Three lessons regarding sanctions for non-compliance with SAGRILAFT and PTEE obligations

On November 3, 2023, through resolutions 2023-01-880062 and 2023-01-880696 (the “Resolutions”), the Superintendence of Companies (“SSC”) imposed fines on a well-known food delivery company totaling almost COP$708 million. These fines sanctioned non-compliance with certain obligations established in Chapter X and Chapter XIII of the Basic Legal Circular (“CBJ” by its acronym in Spanish) of said governmental entity, which regulate the System of Self-Control and Integral Risk Management of Money Laundering, Financing of Terrorism and Financing of the Proliferation of Weapons of Mass Destruction (“SAGRILAFT”) and the Program of Transparency and Business Ethics (“PTEE”), respectively. The SSC published the Resolutions, allowing the general public to learn more about the details and reasoning behind these sanctions. From them, three (3) relevant lessons can be drawn for any company obliged to implement a SAGRILAFT and/or a PTEE.

First lesson: Importance of appointing a substitute compliance officer

The Resolutions imposed a sanction for operating without a compliance officer for the SAGRILAFT and PTEE between April 1, 2023, and May 26, 2023. The sanctioned company’s compliance officer had announced his resignation eight (8) days before April 1; however, by April 19, when the SSC carried out an administrative visit to the company, a new compliance officer had not been appointed for the aforementioned systems. In this regard, the SSC determined that the company should have noticed the need to appoint a substitute compliance officer when the principal compliance officer announced his resignation to avoid a vacancy in the position.

The Resolutions emphasize that the compliance officer is the leader and administrator of the SAGRILAFT and PTEE, and that they must be present in all processes, stages and elements of such systems. Therefore, the vacancy of this position, even if temporary, generates daily uncertainty regarding the administration of the SAGRILAFT and PTEE and the monitoring of the risks they seek to control. Thus, a first lesson to be taken from the Resolutions by any company obliged to implement a SAGRILAFT and/or a PTEE is the importance of appointing a substitute compliance officer who can assume the position and avoid any vacancy in this position, especially in the absence or resignation of the main compliance officer.

Second lesson: The risk matrix must comply with the requirements of Chapters X and XIII of the CBJ

The SSC stated that, during its administrative visit, it learned of an Excel document used as a risk matrix for the SAGRILAFT and PTEE. However, it determined that said document did not comply with the minimum characteristics that a risk matrix must have according to Chapters X and XIII of the CBJ.

The Resolutions emphasize that a risk matrix that complies with the requirements of said chapters must be a tool that, through a practical use, evidences the individualization, measurement or evaluation of money laundering, financing of terrorism and financing of the proliferation of weapons of mass destruction risks, and/or corruption and transnational bribery risks. In addition, such matrix must propose measures for the adequate control of the aforementioned risks, evidence an examination of the inherent and residual risk of each one and assign personnel responsible for their management. With this in mind, the second lesson to be taken from the Resolutions by any company obliged to implement a SAGRILAFT and/or a PTEE is the importance of having a robust risk matrix that complies with current regulations on the subject.

Third lesson: Prompt adoption of corrective actions leads to a reduction of the sanction

In the administrative visit report, the SSC listed a series of opportunities for improvement for the company’s SAGRILAFT and PTEE, as well as two (2) corrective actions to be taken in the shortest possible time: (i) the appointment of a compliance officer, and (ii) the adoption of a risk matrix. Even though the company promptly implemented these corrective actions, submitting to the SSC the Board of Directors’ resolution of appointment of a new compliance officer, together with a new risk matrix, on June 8, 2023, the Resolutions affirmed that the sanctions were inevitable. However, the SSC acknowledged the prompt adoption of the corrective measures as a favorable graduation factor when assessing the fines’ value. Therefore, the third lesson to be taken from the Resolutions by any company obliged to implement SAGRILAFT and/or PTEE and that may be subject to an administrative visit by the SSC, is that any corrective action required by such entity must be adopted as soon as possible; otherwise, the sanctions imposed could be more severe.

It should be noted that, to date, several companies have been sanctioned in the matter of SAGRILAFT and/or PTEE for non-compliance with the provisions of Chapters X and XIII. So far this year, the SSC has imposed four (4) sanctions against companies for non-compliance with these regulations. Therefore, all companies obliged to implement SAGRILAFT and/or PTEE must ensure that their compliance systems effectively comply with the obligations set forth in Chapters X and XIII of the CBJ of the SSC.