfeiture process (Articles 16, 87, 88, 203, 212 AFL). - Criterion 38.2 – (Met) - Colombia has broad powers to provide assistance for provisional measures and non-conviction proceedings aimed at asset forfeiture/confiscation. - Article 489: MLA can be provided even if action not criminalized domestically, unless contrary to values and principles of the Political Constitution; asset forfeiture or measure involving loss or suspension of disposal power over assets declared by a foreign competent judicial authority may be executed in Colombia. - Article 208 AFL: allows implementation of investigative measures or injunctions to comply with international requests; execution in shortest possible time; cooperation based on non-conviction based confiscation when perpetrator unavailable can be provided under AFL. - Criterion 38.3 – (Met) - Subcriterion 38.3(a) – (Met): CPC Article 487 permits FGN to coordinate seizure and confiscation actions with foreign countries; FGN may create a fund of international judicial assistance to receive such assets; Article 203 AFL provides international judicial cooperation for investigation, localization, identification and implementation of measures aimed to obtain confiscation and asset forfeiture; Article 208 AFL allows implementation of investigative measures or injunctions. - Subcriterion 38.3(b) – (Met): CPC Article 82: confiscated property transferred to FGN through “Special Fund for Assets Management”; CPC Article 86: property subject to provisional measures managed for the Special Fund for Assets Management; AFL provides specific management mechanism and FRISCO has management and disposing powers; framework further regulated through Decree 2136/2015. - Criterion 38.4 – (Met) - Article 214 AFL specifically establishes possibility of sharing assets with other countries in asset forfeiture processes. - Colombia has entered agreements with several countries including possibility of sharing confiscated property (e.g., agreements with the United States, Argentina, Switzerland, Cuba, Ecuador, Spain, Mexico, and Peru). Weighting and Conclusion for R.38: - Since all criteria are met, Recommendation 38 is rated compliant. ### Recommendation 39 — Extradition - Historical rating: Colombia was largely compliant with former R.39 in 2008 MER; assessors noted not all ML predicate offenses were covered then. Findings by criterion: - Criterion 39.1 – (Mostly Met) - Subcriterion 39.1(a) – (Mostly Met) - Extradition provided in Article 35 of the Political Constitution (as amended by Legislative Act No. 1/1997) and regulated by CPC (Articles 490–514). - Colombia has entered 24 bilateral agreements on extradition. - ML and TF are extraditable offenses. - Technical gaps related to criminalization of ML and TF identified in R.3 and R.5 could impact extradition requests for conducts not fully covered. - All offenses are extraditable except political offenses (CPC Article 490). - Section 72 of the final agreement for termination of conflict with FARCs establishes a new exception for extradition for actions related to the armed conflict which are object of the agreement. - Subcriterion 39.1(b) – (Met) - Executive Branch has authority to grant extraditions with prior approval from Supreme Court of Justice. - FGN oversees capture of extraditable person; MINJUS oversees processing extradition requests. - FGN processes requests; uses ORFEO System and has International Management Division following Directive FGN 002/2015. - Subcriterion 39.1(c) – (Met) - No unreasonable or unduly restrictive conditions on execution of extradition requests (Articles 493 and 494 CPC set requirements and possible conditions). - Criterion 39.2 – (Met) - Subcriterion 39.2(a) – (Met) - Article 35 Political Constitution allows extradition of nationals and foreigners; for Colombians by birth, extradition granted only for offenses committed abroad which also constitute offenses in Colombia. - Subcriterion 39.2(b) – (N/A) - Given that Colombian authorities can extradite Colombian nationals, this Criterion is not applicable. - Criterion 39.3 – (Met) - Where dual criminality is required, only requirements are a formal accusation and that the offense is punished with at least 4 years of imprisonment; not necessary that both jurisdictions place the offense within the same category or use same terminology. - Criterion 39.4 – (Met) - Colombia has simplified extradition mechanisms (CPC Article 500) for cases where requested person renounces ordinary procedure. Weighting and Conclusion for R.39: - Colombia has a solid extradition regime; ML and TF are extraditable offenses. - Almost all criteria of R.39 