Parex
← Back to home
Corporate governance · SAGRILAFT and PTEE

ML/TF/FP and C/TB Compliance Policy

Last updated: October 1, 2026

PAREX COLOMBIA S.A.S. · Version 01

This is an English translation of the Política de Cumplimiento LA/FT/FP y C/ST issued under Colombian law. If there is any discrepancy, the Spanish version prevails.

1. General purpose

To establish the guidelines and directives for the comprehensive prevention, identification, assessment, control and monitoring of the risks of Money Laundering, Terrorist Financing, Financing of the Proliferation of Weapons of Mass Destruction, Corruption and Transnational Bribery (hereinafter “ML/TF/FP and C/TB”) to which Parex Colombia (hereinafter “Parex” or “the Company”) may be exposed in carrying out its corporate purpose as a factoring company, protecting its reputation, its stakeholders and business continuity.

Specific objectives

  • Adopt in advance, from the Company’s incorporation, a single ML/TF/FP and C/TB risk management system, in line with Chapter IX of the Circular Básica Jurídica of the Superintendencia de Sociedades (External Circular 100-000020 of 2026), which merged what was previously regulated separately as SAGRILAFT and PTEE.
  • Define the governance framework, roles and responsibilities for managing ML/TF/FP and C/TB risk.
  • Establish the due diligence principles for knowing Parex’s counterparties (portfolio-originating clients, debtors, suppliers, employees and shareholders), under a risk-based approach (RBA).
  • Set the specific corruption and transnational bribery prevention policies required by the new regulation (gifts, travel expenses, political contributions, donations, lobbying, FPWMD, public procurement and code of ethics).
  • Lay the minimum documentary foundations that allow Parex to scale its compliance system proportionately as the Company starts operations and onboards clients.

2. Scope

This Policy applies to the shareholders, members of the highest corporate body, legal representative, Compliance Officer, employees (current and future), suppliers, contractors and, in general, any counterparty that joins or seeks to join Parex, including invoice-originating clients and their debtors/payers once the Company starts its commercial factoring operations.

Since Parex is a recently incorporated company that, as of the approval date of this Policy, has no clients or active operations, it is applied preventively and in stages: the governance, ethics and due diligence guidelines apply now to shareholders, directors and officers and employees, while the operational counterparty onboarding procedures (forms, risk matrix, list screening) will be activated and detailed in the Procedures Manual implementing this Policy, before commercial operations begin.

3. Legal framework

This Policy is issued under the new Chapter IX, Self-Control and Risk Management System for ML/TF/FP and C/TB (Sistema de Autocontrol y Gestión de Riesgos LA/FT/FP y C/ST), of the Circular Básica Jurídica of the Superintendencia de Sociedades, adopted by External Circular 100-000020 of July 2, 2026, which merged into a single system, with one policy, one manual and one risk matrix, what was until then regulated separately under SAGRILAFT (former Chapter X, External Circular 100-000016 of 2020) and PTEE (former Chapter XIII, External Circular 100-000011 of 2021). Circular 100-000020 of 2026 expressly repealed Circulars 100-000016 of 2020, 100-000004 of 2021, 100-000011 of 2021, 100-000015 of 2021, 100-000008 of 2022, 100-000009 of 2022, 100-000004 of 2023, 100-000010 of 2023, 100-000001 of 2024, 100-000003 of 2024 and 100-300000 of 2024, among other contrary provisions.

Notwithstanding the above, and to the extent compatible with the new unified framework, this Policy draws on the policies and best practices previously documented by the economic group and its advisors in the SAGRILAFT and PTEE manuals used as a reference in preparing it.

Applicable national regulations (non-exhaustive list)

  • Chapter IX of the Circular Básica Jurídica of the Superintendencia de Sociedades, Self-Control and Risk Management System for ML/TF/FP and C/TB (External Circular 100-000020 of 2026), and the circulars that amend, clarify or replace it.
  • Law 222 of 1995, the Code of Commerce and Law 1258 of 2008 (simplified stock companies).
  • Law 526 of 1999, which created the UIAF.
  • Law 599 of 2000 (Criminal Code), in particular the offenses related to ML/TF/FPWMD and corruption.
  • Law 1121 of 2006, on the prevention, detection, investigation and punishment of terrorist financing.
  • Law 1474 of 2011 (Anti-Corruption Statute).
  • Law 1581 of 2012 and Decree 1377 of 2013, on personal data protection.
  • Law 1676 of 2013 and Decree 2669 of 2012, which regulate factoring and the National Single Registry of Factors.
  • Decree 4350 of 2006 and its amendments, on the grounds for supervision by the Superintendencia de Sociedades applicable, among others, to factors incorporated as commercial companies.
  • Law 1778 of 2016, on the liability of legal entities for acts of transnational corruption.
  • FATF: 40 Recommendations and international standards against money laundering and the financing of terrorism and proliferation.

