Mule Accounts in Colombia: What SARLAFT Compliance Officers Must Report to the UIAF 

A mule account is not only a banking problem. When a movement of funds does not fit the customer’s declared profile, within the SARLAFT system (Colombia’s money laundering and terrorist financing risk management system) of an institution supervised by the Financial Superintendence of Colombia (SFC), the mule account also becomes a finding with a reporting obligation to the UIAF. 

This article does not explain what a mule account is in the abstract, but what the Colombian SARLAFT compliance officer must monitor, document and report when one is detected. 

When Does a Mule Account Become a Suspicious Transaction Report (ROS) for the UIAF? 

A mule account becomes a Suspicious Transaction Report (ROS) when the movement of funds does not fit the customer’s declared profile, according to the objective criteria of the Financial System Organic Statute (Estatuto Orgánico del Sistema Financiero, EOSF, arts. 102 to 104). The report concerns the transaction, not the person who holds the account. 

The criterion is not subjective. The compliance officer does not report because they suspect a person; they report because a specific transaction departs from the behavior declared in the customer knowledge file. Articles 102 to 104 of the EOSF set that objective criterion: origin and destination of the funds, consistency with the declared economic activity and size relative to the account’s transaction history. 

The Financial Information and Analysis Unit (UIAF) is the official recipient of the Suspicious Transaction Report. The report does not accuse, it informs: an institution can and must report without that implying, by itself, a criminal complaint against the account holder. 

The ROS has no monetary threshold. It is filed upon reasonable suspicion of money laundering or terrorist financing, even when each transaction stays below the thresholds for cash or international transfer reports, something common in mule accounts, which split funds to avoid crossing them. The compliance officer can file it without interference from management, and Article 42 of Law 190 of 1995 protects the institution and its employees from civil or contractual liability for reports made in good faith. 

Mule Account Red Flags That a SARLAFT System Should Monitor 

A well-calibrated SARLAFT system monitors patterns such as: 

• Inflows and outflows of funds within very short time windows, with no apparent justification. 

• Mismatch between the account’s actual movement and the transactional profile the customer declared at onboarding. 

• Recently opened accounts with activity spikes out of proportion to their history. 

• Dormant accounts that show sudden activity, or rapid cycles of funds that come in and go out without leaving a balance. 

• Repeated microtransactions that keep each operation below reporting thresholds, or beneficial owners that do not match the transactional profile. 

• “Trama” patterns: several mule accounts operating in a coordinated way, with cross transfers between them. 

None of these signals, on its own, is conclusive. A recently opened account with an activity spike may belong to a legitimate customer. What turns the signal into an actionable alert is the correlation between several of them. 

Mule Accounts from Stolen Identity vs. Mule Accounts from Recruitment (testaferro o prestanombres) 

Not all mule accounts have the same origin, and that distinction matters for reporting. There are two main routes. 

The first is stolen or impersonated identity: a third party opens or takes control of an account without the real holder knowing. The second is recruitment, and this is where the figure known in Colombia, both colloquially and legally, as testaferrato or prestanombres bancario (straw-man or nominee bank account holding) appears. 

Testaferrato or prestanombres bancario is the arrangement in which a person lends or sells their bank account to third parties to move funds of illicit origin without raising suspicion. It is the colloquial Colombian variant of what is technically known as a mule account. 

For the compliance officer, the distinction is operational, not just semantic, because it changes where the account is detected and what evidence must be documented: the mule account from stolen identity and the mule account from recruitment are detected by identifying different signals. 

The “trama” Pattern: Several Connected Mule Accounts 

When several mule accounts operate in a coordinated way (receiving and forwarding funds among themselves in a chain), the phenomenon stops being an isolated case and becomes what is known as a trama, a network concept that Spain’s SEPBLAC, for example, also uses. What matters is not each account separately, but the relationship between them. 

For the Colombian compliance officer, identifying a network of accounts means cross-checking alerts across accounts that appear unrelated, rather than reviewing each account separately. In practice, it means looking for matches that are not visible at first glance: the same devices, the same IP addresses, the same movement patterns or the same final recipients. It is the difference between reporting an isolated case and reporting a network. 

Regulatory Framework: SARLAFT 4.0, Circular Externa 006/2025 and the Circular Básica Jurídica 

The reference system remains the SARLAFT 4.0 framework in Colombia, supervised by the Superintendencia Financiera de Colombia (SFC) through the Circular Básica Jurídica (Basic Legal Circular). These are the rules that currently shape the reporting of a mule account: 

Table 1. Rules that shape the reporting of a mule account. Sources: SFC, Diario Oficial (Official Gazette). 

SARLAFT operates in two phases: prevention, to stop illicit funds from entering the system, and control, to detect and report when prevention has failed. An active mule account is a control case. The system also requires a senior-level compliance officer who reports directly to the Board of Directors. 

For a supervised institution, a well-written SARLAFT policy is no longer enough. Supervisors look for evidence that controls work: customer files, screening results, risk ratings, escalation records and audit logs. 

Legal Consequences of Operating as a Mule Account in Colombia 

Article 323 of Law 599 of 2000 (Criminal Code) provides for 10 to 30 years in prison for money laundering. Handing over the account to move funds of illicit origin can fall within that offense; it is assessed case by case depending on the account holder’s knowledge. 

The consequence is not limited to the account holder. The SFC can impose substantial fines on a supervised institution that fails to detect and report on time, and it publishes final sanction decisions. For the compliance officer, this double consequence (criminal for the account holder, regulatory for the institution) is the argument for why reporting to the UIAF is not optional once the red flags are confirmed. 

What a SARLAFT Compliance Officer Must Demonstrate When Facing a Mule Account 

When a mule account is detected, the SARLAFT compliance officer must document traceable operational evidence: the red flags identified, the analysis of the transaction, the decision taken and, where applicable, the Suspicious Transaction Report (ROS) sent to the UIAF. 

The methodology of the 5th Round of Mutual Evaluations by FATF (GAFI) and GAFILAT, adopted in 2022 and operational since 2024, introduces that same criterion at country level: it gives more weight to effectiveness than to technical compliance, and Colombia’s next evaluation will be conducted under it.  

Time also counts. It is not enough to identify a suspicious pattern weeks later if the institution had the data to detect and escalate it earlier. The case file must show when the signal appeared and when it was escalated, and it feeds the annual SARLAFT effectiveness report that the officer presents to the Board of Directors, with the deficiencies identified and the remediation actions. 

To go deeper into the full SARLAFT 4.0 framework, see SARLAFT 4.0 framework in Colombia and what the compliance officer must demonstrate. 

FAQs

Growth adds the JSON-LD after delivery. The answers already appear verbatim in the body of the article.