Colombia built the thing most of Latin America only talks about: a dedicated, national beneficial-ownership register. The RUB — the Registro Único de Beneficiarios Finales — has been live since 2022, sits inside the tax authority, and captures owners at 5%, the lowest threshold in the region and among the lowest anywhere. It also captures nobody you can look up. The register is closed, its data flows into tax administration and enforcement rather than public search, and the public corporate layer — the chambers of commerce — stops at directors and legal representatives. Colombia is the sharpest version of the pattern that runs through Brazil and Mexico: the state knows more about who owns what than almost any peer, and shares almost none of it. Verifying a Colombian UBO means understanding exactly what the RUB forces onto file, and then building the answer from the outside.
01A real register, inside the tax authority
Where Brazil declared beneficial owners into a CNPJ form and Mexico into an accounting file, Colombia legislated a register. Articles 631-5 and 631-6 of the Estatuto Tributario — introduced through the 2019 and 2021 tax reforms — define the beneficiario final and create the RUB, and DIAN's Resolution 000164 of 27 December 2021 (in force 15 January 2022, since amended and compiled into Resolution 227 of 2025) makes it operational. The custodian is the tax authority; the register forms an integral part of the tax registration every entity holds; and the interpretive anchor, written into the statute itself, is the FATF's recommendations.
For a verifier that framing carries the whole lesson: the RUB is a formidable state instrument and a non-existent public one. What it delivers to you is leverage — an entity that must be able to prove it filed — not a lookup.
02The 5% threshold: lowest in the region
Colombia's number is the story. Most of the world's beneficial-ownership regimes sit at 25%; India's SBO test runs at 10%; South Africa's CIPC register at 5%. Colombia joins South Africa at the floor — and defines the test broadly: a natural person who, alone or acting jointly, holds directly or indirectly 5% or more of the capital or voting rights, or who benefits from 5% or more of the assets, yields or profits. Three routes, any one of which suffices. Secondary sources routinely round Colombia up to 25% by regional habit; the statute is unambiguous, and the practical consequence is that a Colombian entity's RUB list is typically far longer than a 25%-regime KYC file for the same structure.
03The corporate base by the numbers
The RUB sits on top of a business population that is large, young and overwhelmingly small — which shapes what the 5% test actually captures. The chambers of commerce, through their federation Confecámaras, publish the RUES demography every year; the picture below is theirs.
| Measure | Figure | What it means for verification |
|---|---|---|
| Registered enterprises, end-2024 | 1,739,405 | Up 0.3% on 2023 — the total RUB-relevant population, sole traders included |
| New enterprises, 2024 | 297,475 | Down 2.8% on 2023's 305,997; a high-churn base — check status, not just existence |
| By legal type (2024 formations) | 72.3% sole traders / 27.7% companies | Only the company share carries a shareholder register; sole traders are the owner |
| By size (new formations) | >99% microenterprises | The RUB captures a base of very small entities — and the 5% test lengthens their lists |
| New enterprises, H1 2025 | 173,907 (+1.9%) | 74% sole traders / 26% companies |
| Top sector, H1 2025 | Wholesale & retail: 66,626 new units | Followed by accommodation & food services and manufacturing |
| Five-year survival | Companies 44% / sole traders 30% | Confirm an entity is still active before spending effort on its owners |
04The FATF context
Colombia is a GAFILAT member and has never been grey-listed. Its regime was built with the FATF standard in view to an unusual degree: paragraph 2 of Article 631-5 instructs DIAN to interpret the beneficial-owner definition in line with the FATF's updated recommendations and interpretive notes, and Resolution 164 records that it did so. The RUB, the SIESPJ system for structures without legal personality, and the due-diligence principle written into Law 2195 of 2022 (which obliges every entity reporting to the RUB to conduct due diligence to identify its beneficial owners) together form Colombia's implementation of Recommendations 24 and 25 — the register plus the duty to know.
05The three-step test
Resolution 164 sets out a successive test — and, like Mexico and Korea, guarantees a name at the end of it.
