CIB Bancolombia SA

Risk Factors

Investing in the Notes involves risks. Before you invest in the Notes, you should consider carefully the information set forth in this section and all the other information provided to you or incorporated by reference in this prospectus supplement and the accompanying prospectus, as the same may be updated from time to time by our future filings under the Exchange Act. In addition, new risks may emerge at any time and we cannot predict such risks or estimate the extent to which they may affect our financial performance or business operations.

RISKS RELATING TO COLOMBIA AND OTHER COUNTRIES WHERE WE OPERATE

Changes in economic and political conditions in Colombia, Panama, El Salvador and Guatemala or in other countries where we operate may adversely affect our financial condition and results of operations.

Our financial condition, results of operations and asset quality are significantly dependent on the macroeconomic and political conditions prevailing in Colombia, Panama, El Salvador, Guatemala and the other jurisdictions where we operate. Accordingly, decreases in the growth rate, periods of negative growth, increases in inflation, changes in policy, or future judicial interpretations of policies involving exchange controls and other matters such as currency depreciation, inflation, interest rates, taxation, banking laws and regulations and other political or economic developments in such jurisdictions may affect the overall business environment and may in turn negatively affect our financial condition and results of operations.

In particular, the governments of Colombia, Panama, El Salvador and Guatemala have historically exercised substantial influence on their economies, and they are likely to continue to implement policies that will have an important impact on the business and results of operations of the entities in such countries (including us), market conditions and prices and rates of return on securities of local issuers (including our securities). Potential changes in laws, public policies and regulations may cause instability and volatility in Colombia, Panama, El Salvador and Guatemala, and their respective markets. Future developments in government policies could negatively affect our business and financial condition and the market value of our securities.

Although Colombia and Panama currently have investment grade credit ratings from international rating agencies, El Salvador and Guatemala do not. As of the date of this prospectus supplement, El Salvador has a long-term debt rating of B- from Fitch, B3 from Moody’s, and B- from S&P, respectively. Guatemala has ratings of BB from Fitch, Ba1 from Moody’s and BB- from S&P, respectively. Downgrades in the ratings of either country, or the failure of Colombia or Panama to maintain investment grade credit ratings, could increase our financing costs and adversely affect our results of operation and financial condition.

The economies of the countries in which we operate are vulnerable to external effects that could be caused by significant economic difficulties experienced by their major regional trading partners or by more general contagion effects, which could have a material adverse effect on economic growth in these countries and their ability to service their public debt.

A significant decline in economic growth or a sustained economic downturn of any of Colombia, Panama, El Salvador or Guatemala’s major trading partners (i.e., the European Union, the United States, China and other Latin American countries for Colombia and the United States and European Union for Panama, El Salvador and Guatemala) could have a material adverse impact on the balance of trade and remittances inflows in those countries, resulting in lower economic growth.

Deterioration in the economic and political situation in neighboring countries could adversely affect the economy and cause instability in Colombia, Panama, El Salvador and Guatemala by disrupting their diplomatic or commercial relationships with neighboring countries. Any future tensions may cause political and economic uncertainty, instability, market volatility, low confidence levels and higher risk aversion by investors and market participants that may negatively affect economic activity in any of those jurisdictions.

Events occurring in a market where we do not operate may cause international investors to have an increased risk perception of an entire region or class of investment, which could in turn negatively affect market prices and liquidity of securities issued or owned by us.

Recently, a wave of protests has taken place in several countries of Latin America, including Colombia, demanding social reforms to pension and retirement regimes, access to health care, access to education, environmental protection, and taking measures against inequality, among others. Such events could have an adverse effect in the economies of the countries where they are taking place or in other countries in which we operate. This could have a material adverse effect on our business, results of operations, financial condition and ability to make payments on the Notes.

Any additional taxes resulting from changes to tax regulations or the interpretation thereof in Colombia, Panama, El Salvador, Guatemala or other countries where we operate, could adversely affect our consolidated results.

