The starting point

What a corporate review for shareholders and SAS companies solves

A company can be registered with the Cámara de Comercio (the chamber of commerce, which keeps Colombia's commercial registry) and still operate with weak rules. The certificate proves that the company exists; it does not prove that the shareholders know how to decide, how to leave, how to invest, how to distribute profits or how to respond when a conflict appears.

A corporate review seeks to turn that informal architecture into useful documents: clear bylaws, consistent minutes, shareholders' agreements, limits on the legal representative (the officer with authority to bind the company), information rules and records that can be shown to banks, investors, authorities or judges. It is not a luxury reserved for large companies. It is the preventive work that lets a company survive its own internal tensions.

Many SAS (sociedades por acciones simplificadas, Colombia's simplified stock corporations) come to a lawyer's office when the problem already has a name: a shareholder who denies access to the books, a legal representative who signed commitments the others know nothing about, a share sale that did not follow the rules, minutes that were never drawn up, or a decision that everyone now remembers differently. The legal cost of remedying those situations is always higher than the cost of having prevented them. A corporate review is exactly that preventive work: putting the rules in order before the pressure arrives.

But corporate order is not achieved with good bylaws alone. It also means understanding which documents exist, which are consistent with one another and which create friction. This guide covers each of those fronts: the architecture of the company before it is incorporated or amended, the clauses that hold up under pressure, the agreements that complement the bylaws, the documents that structure the company's legal history, the risks that usually fall outside the analysis, and the signs that the moment to act has arrived.

Before the first step

Before you incorporate or amend a SAS

The flexibility of the SAS is valuable, but it can also be dangerous if a template is used without thinking about the actual business. A family business, a company with two 50% shareholders, a startup that anticipates future investment and an operating company with many contracts do not need the same rules. The document has to match the way that specific company is going to make money, hire, take in capital and resolve disagreements.

Before drafting or amending the bylaws it is worth having a clear answer to four fundamental questions. First, who decides: which matters management can settle on its own, which require a simple majority of the shareholders, which call for a supermajority and which demand unanimity. Article 22 sets a base quorum of half plus one of the subscribed shares, but the bylaws can move that rule up or down depending on the type of decision; leaving it at the minimum standard sometimes protects no one.

Second, who signs: the limits on the legal representative, the amounts above which prior authorization is required, and the distinction between acts of ordinary administration and acts that can commit the company's core assets. Article 26 allows those limits to be designed precisely; without them, the representative can take on obligations the shareholders would never have approved.

Third, how a shareholder joins or leaves: the right-of-first-refusal mechanism when someone wants to sell, the valuation of the shares when there is no agreement on price, the payment terms that keep the company from being decapitalized in one blow, and the handover rules for when the departing shareholder was also the key operator of the business. Article 13 allows the transfer of shares to be restricted for up to ten years; article 24 enables purchase, sale and first-refusal agreements with the same maximum term. Without any of those clauses, the only real way out is usually litigation.

Fourth, how information is handled: what reports each shareholder receives, how often, under what confidentiality conditions and how the books and accounting records are accessed. A minority is entitled to enough information to exercise its economic rights; a majority is entitled not to have the company turned into a stage for abusive surveillance. Defining this in the bylaws avoids the fight over that boundary.

One last consideration before incorporating: the SAS must identify its beneficial owners before the DIAN (Colombia's tax authority) in the Registro Único de Beneficiarios (RUB, the beneficial owners registry), an obligation set out in article 631-5 of the Estatuto Tributario, Colombia's tax code (Ley 2155 de 2021), and in Resolución DIAN 000164 de 2021. The real control structure should match what the bylaws say from the outset, rather than leaving that alignment as a compliance problem for later.

The documents that hold up

Bylaws that actually work under pressure

Good bylaws do not try to anticipate every possible dispute, but they must answer the questions that damage a company most when there is no agreement: who can bind it, which decisions require authorization, how meetings are called, how a decision is proved and what happens if a shareholder blocks operations.

When the bylaws merely repeat generic formulas, the company looks flexible until the problem arrives: an urgent purchase, a bank debt, a shareholder who will not sign, an heir who makes a claim, a share sale or an authority that asks for the record behind an earlier decision. At that moment, the document that seemed sufficient reveals that it never considered the specific business it purported to govern.

Five clauses account for most conflicts and are worth reviewing with particular care.