The fallback has recently gained teeth. DIAN doctrine issued in November 2024 and confirmed in May 2025 holds that a natural person can be a beneficial owner through "control by any other means" without holding any capital or votes at all — which puts pressure on the many entities that reported their legal representative by default. A verifier reading a Colombian RUB filing that names only the representative should ask whether step 2 was actually applied.
06Filing mechanics: forms, deadlines, quarters
07Penalties: the RUT regime
Because the RUB forms part of the RUT — the tax registration — failures are punished under Article 658-3 of the Estatuto Tributario, the sanction article for tax-registration breaches, applied by Article 20 of Resolution 164 to non-filing, erroneous or incomplete filing, and failure to update. The instrument is administrative and daily-accruing rather than a headline per-beneficiary fine, and it sits alongside the practical consequences of a defective RUT: friction with invoicing, contracting and the tax-compliance standing a Colombian business trades on. As in Brazil and Mexico, the sanction lives inside the tax machinery the entity cannot operate without.
08Access: who sees the RUB
| Holder | Access | Basis |
|---|---|---|
| DIAN — the RUB | Closed | Tax-reserved; serves DIAN, enforcement and exchange — not counterparties |
| The entity itself | The filing | Must identify, keep and update the information — the practical route for a verifier |
| Chambers of commerce (RUES) | Public | Company existence, status, legal representative, directors — not shareholders for most companies |
| Reporting entities (SARLAFT) | Own files | Banks and other obliged sectors hold their own beneficial-owner CDD |
| Foreign authorities | Exchange | DIAN as custodian exchanges under treaties and CRS |
Two further tracks build beneficial-owner files under their own rulebooks. Financial institutions run SARLAFT, the Financial Superintendence's AML system; and since 2020 the Superintendencia de Sociedades' SAGRILAFT regime (Circular 100-000016) obliges larger supervised non-financial companies — broadly those above 30,000 monthly minimum wages in assets or income, plus designated sectors — to run their own risk systems and identify the beneficial owners of counterparties. As in Mexico, the RUB, SARLAFT and SAGRILAFT can produce different lists for the same structure; a verifier should know which file produced the name in front of them. On the international side, DIAN as custodian exchanges under Colombia's FATCA agreement and the CRS — closed to you, open state-to-state.
09Where to look: sources, access and cost
| Source | What it gives you | Access & cost |
|---|---|---|
| RUES (rues.org.co) | National company search: existence, status, registration data, legal representative | Free search |
| Chamber certificate | Certificate of existence and legal representation: representative, board, constitutive acts, registered control situations | Small fee — online, a few thousand pesos |
| Supersociedades | Control-situation declarations, corporate filings of supervised companies | Largely free portals |
| Financial Superintendence / BVC | Listed issuers: shareholding and relevant-information disclosures | Free |
| RUT (DIAN) | Tax registration status of an entity | Limited — basic status checks; the RUB inside it is closed |
| RUB (DIAN) | Declared beneficial owners at 5% | Not accessible — request the filing from the counterparty |
| Company shareholder book | The actual owners of an S.A.S. or S.A. | Via counterparty |
| Dimension | Local sources (RUES / chambers / DIAN) | Zavia.ai |
|---|---|---|
| Data origin | The official record itself | Sourced directly from the same official registries — not third-party aggregation |
| Beneficial owners | RUB closed; not retrievable | Ownership chains mapped from registry data through the layers above, to the natural person; the RUB filing you obtain from the counterparty is benchmarked, not replaced |
| Chain resolution | One entity per lookup; foreign layers in other systems | Cross-border resolution across 100+ countries in one query — Panama, US and fund layers included |
| Threshold logic | Fixed by law (5% RUB) | Configurable thresholds — run the same structure at 5% for Colombia and 25% for your global policy |
| Screening | None | Sanctions and PEP overlays on resolved individuals |
| Freshness | Live at the source; RUB may lag a quarter | Real-time updates from official registries, with change monitoring |
| Language | Spanish | Multi-language, English output |
| Delivery | Manual portal lookups, per-certificate fees | API, bulk data feeds and MCP integration for AI agents |
| Audit trail | Documents you assemble yourself | Auditable, timestamped resolution path |
The register you can't read — and the file they must have
Colombia's RUB is closed, but its 5% test forces an unusually complete list onto every entity's own records. Zavia.ai connects directly to official registries in 100+ countries, assembles the Colombian corporate layer from the chambers-of-commerce record, follows corporate shareholders up through the Panama, US and other layers where Colombian structures resolve, and returns an auditable map to the natural person — with sanctions and PEP overlays and a benchmark for the RUB filing you request from the counterparty.