Uncertainty relating to tax legislation poses a constant risk to us. Changes in legislation, regulation and jurisprudence can affect tax burdens by increasing tax rates and fees, creating new taxes, limiting deductions and exemptions, and eliminating incentives and non-taxed income. Notably, the Colombian and Salvadorian governments have significant fiscal deficits that may result in future tax increases. Moreover, in Colombia, the tax reform of 2018 resulted in a tax that is higher on the banking industry than on other taxpayers and, therefore, we can give no assurance that additional differential treatment will not be imposed in the future. On October 16, 2019, the Colombian Constitutional Court declared the tax reform of 2018 unconstitutional with effect as of January 1, 2020. Consequently, on October 22, 2019, the Colombian government presented a new tax reform bill to Congress to replace the 2018 reform which was signed into law on December 27, 2019. The new tax reform is similar to the 2018 tax reform (except for issues that were challenged in 2019), but does increase the surcharge for financial entities to 4% in 2020. The surcharge for years 2021 and 2022 remains at 3% as initially intended in the 2018 tax reform. Moving forward, higher taxes could negatively affect our results of operations and cash flow. In addition, national or local taxing authorities may not interpret tax regulations in the same way that we do. Differing interpretations could result in future tax litigation and associated costs.

Exchange rate fluctuations may adversely affect the Colombian economy and our results.

Colombia has adopted a floating exchange rate system. The Central Bank maintains the power to intervene in the exchange market in order to consolidate or dispose of international reserves, and to control any volatility in the exchange rate. From time to time, including during 2019, there have been significant fluctuations in the exchange rate between the Colombian peso and the U.S. dollar. Unforeseen events in the international markets, fluctuations in interest rates, volatility of the oil price in the international markets, or changes in capital flows, may cause exchange rate instability that could generate sharp movements in the value of the peso. Because a portion of our assets and liabilities are denominated in, or indexed to, foreign currencies, especially the U.S. dollar, sharp movements in exchange rates may negatively impact our results.

Colombia has experienced several periods of violence and instability that could affect the economy and the Bank.

Colombia has experienced periods of criminal violence over the past four decades, primarily due to the activities of guerilla groups and drug cartels. Despite the peace treaty between the Colombian government and the Revolutionary Armed Forces of Colombia (Fuerzas Armadas Revolucionarias de Colombia or FARC), a lasting decrease in violence or drug-related crime in Colombia or the successful integration of former guerilla members into Colombian society, may not be achieved. In 2018, the Colombian government suspended the peace negotiations with the National Liberation Army (Ejército de Liberación Nacional or ELN) and in 2019, a minority group of dissidents of the peace process with FARC announced their return to illegal activities. An escalation of violence or drug-related crime may have a negative impact on the Colombian economy and on us.

Allegations of corruption against the Colombian government, politicians and private industry could create economic and political

uncertainty and could expose us to additional credit risk.

Allegations of corruption against the Colombian government, politicians and private industry could create economic and political uncertainty should the investigations triggered by these cases reach conclusions or result in further allegations or findings of illicit conduct committed by the accused parties. Furthermore, proven or alleged wrongdoings could have adverse effects on the political stability in Colombia and the Colombian economy. These adverse political and economic effects may negatively impact our business, including by depressing business volumes, reducing our ability to recover amounts we have loaned to persons or projects involved in illicit or allegedly illicit conduct and/or harming our reputation.

RISK FACTORS RELATING TO OUR BUSINESS AND THE BANKING INDUSTRY

Our financial results may be negatively affected by changes to accounting standards.

We report our results and financial position in accordance with IFRS as issued by the IASB. Changes to IFRS or interpretations thereof may cause our future reported results and financial position to differ from current expectations, or historical results to differ from those previously reported due to the adoption of accounting standards on a retrospective basis. Such changes may also affect our regulatory capital and financial ratios. We monitor potential accounting changes and when possible, we determine their potential impact and disclose significant future changes in our financial statements that we expect as a result of those changes. Currently, there are a number of issued but not yet effective IFRS changes, as well as potential IFRS changes, some of which could be expected to impact our reported results, financial position and regulatory capital in the future. In particular, since January 1, 2019, IFRS 16 requires lease obligations to be brought on balance sheet through the recognition of the present value of contractual payment as lease liabilities and the assets representing the contractual rights of use. For further information about developments in financial accounting and reporting standards, see Note 2 to our consolidated financial statements as of December 31, 2018 and the “Significant Accounting Policies” in the Annual Report.

Our financial results may be negatively affected by changes to assumptions supporting the value of our goodwill.

