Financial Integrity Monitor

Colombia CO

Domains (D1–D6)

Sources

Role actions

Horizon <90d

Jurisdiction profile

CompliantTier BRisk: IncreasingMixed

Colombia operates SARLAFT (risk-based AML/CFT framework for financial institutions, overseen by the Financial Superintendence) and a 2021-era Registro Único de Beneficiarios (RUB) beneficial-ownership registry administered by DIAN.

UIAF is the FIU. The 2018 GAFILAT/FATF mutual evaluation found technical-compliance improvements via subsequent enhanced follow-up but persistent effectiveness gaps, especially on beneficial-ownership verification and territorial enforcement.

Key deficiencies

Large swathes of national territory remain outside effective state control, ceded in practice to ELN, FARC dissidents and Clan del Golfo, who tax and launder through the drug, gold and extortion economies
Beneficial ownership registry (RUB) is recent (2021) and untested for effectiveness/access at the standard FATF will require for 5th-round evaluations
Cash- and commodity-intensive economy remains structurally exposed to Black Market Peso Exchange-style trade-based laundering
Unprecedented October 2025 OFAC designation of the sitting president and his inner circle has introduced acute diplomatic/political-economy stress into the bilateral AML/CTF cooperation architecture

Recent developments (18m)

September 16 2025: US 'decertified' Colombia as a drug-war partner amid record cocaine production
October 24 2025: OFAC designated President Gustavo Petro and members of his family/inner circle under the Illicit Drugs EO 14059 sanctions authority
October 2025: Colombian National Police, Chainalysis, Europol and Spanish Civil Guard dismantled the 'Black Jack' crypto-laundering network tied to Clan del Golfo, seizing an estimated $13.5 million
December 9 2025: OFAC sanctioned a Bogotá-based recruitment network (Maine Global Corp S.A.S.) funnelling Colombians to fight in Sudan's civil war, with links to Russia-designated individuals
December 16 2025: OFAC updated the terrorist designation of Clan del Golfo (Gulf Clan/AGC)
February 2026: Trump-Petro diplomatic thaw on counternarcotics cooperation
July 3 2026: Petro publicly asked President Trump to remove him from the US sanctions list ahead of leaving office

Brief

Lead signal

Lead Signal

Read full brief

Lead Signal

Colombia's financial-integrity posture this cycle is defined by a layering of sanctions architecture onto its largest armed criminal organisation. OFAC's 16 December 2025 SDN update added Foreign Terrorist Organization and Specially Designated Global Terrorist status under Executive Order 13224, as amended, to Clan del Golfo (also known as Los Urabeños or AGC), stacking terrorism-finance authority atop the group's pre-existing Executive Order 14059 narcotics designation. This is architecture rather than incident: the addition does not reflect a single enforcement action against the group but a broadening of the legal toolkit available against its financial networks, which are implicated in cocaine revenue and Darién Gap migrant-smuggling proceeds. Firms with correspondent-banking or trade-finance exposure to Colombia should treat the layered designation as expanding secondary-sanctions risk under section 1(b) of the amended order, not as a discrete transaction to screen against.

Other Developments

A CARF-based reporting regime enters force without a parallel licensing framework. DIAN's Resolución 000240 de 2025 implements the OECD Crypto-Asset Reporting Framework, requiring Crypto-Asset Service Providers to report user-identification and transaction data from tax year 2026, fulfilling Colombia's 31 October 2024 CARF Multilateral Competent Authority Agreement commitment. This obligation now coexists with the absence of any comprehensive VASP prudential or licensing regime: Proyecto de Ley 510 de 2025, the sole comprehensive legislative vehicle for such a regime, was archived under article 190 of Ley 5 de 1992. A successor bill drafted by the Ministry of Finance, reportedly including a specialised entity category and a Financial-Superintendence-supervised sandbox, is described as ready for pre-filing but had not been formally introduced to Congress as of this cycle. Colombia's standing AML/CTF posture continues largely unchanged. Colombia remains outside FATF's grey and black lists but continues under GAFILAT's enhanced follow-up process stemming from its 2018 mutual evaluation, and it holds the GAFILAT Vice-Presidency Pro Tempore through 2026 as the bloc's fifth round of mutual evaluations begins.

Cross-Monitor Connections

The Clan del Golfo designation intersects directly with conflict-finance and extractive-industry-integrity concerns: the group's implicated revenue streams span cocaine trafficking and Darién Gap migrant-smuggling, both conflict-adjacent illicit-finance channels, though this cycle's evidence anchors primarily in the sanctions development itself rather than independent conflict-finance sourcing. The CARF reporting regime is directly relevant to payments and digital-asset monitors tracking Colombia's crypto-asset service-provider ecosystem, where a reporting obligation now applies in the absence of a prudential licensing perimeter.

