The letter recalls a duty and publishes a guide
On 20 October 2026 the Colombian Financial Superintendency sent Circular Letter 71 to the legal representatives and statutory auditors of supervised entities. It recalls that a natural-origin event can be an external factor of operational risk and, for that reason, must enter identification, evaluation, measurement, control, and monitoring. The continuity plan must provide for how to follow the protocols of the competent authorities and how to sustain operations and service to the financial consumer with safety, timeliness, and quality. The letter places that compliance in the Basic Financial Circular, in clauses of External Circular 004 of 14 April 2026, and states that it is mandatory for entities under its supervision.
The same letter publishes a good-practice guide. There the text changes: the recommendations are orientative and are not mandatory instructions. The entity may consider them, adopt them, or adjust them to its size, nature, complexity, risk profile, and way of operating.
For APS Judgment, the error is reading the two sentences as one. Treating the guide as a new rule opens a project the letter did not request. Filing it as optional reading can leave unreviewed the duty the letter does recall: for a supervised entity, the natural event already belongs in operational risk and in the continuity plan.
The letter does not govern an organization the Superintendency does not supervise. The question that still travels outside that perimeter is whether its own plan remains usable when the system, the site, and a supplier fail together.
What should stay separate
The letter separates three layers. The table adds no obligations: it records what the text distinguishes.
| What the letter says | Whom it reaches | What it does not do |
|---|---|---|
| The natural event enters operational risk and the continuity plan. The compliance it recalls sits in the Basic Financial Circular. | Entities supervised by the SFC. | This essay does not reproduce the clauses cited. |
| The guide orients governance, plans, resources, tests, communication, and coordination. | The entity that chooses to use it, according to its size and complexity. | It is not a mandatory instruction. |
| It calls it fundamental that prevention, preparation, response, continuity, and recovery plans be available on paper and in digital form. | The moment technology will not open the system. | A file that lives only in that system does not cover that moment. |
The dependency the weather report does not name
The letter describes a concrete exposure: the event can affect people, physical infrastructure, service channels, especially in-person ones, the services, and the entity's objectives. The official presentation of the guide adds critical suppliers and dependence on technology, electric power, telecommunications, and other essential services. It also proposes scenarios in which the site, the supplier, and the infrastructure fail together.
A weather report says that it is raining or that the ground has moved. It does not name the telecommunications node, the power feeder, or the critical supplier that share the interruption. If that dependency is not stated beforehand, the meeting discovers it on the day of the event.
There is a second gap, and the letter writes it down. The plan has to be consultable when the technology is not. A procedure stored only in the system that has just failed is not carried out.
In a hypothetical example, a service office loses power and the in-person channel. The procedure is on the intranet. The person who remains on site has a copy that states which service continues, through which alternate channel, and who authorizes stopping the rest. It is not a client and not a real site. It shows the difference between a plan that requires the system and a plan that works when the system is part of the failure.
Context can change the conditions without changing the question. The letter notes that climate change and a greater frequency and intensity of extreme phenomena, such as El Niño or La Niña, have increased exposure. That can change which site, which supplier, or which essential service remains available. It does not turn the guide into a rule, and it does not answer which service must continue.
What to settle beforehand
- For a supervised entity, whether the natural-origin event is already in operational risk and in the continuity plan, and not only in the folder that holds the guide.
- Which essential service continues, and which supplier, power supply, or telecommunications link can stop it even if the site holds.
- Whether the plan can be read and applied when the system will not open, on a medium the operation actually has at hand.
- Who decides, who carries it out, and whether that person knows the criterion before the event.
- Which part of the guide is adopted, if any, and what is adjusted to size and complexity. Adopting all of it as a precaution is not the decision.
- What change in exposure would require a review of the site, the supplier, or the essential service.
Those answers guide preparation. During the event they can be adjusted, especially when life or people's safety is at stake. The letter says that people, organizations, and authorities should give priority to that protection and to the continuity of essential services. The adjustment starts from a plan that can already be used.
Methodological note
Verification cutoff: 26 October 2026. Circular Letter 71 of 2026, dated 20 October, was read in full. The letter calls the good-practice document orientative. The duty it recalls is placed in clauses 1.1.2.114, 1.1.2.127, 1.1.2.135, and 1.1.2.136 of External Circular 004 of 14 April 2026. This essay does not reproduce those clauses: the Basic Financial Circular was not read. The mention of suppliers, power, telecommunications, and the simultaneous failure of sites, suppliers, and infrastructure comes from the official presentation of the guide and from what the letter says the document covers. The guide was not read line by line. In its index, the Superintendency defines circular letters as informative communications, through which regulations are not issued. The office example is hypothetical. This text does not describe a client or certify a management system.
The decision
If the guide is filed and the supervised entity's plan still does not contemplate the event, or if that plan opens only in the system the event takes out, the distinction the letter draws has not been used. The guide can orient. It does not decide which service continues, and it does not replace the plan that has to be readable without the system.
Talk with APS about how to apply these criteria to your operation.