We test the goodwill that we have recognized on the respective financial position of our operating segments for impairment at least annually. Our impairment test in respect of the assets recognized for the nine months ended September 30, 2019 indicated that our respective goodwill balances are not impaired. The impairment test requires that we make assumptions regarding estimated earnings, discount rates and long-term growth rates impacting the recoverable amount of the goodwill associated with each operating segment and on estimates of the carrying amounts of the operating segments to which the goodwill relates. If the actual results in future periods deviate from the earnings and other assumptions on which our impairment testing is based, the value of the goodwill in any one or more of our businesses may become impaired in the future, resulting in charges to income. As of September 30, 2019, we had COP 7,648 billion of total goodwill and intangibles.

Changes in banking laws and regulations in Colombia and in other jurisdictions in which we operate could adversely affect our consolidated results.

Banking laws and regulations, or their official interpretation, in Colombia and in other jurisdictions in which we operate, have a material effect on our business and operations. Banking laws and regulations may change frequently, and changes may be adopted, enforced or interpreted in a manner that may have an adverse effect on our business.

Moreover, regulators in the jurisdictions where we operate may alter the current regulatory capital requirements to which we are subject and thereby require equity increases that could dilute existing stockholders, lead to required asset sales or adversely impact the return on stockholders’ equity and/or the market price of our common and preferred shares.

Furthermore, banking laws and regulations may create new types of financial entities whose services could compete with the segments or services offered by us. Increased competition could lead to lower margins for affected products and services and could adversely affect our results of operations.

We are subject to regulatory inspections, examinations, inquiries or audits in Colombia and in other countries where it operates, and any sanctions, fines and other penalties resulting from such inspections, examinations, inquiries or audits could materially and adversely affect our business, financial condition, results of operations and reputation.

We are subject to comprehensive regulation and supervision by the banking authorities of Colombia, Panama, El Salvador, Guatemala and the other jurisdictions where we operate. These Banking authorities have broad powers to adopt regulations and impose other requirements affecting or restricting virtually all aspects of our capitalization, organization and operations, including the imposition of anti-money laundering measures and the authority to regulate the terms and conditions on which banks can extend credit. In the event of non-compliance with applicable regulations, we could be subject to fines, sanctions or the revocation of licenses or permits to operate our business. In Colombia, for instance, if we encounter significant financial problems or become insolvent or in danger of becoming insolvent, banking authorities would have the power to take over our management and operations. Any sanctions, fines and other penalties resulting from non-compliance with regulations in Colombia, Panama, El Salvador, Guatemala and other jurisdictions where we operate could materially and adversely affect our business, financial condition, results of operations and reputation.

An increase in constitutional public interest actions (acciones populares) or class actions (acciones de grupo) may affect our businesses and results of operations.

Under the Colombian Constitution, individuals may initiate constitutional public interest or class actions to protect their collective or class rights, respectively. Colombian financial institutions, including us, have experienced a high number of these actions. The great majority of such actions have been related to fees, financial services and interest rates, and their outcome is uncertain. Pursuant to Law 1425 of 2010, monetary awards for plaintiffs in constitutional actions or class actions were eliminated as of January 1, 2011. Nevertheless, individuals continue to have the right to initiate these actions against us. These actions could result in judgments against us and could materially and adversely affect our business, financial condition, results of operations and reputation.

Future restrictions on interest rates or banking fees could negatively affect our profitability.

In prior years, the Colombian congress has considered various regulatory initiatives regarding banking fees. Although no such initiatives have been adopted in the past, there are new initiatives to impose similar restrictions on banking fees. If we are prohibited from continuing to charge our clients for certain products or services, including specified types of transactions, or from imposing charges for products or services that might be introduced in the future, our results of operations and financial condition could be adversely affected.

Colombian tax haven regulation could adversely affect our business and financial results.

Article 1.2.2.5.1 of Decree 1625 of 2016 designates 37 jurisdictions as non-cooperative or low-tax jurisdictions (also known as tax havens) for Colombian tax purposes, although neither Panama nor other countries where we operate were included on this list. As a result of the tax haven regulation, payments made to our clients who are residents in such jurisdictions do not benefit from the Colombian Holding Corporation Regime and clients are subject to (i) higher withholding tax rates including a higher withholding rate on interest and dividends derived from investments in the Colombian securities market, (ii) the transfer pricing regime and reporting duties, (iii) enhanced ability on the part of Colombian authorities to qualify certain conduct as abusive under tax regulations, (iv) non-deductibility of payments made to such residents or entities located in tax havens, unless the required tax amount has been withheld, and (v) additional information disclosure requirements, any of which could have a negative impact on our business and financial results.