Outlook

Watch for whether the layered FTO/SDGT designation on Clan del Golfo is mirrored by EU or UK terrorist-organisation listings, which was not verified this cycle, and whether the Ministry of Finance's successor crypto bill is formally introduced to Congress following its March 2026 drafting stage. The structural gap between an expanding tax and information-reporting perimeter for crypto-asset activity and the absence of a comprehensive licensing regime is likely to remain the defining feature of Colombia's digital-asset integrity landscape until a successor bill, if any, is enacted.

weekly_brief_draft · JID CO

Domain intelligence (D1–D6)

D1 Sanctions Architecture and Evasion

Sanctions Architecture and Evasion

OFAC's 16 December 2025 update to the Specially Designated Nationals list added Foreign Terrorist Organization and Specially Designated Global Terrorist designations under Executive Order 13224, as amended, to Clan del Golfo (also known as Los Urabeños or the Autodefensas Gaviristas de Colombia, AGC). This layers a terrorism-finance sanctions architecture atop the group's pre-existing narcotics designation under Executive Order 14059. The architectural significance here exceeds that of a routine SDN listing update: it represents a structural broadening of the legal basis for secondary-sanctions exposure, engaging section 1(b) of the amended EO 13224, for any financial institution with correspondent or trade-finance links into networks associated with the group. Clan del Golfo is Colombia's largest armed criminal organisation, and its implicated revenue base spans cocaine-trafficking proceeds and Darién Gap migrant-smuggling, both channels through which illicit finance can move through formal and informal payment corridors touching Colombia.

The practical consequence of stacking an FTO/SDGT designation onto an existing narcotics designation is that compliance functions screening against OFAC lists now face a dual-basis designation whose secondary-sanctions risk calculus is broader than a narcotics-only listing would generate. This is architecture-over-incident: the designation itself, not any single seizure or interdiction, is the signal. Colombia's own domestic legal exposure to the group is separate from and does not depend on the US listing, but firms operating cross-border payment or correspondent relationships touching Colombia should treat the layered designation as an expansion of the risk perimeter around counterparties and corridors historically associated with the group's activities.

Outlook

What remains unverified this cycle is whether the European Union or the United Kingdom carry a parallel terrorist-organisation listing for Clan del Golfo alongside the OFAC action, a gap that matters because sanctions-regime divergence between the US and EU/UK creates asymmetric compliance obligations for firms operating across those jurisdictions. Watch for confirmation of parallel EU/UK listing status, and for any indication that the FTO/SDGT designation prompts enhanced due-diligence guidance specific to Colombian correspondent-banking or trade-finance corridors from US, EU or UK regulators.

D2 Beneficial Ownership

Not covered

Beneficial Ownership is not yet covered for this jurisdiction in this report.

D3 Enabler Jurisdictions

Not covered

Enabler Jurisdictions is not yet covered for this jurisdiction in this report.

D4 Conflict Finance and Extractive-Industry Integrity

Conflict Finance and Extractive-Industry Integrity

This cycle's Colombia-relevant conflict-finance signal is anchored in the OFAC sanctions action against Clan del Golfo rather than in independent D4 sourcing. The group's implicated revenue streams, cocaine-trafficking proceeds and Darién Gap migrant-smuggling proceeds, both sit within the conflict-finance and illicit cross-border-flow space that D4 exists to track, but this cycle's evidence base does not extend beyond the sanctions development itself into independently sourced extractive-industry or conflict-commodity findings for Colombia. The honest position is that Colombia's conflict-finance signal this cycle is a derivative reading of the D1 sanctions escalation rather than a freestanding finding: the same designation that broadens sanctions architecture also, by extension, broadens the set of financial flows that a conflict-finance analyst would want to trace, but no independent tracing was performed this cycle.

The structural point worth preserving is that Clan del Golfo's designated status now sits at the intersection of narcotics finance, terrorism finance, and migrant-smuggling-linked revenue, a combination that is analytically significant for conflict-finance purposes regardless of whether a discrete conflict-commodity trace was completed this cycle. Migrant-smuggling revenue through the Darién Gap corridor is a distinct illicit-finance channel from narcotics trafficking, and the layered designation implicitly captures both without this cycle's sourcing distinguishing the relative weight of each revenue stream.

