PTEE Colombia: what the anti-bribery compliance program requires

A finance lead at a foreign company with a subsidiary, distributor or local contracts in Colombia faces a concrete question since July 2026: does PTEE still exist, and if so, what does it require today? The answer changed substantially when the Superintendencia de Sociedades rewrote the rule, and most content published before that date no longer describes the system in force.

In Soulbit Academy we explain what PTEE is within the unified system, which companies must cover it, what it requires against corruption and transnational bribery risk, what the law sanctions, and what changes for a company that already had a standalone PTEE or SAGRILAFT.

What PTEE is today: the C/ST component of the unified system

PTEE, the Business Transparency and Ethics Program, has been the corruption and transnational bribery component of a single unified system since July 2, 2026. That is set out in Circular Externa 100-000020 of 2026 from the Superintendencia de Sociedades, which renews the Circular Básica Jurídica and creates Chapter IX.

That chapter is called the LA/FT/FP y C/ST Self-Control and Risk Management System. LA/FT/FP covers money laundering, terrorism financing and proliferation financing, the ground previously covered by SAGRILAFT. C/ST covers local corruption and transnational bribery, the ground previously covered by PTEE.

The merger is not cosmetic. The circular requires a single policy, a single procedures manual and a single risk matrix covering both fronts, under one compliance officer. The two are no longer designed or audited separately. If a company ran SAGRILAFT and PTEE with different teams, the first practical change is folding them into one program.

As of October 2026, the circular is in force from the date it was published. It is not a draft or a proposal under consultation. We cover its money-laundering side in SAGRILAFT Colombia: who must comply. This article focuses on the corruption and transnational bribery side.

Who must cover the C/ST component: the same thresholds as SAGRILAFT

The companies obligated to cover C/ST are the same ones obligated to have SAGRILAFT, with no separate threshold for the anti-bribery piece. The circular treats both risks as a single scope of application.

The general criterion is total revenue or total assets, as of December 31 of the prior year, equal to or above 4,929,017 UVB, provided the company is supervised by the Superintendencia de Sociedades and has no special supervisory regime tied to its activity. Six higher-risk sectors, including real estate, precious metals and stones, legal services, accounting services, construction and vehicle trading, fall in from 3,696,762 UVB if their registered CIIU code matches the circular's list.

Scope	Who is covered	Threshold under the circular	Separate C/ST threshold?
General criterion	Companies, sole proprietorships and branches of foreign companies supervised by the Superintendencia de Sociedades	Revenue or assets from 4,929,017 UVB	No. Same threshold as SAGRILAFT
Six higher-risk sectors	Real estate, precious metals and stones, legal services, accounting services, construction and vehicle trading	Revenue or assets from 3,696,762 UVB	No. Depends on the registered CIIU code, not on bribery risk
Virtual assets	Entities receiving virtual asset contributions or providing exchange, transfer or custody services	From 12,323 UVB in contributions or transactions	No. The threshold covers LA/FT/FP and C/ST together
Minimum measures regime	Listed sectors below the general threshold	From 369,676 UVB in revenue or 616,127 UVB in assets	No. The reduced regime is also joint

Is there a headcount or state-contracting threshold for PTEE?

Circular Externa 100-000020 sets no headcount or state-contracting threshold for PTEE. Ley 2195 of 2022 authorized the Superintendencia to set program content by sector, risk, assets, revenue and headcount, but the entry threshold the circular finally adopted is the same revenue-or-assets test in UVB for both components. Contracting with the state is not, on its own, a trigger for the obligation; it triggers one of the policies the system requires, not the duty to have the system.

Chambers of commerce with ordinary revenue from 4,929,017 UVB are also obligated, and the Colombian Confederation of Chambers of Commerce is obligated regardless of size. A company not supervised by the Superintendencia de Sociedades, because another entity with a special regime supervises it instead, is not obligated under this specific chapter.

The seven policies the system requires against corruption and transnational bribery

The C/ST component requires the obligated company to design and adopt, at minimum, seven written policies covering the points where corruption and transnational bribery risk most often materializes. A generic manual is not enough: each policy must set its own procedures, thresholds, controls and internal sanctions.

The seven are gifts and benefits to third parties, meal, lodging and travel expenses, political contributions, donations, lobbying, proliferation financing prevention, and state contracting. The last three are the ones least common outside this framework, and the ones that most expose an SMB with suppliers, intermediaries or agents abroad.

Policy	What the circular requires	Where the risk sits for an SMB
Gifts and benefits to third parties	Minimum and maximum amounts, with controls and internal sanctions for violations	Gifts to officials or to business counterparties during negotiations
Meal, lodging and travel expenses	Procedure for receiving and granting these to staff, contractors and suppliers, limiting cash use	Paid travel or hospitality tied to a purchasing or contract decision
Political contributions	Prohibition or procedure for contributing to campaigns, with due diligence on the candidate or party	Contributions by the company or its executives to political actors
Donations	Format, due diligence and follow-up on the destination of cash or in-kind donations	Donations that end up masking an improper payment
Lobbying	Transparency in dealings with public decision-makers	Managing interests before public entities without a paper trail
Proliferation financing prevention	Alerts on transactions linked to weapons of mass destruction	Payments to counterparties or jurisdictions carrying that risk
State contracting	Guidelines for the pre-contractual, contractual and post-contractual stages, with an explicit ban on improper incentives	Companies selling to public entities or bidding on tenders

The circular defines contractors broadly: suppliers, intermediaries, agents, distributors, advisors and consultants, plus anyone in a joint venture or consortium with the obligated company. A company that pays a commercial agent abroad or receives services from an intermediary must run due diligence on them under these policies, not only under SAGRILAFT's general due diligence.

