Home / Publications / The Superintendence of Companies has issued new instructions...

The Superintendence of Companies has issued new instructions for the implementation of Integrity and Transparency Business Programs to manage corruption and transnational bribery risks

​The Superintendence of Companies (the “SC”) issued two new regulations through which it intends to strengthen the fight against corruption by means of efficient corporate governance mechanisms such as the Integrity and Transparency Business Programs (“ITBP”). Below you can find a summary of said regulations that are of the upmost importance for real sector companies in Colombia.


On August 9th, 2021, the SC issued Circular Externa 100-000011 (“ITBP Circular”) through which it amended the administrative instructions and recommendations related to the adoption of ITBPs and repealed the recommendations included in the Guide provided in Circular Externa No.100-000003 of July 26th, 2016 (“ITBP Guide”). 

One of the main amendments included in this new regulation is the incorporation of the need of identifying and managing not only transnational bribery (“TB”) risks but also corruption (“CO”) for certain companies that enter into contracts with public entities. Even though managing this risk was already recommendable based on compliance best practices, this was not mandatory.

The ITBP Circular includes generic provisions applicable to CO and TB risks, but also specific provision related to each of these risks individually.

Below you will find a brief summary of the amendments introduced to this regime by the ITBP Circular:

1.    Companies that have the obligation to implement an ITBP

The ITBP Circular modifies the criteria for determining which companies are obligated to implement an ITBP, reducing in the first place the limit of income or assets from 40.000 monthly minimum legal wages (“MMLW”) [1] In 2021, the MLMW is equal to COP $908.526 , Moreover, it differentiates the criteria for companies to determine whether they must include in its ITBP the identification and management of TB and/or CO as follows:

​Identification of CO risksIdentification of TB risks
  1. Commercial companies, sole proprietorships and branches of foreign companies supervised by the SC:  

- During the last fiscal year have, directly or indirectly [2] Through consortiums, temporary unions or any other association figure permitted by law , entered into contracts with public entities, individually or collectively, for a value higher than 500 MMLW; and

- As of December 31st, 2020, obtained gross income or total assets equal to or greater than 30,000 MLMW.

 2. Commercial companies, sole proprietorships and branches of foreign companies supervised by the SC: •    During the last fiscal year have, directly or indirectly [3] Through consortiums, temporary unions or any other association figure permitted by law , entered into contracts with public entities, individually or collectively, for a value higher than 500 MMLW; and
•    Belong to any of the following economic sectors and fulfill the specific requirements per sector established in the ITBP Circular:

o    Pharmaceutical;
o    Infrastructure and construction;
o    Manufacturing;
o    Mining and energy;
o    Technology and Communications;
o    Vehicles, their parts, pieces and accessories; and
o    Financial services auxiliary activities.

1. Companies under the surveillance of the SC that:  
•    During the last fiscal year, have undertaken international business or transactions through an agent or contractor, or through a subordinated company or a branch that has been incorporated under the laws of any jurisdiction different than Colombia with any individual or legal entity (governed by private or public law) for a value equal or higher than 100 MLMW; and
•    As of December 31st, 2020, obtained gross income or total assets equal to or greater than 30,000 MLMW. 


Notwithstanding the foregoing, the SC may issue anytime specific instructions to any company subject to its supervision, that does not have the obligation, to implement an ITBP. 

2.    Reports- Protection of the complainant and mandatory implementation of the whistleblower channel

 Based on best practices on this matter, the companies that are obligated to implement an ITBP have now the obligation to implement a clear policy of protection to whistleblowers in which it expressly mentions that employees and other counterparties can report irregularities or conducts without having the fear of retaliation from other colleagues.
Moreover, obliged entities must include in its ITBP the promotion of the SC’s online report system. For this purpose, this entity has arranged for different channels for reporting CO or TB conducts.

3.    Compliance officer’s profile

The ITBP Guide provided that companies had to furnish the profile of its compliance officer depending on its specific needs. On the other hand, the ITBP Circular now provides several minimum requirements that the individual appointed as compliance officer must necessarily fulfil.
As for SAGRILAFT, the SC established an obligation to certify, by notification in writing, that the person appointed has the required experience and is suitable to manage CO and TB risks.
4.    Corporate bodies’ specific roles

The companies obliged to implement an ITBP must specifically designate various roles and functions to their board of directors, legal representatives and external auditors such as the elaboration of the policies and adoption of the ITBP, among others. 