4. Definitions

Beneficial owner: The individual who ultimately owns or controls a counterparty, or on whose behalf a transaction is carried out, including whoever exercises effective control or directly or indirectly holds 5% or more of the capital or voting rights.

Counterparty: Any individual or legal entity with which Parex establishes or intends to establish a contractual or legal relationship, including clients (portfolio originators), debtors/payers, suppliers, employees and shareholders.

Due diligence: The process of knowing the counterparty, its economic activity, the origin of its funds and its risk profile, before and during the contractual relationship. It is classified as simplified, enhanced or intensified according to the associated risk level.

Risk-Based Approach (RBA): A cross-cutting methodology required by Chapter IX under which the identification, measurement, control and monitoring of ML/TF/FP and C/TB risk is carried out in proportion to the level of exposure of each process, product, channel or counterparty, and not only for money laundering risk.

ML/TF/FP and C/TB: Money Laundering, Terrorist Financing, Financing of the Proliferation of Weapons of Mass Destruction, Corruption and Transnational Bribery, the five risks covered by the unified System.

Compliance Officer: The individual appointed by the highest corporate body, responsible for designing, directing, supervising and monitoring the System, as well as for relations with the UIAF and the Superintendencia de Sociedades.

Unusual / suspicious transaction: A transaction whose amount or characteristics are not consistent with the counterparty’s usual economic activity (unusual), or that also raises reasonable doubt about the lawfulness of the funds or the purpose of the transaction (suspicious), the latter being reportable to the UIAF through a Suspicious Transaction Report (ROS).

Politically Exposed Person (PEP): A national or foreign individual who, by virtue of their position, office or influence, has or has had management or disposal power over public resources, or presents a higher risk due to their political exposure.

Inherent / residual risk: Inherent risk is the level of risk before controls are applied; residual risk is what remains after those controls are applied.

Red flag: A fact, situation, behavior or characteristic of a transaction or counterparty that draws attention because it is not usual, consistent or reasonable, and that triggers analysis by the Compliance Officer.

Obligated entity: A company that, because it is under the permanent supervision or control of the Superintendencia de Sociedades and/or exceeds the revenue or asset thresholds set in Basic Value Units (UVB) for its sector, must implement the Self-Control and Risk Management System for ML/TF/FP and C/TB.

UIAF: Unidad de Información y Análisis Financiero, Colombia’s financial intelligence unit that receives Suspicious Transaction Reports.

5. Company context

Parex Colombia S.A.S. is a recently incorporated company whose corporate purpose centers on factoring, that is, financing the purchase of construction materials through the acquisition or discounting of invoices: the supplier is paid on the day of delivery and the buyer repays Parex within 30, 60 or 90 days. Because of the nature of its activity, Parex may become subject to supervision by the Superintendencia de Sociedades under Decree 4350 of 2006 and Decree 2669 of 2012, once it reaches the operating volumes set out there.

6. Applicability of the system and early adoption

Chapter IX of the Circular Básica Jurídica determines obligated-entity status through two alternative routes: (i) being under the permanent supervision or control of the Superintendencia de Sociedades, or (ii) exceeding, according to the economic sector (identified by CIIU code), the revenue or asset thresholds expressed in Basic Value Units (UVB). For 2026, the Ministry of Finance set the UVB at COP $12,110, so the general threshold of the System is 4,929,017 UVB (approx. COP $59,690 million), a figure updated annually that must be checked each year.

For factoring companies, article 5 of Decree 4350 of 2006 (as amended) places under the permanent supervision of the Superintendencia de Sociedades factors incorporated as commercial companies whose exclusive activity is factoring or receivables discounting, when (a) they carried out factoring operations in the previous calendar year for an amount equal to or greater than 30,000 SMLMV (monthly minimum wages), or (b) they have in force or have performed specific mandate contracts for the acquisition of invoices. Since Parex is in its incorporation stage and has not yet started operations, these supervision thresholds have not yet been met in practice.

