The Financial Action Task Force (FATF, known regionally as GAFI) is the body that sets the global standards against money laundering and terrorist financing. Its mutual evaluations are not optional audits: they determine the international reputation of a country’s financial system, its access to capital markets, and the intensity of the scrutiny its institutions face when they operate with foreign counterparties. A country on the FATF grey list creates concrete costs for the financial institutions operating under its jurisdiction.
Colombia has known this since 2018. It has been under GAFILAT’s enhanced follow-up, the FATF-style regional body for Latin America, since its mutual evaluation eight years ago. What changes now is the standard against which it will be evaluated next time, and that change is fundamental.
FATF changed the question. The financial sector has not yet changed the answer.
In 2022, FATF adopted a new evaluation methodology that took effect in 2024. The first countries assessed under it, among them Austria, Italy and Singapore, whose reports were approved at the February 2026 plenary, already show a clear pattern of what the new standard demands.
The fifth round moves the focus from the legal framework to demonstrable results: whether controls produce real detection, quality reporting and documented cases, or whether they produce only policies and archived procedures.
The difference between a country that passes the evaluation and one that does not lies in whether private financial institutions can prove that their SARLAFT, Colombia’s AML/CFT risk-management system, works in practice, with concrete evidence.
Colombia has one to two years to prepare that demonstration.
According to the UIAF, Colombia’s financial intelligence unit, its mutual evaluation under the fifth-round methodology is expected between 2027 and 2028. Evaluators will arrive at a financial system that has undergone significant regulatory change: a consolidated Circular Básica Jurídica, Decree 0368/2026 on Open Finance, and Statutory Law 2573 of May 2026 on identity impersonation.
Colombia does not lack a solid regulatory framework. The risk lies in what the fifth round has already shown with the first countries evaluated: systems that look sound on paper but do not generate operational evidence of how they work fail the new effectiveness test.
Evaluators will ask the private financial sector concrete questions about results: how many mule accounts did your system detect last year? What signals triggered the alerts? What evidence trail exists from the alert to the report to the UIAF? How did the quality of your suspicious transaction reports improve over the previous cycle?
Law 2573 and the fifth round measure the same thing from different angles.
Law 2573, effective in November 2026, requires financial institutions to prove that their identity-verification controls were adequate when impersonation is alleged. The proof is not the policy: it is the log of the process. The record of what was verified, with what technology, what result it produced and what decision the system made.
The FATF fifth-round methodology demands exactly the same thing, with broader scope: that the controls in the AML/CFT system produce measurable results, documented in real time (AI-driven transaction monitoring), not only in hindsight.
Institution ready for November 2026: auditable onboarding, continuous monitoring, alert traceability. It has the infrastructure GAFILAT will want to see in 2027 when it asks how SARLAFT works in practice.
Institution with policies but no architecture: the same problem on two fronts, before the SFC, Colombia’s financial regulator, under Law 2573, and before GAFILAT under the fifth-round methodology.
An institution that builds the evidence architecture Law 2573 requires is simultaneously building its answer to the fifth round’s effectiveness test. These are not two parallel projects. They are the same project with two delivery dates: November 2026 for domestic regulation, and 2027-2028 for the international evaluation.
The private financial sector’s role in the evaluation.
A GAFILAT mutual evaluation does not audit the regulator alone. It audits the private financial sector. Evaluation teams visit institutions, interview compliance teams, review real cases and assess the quality of the financial intelligence the private sector contributes to the national AML/CFT system.
The quality of the suspicious transaction reports that Colombian institutions send to the UIAF is one of the indicators that carries the most weight in that process. And that quality depends directly on the robustness of internal verification and monitoring controls, including AML screening: a report backed by authentication logs, behavioral biometrics signals, device-change alerts and transaction-pattern analysis has a completely different analytical value from one built on a manual review of past transactions.
The FATF (Financial Action Task Force) is the international body that sets the global standards against money laundering and terrorist financing. Its mutual evaluations determine each country’s financial-system reputation, its access to capital markets and the scrutiny its institutions face when operating with foreign counterparties.
GAFILAT is the FATF-style regional body for Latin America; it groups 18 countries and supports implementation of the 40 Recommendations through mutual evaluations on money laundering and terrorist financing. Colombia had its mutual evaluation report approved in 2018 and has since been subject to follow-up reports and technical-compliance re-ratings. It will be evaluated again under the fifth-round methodology.
The fifth round is FATF’s new evaluation methodology, adopted in 2022 and operational since 2024, which moves the focus from the legal framework to demonstrable results. Evaluators place greater emphasis on evidence of real detection, quality reporting and documented cases that prove controls work in practice.
Colombia’s mutual evaluation under the fifth-round methodology is expected between 2027 and 2028, according to the UIAF. GAFILAT evaluators will review both the regulator and the private financial sector: they will visit institutions, interview compliance teams and assess the quality of the financial intelligence the sector contributes to the system.
The FATF 40 Recommendations are the international standard defining how countries should prevent money laundering and terrorist financing. Meeting them technically is no longer the decisive criterion: the fifth round evaluates whether those recommendations produce measurable operational results, not whether they are written into law.
A country on the FATF grey list creates direct costs for its financial institutions: greater scrutiny from foreign counterparties, more expensive correspondent banking and friction in access to capital markets. That is why preparing for the mutual evaluation is not a matter for the regulator: it is a business risk for every institution.
SARLAFT effectiveness is demonstrated with operational evidence, not policies: identity-verification logs, traceability from the alert to the report to the UIAF, mule-account detection metrics and documented improvement in the quality of suspicious transaction reports. Systems that are correct on paper but do not generate that evidence fail the fifth round’s test.