Therefore, the functions provided under Section 5.1.5 of the ITBP Circular for these corporate bodies are mandatory for all companies to adopt. Notwithstanding the foregoing, each company may add functions in accordance with its corporate structure and the specific needs.

5.    Specific provisions applicable for the management of TB risks

In addition to the general measures applicable to all ITPBs, the SC provided for certain particular measures for companies that are obliged to manage TB risks for them to include, mandatorily, the following:

•    As part of the identification of TB risks, the ITBP Circular establishes that it is necessary for companies to revise country risk and third-party risks, specifically in relation to individuals or legal entities that are located abroad;
•    Compliance policies and ITBP manuals, as well ad communication strategies, must be translated to the official companies of the countries in which the company performs business or transactions, directly or through its branches, subordinated companies or contractors; 
•    The procedure for filing and keeping documents related with international businesses or transactions must be clearly regulated.

The abovementioned is only a brief summary of some the conditions required by the SC in relation to the implementation of new ITBP. It is important to remember that the provisions established in the ITBP Guide (previous regulation on the matter) were only recommendations for the implementation of these programs. On the other hand, the ITBP Circular provides instructions and mandatory requirements to be included for managing CO/TB risks, which poses a big responsibility for the companies in relation to the adequate implementation and execution of the system. 

The ITCP Circular will enter into force as of January 1st, 2022, date on which the ITBP Guide and Resolution 100-006261 of October 2nd, 2020 will both be repealed. Thus, obligated companies that meet the criteria established in the new regulation as of December 31 each year will have until May 31 of the following year to adopt their respective ITBP.
In any case, companies that implemented an ITBP this year or that are currently in this process must review the amendments provided in the ITBP Circular to adopt their systems to these new guidelines.


In addition, with the objective of supervising the compliance with the obligation of implementing an ITBP, the SC issued Circular Externa 100-000012 of August 9th, 2021 through which it establishes certain clear policies to exercise its surveillance functions (the “ITBP Supervision Policy”). This entity had already issued a similar regulation for supervising the implementation of SAGRILAFT [4] Circular No. 100-000008 of June 11th, 2021 , which clearly demonstrates that the SC will be over real sector companies demanding for companies to comply with its instructions.

 The ITBP Supervision Policy presents the manner in which the SC will oversigh obligated companies, which is based in the following three pillars:

1.    Education

The SC Will concentrate its efforts on promoting and educating obligated entities, its officers and directors, and auditors in relation to the content of the ITBP and the periodicity of the information that must be reported to the entity.

2.    Compliance

This pillar intends that obligated entities do comply with their obligation to implement an ITBP according to the instructions provided in the ITBP Circular. For this purpose, the SC will carry out the following:

•    Verification that companies are complying with regulation, with in situ or ex situ visits to gather relevant information to determine if a company (i) has implemented an ITBP and (ii) has done so according to what is established in regulation; 
•    Sanctioning activities: (i) administrative orders (corrective measures) for mild and non-reiterated infringement; and (ii) sanctioning administrative investigations.

3.    Early and timely actions

The SC will design and implement verification mechanisms that allow the entity to identify risk alerts or non-compliance threats. For this purpose, the companies will have to submit Informe 52 whose purpose is to have information in relation to the implementation of ITBP.

Therefore, there is no doubt of the SC’s commitment not only to prevent a compliance culture and an adequate corporate governance for companies but also to demand that companies comply with administrative instructions associated with CO and TB risks. This entity has already announced that it will be less benign and will adopt all actions necessary actions to enforce this regulation.

Some considerations we suggest taking in mind

Another new relevant aspect of the ITBP Circular is that companies that are obliged to implement must submit a communication to the SC, in the following 15 business days after the term for the adoption of the ITBP, informing that they have this obligation. This requires a major commitment from companies to have the ITBP ready by the established deadline.

Additionally, not only a company is responsible for the implementation but also its compliance officer, its officers and directors and external auditors. To that extent, all these people, can be subject of an administrative investigation by the SS and might be sanctioned if the company does not comply with the obligation.

Therefore, it is really important that companies interiorize the content of this new regulation, verify its conditions and determine if it has the obligation to implement an ITBP. This process takes time, so we recommend not leaving this process until last minute. If you require legal advice in relation to this matter, please do not hesitate to contact us. 


Portrait of Daniel Rodríguez, LL.M.
Daniel Rodríguez, LL.M.
María Lucía Amador, LL.M.
Ana Maria Barrios