Outlook

The gap register for this cycle explicitly flags that the Venezuela-corridor-specific narco-finance typology and independent D3/D4 sourcing were not actively searched for Colombia this cycle. Future cycles should prioritise independent sourcing on the relative scale of Darién Gap migrant-smuggling revenue versus narcotics revenue within Clan del Golfo's financial base, since the current record cannot distinguish between them.

D5 Crypto / Digital Assets / Financial Innovation

Crypto / Digital Assets / Financial Innovation

Colombia's crypto-asset integrity landscape this cycle is defined by a structural asymmetry: DIAN's Resolución 000240 de 2025 brings the OECD's Crypto-Asset Reporting Framework into force for Colombia, requiring Crypto-Asset Service Providers to report user-identification and transaction data to DIAN beginning tax year 2026, in fulfilment of Colombia's 31 October 2024 CARF Multilateral Competent Authority Agreement. This reporting perimeter now applies even though no comprehensive VASP licensing or prudential regime exists in Colombia. Proyecto de Ley 510 de 2025, the one legislative vehicle that would have established such a comprehensive regime, was archived under article 190 of Ley 5 de 1992, meaning the reporting obligation currently operates without a corresponding supervisory or prudential architecture behind the entities it captures.

A successor bill, reportedly drafted by the Ministry of Finance and including a specialised regulated-entity category and a sandbox supervised by the Superintendencia Financiera, was described in March 2026 reporting as ready for pre-filing, but this cycle's evidence does not confirm it has been formally introduced to Congress. This is a case where enablement itself is the analytically significant signal: Colombia's information-reporting reach into crypto-asset activity is expanding through tax administration channels even as its prudential and licensing perimeter remains, structurally, absent. That combination creates a distinctive compliance environment for crypto-asset service providers operating in or into Colombia: tax and information-reporting exposure without a corresponding licensing gate.

Outlook

The key open question is whether the Ministry of Finance's successor bill is formally radicado in Congress following its March 2026 drafting stage; this was not confirmed this cycle. If introduced, the bill's specialised entity category and sandbox mechanism would begin to close the licensing gap that currently coexists with the CARF reporting perimeter, materially changing Colombia's institutional architecture for crypto-asset oversight.

D6 Compliance Technology & Active Defence

Not covered

Compliance Technology & Active Defence is not yet covered for this jurisdiction in this report.

D7 AML/CTF Regime

Not covered

AML/CTF Regime is not yet covered for this jurisdiction in this report.

D8 Commercial Activity

Not covered

Commercial Activity is not yet covered for this jurisdiction in this report.

Regulatory horizon

Proposed2027 · ±multi_year

New comprehensive crypto bill (successor to archived PL 510/2025)

A specialised regulated-entity category and an SFC-supervised sandbox were reported as drafted as of March 2026 but not yet formally filed with Congress.

Source

1 dated · 4 pending date · baseline fim-2026-07-10

Role action cards

MLRO

OFAC layered FTO/SDGT status onto Clan del Golfo's existing narcotics designation, and DIAN's CARF reporting regime for crypto-asset service providers enters force for tax year 2026.

MLROs with correspondent-banking, trade-finance or crypto-asset-counterparty exposure touching Colombia should treat the layered Clan del Golfo designation as broadening secondary-sanctions screening scope, and should note that CARF reporting obligations for CASPs are now in force even though no comprehensive VASP licensing regime backs them.

2 evidence refs

Compliance

Colombia continues GAFILAT enhanced follow-up status and holds the Vice-Presidency Pro Tempore through 2026 while a comprehensive VASP bill remains archived.

Compliance functions should note Colombia's standing AML/CTF regime posture is unchanged this cycle, but the absence of a licensing perimeter for crypto-asset service providers alongside an active tax-reporting obligation creates a distinctive control-framework gap for any CASP relationship touching Colombia.

3 evidence refs

Legal

The OFAC FTO/SDGT designation on Clan del Golfo broadens secondary-sanctions liability exposure under section 1(b) of Executive Order 13224 as amended.

Legal counsel advising on cross-border Colombian exposure should account for the expanded secondary-sanctions basis, and should note that parallel EU/UK terrorist-organisation listing status for the same group has not been verified this cycle, which is a live uncertainty rather than a settled fact.

1 evidence refs

Board

Colombia's largest armed criminal organisation now carries a dual-basis US sanctions designation combining terrorism-finance and narcotics-finance authority.

This is a structural escalation in the sanctions architecture applicable to a major Colombian illicit-finance actor, material for board-level risk appetite discussions concerning any institutional exposure, direct or indirect, to Colombian correspondent-banking or trade-finance corridors.