In order to avoid Panama’s designation as a tax haven for Colombian tax purposes, Colombia and Panama signed a memorandum of understanding that establishes that both countries will negotiate a double taxation treaty. This treaty is expected to include provisions regarding the exchange of information between Colombian and Panamanian tax authorities. Any failure of Colombia and Panama to enter into such a treaty, or the designation of Panama as a tax haven by Colombia, could negatively impact our customer base and, as a result, have a potential adverse impact on our results of operations and financial condition. On April 28, 2016, the Colombian Ministry of Finance and Public Credit announced the successful conclusion of the negotiations between Colombia and Panama. In addition, Panama adhered to the Convention on Mutual Administrative Assistance in Tax Matters and the Multilateral Competent Authority Agreement of the Organization for Economic Cooperation and Development (“OECD”). However, as of the date of this prospectus supplement, the relationship to exchange financial information between Colombia and Panamá has not been activated.

We and most of our Subsidiaries are subject to the U.S. Foreign Account Tax Compliance Act of 2010 and the OECD’s Automatic Exchange of Information - Common Reporting Standard (CRS).

We and most of our subsidiaries are considered foreign financial institutions (“FFIs”) under the Foreign Account Tax Compliance Act of 2010 (“FATCA”). Additionally, we and some of our subsidiaries are subject to the reporting obligations derived from the conventions that implement the Common Reporting Standard (“CRS”) approved by the OECD.

Given the size and the scope of our international operations, we have taken measures and implemented procedures aimed at complying with FATCA and CRS, including transmitting to the relevant authorities the reports required under FATCA and CRS.

However, if we cannot satisfy the requirements thereunder, certain payments to us, or our Subsidiaries, may be subject to withholding under FATCA or other penalties imposed by each government. The possibility of such withholding or penalties and the need for accountholders and investors to provide certain information may discourage some customers or potential customers from banking with us, thereby adversely affecting our results of operations and financial condition. In addition, compliance with the terms of the intergovernmental agreements (“IGA”), particular agreements entered into with the IRS, the international conventions signed for the exchange of information under CRS, the laws or any other regulations enforced in the relevant jurisdictions may increase our compliance costs. Legislation and regulations implementing FATCA and CRS in some of the countries in which we operate remain under development, and the reporting dates vary depending on the jurisdiction.

We are exposed to increased costs and damages in the event of failure of our services providers to perform their obligations under key services contracts.

We enter into contracts with third parties who provide certain key services that are essential to our business. These services include online banking platforms, data processing and payment services, clearing and settlement services, software for processing credit and debit card services, and technological infrastructure, among others. We face the risk of operational disruption, failure or capacity constraints due to our dependency on such third party vendors for certain components of our systems.

While we conduct due diligence prior to engaging with third party service providers and perform ongoing monitoring of vendor controls, we do not control their operations. If any of our key service providers fails to fulfill any of their contractual obligations or cause disruptions in services (including as a result of a cyberattack, other information security event or a natural disaster, failure to handle current or higher volumes, poor performance of services and failure to comply with applicable laws and regulations), our ability to conduct our businesses could be adversely affected and could also negatively impact our results of operations and financial position. In addition, we might be required to incur significant additional costs to find replacement providers. Furthermore, the unavailability of the services provided by some technology vendors could result in the unavailability of certain channels through which our clients execute transactions with us until a replacement provider is engaged, which could result in lost revenue, additional costs and, potentially, adverse regulatory consequences and reputational harm.

Although we have implemented contingency plans to anticipate, identify, and mitigate these potential risks, we may not be able to prevent all significant negative consequences in case of a material failure of our key service providers.

We are subject to credit risk and estimating exposure to credit risk involves subjective and complex judgments.

A number of our products expose us to credit risk. These products include loans, financial leases, guarantees and lending commitments.

We estimate and establish reserves for credit risk and potential credit losses. This process involves subjective and complex judgments, including projections of economic conditions and assumptions about the ability of our borrowers to repay their loans. This process is also subject to human error as our employees may not always be able to assign an accurate credit risk rating to a client, which may result in our exposure to a higher credit risk than the one indicated by our risk rating system. We may not be able to timely detect these risks before they occur, or due to limited resources or available infrastructure, our employees may not be able to effectively implement our credit risk management system, which may increase our exposure to credit risk. Moreover, our failure to continuously refine our credit risk management system may result in a higher risk exposure for us, which could materially and adversely affect our results of operations and financial position.

