Introduction
It's been long since governments and international businesses have fought against crime, terrorism and its financing schemes, particularly those hidden behind commercial ordinary organizations and operations. Risk of inadvertently having an investment, a partner, a provider, an employee, even a customer with dubious, informal or flexible links to criminal proceeds becomes particularly wide and familiar when it comes to seize global markets demanding attention not just from legal counsel but from every officer of a corporation.
Traditionally, Financial Institutions were required to implement internal measures to contain flows of those unwanted funds, but today corporations are under scrutiny too. Several jurisdictions have enacted internal specific regulations to help the business community in avoiding such risks. Some of these regulations are based on international models designed under cooperation institutions as the Financial Action Task Force (FATF), some others include as well provisions out of its successful experience on the matter.
Colombia is no exception and for those making or about to make business there awaits a complete set of laws and government agencies devoted to help private sector adopting AML/CTF practices. The following tips summarize key issues of such regulations.
1. Who needs to comply with AML/CTF regulations?
Whether a Corporation is mandated to comply with Corporate AML/CTF provisions is a matter of reported income. Every corporation that reported, by December 31, 2013 COL$94.320,000,000.000.oo (around US$50,000,000.oo) of yearly income is required to comply with AML/CTF regulations.
The figure is revised annually in accordance with rate of exchange and changes in "minimum monthly legal wage".
Also compliance depends on supervision of Superintendence of Corporations of Colombia. Legally almost every corporation is subject to such supervision and, particularly all foreign ones or receiving foreign investment.
Every other Corporation has a voluntary compliance status, yet all of them can be eventually required by competent authorities to provide specific financial information about operations with related parties under criminal investigation or deemed suspicious or unusual. In that sense, even if not over the income cap, it is advisable to implement a corporate AML/CTF.
2. What penalties noncompliance entails?
Authorities can impose administrative fines if a Corporation is found to be failing to comply with Corporate AML/CTF regulations. This fines are up to USD$40.000.00 and can be imposed several times. There are as well nearly 50 different types of criminal charges that may arise from a non-controlled event of AML/CTF. In that case, directors and legal representatives are find guilty and imprisonment of 10-20 years is likely to be imposed.
Colombian government as well regularly reports Corporations and individuals with proven links to Criminal or Terrorist activities to other governments and organisms that keep lists of unwanted subjects as U.S. Treasury's Office of Foreign Assets Control (OFAC) OFAC list or United Kingdom's Consolidated List of Financial Sanctions Targets.
3. What needs to be done?
Corporate AML/CTF regulations require implementing a comprehensive Self-controlled and Self-managed System to address the risk of ML/FT. This means, accordingly with the specific type, size, business, activities, sell channels and details of the given Corporation, to:
a. Adopt a documented methodology to identify, evaluate and follow risk of ML/FT. This methodology should be mentioned in minutes of Board of Directors meetings to approve it and instructing/authorizing corporate officials to implement it, allocating the resources needed.b. Hire/nominate personnel trained and dedicated to undertake such evaluation and revision.c. Implement the technology to keep track of financial and operational data and to identify suspicious, unusual operations or attempts of operations, including a data base of customers, providers, employees and other third parties associated with corporate operations.d. Review all contracts with employees, providers and customers to include clauses referring to Corporate AML/CTF Risk Management System information gathering obligations.e. Implement a know-your-customer process asking for relevant sources of their finances and legality of their activities as well as those of their business partners.f. Provide information and educational materials and activities to all employees of the Corporation about the Corporate AML/CTF Risk Management System.g. Provide all information required by internal and external Auditors, Board of Directors and Shareholders about Corporate AML/CTF Risk Management System, including an annual full report prepared by legal representatives.h. Report all suspicious or unusual operations or attempt of operations to authorities.
4. What kind of operations should be followed by our AML/CTF Self-managed System?
All operations and businesses need to be placed under the Corporate AML/CTF Risk Management System review. Not just businesses with consumers, but those required to run the Corporation in the country or abroad.
E.g.: for businesses with distance sales (regular mail, phone, internet, etc.) a full identification of consumers is required.
5. Who is the Compliance Officer?
A requirement for appointing a Compliance Officer is included in Colombian Corporate AML/CTF regulations. Since an specialized officer comes in hand for effective implementation and management of the Corporate AML/CTF Risk Management System, the law gives this official the task of reporting every six months (at least) directly to legal representatives and the Board of Directors about the System's progress and findings, as well as the recommendations arising from them.
6. Already established AML/CTF risk management systems are sufficient or is required to change them?
Corporate AML/CTF risk management systems were encouraged by regulations in Colombia. Yet, since 2014, a more comprehensive and exhaustive approach was adopted for the business community beyond Financial Institutions, rendering necessary to adapt all previous systems and programs to the new standard which in turn comes out directly of a full implementation of FATF recommendations of 2012.
7. How much time is there to adopt a Corporate AML/CTF Risk Management System?
For corporations established or doing business in Colombia before December 31, 2013, time is already up. The regulatory deadline was December 31, 2014, any delay beyond that date exposes to penalties.
For corporations established or doing business in Colombia after December 31, 2013 that reach the income cap described in 1, a period of 1 year is granted to start running their Corporate AML/CTF Risk Management System.
8. Is there any model of Corporate AML/CTF Risk Management recommended by Colombian government?
As a joint effort made by the United Nations Office against Drugs and Crime, the Chamber of Commerce of Bogota and the British Embassy in Colombia, the "Responsible and Safe Businesses" Program was established to bring a customized and adapted approach of AML/CTF to Colombian businesses.
The result is a document known as the "Responsible and Safe Businesses AML/CTF Risk Management Model" which is officially recommended by the Superintendency of Corporations of Colombia as valid reference to comply with AML/CTF national regulations.
9. Which government agencies advice on/enforce compliance of AML/CTF regulations?
There are 3 Colombian government institutions that are competent to enforce compliance and impose sanctions in the AML/CTF field.
a. Superintendency of Corporations (Superintendencia de Sociedades). Supervision authority for ordinary commercial Corporations acting in the country. This agency has issued the bulk of AML/CTF regulatory body for the nation.b. Financial Information and Analysis Unit (Unidad de Información y Análisis Financiero).Specialized intelligence agency responsible for gathering and identifying financial criminal activity.c. Criminal Judiciary (Jueces Penales). Part of the judiciary system of the country in charge to prosecute and judge crime as money laundering and terrorism.
10. Which regulations to look for?
Colombian Corporate AML/CTF regulations are comprised by the following sources of law:
- Powers Superintendency of Corporations: Law 222, Section 84,83-Decree 4350/2006
- Powers of Financial Information and Analysis Unit: Law 526/1999-Law 1121/2006
- AML/CTF regulatory powers for Superintendency of Corporations: Decree 10323/2012, Section 7
- Full body of Corporate AML/CTF duties: Chapter X. Superintendency of Corporations Basic Legal Letter
Conclusion
As a worldwide phenomenon money laundering and terrorism needs to be confronted in a coordinated manner, taking AML/CTF beyond to be a government exclusive issue and making it a social one, and even more, a culture. Therefore jurisdictions need to commit with a mixture of international recommendations and locally effective measures. Colombian regulations may be a good example of that, as well as a working case of rigorous inception of AML/CTF risk management for its internal commercial practices.
Additional Resources