The first is the one on legal representation. Article 26 allows its powers to be designed precisely: setting an amount threshold above which minutes of the shareholders' meeting are required, distinguishing acts of ordinary administration from acts that commit core assets, and requiring two signatures for sensitive transactions. Unlimited authority is convenient until the day it is used for something the shareholders would never have approved.

The second is the one on majorities and reserved decisions. Not every decision deserves the same threshold. Approving the annual budget is not the same as selling real property, changing the corporate purpose or issuing new shares. The bylaws must define, for each category of decision, whether the simple majority of article 22 is enough, whether a special majority is needed or whether unanimity is required. Without that distinction, the majority can always press the minority on matters that affect it directly.

The third is the one on transfer of shares. Article 13 allows transfer to be restricted or even prohibited for up to ten years. In practice, that serves to require every sale to pass first through a right of first refusal in favor of the other shareholders, to veto the entry of competitors or to block the transfer of shares to unwanted heirs in the short term. With no restriction at all, a shareholder can sell to whomever they wish and the others can do nothing about it.

The fourth is the one on conflicts of interest. If a shareholder or an officer wants to contract with the company, or if their family has a business that competes with it or provides services to it, the bylaws must set out the procedure: disclose the interest, abstain from voting and record the others' approval in the minutes. Without that procedure, the transactions are approved de facto and no one can clearly challenge them afterward.

The fifth is the one on exit and withdrawal. This clause defines how an exit is paid for, what valuation method is used, over what period, and what happens to the departing shareholder's duties, clients, information and outstanding commitments. Designing it in calm times, while the shareholders still agree, is far easier than negotiating it when someone already has one foot out the door.

One further warning that the bylaws must also take into account: a SAS cannot trade its shares on the public securities market. Article 4 of Ley 1258 de 2008 expressly prohibits it, and the Corte Constitucional (Colombia's Constitutional Court) confirmed that this prohibition remains in force in Sentencia C-038 de 2025 (M.P. Cristina Pardo Schlesinger), which declared unconstitutional the rule that sought to open that possibility. If the future plan includes raising investment on the stock exchange, it is worth evaluating a different corporate structure from the start.

The complementary document

Shareholders' agreements: rules for difficult conversations

A shareholders' agreement makes it possible to govern matters that it is not always advisable to put in the bylaws or to make public. It can hold rules on tenure, non-competition, information, sales to third parties, future investment, dividends, deadlock-breaking, valuation and an orderly exit. Article 24 of Ley 1258 de 2008 authorizes it with a term of up to ten years, renewable; it can be deposited with the company, and management is required to abide by it within its sphere.

The difference between an agreement that works and one that creates more problems than it solves lies in the level of precision. It is not enough to say that the shareholders will act in good faith or that they will respect the spirit of the business: you have to define who can demand what, within what period, with what consequences and with what documents a breach is proved. A vague agreement is worse than no agreement, because it creates the expectation of a protection that does not actually exist.

The matters most often worth including in an agreement are the following.

• Tenure and dedication. If a shareholder works in the company, the agreement can make their stake conditional on a minimum period of service and set out what happens to their shares if they leave before the agreed term.
• Non-competition. Term, territory, prohibited activities and consequences of breach. A reasonable clause protects without tying the shareholder down for life.
• Periodic information. Financial reports, access to the books, confidentiality conditions and a mechanism for resolving discrepancies over the numbers.
• Deadlock-breaking rules. In a 50/50 company with no deadlock-breaking mechanism, any conflict can paralyze the business. The agreement can set out stages: direct negotiation, mediation by a third party, an option to buy or to sell at an agreed price.
• Share valuation. Agreeing the valuation method in calm times (book value, earnings multiples, present value of future cash flows, a fixed price per period) avoids the dispute when someone wants to leave or must be bought out.
• Future investment and anti-dilution. If one of the shareholders expects to contribute more capital, the agreement can set conditions and protect the others from unanticipated dilution.
• Dividends and retained earnings. When distributions are made, in what proportion, with what limits, and what happens if a shareholder needs liquidity and the company has no defined policy.

There is, however, a limit that Oficio 220-099807 de 2023 made clear: the agreement cannot disregard the majority-voting regime set in the bylaws. If a private agreement provides that certain shareholders will vote a particular way on a matter the bylaws do not govern, that may be valid between the parties. But if that agreed vote contradicts a majority already set in the bylaws, the agreement gives way. The hierarchy is always: bylaws first, agreement second. That is why, before signing an agreement that touches voting power, appointments or rights of first refusal, it is worth checking that the bylaws already allow it, and if not, amending them first.