Overall, if we are unable to effectively control the level of non-performing or poor credit quality loans in the future, or if our loan loss reserves are insufficient to cover future loan losses, our financial condition and results of operations may be materially and adversely affected.

In addition, the amount of our non-performing loans may increase in the future as a result of factors beyond our control, such as changes in the income levels of our borrowers, increases in the inflation rate or an increase in interest rates, the impact of macroeconomic trends and political events affecting Colombia and other jurisdictions where we operate or have exposure (especially Panama, El Salvador and Guatemala) or events affecting specific industries. Any of these developments could have a negative effect on the quality of our loan portfolio, requiring us to increase provisions for loan losses and resulting in reduced profits or in losses.

We are subject to credit risk with respect to our non-traditional banking businesses including investing in securities and entering into derivatives transactions.

Non-traditional sources of credit risk can arise from, among other things: investing in securities, entering into derivative contracts under which counterparties have obligations to make payments to us, and executing securities, futures, currency or commodity trades from our proprietary trading desk that fail to settle at the required time due to non-delivery by the counterparty or systems failure by clearing agents, exchanges, clearing houses or other financial intermediaries. Any significant increases in exposure to any of these non-traditional risks, or a significant decline in the credit quality or the insolvency of any of the counterparties to such transactions, could materially and adversely affect our results of operations and financial position.

We are exposed to risks associated with the mortgage loan market.

We are a relevant player in the mortgage loan markets where we operate. Colombia’s mortgage loan market is highly regulated and has historically been affected by macroeconomic factors, as have the mortgage loan markets of Panama, El Salvador and Guatemala. Although interest rates have been stable during recent years, periods of sustained high interest rates have historically discouraged customers from borrowing and have resulted in increased defaults in outstanding loans and deterioration in the quality of assets.

We are subject to concentration of default risks in our loan portfolio. Problems with one or more of our largest borrowers may adversely affect our financial condition and results of operations.

As of and for the nine months ended September 30, 2019, the aggregate outstanding principal amount of our 25 largest credit exposures, on a consolidated basis, represented 6.94% of our loan portfolio. No single exposure represented more than 1.00% of the loan book and all of those loans were corporate loans. Problems with one or more of our largest borrowers could materially and adversely affect our results of operations and financial position.

The value of the collateral or guarantees securing the outstanding principal and interest balance of our loans may not be sufficient to cover such outstanding principal and interest. In addition, we may be unable to realize the full value of the collateral or guarantees securing the outstanding principal and interest balance of our loans.

Our loan collateral primarily includes real estate, assets pledged in financial leasing transactions and other assets that are located primarily in Colombia, Panama, El Salvador and Guatemala, the value of which may significantly fluctuate or decline due to factors beyond our control. Such factors include market factors, environmental risks (including natural disasters), macroeconomic factors and political events affecting the local economy. In addition, we may face difficulties in enforcing our rights as a secured creditor. Timing delays, procedural problems enforcing on collateral and laws, related judicial interpretations that are protective of debtors and local protectionism may make foreclosures on collateral and enforcement of judgments difficult. Any decline in the value of the collateral securing our loans, or inability to enforce on such collateral, may result in a reduction in the recovery from collateral realization and may have an adverse impact on our results of operations and financial condition.

We are subject to market risk.

We are directly and indirectly affected by changes in market conditions. Market risk, or the risk of losses in positions arising from movements in market prices, is inherent in the products and instruments associated with our operations, including loans, deposits, securities, bonds, long-term debt, short-term borrowings, proprietary trading in assets and liabilities and derivatives. Changes in market conditions that may affect our financial condition and results of operations include fluctuations in interest and currency exchange rates, securities prices and changes in the implied volatility of interest rates and foreign currency exchange rates, among others.

Our results of operations are sensitive to fluctuations in interest rates.

We hold a substantial portfolio of loans and debt instruments that have both fixed and floating interest rates. Therefore, changes in interest rates could adversely affect our net interest margins as well as the value of the debt instruments. Increases in interest rates may reduce the market value of our debt instruments, leading to smaller gains or larger losses on these investments. Sustained high interest rates have historically discouraged customers from borrowing and have resulted in increased delinquencies in outstanding loans and deterioration in the quality of assets. On the other hand, decreases in interest rates may cause margin compression and lower net interest income as we usually maintain more assets than liabilities at variable rates. Decreasing interest rates also may trigger loan prepayments, which could negatively affect our net interest income. Generally, in a declining interest rate environment, prepayment activity increases, reducing the weighted average maturity of our interest earning assets and adversely affecting our operating results. Prepayment risk also has a significant adverse impact on our earnings from our credit card and collateralized mortgage obligations, since prepayments could shorten the weighted average life of these portfolios, which may result in a mismatch in funding or in reinvestment of the prepayment proceeds at lower yields.