are fully covered. - Technical gaps related to criminalization of both offenses could impact extradition requests for conducts not fully covered. - Colombia is largely compliant with Recommendation 39. ### Recommendation 40 — Other Forms of International Cooperation - Historical rating: Colombia was compliant with former R.40 in 2008 MER. New R.40 requirements are considerably more detailed. General principles and findings: - Criterion 40.1 – (Mostly Met) - Colombia has mechanisms allowing UIAF, FGN and LEAs to rapidly provide a wide range of cooperation in relation to ML, associated predicate offenses and TF. - SFC has signed MOUs with 24 foreign counterparts and 5 multilateral bodies; EOSF’s scope beyond MOUs is more limited. - Provision of international cooperation can be upon request or spontaneous, per legal framework, MOUs and agreements. - Criterion 40.2 – (Met / Mostly Met across subcriteria) - Subcriterion 40.2(a) – (Met): UIAF authority to enter cooperation agreements (Article 3.2 Law 526/1999); UIAF signed 43 MOUs. Article 11 Law 1621/2013 applies to Intelligence Community; Decree 1070/2015 Article 2.2.3.3.1 details coordination; Article 326 EOSF and Article 22 Law 964/2005 for SFC; National Police agreements with Interpol (Decree 216/2010) and Europol (Law 1582/2012); Article 4 Decree 16/2014 duties for FGN; Section 631 Tax Statute allows DIAN exchange. - Subcriterion 40.2(b) – (Met): Nothing prevents use of most efficient means to cooperate. - Subcriterion 40.2(c) – (Met): UIAF exchanges via Egmont Secure Web; National Police and FGN are point of contacts in the RRAG; National Police uses Interpol and Europol channels; DIAN uses WCO mechanisms. - Subcriterion 40.2(d) – (Mostly Met): FGN, UIAF, National Police have clear prioritization and timely execution processes; DIAN lacked manual at onsite but approved internal procedure PR-IC-0356 after onsite. - Subcriterion 40.2(e) – (Mostly Met): UIAF, National Police, and DNI have clear processes for safeguarding information; SFC has Information Security Policy (Document A-PT-GTI-001) and Manual (A-MN-GTI-006); DIAN approved PR-IC-0356 after onsite. - Criterion 40.3 – (Met) - Members of Intelligence Community, UIAF, and SFC have legal powers to exchange information and enter MOUs without need for specific agreement; UIAF signed 43 MOUs; SFC entered 29 bilateral and multilateral arrangements; DIAN signed several agreements. - Criterion 40.4 – (Met) - Competent authorities can provide feedback in a timely manner; UIAF includes feedback clauses in MOUs. - Criterion 40.5 – (Met) - Legal framework does not prohibit or place unreasonable or unduly restrictive conditions on information exchange on grounds listed. - Criterion 40.6 – (Mostly Met) - Robust legal framework protecting adequate use of exchanged information for Intelligence Community (Law 1621/2013 and Decree 1070/2015). - MOUs and resolutions include clauses for adequate use. - DIAN lacked internal controls at onsite but approved PR-IC-0356 after onsite. - Criterion 40.7 – (Met) - Robust legal framework protecting confidentiality of exchanged information for Intelligence Community; UIAF may refrain from sharing when no legal grounds (Article 6 Decree 1497/2002); MOUs include confidentiality clauses; Resolution DIAN 101/2015 includes confidentiality provision. - Criterion 40.8 – (Mostly Met) - UIAF, National Police, FGN, and SFC can conduct inquiries on behalf of foreign counterparts and exchange information obtainable domestically; DIAN cannot. Exchange of information between specialized counterparts: - FIUs (40.9–40.11) — (Met) - UIAF has legal basis (Article 3 Law 526/1999; Articles 10 and 11 Law 1621/2013; Article 2.2.3.3.1 Decree 1070/2015) and 43 MOUs; MOUs include feedback clauses; UIAF can exchange range of information including that accessible under R.29 and any other information it can obtain domestically, subject to reciprocity. - Financial supervisors (40.12–40.16) — (Mostly Met / Met) - SFC has authority to provide cooperation (Article 326.8 EOSF amended by Article 45 Law 510/1999) and 29 arrangements. - DIAN can exchange information set out in Decree 4048/2008; SES lacks specific legal basis for cooperation but entities supervised by SES cannot have foreign branches or operate in other jurisdictions. - SFC and DIAN can exchange domestically available information; SES cannot. - SFC can exchange regulatory, prudential and AML/CFT information when relevant; unclear whether DIAN has sound legal basis for same; SES cannot. - SFC able to conduct inquiries on behalf of foreign counterparts; unclear for DIAN; SES entities limited by lack of foreign