Notwithstanding the above, and as good corporate governance practice, Parex adopts this Policy early and voluntarily from its incorporation, so that the System is fully implemented and tested before the Company reaches the thresholds that would formally make it an obligated entity, and at the latest within the period applicable under the transition regime of Circular 100-000020 of 2026 (May 31, 2027 for entities that were already obligated when the Circular was issued, or May 31 of the year following the one in which they acquire that status, for new obligated entities).

7. Statement of commitment and zero tolerance

The Sole Shareholder and Senior Management of Parex declare a ZERO TOLERANCE position toward money laundering, terrorist financing, financing of the proliferation of weapons of mass destruction, corruption and transnational bribery, in any of their forms. Accordingly, Parex undertakes to:

  • Promote an organizational culture of compliance, self-control, ethics and transparency from management throughout the organization.
  • Not start contractual or legal relationships with clients, debtors, suppliers or employees without completing the applicable due diligence process, nor with counterparties listed on binding or restrictive lists for Colombia.
  • Not receive or deliver cash to its counterparties, except for the strictly necessary handling of petty cash.
  • Immediately report identified suspicious transactions to the UIAF, and cooperate promptly with the competent authorities.
  • Allocate the human, technical and technological resources needed for the effective operation of the System, in proportion to the Company’s size and stage of development.
  • Train its employees and, where applicable, its counterparties on ML/TF/FP and C/TB risks at least once a year.
  • Update this Policy and its procedures manual periodically, and in any case before the end of the transition period set in Circular 100-000020 of 2026.

8. Cross-cutting risk-based approach (RBA)

Under Chapter IX, the Risk-Based Approach is no longer exclusive to ML/TF/FP risk and becomes a cross-cutting element for corruption and transnational bribery risk as well. Parex will manage its ML/TF/FP and C/TB risks through the following four stages, applied to a single risk matrix:

  • Identification: recognizing the risk factors (counterparties, products, channels and jurisdictions) specific to construction materials factoring.
  • Measurement or assessment: determining the probability and impact of each identified risk to establish the inherent risk profile.
  • Control: defining and implementing controls (due diligence, list screening, approvals, segregation of duties) to achieve a residual risk profile within the approved risk appetite.
  • Monitoring: periodic follow-up of counterparties and transactions to detect changes in the risk profile and red flags.

Since Parex does not yet have an operating history, the initial risk matrix will be built on sector-specific risk factors (type of counterparty, factoring of construction materials invoices, onboarding channel and jurisdiction) and recalibrated with real data once the Company starts operations. Residual risk levels may not exceed the risk appetite approved by the highest corporate body.

9. Governance structure and responsibilities

Highest corporate body (Sole Shareholder)

Parex is a simplified stock company incorporated with a single founding shareholder. Accordingly, and under article 18 of Law 1258 of 2008, its functions as highest corporate body are exercised by the Sole Shareholder, whose decisions are recorded in the Company’s minutes book. As long as Parex does not create a Board of Directors or admit new shareholders, references in this Policy to the “Shareholders’ Meeting” or the “Board of Directors” are understood to refer to the Sole Shareholder.

  • Approve this Policy and its updates, as well as the procedures manual implementing it.
  • Appoint the Compliance Officer and their alternate, verifying that they meet the suitability requirements of Chapter IX.
  • Approve the Company’s risk appetite and ML/TF/FP and C/TB risk matrix.
  • Review the reports submitted by the Compliance Officer and order the resources needed for the System to function.

Legal Representative

  • Submit this Policy and its updates to the highest corporate body, together with the Compliance Officer.
  • Allocate the human and technical resources needed to implement the System.
  • Certify to the Superintendencia de Sociedades compliance with the obligations of Chapter IX, when required.

Compliance Officer

Chapter IX requires the Compliance Officer to have at least one (1) year of professional experience (compared with the six months previously required) and certified knowledge of both ML/TF/FP and C/TB risk areas, from formal education or informal training that meets minimum conditions of intensity, relevance and certification, with mandatory updating at least every three years. They must also hold a senior position, with direct communication with management and functional reporting to the highest corporate body. Parex must appoint, under the same procedure and requirements, an alternate Compliance Officer to replace them in temporary or permanent absences.