Another important limitation: SAS shares cannot be traded on the stock exchange (art. 4), so any clause of the agreement requiring a public sale of shares would be null. The exit options the agreement governs must be capable of being carried out between private parties.

The minimum file

Documents an orderly company must have

The corporate file must tell the company's history without depending on memories, scattered chats or after-the-fact explanations. When an audit arrives, or an inspection by the Superintendencia de Sociedades, a due diligence process for a sale or litigation among shareholders, the documents are the only source of truth that carries weight. What is not documented does not exist for legal purposes.

In an initial review we usually ask for, at a minimum, the documents described in the following table. Each one serves a specific function and its absence leaves a concrete gap.

One point that deserves special attention is the distinction between what the Cámara de Comercio records and what stays in the internal books. The certificado de existencia reflects the amendments that have been registered; but the minute book and the shareholders' ledger reflect the internal life of the company. Many SAS have the first up to date and the other two abandoned. That gap creates a real legal risk: if the minutes do not exist or are behind, past decisions can be challenged.

It is also worth mentioning that the Superintendencia de Sociedades, in its Cartilla (guidance booklet) Cien preguntas y respuestas sobre la SAS, has emphasized the importance of corporate documents being consistent with one another: the bylaws must match the certificate, the minute book must reflect the actual decisions and the shareholders' ledger must be updated with every transfer. A company with inconsistent documents is a company with potential litigation.

• Certificado de existencia: Do the details on legal representation, corporate purpose and capital reflect the company's current position?
• Shareholders' register: Is it up to date with every transfer and with each shareholder's current percentage?
• Minute book: Are there signed minutes for every important decision of the last two years?
• Shareholders' agreement: Does it cover exit, valuation, information, non-competition and deadlock-breaking?
• Contracts with founders: Does it clearly distinguish what each shareholder receives as an owner and as a worker?
• Current powers of attorney: Is there an up-to-date list of who can sign what, and up to what amount?
• Beneficial owners (RUB): Does the filing with the DIAN reflect who really controls the company?

The wider perimeter

Risks that usually fall outside the corporate review

Corporate law is not just minutes. A company can look orderly —with updated bylaws, minutes kept current and a signed shareholders' agreement— and still carry tax, labor, regulatory or criminal contingencies that affect its value, its ability to sell or its defense against third parties. A corporate review that looks only at the corporate-law module leaves four flanks open.

The first is tax risk. A SAS that has not updated its RUT (the tax registry), that has inconsistencies in its electronic invoicing, that has not reported its beneficial owners as required by article 631-5 of the Estatuto Tributario, or that has miscalculated its withholdings, can receive a formal inquiry from the DIAN at the worst possible moment: just as it is closing an investment or a sale. The ICA (the municipal industry and commerce tax), the información exógena (the annual third-party data return to the DIAN) and withholding at source are areas frequently neglected in a company's early stages.

The second is labor risk. Many small SAS operate with service providers who, given their actual relationship with the company —set hours, subordination, exclusive dedication—, could be treated as employees in the event of an inspection by the Ministerio de Trabajo (Colombia's labor ministry) or a lawsuit. If that situation has not been identified, the corporate review may conclude that the company is in order while an employment liability grows silently. The Sistema de Gestión de Seguridad y Salud en el Trabajo (SG-SST, the occupational health and safety management system) and the PILA (the integrated social security contribution filing) are mandatory checkpoints.

The third is regulatory risk. Depending on the activity, the SAS may be subject to supervision by the Superintendencia Financiera (the financial regulator), the Superintendencia de Industria y Comercio (the competition and consumer protection authority), the DIAN on PTEE matters (corporate transparency and ethics programs), the Agencia Nacional de Protección de Datos or sector-specific bodies. Many of those requirements carry strict deadlines and financial penalties; identifying them in time is part of a complete corporate review.

The fourth is corporate criminal risk. This is the one that most often takes by surprise the shareholders who are not officers. Administración desleal (disloyal management), abuso de confianza (criminal breach of trust), forged invoices or documents, transactions with funds of doubtful origin and certain decisions with criminal consequences can compromise both the officer and, in extreme cases, the shareholders who failed to raise the alarm. The Gyptec case illustrates how a problem that looks purely civil —the irregular handling of funds by the controlling shareholder— can escalate until it involves liabilities that go beyond restitution.

