AML and Anti-Bribery Compliance

It turns on two things: whether the company exceeds the asset or revenue thresholds set out in the Superintendency of Companies' Basic Legal Circular, and whether it belongs to one of the sectors covered regardless of size. Both the thresholds and the list have changed across successive versions of the circular, so the answer is checked against the financial statements for the relevant cut-off date and against what the company actually does. We deliver that conclusion in writing.

They address different risks. SAGRILAFT targets money laundering, terrorism financing and the financing of the proliferation of weapons of mass destruction, and rests on knowing your counterparties. The PTEE targets transnational bribery, corruption and fraud, and rests on the code of conduct, the whistleblowing channel and due diligence on intermediaries and business partners. A company may be required to have one, both or neither.

No. SARLAFT is the financial sector system, required by the Financial Superintendency. SAGRILAFT is the real sector system, required by the Superintendency of Companies. The underlying risk-management logic is similar, but the scope, the supervising authority and the specific obligations differ, and a manual copied from the other regime usually creates more problems than it solves.

It must be an individual with knowledge of the risk, functional independence from the areas being controlled, and a direct reporting line to the highest corporate body. The appointment is documented and registered with the Superintendency. The role is exercised from within the company, but where the appointee has no prior experience we provide ongoing external support: we train them, hand over the calendar of their obligations and review their reports with them.

It depends on what sits behind it. A generic manual, with no risk matrix built on the actual business, no procedures staff actually follow and no training records, is hard to defend in a review. What we do is audit the program against the applicable circular and against how the company really operates, and deliver a gap report with a remediation plan prioritised by risk. In many cases the structure is kept and the missing pieces are fixed.

The authority reviews documentation, interviews the compliance officer and checks whether the program is genuinely applied, not merely written down. An information request carries a deadline, and what is filed shapes the discussion that follows. The first thing we do is confirm the date of service and the applicable deadline; from there we prepare the response and take on the technical defence in the administrative investigation, which can reach both the company and its directors and officers.

An adopted program, not a folder. That includes the risk assessment, the documented matrix with the reasoning behind each rating, the manual drafted around the company's operations, the minutes approving it, the due diligence procedures and templates, the red flags with their escalation route, the supporting record of the compliance officer's appointment and the record of the training delivered.

Where the internal analysis concludes that a transaction is suspicious, a report must be filed with the UIAF. The rule worth being clear about from the outset is that the reported counterparty is not informed. That is why the procedure has to set out in writing who analyses the alert, who decides, and how the decision is documented, both when a report is filed and when the conclusion is that no report is due.