  • Design, direct, supervise and monitor the Self-Control and Risk Management System for ML/TF/FP and C/TB.
  • Perform and/or supervise counterparty due diligence, red flag analysis and the preparation of reports to the UIAF (ROS/AROS).
  • Report to the highest corporate body, at least once a year, on the efficiency and effectiveness of the System.
  • Respond to information requests from the Superintendencia de Sociedades and the UIAF.
  • Coordinate the annual training programs for employees and, where applicable, counterparties.

Compliance Committee

To the extent Parex’s structure allows, a Compliance Committee is recommended to meet quarterly to review the operation of the System, training results and corrective measures for deviations from the approved risk appetite.

Employees

  • Comply with this Policy, the Code of Ethics and the procedures implementing them.
  • Report to the Compliance Officer any unusual transaction, red flag or possible act of corruption they become aware of.
  • Take part in the training scheduled by the Company.
  • Keep confidential the information related to due diligence processes and to reports of unusual or suspicious transactions.

10. Counterparty due diligence

Parex will not start contractual or legal relationships with clients, debtors, suppliers, employees or shareholders until it has (i) collected the necessary information and identification, including that of the beneficial owner; (ii) verified that information and screened the counterparty against the binding and restrictive lists applicable in Colombia; (iii) determined its risk profile under the current matrix; and (iv) approved its onboarding based on the result of that analysis.

  • Simplified due diligence: for low-risk counterparties, with basic verification of identity and economic activity.
  • Enhanced due diligence: when red flags, unusual activity or a medium or high risk profile are detected.
  • Intensified due diligence: for counterparties classified as PEPs, with matches on public restrictive lists (for example, OFAC), or of extreme risk.

In line with Chapter IX, information on counterparties rated high risk must be updated at least once (1) a year, and on medium- or low-risk counterparties at least every two (2) years, without prejudice to immediate updates when alerts arise that change the risk profile.

11. Politically exposed persons (PEPs)

Onboarding or retaining a counterparty classified as a PEP, or their spouse, permanent partner or relatives up to the second degree of consanguinity or affinity, requires prior approval from Senior Management and will be subject to intensified due diligence and specific monitoring throughout the contractual relationship, in order to mitigate the higher reputational and ML/TF/FP and C/TB risk associated with this type of counterparty.

12. Personal data handling policy

In compliance with personal data protection regulations (Law 1581 of 2012 and its regulatory decrees) and consistent with the obligations of the System, Parex processes the personal data of its shareholders, employees, suppliers, clients and other counterparties for the sole purpose of carrying out the due diligence processes, before and during the contractual relationship, needed to identify, assess and mitigate ML/TF/FP and C/TB risks. This data is stored digitally on authorized servers, and access to it is restricted to Compliance personnel in the exercise of their duties.

Parex Colombia S.A.S. has a Personal Data Processing Policy, published on its website www.parex.ai, which applies alongside this section.

13. Specific policies to prevent corruption and transnational bribery

Chapter IX requires obligated entities to design, at a minimum, the eight (8) specific policies set out below, in proportion to Parex’s current size, which will be expanded in the procedures manual as the Company grows.

13.1. Gifts, hospitality and gratuities

  • The value of gifts, hospitality or courtesies received or given may not exceed COP $200,000 (or its equivalent in USD) per event, nor occur more than three (3) times a year with the same third party.
  • Receiving or offering gifts in cash or in instruments convertible into cash is prohibited, as is any gift during or within three (3) months after a negotiation or contract award.
  • Any gift exceeding the set amount must be reported to the Compliance Officer for analysis and prior approval.

13.2. Meal, lodging and travel expenses

Representation expenses, travel expenses and invitations to events of interest to Parex must be approved in advance by Senior Management, supported by documents (invoices, transfers) and reimbursed only when they benefit the Company.

13.3. Contributions to and participation in political campaigns

Parex refrains from making financial contributions to, and from taking part as a legal entity in, political campaigns, without prejudice to the individual right of its employees to take part in politics in a personal capacity, outside their employment relationship with the Company.

13.4. Donations

Every donation made by Parex must go to humanitarian causes or well-established entities, be approved in advance by the Compliance Officer and be preceded by due diligence on the beneficiary, to prevent its use as a mechanism to conceal acts of corruption.

13.5. Lobbying

Parex Colombia S.A.S. does not engage in or hire lobbying before public authorities. Any approach to public officials to promote the Company’s interests must be authorized in advance by the Legal Representative, carried out transparently, documented and reported to the Compliance Officer. Third parties hired for this purpose will be subject to enhanced due diligence.