10The public layer: chambers, RUES, RUT
Colombia's commercial registry is decentralised to the chambers of commerce, unified through RUES (the Registro Único Empresarial y Social): a national search returns any company's registration, status, legal representative, board and constitutive acts, and a certificado de existencia y representación legal can be obtained online for a modest fee — the standard proof of a Colombian company. What it generally does not show is shareholders: for the S.A.S. and S.A. that dominate Colombian practice, the shareholder register is a company book, not a chamber record. The RUT, DIAN's tax registration, is a separate identity layer — and the RUB sits inside it. So the public paper trail proves existence, management and legal capacity — and, where a control situation has been registered, the identity of the controller (next section); the shareholder register itself begins where the public record ends.
11The older track: registered control situations
The RUB is not Colombia's only ownership-disclosure rule — and the older one is public. Under Article 30 of Law 222 of 1995, whenever a "situación de control" or a "grupo empresarial" arises — one company's decision-making subordinated to another person or entity, under the tests in Articles 260–261 of the Commercial Code — the controlling party must record it in a private document naming the linked entities (name, domicile, nationality, activity and the basis of control) and file it for registration at the chamber of commerce of each linked entity within 30 days. Every later change must be registered too. And the law requires the chamber to state on the certificado de existencia y representación legal whether the company is a parent or a subsidiary and whether it belongs to a business group.
That has a real consequence for verifiers: for a controlled S.A.S., the controller is frequently on the public record even though the shareholder register is not. The Superintendencia de Sociedades polices the rule — it can declare a control situation on its own initiative or at anyone's request, order the registration and fine the omission, and since 2021 has run a normalisation programme and numerous investigations for unregistered control. So the certificate does two jobs: it proves existence and management, and it may name the parent. When it is silent on control for a company that plainly has one, that silence is itself a finding.
12The entity landscape
| Vehicle | Form | Where ownership sits |
|---|---|---|
| Simplified stock company | S.A.S. | The dominant form since 2008 — shareholder register kept by the company, not the chamber |
| Stock company | S.A. | Traditional corporation; listed tier disclosed through the Financial Superintendence and BVC |
| Limited company | Ltda. | Partners appear in the constitutive acts filed at the chamber — the one form where the public record shows owners |
| Investment fund | Structure without legal personality | Registered in the SIESPJ; its own beneficial owners flow into any entity it holds 5% of |
| Fiducia mercantil | Trust-like structure | Colombia's fiduciary vehicle, run by licensed fiduciarias; reported via the SIESPJ |
13Chains: Colombia in the region
14A worked example
Take a Bogotá services S.A.S. held 70% by a Colombian holding S.A.S. and 30% by a Panamanian company. Behind the holding sit four siblings at 25% each; behind the Panamanian company, a single individual.
Run the Colombian test. All four siblings hold 17.5% indirectly — every one is a beneficiario final at 5%; so is the Panama individual at 30%. Under a 25% regime, only the Panama owner would appear; the RUB list is five names, the KYC list one. That gap is the practical value of understanding the threshold: if a Colombian counterparty produces a RUB filing with a single name for a structure like this, either step 1 was mis-applied or the structure is not what it seems. The chamber gives you both Colombian entities, their representatives and boards; the shareholder registers come through the counterparty; the Panamanian layer resolves under Panama's own private-register rules; and the RUB filing — a document the entity is obliged to hold and keep current to the quarter — is the cross-check you request.
