AML compliance 2026: which companies must comply and what happens if you do not

What is the AML system and why does it matter now?

The self-control and integral risk management system for money laundering, terrorist financing and proliferation financing is the set of policies, procedures and controls a company must implement so its operations are not used for unlawful purposes. It is not a manual: it is a system with auditable evidence.

The Superintendence of Companies requires it from commercial companies exceeding certain prior-year revenue or asset thresholds, and from sectors considered higher risk regardless of size.

The three costliest mistakes

1. Confusing the manual with the system. Having the document does not evidence compliance: what the regulator reviews is proof that controls actually operated.
2. Appointing a compliance officer without real decision-making authority or a reporting line to the highest corporate body.
3. Skipping counterparty due diligence, which is precisely where risk materialises in practice.

What the regulator reviews during an inspection

• An updated risk matrix with documented methodology.
• Evidence of staff training, with attendance records and assessment.
• Suspicious transaction reports filed with the financial intelligence unit, or documented justification for their absence.
• Due diligence applied to clients, suppliers and third parties, with escalation criteria.

Where to start

The first step is always the applicability assessment: determining from prior-year financial statements whether the company falls within the regime and under which category. That analysis takes under a week and defines everything else.