1 evidence refs

CTO

DIAN's CARF-based reporting regime requires crypto-asset service providers to report user and transaction data from tax year 2026, in the absence of a comprehensive VASP licensing framework.

Technology functions supporting crypto-asset products with Colombian exposure need to build reporting-data pipelines to DIAN's CARF requirements now, even though no corresponding prudential licensing regime currently governs the underlying business, and the successor licensing bill's progress remains unconfirmed.

2 evidence refs

Risk

A structural asymmetry has opened in Colombia between expanding crypto-asset tax/information-reporting reach and the continued absence of a prudential licensing perimeter.

Risk functions should flag Colombia-linked crypto-asset counterparty exposure as carrying elevated model-risk and control-gap characteristics: reporting data now flows to DIAN, but no licensing-based risk controls (capital, custody, conduct) apply to the underlying CASPs.

2 evidence refs

Operations

No material change this cycle.

No material change for this persona this cycle

Audit

Colombia's RUB beneficial-ownership register continues periodic administrative deadline updates with no change to its core legal basis.

Internal audit should note that RUB compliance-deadline cycles continue on an administrative basis (e.g. reported April/May 2026 updates) without any change to the underlying Ley 2155 de 2021 / Resolución DIAN 000164 de 2021 legal basis, so existing control-testing scope for beneficial-ownership record-keeping should remain adequate absent further change.

1 evidence refs

Decision lens

MLRO

OFAC layered FTO/SDGT status onto Clan del Golfo's existing narcotics designation, and DIAN's CARF reporting regime for crypto-asset service providers enters force for tax year 2026.

Compliance

Colombia continues GAFILAT enhanced follow-up status and holds the Vice-Presidency Pro Tempore through 2026 while a comprehensive VASP bill remains archived.

Legal

The OFAC FTO/SDGT designation on Clan del Golfo broadens secondary-sanctions liability exposure under section 1(b) of Executive Order 13224 as amended.

Board

Colombia's largest armed criminal organisation now carries a dual-basis US sanctions designation combining terrorism-finance and narcotics-finance authority.

CTO

DIAN's CARF-based reporting regime requires crypto-asset service providers to report user and transaction data from tax year 2026, in the absence of a comprehensive VASP licensing framework.

Risk

A structural asymmetry has opened in Colombia between expanding crypto-asset tax/information-reporting reach and the continued absence of a prudential licensing perimeter.

Operations

No material change this cycle.

Audit

Colombia's RUB beneficial-ownership register continues periodic administrative deadline updates with no change to its core legal basis.

Shared evidence: 3 refs

Scenario sketches

AMLA transition and cross-border obliged-entity supervision

Illustrative orientation only: as the EU AML Package matures, the move from purely national AML supervision toward AMLA direct and indirect supervision of cross-border obliged entities, under the AMLA Regulation (Reg (EU) 2024/1620) alongside the directly-applicable AMLR (Reg (EU) 2024/1624) and per-state 6AMLD transposition, could reshape the EU-facing supervisory and evasion landscape. For a non-EEA jurisdiction such as Colombia, the illustrative relevance would run through correspondent-banking and crypto-asset counterparties whose EU-facing obligations tighten under the new hybrid supervisory architecture, potentially increasing due-diligence friction on Colombia-linked flows without any change to Colombia's own domestic regime. This is architecture-over-incident illustration, not a prediction of any specific enforcement outcome.

Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact.

Standing trackers (T1–T6)

Tracker	Status	Note
T1 · Russian Sanctions-Evasion Architecture	no_change	No material change found for CO specifically this cycle.
T2 · EU AML Package / AMLA	no_change	CO is autonomous and not bound by AMLR/6AMLD/AMLA; no EEA-incorporation mechanism applies.
T3 · FATF Grey List	watch	Colombia remains outside grey/black lists but continues in GAFILAT enhanced follow-up; holds GAFILAT Vice-Presidency Pro Tempore through 2026 as the 5th round of mutual evaluations begins.
T4 · Beneficial-Ownership Register Status	stable	RUB register continues periodic administrative deadline updates; no core legal-basis change identified this cycle.
T5 · Crypto & Digital-Asset Integrity	material_change	New CARF-based reporting regime enters force for tax year 2026 alongside continued absence of a comprehensive VASP licensing/prudential regime; PL 510/2025 archived.
T6 · Sanctions Regime Divergence	watch	OFAC's Dec-2025 FTO/SDGT addition for Clan del Golfo is a US-specific escalation; parallel EU/UK terrorist-organisation listing status not verified this cycle.