15Common failure modes
| The mistake | Why it fails |
|---|---|
| Applying 25% by regional habit | Colombia's statute says 5% — capital, votes or benefit |
| Expecting to search the RUB | It is closed to private parties; no legitimate-interest route exists |
| Reading the chamber certificate as ownership | It shows the representative and board; S.A.S./S.A. shareholders sit in company books |
| Accepting a representative-only RUB filing | DIAN's 2024–25 doctrine: control by other means applies without any shareholding — ask whether step 2 was run |
| Stopping at a fund or fiducia | The structure's own beneficial owners flow into any entity it holds 5% of |
| Ignoring the quarterly lag | Filings may lawfully trail a change by up to three months — read the date fields |
| Ignoring registered control situations | Law 222/1995 puts controllers on the public record within 30 days — check the certificate for parent/subsidiary status |
| Forgetting the foreign branch | Foreign entities with a Colombian permanent establishment file to the RUB too |
16How to verify a Colombian UBO: workflow
- Pull the chamber record. RUES search plus the certificate of existence and legal representation: existence, status, representative, board, constitutive acts — and any registered control situation or business-group membership.
- Classify the vehicle. Ltda. (owners on the public record), S.A.S./S.A. (company books), fund or fiducia (SIESPJ) — the form sets the route.
- Request the shareholder register. Through the counterparty, reconciled against its financial statements and the constitutive acts.
- Apply the Colombian test at 5%. Capital, votes or benefit — then control by any other means — then the representative fallback, consciously.
- Request the RUB filing. Forms 2687/2688 evidence and the DIAN acknowledgement; benchmark the names against the chain you built and check the effective-date fields.
- Resolve the layers above. Panama, US and fund layers in their own jurisdictions; foreign parents with Colombian branches are RUB filers themselves.
- Screen and evidence. Sanctions, PEP and adverse-media checks on every resolved individual, with an auditable trail.
17Practical takeaways
| Scenario | What you can rely on | What you must supplement |
|---|---|---|
| Any Colombian entity | A RUB filing must exist — a document you can demand | Independent chain-building; the filing is self-declared |
| S.A.S. with corporate shareholders | Chamber records for each layer | The shareholder books, via the counterparty |
| Fund or fiducia in the chain | The pass-through rule at 5% | The vehicle's own beneficiary schedule |
| Foreign-parented subsidiary | The parent's Colombian branch as a RUB filer | The parent's home-jurisdiction register |
Colombia rewards the verifier who takes the threshold seriously and the register realistically. The RUB is the most ambitious beneficial-ownership instrument in Latin America — a true register, at 5%, with a fallback that names someone every time, and a due-diligence duty behind every filing. None of it is yours to search. What it gives you is a document every counterparty must possess and keep current to the quarter, and a list that should be longer than the one your 25% instincts predict. Build the workflow around the chamber record, the shareholder books, the right threshold and the chain above — and treat a short RUB filing on a layered structure as the finding it probably is.
Colombia & cross-border ownership data — however you build
Skip the layer-by-layer unwinding. Get Colombian corporate data and cross-border ownership resolution sourced directly from official registries — mapped through the regional and fund layers to the natural person at the top.
18Frequently asked questions
What is the RUB in Colombia?
The RUB — Registro Único de Beneficiarios Finales — is Colombia's national beneficial-ownership register, created by Article 631-6 of the Estatuto Tributario and made operational by DIAN Resolution 000164 of 2021, in force since 15 January 2022 and since compiled into Resolution 227 of 2025. It is administered by DIAN, the tax authority, forms part of the RUT tax registration, and receives each obliged entity's identification of the natural persons who ultimately own or control it. Alongside it runs the SIESPJ, the identification system for structures without legal personality such as funds and fiduciary arrangements. The register is closed to the public.
What is the beneficial ownership threshold in Colombia?
5% — the lowest in Latin America. Under Article 631-5(a) of the Estatuto Tributario and Article 6 of Resolution 164/2021, a beneficiario final is a natural person who, alone or acting jointly, directly or indirectly holds 5% or more of an entity's capital or voting rights, and/or benefits from 5% or more of its assets, yields or profits. Any one of the three routes suffices. Secondary sources often assume the regional 25% norm; the Colombian statute is explicit at 5%, which typically produces a much longer list of beneficial owners than a 25% regime would for the same structure.
Is the Colombian beneficial ownership register public?
