Colombia -- Sanctions Compliance Regulatory Overview

While Colombia does not have a comprehensive, dedicated legal framework specifically for cryptocurrencies as financial instruments, it has significantly advanced its anti-money laundering and counter-terrorist financing (AML/CFT) regime for Virtual Asset Service Providers (VASPs). This framework is the primary channel through which international sanctions and restrictions apply.

Here's a detailed breakdown of cryptocurrency sanctions and restrictions in Colombia:

1. Legal Framework for VASPs and Sanctions Compliance

Colombia's approach to crypto regulation is primarily through AML/CFT laws, aligning with the Financial Action Task Force (FATF) Recommendations. The key authority is the Unidad de Información y Análisis Financiero (UIAF), Colombia's Financial Intelligence Unit.

UIAF Resolution 314 of 2021 is the cornerstone for VASPs. It mandates that VASPs implement a Sistema de Administración del Riesgo de Lavado de Activos y Financiación del Terrorismo (SARLAFT) – an AML/CFT Risk Management System. This system requires VASPs to:

• Identify, measure, control, and monitor the risks of money laundering and terrorist financing (ML/TF).
• Report suspicious transactions (SARs) to the UIAF.
• Conduct comprehensive customer due diligence (CDD), including identifying ultimate beneficial owners (UBOs) and politically exposed persons (PEPs).
• Implement policies, procedures, and internal controls to prevent ML/TF.
• Train personnel on AML/CFT obligations.

Crucially, UIAF Resolution 314 of 2021 explicitly includes compliance with international sanctions regimes as part of a robust SARLAFT system.

Legal Reference:

• Resolución 314 de 2021 de la UIAF: Por la cual se imparten instrucciones relacionadas con el SARLAFT a los proveedores de servicios de activos virtuales.
  • [Link to official UIAF Resolution 314/2021 (often found via UIAF's regulations section or official gazettes)] - Note: Official direct link may vary as government sites update. Search "Resolución UIAF 314 de 2021" for the most current access. A common source for these regulations is the "Diario Oficial" (Official Gazette) or the UIAF's own regulatory publications page. As an example, a legal portal reference: Resolución 314 de 2021 - Legis Xperta (subscription required, but shows its existence)

2. OFAC/EU/UN Sanctions Compliance Requirements for VASPs

Colombian VASPs, particularly those operating internationally, are expected to comply with global sanctions regimes:

• UN Sanctions: As a member state of the United Nations, Colombia is legally obligated to implement sanctions imposed by the UN Security Council. UIAF Resolution 314/2021 directly references adherence to UN Security Council resolutions as a core component of ML/TF risk management. This includes asset freezes and other restrictions against listed individuals and entities.

  • How Colombia implements: UN sanctions are generally incorporated into Colombia's domestic legal system through presidential decrees or ministerial resolutions, requiring financial institutions (now including VASPs) to monitor and comply.
  • Legal Reference: While a single overarching decree for all UN sanctions isn't typical, specific resolutions are adopted. The UIAF's mandate inherently covers adherence.
  • UN Sanctions Lists: https://www.un.org/securitycouncil/sanctions/information

• OFAC (U.S. Office of Foreign Assets Control) Sanctions: While OFAC sanctions are extraterritorial and primarily apply to U.S. persons, Colombian VASPs (and any entity operating in Colombia) are effectively compelled to comply for several reasons:

  • Access to the U.S. financial system: Many international transactions involve U.S. dollars or U.S. correspondent banking relationships. Non-compliance can lead to "de-risking" by banks, refusal to process transactions, and difficulties accessing global financial services.
  • Secondary Sanctions: Some OFAC sanctions include provisions for secondary sanctions against non-U.S. persons who engage in certain activities with sanctioned entities or countries.
  • International Partnerships: VASPs with international clients or partners will find OFAC compliance a standard requirement.
  • Best Practice: Adhering to OFAC lists is considered an international best practice for robust AML/CFT compliance.
  • OFAC Sanctions List (SDN): https://home.treasury.gov/policy-issues/financial-sanctions/specially-designated-nationals-and-blocked-persons-list-sdn-human-readable-lists

• EU (European Union) Sanctions: Similar to OFAC, EU sanctions primarily apply to EU persons and entities. However, for the same reasons mentioned above (international financial access, global partnerships, and best practice), Colombian VASPs dealing with European entities or customers will generally need to screen against EU sanctions lists to mitigate risks.

  • EU Consolidated Sanctions List: https://www.sanctionsmap.eu/

In summary for VASPs: The UIAF regulations for SARLAFT implicitly and explicitly require screening against international restrictive lists to manage ML/TF risks. This includes UN lists directly and, by industry best practice and necessity for international operations, OFAC and EU lists.