The lesson of Gyptec for a SAS under review is a direct one: disorder in the cash —mixing personal expenses with company funds, approving de facto loans with no minutes, treating the company's money as if it belonged to the controlling shareholder— is not merely an accounting problem. It is a legal liability that the minority or a third party can enforce before the Superintendencia de Sociedades, which under article 42 of Ley 1258 may disregard the company's separate legal personality where the company is used in fraud or to harm third parties.

When to make the call

Signs that the problem already needs a lawyer

It is worth seeking legal support when a business decision stops being operational and starts creating legal risk. That boundary is not always visible from the inside, but there are signs that mark it quite sharply.

The first is when there are shareholders blocking information. If a shareholder denies access to the books, the financial statements or the minutes, or if management does not answer reasonable requests for information, the problem has already gone beyond what a conversation can solve. The minority has economic rights that include enough information to exercise them, and systematically denying that information is conduct that may amount to an abuse which the Superintendencia de Sociedades hears under article 43 of Ley 1258.

The second is when there are share sales or transfers with no procedure. If a shareholder transferred their shares to a relative, to a related company or to a third party without respecting the right of first refusal or the limits of article 13, that transfer may be open to challenge. But acting after the third party is already entered in the shareholders' ledger is more expensive than doing so beforehand.

The third is when there are exits with no valuation. If a shareholder has left —or wants to leave— and there is no agreed method for valuing their shares, the argument over price can block the transaction for years. A lawyer can propose valuation structures and make agreement easier before the conflict escalates.

The fourth is when there are late or non-existent minutes. If the important decisions of recent years have no support in minutes drawn up at the time, any authority or opposing party can question the legitimacy of what was decided. Reconstructing minutes is possible, but it must be done with legal care.

The fifth is when there are powers of attorney with no limits in circulation. If there is a broad, general power of attorney granted at a moment of trust that no longer reflects the reality of the relationship among the shareholders, revoking it in time can prevent someone from signing commitments the company is in no position to take on.

The sixth —and perhaps the most frequent— is when there is cash mixed with personal expenses. Loans to the controlling shareholder with no minutes, personal credit cards charged to the company, fees paid to related third parties without approval and personal expenses disguised as operating expenses are exactly the pattern that the Gyptec ruling penalized with nullity and restitution. When that pattern has been running for years, the review must be a complete one.

It is also prudent to seek legal support before certain corporate events that transform the relationship among shareholders: taking in outside investment, buying or selling a stake, amending the bylaws, signing a shareholders' agreement, responding to an inspection by the Superintendencia or letting relatives, heirs or third parties into the ownership. At those moments, being clear about the company's legal architecture is not a luxury but a condition for negotiating with information.

The Corte Constitucional confirmed in Sentencia C-090 de 2014 (M.P. Mauricio González Cuervo) that the shareholder's limited liability is valid, but that this shield does not cover fraud: articles 42 and 43 of Ley 1258 allow the piercing of the corporate veil and penalize the abuse of the right to vote before the Superintendencia de Sociedades. Put another way: corporate order protects when it is used in good faith; when it is used to harm the minority or third parties, the protection disappears.

The way we work

How Cafore approaches a corporate review

At Cafore we begin by understanding the stage the company is at: whether we are dealing with an incorporation, an amendment, an active dispute, an investment process, the sale of a stake, the exit of shareholders or a response to an authority. Each moment has its own urgency and its own hierarchy of risks, and the review must be calibrated to that.

The second step is gathering the documents. We ask for the current bylaws together with the certificado de existencia, the shareholders' ledger, the minute book for recent years, the contracts with founders and officers, the current powers of attorney, the shareholders' agreement if there is one, and the records supporting recent sensitive decisions. That set quickly reveals where the gaps are.

The third step is the cross-checked diagnosis. We test the corporate documents against the company's operating reality: contracts in force, employment relationships, outstanding tax obligations and regulatory exposure. A SAS whose bylaws are in order but which operates with contractors who are employees in fact carries a risk that does not show up in a strictly corporate review.

The fourth step is the roadmap. We do not propose a standard package of documents; we propose a route proportionate to the moment, the size and the specific risks of that company. Sometimes what is needed is to amend two clauses of the bylaws and sign a simple agreement. Sometimes a fuller restructuring is needed. What is always needed is for the documents to say the same thing as one another.

The goal is not to fill the company with paperwork, but to leave rules that can be used when there is pressure: a difficult meeting, a negotiation, an audit, a visit from an authority or a decision that commits company assets. An orderly company does not need more documents than a disorderly one; it needs documents that work when they really matter.