operations. - Financial supervisors obtain prior authorization of requested supervisor before dissemination or using exchanged information (Criterion 40.16 – Met). - Law Enforcement Authorities (40.17–40.19) — (Met) - LEAs can exchange domestically available information with foreign counterparts for intelligence or investigative purposes (Article 11 Law 1621/2013; Decree 1070/2015). - LEAs can use powers and investigative techniques described in R.31 to conduct inquiries and obtain information on behalf of foreign counterparts (Article 4 Decree 16/2014). - CPC Article 487 allows FGN to be part of international commissions for transnational offenses; National Police agreements with Interpol, Europol, Ameripol. - Exchange with non-counterparts (40.20) — (Not Met) - Competent authorities in Colombia do not have a legal framework specifically allowing them to exchange information indirectly with non-counterparts. Weighting and Conclusion for R.40: - Colombia has a robust regime allowing competent authorities to rapidly provide a wide range of international cooperation, both upon request and spontaneously. - Most relevant criteria of R.40 are fully met or mostly met. - LEAs have solid procedures for safeguarding confidentiality of information. - Competent authorities do not have a legal framework specifically allowing them to exchange information indirectly with non-counterparts. - Recommendation 40 is rated largely compliant. *International Monetary Fund* ### Annex II. Summary of Technical Compliance—Key ### Annex II. Summary of Technical Compliance—Key Deficiencies ### Overview - This annex summarizes technical compliance with FATF Recommendations and the key factors underlying each rating. ### Recommendation 1 — Assessing risks and applying a risk-based approach (LC) - Some sectors were not involved and there were data gaps during the NRA process. - Not all the risks of the 2013 and 2016 NRAs have been addressed in the AML/CFT policies. - Some of the criteria related to FIs and DNFBPs obligations are partially met. ### Recommendation 2 — National cooperation and coordination (LC) - AML/CFT policies still do not fully reflect some of the risks identified in the NRAs. - There is a need to strengthen inter-institutional collaboration between the UIAF and the supervisors and the UIAF and the customs authorities. - It is not clear how these national mechanisms are applied to coordinate policies against proliferation financing. ### Recommendation 3 — Money laundering offense (LC) - Some predicate offenses are still not covered and there is no criminal liability for legal persons for ML. ### Recommendation 4 — Confiscation and provisional measures (C) - (No underlying factors listed.) ### Recommendation 5 — Terrorist financing offense (LC) - There is no criminal liability of legal persons for TF. ### Recommendation 6 — Targeted financial sanctions related to terrorism and TF (PC) - Freezing of terrorist assets is tied to asset forfeiture process. - Terrorist assets require a link to criminal activity to be frozen. - There is no process for unfreezing or returning the funds. ### Recommendation 7 — Targeted financial sanctions related to proliferation (NC) - There are no laws or regulations that require individuals or entities to freeze goods and assets related to the UNSCRs on proliferation of WMD and its financing. - Freezing can only be applied after ordered by the prosecutor as precautionary measure under the AFL. - Assets require a link to criminal activity to be frozen. ### Recommendation 8 — Nonprofit organizations (PC) - Colombia has not identified which subset of organizations fall within the FATF definition of NPO. - Colombia has not clearly identified the features and types of NPOs which are likely to be at specific risk for TF abuse. - Competent authorities have not reviewed the adequacy of AML/CFT regulations for relevant NPOs. - Colombian authorities have not periodically reassessed the sector by reviewing additional information on the sector’s potential vulnerabilities to terrorist activities to ensure effective implementation of measures. - No outreach, training, and communication initiatives related to ML/TF in the NPO sector falling under the scope of the FATF definition where implemented by competent authorities. - There are no comprehensive and clear policies in place concerning NPOs falling under the scope of FATF definition. - Colombia has not taken specific relevant actions to encourage NPOs to conduct transactions via regulated financial channels, wherever feasible. - Competent authorities have not taken steps to promote effective supervision or monitoring