Your Colombian customer has sent you an ESG questionnaire. Here is what the law requires of them — and what they need from you.
Colombia has introduced mandatory sustainability reporting for listed companies through the Financial Superintendency of Colombia (SFC — Superintendencia Financiera de Colombia) and the Colombian Stock Exchange (BVC — Bolsa de Valores de Colombia). Colombia is also a major supplier to EU and US markets — particularly in coffee, flowers, coal, oil, and manufacturing — and Colombian suppliers face ESG questionnaires from international buyers subject to CSRD, CSDDD, and California SB 253. The EU-Colombia Free Trade Agreement and Colombia's OECD membership further align Colombian business standards with international ESG expectations. If you supply goods or services to a Colombian buyer, or if your Colombian buyer supplies international markets, ESG compliance evidence is increasingly a regulatory and procurement requirement.
Key regulations in Colombia — ESG & Sustainability Reporting Supplier Guide
SFC Circular 028/2021 — Sustainable Finance and ESG Disclosure
Colombia's Financial Superintendency (SFC) issued Circular 028/2021 requiring financial institutions and listed companies to integrate ESG risk management and disclose sustainability information. The framework is aligned with TCFD and GRI Standards. Companies must disclose climate-related risks, supply chain sustainability data, and ESG governance structures.
BVC Sustainability Reporting Guidelines
The Colombian Stock Exchange (BVC) requires listed companies to publish sustainability reports aligned with GRI Standards. Reports must cover environmental, social, and governance performance, including supply chain sustainability. BVC-listed companies are required to disclose their supplier assessment processes and supply chain sustainability data.
EU CSRD & CSDDD — Reach into Colombian Suppliers
Colombian companies that supply European buyers — particularly in coffee, flowers, coal, and manufacturing — are subject to ESG questionnaires driven by EU CSRD and the incoming CSDDD. Colombia is the world's third-largest coffee producer and the largest cut flower exporter to the EU — these sectors face direct ESG questionnaire pressure from European buyers.
OECD Guidelines and Due Diligence Guidance
Colombia joined the OECD in 2020. OECD membership means Colombian companies are expected to align with OECD Guidelines for Multinational Enterprises, including the OECD Due Diligence Guidance for Responsible Business Conduct. International buyers — particularly from EU and US markets — will reference OECD standards in their supplier questionnaires.
Colombia Ley 1581 & ColCERT Cyber Obligations
Colombia's Law 1581 of 2012 (Data Protection Law) and Decree 1377 of 2013 require data controllers to notify the Superintendencia de Industria y Comercio (SIC) of personal data breaches within 15 business days. The SIC has issued guidance on breach notification requirements. Colombia's ColCERT (Colombian Computer Emergency Response Team) coordinates national cyber incident response under the Ministry of Information and Communications Technologies (MinTIC). Colombia's National Cybersecurity Policy (CONPES 3995) is expanding mandatory incident reporting for critical infrastructure. Suppliers processing Colombian customer data must align incident response to SIC notification requirements and monitor the evolving framework.
What this means for you as a supplier
You may not be directly regulated by all of these frameworks. But your Colombian buyer is — and so are the international buyers in your supply chain. SFC and BVC-listed companies must disclose supply chain sustainability data. EU buyers must assess Colombian suppliers under CSRD and CSDDD. A non-response or a weak response increases your buyer's regulatory risk and makes you a liability in their supply chain.
Key dates
2021 onwards
SFC Circular 028/2021 — mandatory ESG risk disclosure for financial institutions and listed companies
Active now
BVC sustainability reporting guidelines — listed companies must publish annual sustainability reports
Active now
EU CSRD — large EU companies must disclose supply chain sustainability data including Colombian suppliers
2026
California SB 253 mandatory Scope 3 reporting — US buyers must disclose supply chain emissions including Colombian suppliers
July 2029
EU CSDDD Phase 1 — large EU companies must conduct active supply chain due diligence; Colombian suppliers will receive structured questionnaires
Colombia's position as an OECD member and major EU supplier
Colombia joined the OECD in 2020 and has an EU Free Trade Agreement in force. This positions Colombia's regulatory framework closer to international ESG standards than many other Latin American markets. Colombian companies that build ESG credentials aligned with OECD and EU standards are better positioned for international procurement, investment, and the regulatory convergence that OECD membership and the EU FTA will continue to drive. Colombia is the world's third-largest coffee producer and the largest cut flower exporter to the EU — these sectors face particularly direct ESG questionnaire pressure from European buyers.
Coffee, flowers, and the EU supply chain
Colombia's coffee and cut flower industries are among the most directly affected by EU ESG requirements. European coffee roasters and retailers subject to CSRD must disclose supply chain sustainability data — including labour conditions, water usage, and carbon emissions from Colombian coffee farms. EU flower importers face similar requirements. Colombian suppliers in these sectors who can provide structured ESG evidence are significantly better positioned to maintain and grow their EU market share.
What your Colombian buyer's questionnaire will ask
Environmental management
Environmental management systems, water usage (critical for coffee and flower production), waste management, and energy efficiency. EU buyers require evidence of environmental compliance aligned with Colombian environmental law.
GHG emissions and climate data
Scope 1 and Scope 2 emissions data, and increasingly Scope 3 (supply chain) emissions. SFC-listed companies and EU CSRD buyers require supply chain emissions data.
Labour rights and working conditions
Compliance with Colombian Labour Law, minimum wage, working hours, health and safety, and freedom of association. EU buyers will reference ILO conventions and OECD Guidelines.
Human rights due diligence
A written policy covering forced labour, child labour, and non-discrimination. Evidence that you assess your own supply chain for human rights risks. OECD Due Diligence Guidance and EU CSDDD both require documented human rights due diligence.
Supply chain traceability
Evidence of your own supplier assessment processes. EU buyers require traceability through the supply chain — particularly for coffee and agricultural products.
Governance and anti-corruption
Anti-bribery and anti-corruption policies aligned with Colombian law. Board oversight of ESG matters. OECD Anti-Bribery Convention standards apply given Colombia's OECD membership.
What happens if your response is inadequate
- →Your SFC/BVC-listed buyer must disclose supply chain sustainability data — a non-response creates a gap in their mandatory sustainability report
- →EU coffee roasters and flower importers subject to CSRD need your supply chain data to complete their own mandatory disclosure
- →EU buyers subject to CSDDD may be required to source from suppliers who can demonstrate compliance — a non-response puts your contract at risk from July 2029
- →OECD-aligned buyers expect suppliers to meet OECD Due Diligence Guidance standards — Colombia's OECD membership raises the baseline expectation
Last reviewed: April 2026. This guide is for general information only and does not constitute legal advice. Regulations change — verify current requirements with a qualified adviser.
Received an ESG questionnaire from your buyer?
ESG Stress Free helps Colombian suppliers respond to international buyer ESG and sustainability requirements.