Law 1778, issued in 2016, established rules regarding administrative liability of entities for acts of transnational bribery, specifically bribery of foreign public officers. This law established that the Superintendency of Companies had to determine the entities that were obliged to implement a PTEE aimed at preventing such behavior.

Taking this into account, on August 9^th, the Superintendency of Companies issued the Circular through which it: (i) modified the criteria used to determine which companies must implement a PTEE, ( ii ) amended the requirements that must be taken into account by the companies to implement a PTEE, and ( iii ) amended the requirements that must be met by the Compliance Officer of the PTEE. The foregoing, through the addition of a Chapter XIII to the Circular Básica Jurídica of the Superintendency of Companies.

1. Companies required to implement a PTEE

The number of companies obliged to implement a PTEE increased with the new amendments, due to (i) the reduction of the threshold of income and assets that determine which companies are obliged to implement a PTEE, (ii) the inclusion of foreign branches and sole proprietorships that were not required to implement a PTEE before this amendment, provided that they meet certain requirements and thresholds and (iii) the inclusion not only of entities subject to surveillance of the Superintendency of Companies, but also those that are being inspected by such authority, provided that they meet certain requirements and thresholds.

Moreover, the Circular no longer focuses exclusively on Transnational Bribery, understood as bribery to a public foreign official, but now includes the risks of Corruption, understood as the possibility that the purposes of the public administration are diverted to, or the public patrimony is affected towards a private benefit. Therefore, depending on the type of entity and the compliance with certain requirements and thresholds, the entities may be obliged to focus their PTEE to tackle the risks of Transnational Bribery and /or Corruption. .

Thus, the entities required to implement a PTEE are the following:

• Surveilled Companies: This category includes companies that are surveilled by the Superintendency of Companies, for whom the thresholds of total income or total assets that determine the obligation to implement a PTEE has been reduced, from 40,000 SMLMV, according to the previous regulation, to 30,000 SMLMV. Thus, surveilled companies are required to implement a PTEE and identify and evaluate Transnational Bribery Risks, if as of December 31^st of the immediately preceding year, the following requirements are met:

• They have carried out International Business or Transactions of any nature, either directly or through an intermediary, Contractor or through a Subordinate Company or a branch, with foreign individuals or legal entities of public or private law, equal to or greater than (individually or jointly) 100 SMMLV; and
• They have obtained Total Income or have Total Assets equal to or greater than 30,000 SMMLV.

• Business partnerships, sole proprietorships or foreign companies branches supervised by the Superintendency of Companies: This category includes companies of any type, foreign companies branches and sole proprietorships that are under inspection, surveillance or control of the Superintendency of Companies and will be obliged to implement a PTEE and identify and evaluate the Risks of Corruption, if as of December 31^st of the immediately preceding year, have directly or indirectly entered into contracts with State Entities with an amount equal to or greater than (individually or jointly) 500 SMMLV; and

• Have obtained Total Income or have Total Assets equal to or greater than 30,000 SMMLV, or

• If they belong to the following sectors and comply with all requirements of income or assets listed for the respective sector in the Circular: Pharmaceutical, Infrastructure and Construction, Manufacturing, Energy Mining, Technology and Communications, Trade of Vehicles and spare parts, financial services assistants.

2. Deadline for implementation

Companies that as of December 31^st of each year, meet the criteria established in this Circular, will have until May 31^st of the following year to adopt their respective PTEE.

Said companies must send an official letter to the Superintendency of Companies within fifteen (15) business days following the expiration of the term for the adoption of the PTEE, informing about their status as Obligated Entity. This is a new obligation that did not exist previously.

3. PTEE requirements

As of January 1^st, 2022, date on which the Circular will come into force, Circular 100-000003 of 2016, which was the first Circular of the Superintendency of Companies to establish a guide for PTEE adoption, will be entirely derogated.

The Circular establishes specific elements that a PTEE must meet in its design and approval, compliance audit, disclosure and training, as well as communication channels. Likewise, it establishes the stages of the PTEE, which are the identification of the Risk of Corruption or Transnational Bribery, identification of the Risk factors, the measurement and evaluation of said risks as well as its control and monitoring. Likewise, the Circular refers to the due diligence procedures in a complete chapter.

4. Compliance Officer Requirements

A fundamental point that has been the subject of important modifications in the Circular, are the requirements that the PTEE Compliance Officer must meet, taking into account that the previous regulation did not indicate specific requirements that said person had to meet. Thus, the Circular has established that the PTEE Compliance Officer must meet the following requirements, along with the requirements of the SAGRILAFT (system of self-control and management of the comprehensive risks of money laundering and financing of terrorism) Compliance Officer:

• Have the ability to make decisions in order to manage the Risks mentioned above and have direct communication with, and depend directly on, the board of directors or the highest corporate body
• Have sufficient knowledge in the management of said Risks and understand the ordinary course of the company's activities.
• Have the support of a human and technical work team, in accordance with the Risks and the size of the company.
• Not belong to the administration, the corporate bodies or the tax audit body or whoever performs similar functions.
• When the Compliance Officer is not employed by the company, this person may or may not be employed by a legal entity.
• Not to serve as Compliance Officer, principal or alternate, in more than ten (10) Companies. To act as Compliance Officer for more than one Obligated Company, (i) the Compliance Officer must certify; and (ii) the body that appoints the Compliance Officer must verify that the Compliance Officer does not act as such in Companies that compete with each other.
• When there is a business group or a declared control situation, the Compliance Officer of the controlling company may be the same person for all the companies that make up the group, regardless of the number of companies that comprise it.
• Live in Colombia.

The Board of Directors or the highest corporate body shall designate the Compliance Officer. The company must inform the Superintendency of Companies in writing, addressed to the Delegation of Economic and Corporate Affairs, within fifteen (15) business days following the appointment, the name, identification number, email and telephone number of the Compliance Officer. The Obligated Entity must keep the information of the Compliance Officer updated. For this purpose, they must inform said Superintendency in writing within fifteen (15) business days following any modification. A copy of the extract of the minutes of the board of directors or highest corporate body in which the appointment of the Compliance Officer is recorded, must be sent.