that demonstrates that risk-based measures apply to NPOs at risk for TF abuse. - Not all the relevant NPOs, particularly the religious and foreign NPOs, are subject to effective, proportionate, and dissuasive sanctions for violations of their obligations. ### Recommendation 9 — Financial institution secrecy laws (C) - (No underlying factors listed.) ### Recommendation 10 — Customer due diligence (PC) - There is no explicit obligation set forth in law for financial institutions to apply CDD. - Except for SFC-supervised entities, there is no legal obligation to identify and verify the identity of the BO. - There is no obligation to understand and, as appropriate, obtain information on the purpose and intended nature of the business relationship. - Professional currency exchange firms are not required to conduct ongoing due diligence on the business relationship, including to scrutinize transactions. - There is no obligation to understand the customers’ ownership and control structure. - Financial institutions conducting business with trusts are not required to identify the trustees and any other natural person exercising ultimate effective control over the trust and to take reasonable measures to verify the information. - There is no requirement to apply the CDD requirements to existing customers based on materiality and risk. - There is no obligation for financial institutions under the supervision of MINTIC to apply enhanced due diligence measures where ML/TF risks are higher. ### Recommendation 11 — Record keeping (C) - (No underlying factors listed.) ### Recommendation 12 — Politically exposed persons (PC) - Only partial coverage of foreign PEPs, and persons who are or have been entrusted with prominent functions by international organization. ### Recommendation 13 — Correspondent banking (PC) - Payable through correspondent accounts are not addressed by the SARLAFT. - There are no prohibitions to enter or continue banking relationships with shell banks. ### Recommendation 14 — Money or value transfer services (C) - (No underlying factors listed.) ### Recommendation 15 — New technologies (PC) - There are no requirements for postal transfer operators. ### Recommendation 16 — Wire transfers (PC) - There are no requirements in place addressing wire transfers from a single originator when these are bundled in a batch file. - There is no requirement for financial institutions to verify the information pertaining to its customer where there is a suspicion of ML/TF. - There is no requirement to include the account numbers or a unique transaction reference for the originator and the beneficiary. - The existing requirements do not explicitly address or differentiate the instances where the institution is acting as the intermediary institution, experiences technical limitations, lacks information required for the originator or beneficiary or is required to apply risk-based policies and procedures in the absence of information. - There is no requirement for money remitters or other transfer systems to obtain the originator’s account numbers or a unique transaction reference. ### Recommendation 17 — Reliance on third parties (N/A) - Reliance on third parties is effectively prohibited. ### Recommendation 18 — Internal controls and foreign branches and subsidiaries (C) - (No underlying factors listed.) ### Recommendation 19 — Higher-risk countries (PC) - There are no provisions in place to apply countermeasures or ensure that financial institutions are advised of concerns about weaknesses in the AML/CFT systems of other countries. ### Recommendation 20 — Reporting of suspicious transaction (LC) - Concerns regarding the scope of Colombia’s financial sector reporting obligations related to the requirement to report transactions and attempted transactions. ### Recommendation 21 — Tipping-off and confidentiality (C) - (No underlying factors listed.) ### Recommendation 22 — DNFBPs: Customer due diligence (PC) - Most lawyers, accountants, and real estate agents do not meet the requirements and thresholds set by regulations, so they are not subject to AML/CFT measures. - Dealers in precious metals and precious stones are not classified as DNFBPs. - CDD obligations are not set in a law. - CDD and BO identification of DNFBPs under the supervision of Supersociedades are not in line with R.10 requirements. - Notaries are not required to identify BO. ### Recommendation 23 — DNFBPs: Other measures (PC) - Most lawyers, accountants, real estate agents, and dealers in precious metals and stones do not have STR obligations. - Notaries are not required to report STRs. ### Recommendation 24 — Transparency and beneficial ownership of legal persons (PC) - There are no processes to obtain and hold accurate and up to date information on beneficial ownership. ### Recommendation 25 — Transparency and beneficial ownership of legal arrangements (LC) - Deficiencies on obtained BO information and in the sanctions for infringements. ### Recommendation 26 — Regulation and supervision of financial institutions (LC) - Supervision and monitoring of non-core financial institutions is not risk-based. - Supervision of postal operations for domestic transfers is not risk-based. ### Recommendation 27 — Powers of supervisors (LC) - No specific sanctions are provided under the law or SARLAFT for the AML/CFT obligations imposed on postal transfer operators. ### Recommendation 28 — Regulation and supervision of DNFBPs (PC) - Coljuegos regulations do not require to identify the BO for casinos operators. - AML/CFT sanctions for casinos are not defined. - Most lawyers, accountants, real estate agents, and dealers in precious metals and stones are not subject to AML/CFT obligations. - Measures to prevent criminals or their associates from being professionally accredited, or holding, or being the BO of a significant or controlling interest, or holding a management function in a DNFBP are very limited. - Sanctions for AML/CFT infringements of DNFBPs are not sufficiently dissuasive/ proportionate. ### Recommendation 29 — Financial intelligence units (LC) - The UIAF does not have timely access to information DIAN declarations on cross-border transportation of cash and BNIs. ### Recommendation 30 — Responsibilities of law enforcement and investigative authorities (C) - (No underlying factors listed.) ### Recommendation 31 — Powers of law enforcement and investigative authorities (C) - (No underlying factors listed.) ### Recommendation 32 — Cash couriers (LC) - Information obtained through the written declaration system is not readily available to the UIAF. - There is not a collaboration agreement between the DIAN and FGN for information-sharing purposes, and it is not clear if the referred coordination agreements are set up. - The DIAN has authority to seize currency or BNI only when there is a false declaration or a failure to submit the declaration. ### Recommendation 33 — Statistics (PC) - Functioning of the national statistic system established in CONPES 3793 could not be established. - Authorities are not complying with their obligation to report quarterly statistical information to UIAF, as provided by law. ### Recommendation 34 — Guidance and feedback (PC) - No guidelines have been issued or feedback provided for financial institutions. ### Recommendation 35 — Sanctions (PC) - No criminal, civil, or administrative sanctions are provided for DNFBPs. ### Recommendation 36 — International instruments (LC) - Not all conducts specified in the Vienna, Palermo, Merida, and TF Conventions are covered in Colombia. ### Recommendation 37 — Mutual legal assistance (LC) - There is no specific procedure or provision in place related to the duty to maintain the confidentiality of MLA requests and the information contained in them, to protect the integrity of the investigation or inquiry. ### Recommendation 38 — Mutual legal assistance: freezing and confiscation (C) - (No underlying factors listed.) ### Recommendation 39 — Extradition (LC) - Technical gaps related to criminalization of both offenses could impact on extradition requests referred to criminal conducts not fully covered. ### Recommendation 40 — Other forms of international cooperation (LC) - At the time of the onsite visit, the DIAN did not have internal procedures or systems for the prioritization and timely execution of international cooperation requests. - At the time of the onsite visit, the DIAN did not have clear internal procedures for safeguarding the information received. - At the time of the onsite visit, the DIAN did not have clear internal controls to ensure that information exchanged is used for the intended purpose for, and by, the authorities for whom the information was provided. - The DIAN is not able to conduct inquiries on behalf of foreign counterparts. - It is not clear whether the DIAN has a sound legal basis for providing cooperation with their foreign counterparts in relation to regulatory, prudential and AML/CFT information. - Competent authorities do not have a legal framework specifically allowing them to exchange information indirectly with non-counterparts. *Annex II. Summary of Technical Compliance—Key Deficiencies* --- _Source: https://www.imf.org/-/media/files/publications/cr/2018/cr18314-colombiadar.pdf_