13.6. Prevention of the financing of the proliferation of weapons of mass destruction (FPWMD)

Parex will not establish contractual relationships with individuals, legal entities, countries or organizations included on the binding lists for Colombia on terrorist financing and the financing of the proliferation of weapons of mass destruction. Any match must be reported immediately to the Compliance Officer, who will evaluate referring it to the UIAF.

13.7. Public procurement

If Parex takes part in procurement processes with public entities, its participation must strictly follow the applicable public procurement regime, without offering, promising or giving gifts to public officials, and with the support of the legal area and the Compliance Officer.

13.8. Code of Business Ethics and Conduct

This Policy is complemented by Parex’s Code of Business Ethics and Conduct, which sets out the corporate principles and values, the expected behavioral guidelines and the consequences of breaching them.

14. Conflict of interest

A conflict of interest exists when a shareholder, director or officer, employee or counterparty is in a situation that may place a personal or family interest, or that of a third party, ahead of the interest of Parex. Anyone in an actual or potential conflict of interest must disclose and report it to the Compliance Officer or their direct superior, who will determine the applicable control measures. The Company’s interests prevail in all cases over the personal interests of those acting on its behalf.

15. Cash handling

Parex will not receive or make cash payments to its counterparties; all disbursements and collections of the factoring operation will be channeled through supervised financial institutions, except for the strictly necessary handling of petty cash under the guidelines set by the finance area.

16. Confidentiality of information

Information arising from due diligence processes, the analysis of unusual or suspicious transactions and reports made to the UIAF is strictly confidential and will only be known by the competent authorities. No employee may disclose to the counterparty involved, or to third parties, the existence or content of a suspicious transaction report.

17. Red flags

Red flags include, among others, transactions inconsistent with the counterparty’s economic activity, repeated use of cash, refusal to provide information or supporting documents, involvement of third parties that cannot be identified as beneficial owners, and requests for preferential treatment toward public officials or the Company’s own staff. The detailed red flags specific to construction materials factoring will be included in the procedures manual.

18. Suspicious transaction reporting and cooperation with authorities

The Compliance Officer will immediately report to the UIAF, through the SIREL system, any transaction classified as suspicious (ROS). If a quarter passes without a ROS, the “Absence of Suspicious Transaction Report” (AROS) will be submitted within ten (10) calendar days after the end of the quarter. Parex will respond promptly to information requests from the UIAF, the Superintendencia de Sociedades and other competent authorities, under article 8 of Law 1121 of 2006 and other applicable regulations.

19. Communication channels and ethics line

Parex will provide the following channels for employees, counterparties and third parties to raise concerns or report in good faith facts that may breach this Policy, with the reporter’s confidentiality guaranteed and retaliation against them prohibited:

  • Compliance Officer mailbox: compliance@parex.ai
  • Ethics Line: lineaetica@parex.ai. Until the Compliance Officer has direct access to this account, all messages received are automatically forwarded to their email, without involvement of management.

20. Training and disclosure

Parex will share this Policy with all its employees and keep a record of their reading and acceptance. Under Chapter IX, ML/TF/FP and C/TB risk training will be provided at least once (1) a year, to employees and, where applicable, to higher-risk counterparties, prioritizing the identification of unusual or suspicious transactions, red flags, and the content and format of internal reports.

21. Document retention

Due diligence records, internal reports, Compliance Officer reports and other documentation related to the System will be kept for no less than ten (10) years, using the means and conditions of security, integrity and availability required by law, and will be made available at any time at the request of the competent authorities.

22. Sanctions

Breach of this Policy will be considered an unsafe and unauthorized practice and will lead to the internal sanctions set out in the Internal Work Regulations and the clauses of the respective contracts, without prejudice to any criminal, disciplinary and administrative sanctions.

The Internal Work Regulations of Parex Colombia S.A.S. classify as a serious offense, and just cause for termination of the contract, the violation of the prohibitions on gifts, bribery, handling of resources, offering returns to third parties and confidentiality of information.

23. Approval, validity and updates

This Policy was approved by the Sole Shareholder of Parex Colombia S.A.S. through Minutes No. 1 of September 30, 2026 and is effective as of October 1, 2026. It must be reviewed and updated at least once a year, or earlier if regulatory, operational or market changes justify it, and in any case before the end of the May 31, 2027 transition period set in Circular 100-000020 of 2026. Any amendment must be approved by the highest corporate body, on the proposal of the Legal Representative and the Compliance Officer.