3. Sanctioned Entity Screening Obligations

UIAF Resolution 314/2021 mandates that VASPs implement mechanisms to:

• Identify clients and transactions linked to individuals or entities on national and international restrictive lists. This means continuous screening of new and existing clients, as well as ongoing transaction monitoring.
• Block or freeze assets of sanctioned individuals/entities as required by UN Security Council resolutions, and other applicable laws.
• Report any hits or suspicious activity related to sanctioned entities to the UIAF.

Screening should include:

• UN Consolidated List
• OFAC Specially Designated Nationals (SDN) List and other relevant OFAC lists
• EU Consolidated List of persons, groups, and entities subject to financial sanctions
• Any other relevant lists provided by local law enforcement or judicial authorities.

4. Geographic Restrictions

Geographic restrictions in Colombia concerning crypto transactions primarily stem from the international sanctions regimes outlined above. This means:

• UN-Sanctioned Countries: Transactions involving countries under UN arms embargoes, financial restrictions, or other measures (e.g., North Korea, Iran in specific contexts) must be flagged and handled in accordance with UN resolutions and Colombian domestic implementation.
• OFAC-Sanctioned Countries: VASPs dealing with international clients or operating globally will need to restrict or block transactions involving comprehensively sanctioned jurisdictions by OFAC (e.g., Cuba, Iran, North Korea, Syria, certain regions of Ukraine/Russia, Venezuela for specific entities/individuals). While Colombia does not directly enforce these, non-compliance can lead to severe operational and reputational consequences.
• FATF High-Risk Jurisdictions: While not a "sanction," VASPs must exercise enhanced due diligence for transactions involving jurisdictions identified by FATF as high-risk for ML/TF (e.g., DPRK, Iran, Myanmar), or those with strategic deficiencies.
  • FATF High-Risk Jurisdictions: https://www.fatf-gafi.org/countries-and-regions/high-risk-and-other-monitored-jurisdictions.html

5. Penalties for Violations

Violations of AML/CFT regulations and sanctions compliance in Colombia can lead to significant administrative, civil, and criminal penalties:

• Administrative Penalties (UIAF/Superintendencies):

  • Fines: The UIAF and other supervisory bodies (like the Superintendencia Financiera, Superintendencia de Sociedades) can impose substantial administrative fines on VASPs and their directors for non-compliance with SARLAFT obligations, including failure to report suspicious transactions or adequately screen for sanctioned entities.
  • Suspension or Revocation of Operations: In severe cases, particularly for unregulated VASPs that fail to adhere to AML/CFT guidelines, authorities could pursue actions to suspend or cease their operations.
  • Legal Reference: The powers for administrative sanctions are typically derived from specific laws establishing the supervisory bodies and their mandates (e.g., Decree 663 of 1993, which is the Organic Statute of the Financial System, and subsequent regulations expanding UIAF's powers).

• Criminal Penalties (Money Laundering and Terrorist Financing):

  • Failure to implement proper AML/CFT controls, which results in the facilitation of money laundering or terrorist financing, can lead to criminal charges against individuals (e.g., directors, compliance officers) and corporate liability.
  • Money Laundering (Lavado de Activos): Articles 323 to 323A of the Colombian Criminal Code. Penalties can range from 10 to 30 years in prison and significant fines.
  • Terrorist Financing (Financiación del Terrorismo): Article 345 of the Colombian Criminal Code. Penalties can range from 13 to 22 years in prison and substantial fines.
  • Illicit Enrichment (Enriquecimiento Ilícito): Article 327 of the Colombian Criminal Code.
  • Legal Reference:
    • Ley 599 de 2000 (Código Penal Colombiano):
      • http://www.secretariasenado.gov.co/senado/basedoc/ley_0599_2000.html (Refer to specific articles mentioned above)

6. Country-Specific Sanctions Lists in Colombia

Colombia does not maintain a standalone, comprehensive "sanctions list" for individuals or entities in the same vein as OFAC's SDN list or the EU's consolidated list, which target foreign policy objectives.

Instead, Colombia primarily implements:

• UN Security Council Sanctions: These are adopted into Colombian law as described above.
• Domestic Lists for AML/CFT Risk Management: Colombian financial institutions and VASPs are also expected to screen against internal lists generated by local law enforcement and judicial authorities for AML/CFT purposes. These might include:
  • Lists of individuals under criminal investigation for ML/TF, corruption, or other illicit activities.
  • Politically Exposed Persons (PEPs) lists.
  • Lists related to individuals or entities linked to organized crime or terrorist groups operating domestically.

While these are used for enhanced due diligence and reporting, they are not typically referred to as "sanctions lists" in the international sense, but rather as "restrictive lists" (listas restrictivas) for domestic risk management.

Conclusion:

Colombian VASPs operate under a robust AML/CFT framework guided by UIAF Resolution 314 of 2021. This framework mandates strict compliance with international sanctions, particularly those from the UN, and requires adherence to global best practices for OFAC and EU sanctions to ensure access to the global financial system and mitigate legal, operational, and reputational risks. Failure to comply can result in severe administrative fines and, if linked to money laundering or terrorist financing, significant criminal penalties.