Registers

Enforcement actions

OFAC designated the sitting Colombian president and members of his family/political network under Executive Order 14059 (Illicit Drugs) for allegedly enabling drug trafficking. 24 Oct 2025
OFAC issued an updated terrorist designation of Clan del Golfo, Colombia's largest transnational criminal organization, flagging secondary sanctions risk for facilitators. 16 Dec 2025
OFAC sanctioned a Bogotá-registered staffing company and Colombian recruiters funnelling nationals into Sudan's conflict, in a package that also included Russia-linked (EO 14024) designees. 9 Dec 2025
Coordinated takedown of the 'Black Jack' crypto-money-laundering network servicing Clan del Golfo, using Chainalysis blockchain-investigation tooling to de-anonymize transactions and identify front companies. 17 Oct 2025
OFAC sanctioned a Canadian national and network trafficking cocaine through Mexico and Colombia for sale in the US and Canada, tied to violent murders across the hemisphere. 19 Nov 2025

Sanctions changes

OFAC added Colombia's sitting president and inner-circle members to the SDN list under the Illicit Drugs EO 14059 narcotics-sanctions program. 24 Oct 2025
OFAC updated the terrorist designation of Clan del Golfo, Colombia's dominant transnational criminal organization, under secondary-sanctions-risk provisions. 16 Dec 2025
President Petro publicly requested that President Trump remove him from the US sanctions list as his term nears its end, signalling a possible future delisting negotiation. 3 Jul 2026
As part of a broader 'Sanctions Modernization Effort', OFAC removed a batch of outdated Colombia-linked narcotics-trafficking (SDNT) entries, including Colombiana de Cerdos Ltda. and associated individuals, from the SDN list. 28 May 2026

Regulatory horizon (register)

Next GAFILAT/FATF enhanced follow-up or re-rating report for Colombia
Annual US narcotics certification/decertification determination
Colombian state gold-purchase formalization program rollout
RUB beneficial-ownership registry effectiveness testing ahead of FATF 5th-round requirement

Active schemes

[HIGH] Crypto-based laundering pipeline for Clan del Golfo cocaine proceeds
[HIGH] Illegal gold mining financing armed groups via cash sales
[HIGH] Black Market Peso Exchange trade-based laundering system
[CRITICAL] PEP-network sanctions designation of head-of-state's inner circle

Sources

Coverage gaps

Large parts of Colombian territory -- especially border and …

Large parts of Colombian territory -- especially border and coastal regions and coca/gold-mining zones -- remain outside effective state control, with ELN, FARC dissidents and Clan del Golfo taxing drug, gold and extortion economies largely unimpeded by financial-sector AML controls that presuppose formal-economy transactions.

Colombia's Registro Único de Beneficiarios (RUB) beneficial-…

Colombia's Registro Único de Beneficiarios (RUB) beneficial-ownership registry is relatively new (2021) and its practical effectiveness -- verification quality, access for competent authorities, and resistance to nominee/layered structures -- remains largely untested against FATF's post-2025 5th-round registry-effectiveness expectations.

The October 2025 OFAC designation of a sitting, historically…

The October 2025 OFAC designation of a sitting, historically-allied head of state and his family introduces an unprecedented politicization vector into the sanctions architecture, straining the diplomatic and institutional channels (extradition, financial-intelligence sharing, joint task forces) that normally underpin bilateral AML/CTF cooperation.

Colombia's full-text Mutual Evaluation Report dates to 2018 …

Colombia's full-text Mutual Evaluation Report dates to 2018 (2012 FATF standards, 2013 methodology); subsequent public documents are narrower enhanced follow-up/re-rating reports rather than a fresh comprehensive effectiveness assessment, limiting independently verifiable detail on current-state Immediate Outcome performance.

Evidence

Confidence-tiered claims

Colombian press (El Diario, citing El Tiempo) reported 3 Oct 2026 that the FBI could arrive in Colombia in October and OFAC is weighing further sanctions, atop the standing Oct 2025 SDN designation under E.O. 14059. SRC-fim-CO-001

Uncertain · 1 source

Colombia's AML/CFT architecture remains unchanged: UIAF (Ley 526 de 1999, Decreto 1068 de 2015) as FIU; GAFILAT membership, last mutual evaluation Nov 2018, Jan 2022 follow-up; SFC/UIAF reporting circulars. SRC-fim-CO-002

Probable · 1 source

Colombia moves roughly USD 44.2 billion in crypto-asset flows per Anif; DIAN tax-reporting obligations (effective tax year 2026) have advanced further than any comprehensive crypto AML/CFT supervisory framework. SRC-fim-CO-003

Probable · 1 source