No. The RUB is a closed register held by DIAN under tax reserve, serving the tax authority, enforcement and international exchange rather than counterparties, and there is no legitimate-interest access route for private parties. The public layer in Colombia is the commercial registry run by the chambers of commerce and unified through RUES, which shows a company's existence, status, legal representative, board and constitutive acts — but generally not the shareholders of an S.A.S. or S.A. In practice a verifier obtains ownership through the entity's own shareholder register and its RUB filing, requested through the counterparty.
Who has to report to the RUB?
Under Article 4 of Resolution 164/2021: companies and other legal entities, non-profit entities, foreign entities with a permanent establishment or branch in Colombia, and structures without legal personality or similar arrangements — investment funds, fiduciary vehicles, consortia — which register through the SIESPJ. Exempt are public entities and bodies, wholly state-owned national companies, and embassies, diplomatic missions and accredited international organisations. Every obliged entity must identify, obtain, keep, supply and update the information — and, under Law 2195 of 2022, conduct due diligence to identify its beneficial owners.
Who is the beneficial owner if no one holds 5%?
The test continues. Step two captures any natural person who, alone or jointly, exercises direct or indirect control over the entity by any means other than the 5% routes. Only where no one is identified under either step does the fallback apply: the legal representative is reported — unless a natural person holds greater authority over the entity's management or direction, in which case that person is reported instead. DIAN doctrine from November 2024, confirmed in May 2025, stresses that control by other means can make someone a beneficial owner with no shareholding at all, so a filing that names only the representative deserves scrutiny.
How are investment funds and trusts treated?
As structures without legal personality, registered through the SIESPJ, with their own beneficial owners identified under Article 631-5(b) — and with a pass-through rule that matters for chains: where such a structure holds, directly or indirectly, 5% or more of a legal entity's capital, the structure's beneficial owners are also treated as beneficial owners of that entity. Colombia's fiducia mercantil, the fiduciary vehicle administered by licensed fiduciarias, falls into the same category. A fund or fiducia in a Colombian chain is therefore not a stopping point; the natural persons behind it flow through to the RUB filing of the entity below.
When must RUB information be updated?
Quarterly. Any event that changes the information registered in the RUB must be updated by the first business day of January, April, July or October, whichever follows the change, filed on DIAN's forms 2687 (individual load) or 2688 (bulk). Initial filings fall due within the statutory window after an entity is registered. The cadence gives verifiers a benchmark: a Colombian RUB filing may lawfully lag a change by up to three months, so the effective-date fields — the dates a person became and ceased to be a beneficial owner — should be read alongside the names.
What are the penalties for RUB non-compliance?
Because the RUB forms an integral part of the RUT tax registration, Article 20 of Resolution 164/2021 — giving effect to Article 631-6 of the Estatuto Tributario — applies the RUT sanction regime of Article 658-3 to any obliged entity that fails to supply beneficial-ownership information, supplies it erroneously or incompletely, or fails to update it. The regime is administrative and daily-accruing rather than a headline per-beneficiary fine, and it sits alongside the practical consequences of a defective tax registration in a system where the RUT underpins invoicing, contracting and compliance standing.
Is Colombia on the FATF grey list?
No — Colombia has never been grey-listed. It is a member of GAFILAT, the FATF-style regional body for Latin America, and built its beneficial-ownership regime with the FATF standard in view to an unusual degree: paragraph 2 of Article 631-5 of the Estatuto Tributario instructs DIAN to interpret the beneficial-owner definition in line with the FATF's updated recommendations and interpretive notes, and Resolution 164 records that it did so. The RUB and the SIESPJ, together with the due-diligence principle in Law 2195 of 2022, are Colombia's implementation of Recommendations 24 and 25.
How do you verify the ownership of a Colombian company?
Start at the chamber of commerce: a RUES search and the certificate of existence and legal representation give existence, status, representative, board and constitutive acts. Classify the vehicle — a Ltda. shows its partners publicly, an S.A.S. or S.A. keeps shareholders in company books, a fund or fiducia sits in the SIESPJ. Request the shareholder register through the counterparty and apply the Colombian test at 5% (capital, votes or benefit), then control by other means, then the representative fallback. Request the entity's RUB filing and check its names and effective dates against your chain, resolve foreign layers in their own jurisdictions, and screen every individual identified.