The compliance officer, the C/ST risk matrix and the whistleblower channel

The same compliance officer who answers for SAGRILAFT also answers for the C/ST component; the circular does not create a separate role for the anti-bribery piece. That officer reports to the board, keeps the requirements already set for SAGRILAFT, a professional degree, one year of experience, a specialization or a 90-hour diploma, and Colombian residence, which we detail in the article on who must comply with SAGRILAFT.

The risk matrix must incorporate factors specific to C/ST, such as exposure to public counterparties, politically exposed persons, intermediaries in higher-risk jurisdictions, or sectors with a history of corruption. It is not the money-laundering matrix with one extra column: the circular requires identifying, assessing, controlling and monitoring these risks explicitly.

What whistleblower channel does the C/ST component require?

It is a confidential, anonymous mechanism for employees, administrators, partners, contractors and third parties to report possible corruption or transnational bribery, or any irregularity in the system. The circular requires protecting it against retaliation, checking it periodically, and publicizing the external channels run by the Superintendencia de Sociedades and the Presidency's Secretaría de Transparencia.

There is also a reporting duty unique to C/ST that did not exist under plain SAGRILAFT: when the statutory auditor or the compliance officer becomes aware of facts that could amount to transnational bribery, they must report them directly to the Superintendencia de Sociedades, the authority with jurisdiction to investigate that conduct. This is additional to, not a replacement for, the suspicious transaction report that still goes to UIAF.

What a company risks: bribery penalties versus non-compliance penalties

Failing to run the system and a proven act of transnational bribery trigger two distinct penalty regimes of very different magnitude. Not having the system in place is sanctioned differently from an actual act of transnational bribery being proven.

Failing to implement or properly run the Self-Control and Risk Management System, in either component, is sanctioned under paragraph 3 of article 86 of Ley 222 of 1995: fines, successive or not, up to 200 monthly minimum wages, assessed in UVB under article 313 of Ley 2294 of 2023. That is the same penalty that applies to SAGRILAFT non-compliance.

Proving an act of transnational bribery is a different matter. Article 5 of Ley 1778 of 2016, as amended by Ley 2195 of 2022, authorizes the Superintendencia de Sociedades to impose, separately or together, a fine of up to 200,000 monthly minimum wages, a ban on contracting with the Colombian state for up to 20 years, publication of the sanction in the media and on the company's website for one year, and a 5-year ban on receiving government incentives or subsidies.

How much does the bribery fine cap represent in Colombian pesos?

Using the 2026 minimum wage of 1,750,905 pesos, the 200,000-minimum-wage cap works out to roughly 350.181 billion pesos. That is a reference ceiling under the law, not a typical penalty: each case is graded under the criteria of article 7 of the same law, and fines actually imposed by the Superintendencia have been lower.

Administrative liability, under article 2 of Ley 1778 of 2016, falls on the legal entity when an employee, contractor, administrator or partner gives, offers or promises a foreign public official money or another benefit in exchange for an act tied to an international business deal. A payment made by an agent or distributor abroad, on the company's behalf, can expose the company as much as one made directly.

What changes if a company already had PTEE or SAGRILAFT separately

If a company was already obligated under the prior circulars, from 2020, 2021 or 2024, its current system remains valid while it adjusts to the new one. Chapter IX sets May 31, 2027 as the deadline for that adjustment, roughly ten months after the circular was issued in July 2026.

The adjustment is not cosmetic. It means merging the PTEE manual with the SAGRILAFT manual, unifying the risk matrix, confirming the compliance officer covers both fronts, and documenting the seven C/ST policies if they previously lived in separate places. The Superintendencia also keeps the power to supervise, even after the new chapter takes effect, compliance with the prior PTEE and SAGRILAFT circulars during the transition.

A company that stops meeting the revenue or asset thresholds is not released immediately: it remains obligated for two more years under the full system, or one more year under the minimum measures regime. This minimum-permanence rule applies equally to both components, since they are now one system.

A company that becomes obligated for the first time after December 31, 2026 has until May 31 of the following year to implement the full system, with its seven C/ST policies included from day one. We cover the related money-laundering distinction in SARLAFT vs. SAGRILAFT: differences and who must comply.

What Soulbit V1 delivers against PTEE, and what it does not

Soulbit V1 does not implement a client's C/ST component and does not replace its compliance officer. The system, its seven policies, the C/ST risk matrix and the reports to UIAF and the Superintendencia remain obligations of each covered company, not of its payment provider.

Today Soulbit V1 verifies client companies through KYB, applies transaction monitoring (KYT) and AML controls to the payments it processes, and operates with institutional custody. The traceability of each payment can serve as supporting evidence for a company's own due diligence on counterparties, as we explain in payment traceability for accounting records, and screening counterparties against sanctions lists is an ongoing task covered in sanctions list screening for international payments.

What Soulbit V1 does not deliver matters just as much. It does not draft a company's state-contracting, gift or donation policies, does not design its C/ST risk matrix, does not report on its behalf to the Superintendencia or UIAF, and does not certify that a company complies with the C/ST component.

Does using Soulbit lower a company's transnational bribery risk?

Not on its own. A payment provider's controls cover the payments it processes, but transnational bribery risk originates in the decisions of a company's own employees, administrators, agents and intermediaries abroad, which its own self-control system, not its payment provider, must govern.