Our income from our proprietary trading activities is highly volatile.

We derive a portion of our profits from our proprietary trading activities. Income from this activity is highly volatile and depends on numerous factors beyond our control, such as the general market environment, overall market trading activity, interest rate levels, fluctuations in exchange rates and general market volatility. A significant decline in our trading income, or the incurrence of a trading loss, could adversely affect our results of operations and financial position.

We have significant exposure to sovereign risk, and especially Colombian risk, and our results could be adversely affected by decreases in the value of our sovereign debt instruments.

Our debt instruments portfolio is primarily composed of sovereign debt instruments, including securities issued or guaranteed by the Colombian Government, which exposes us to credit, market, and liquidity risk associated with sovereign debt. As of September 30, 2019, our total debt instruments represented 7.84% of our total assets, and 44.3% of these securities were issued or guaranteed by the Colombian Government. A significant decline in the value of the securities issued or guaranteed by the Colombian Government could adversely affect our debt investment portfolio and consequently our results of operations and financial position.

We are subject to market, operational and structural risks associated with our derivative transactions.

We enter into derivative transactions for hedging purposes on our own account and on behalf of and for the benefit of our customers. We are subject to market and operational risks associated with these transactions, including basis risk (the risk of loss associated with variations in the spread between the asset yield and the funding and/or hedge cost) and credit or default risk (the risk of insolvency or other inability of the counterparty to a particular transaction to perform its obligations thereunder). In addition, the market practice and documentation for derivative transactions is less developed in the jurisdictions where we operate as compared to other more economically developed countries, and the court systems in such jurisdictions have limited experience in dealing with issues related to derivative transactions. As a result, there are increased operating and structural risks associated with derivatives transactions in these jurisdictions.

In addition, the execution and performance of derivatives transactions depend on our ability to develop adequate control and administrative systems, and to hire and retain qualified personnel. Moreover, our ability to adequately monitor, analyze and report these derivative transactions depends, to a great extent, on our information technology systems. These factors may further increase the risks associated with these transactions and could materially and adversely affect our results of operations and financial position.

We are subject to operational risks and losses.

Our businesses are dependent on the ability to process a large number of transactions efficiently and accurately. Operational risks and losses can result from fraud, employee errors, technological failures and failure to properly document transactions or to obtain proper internal authorization, failure to comply with regulatory requirements, breaches of conduct of business rules, equipment failures, natural disasters or the failure of external systems. We have adopted procedures to prevent and manage each of the operational risks, but there can be no assurance that our procedures will be sufficient to prevent losses resulting from these risks.

In addition, our businesses are exposed to risk from potential non-compliance with policies, employee misconduct or negligence and fraud, which could result in criminal and/or regulatory sanctions and serious reputational or financial harm. In recent years, a number of financial institutions have suffered material losses due to the actions of employees and third parties. The precautions we take to prevent and detect employee and third-party misconduct may not always be effective.

Our businesses rely heavily on data collection, processing and storage systems, the failure of which could materially and adversely affect the effectiveness of our risk management, reputation and internal control system as well as our financial condition and results of operations.

All of our principal businesses are highly dependent on the ability to timely collect and process a large amount of financial and other information at our various branches across numerous markets, at a time when transaction processes have become increasingly complex with increasing volume. The proper functioning of financial control, accounting or other data collection and processing systems is critical to our businesses and to our ability to compete effectively. A partial or complete failure of any of these primary systems could materially and adversely affect our decision-making process, our risk management and internal control systems, the quality of our service, and our ability to respond on a timely basis to changing market conditions. If we cannot maintain an effective data collection and management system, our business operations, financial condition, reputation and results of operations could be materially and adversely affected. We are also dependent on information systems to operate our website, process transactions, respond to customer inquiries on a timely basis and maintain cost-efficient operations. We may experience operational problems with our information systems as a result of system failures, viruses, computer hackers or other causes. Any material disruption or slowdown of our systems could cause information, including data related to customer requests and other client information, to be lost, compromised, or to be delivered to our clients with delays or errors, which could reduce demand for our services and products, resulting in additional costs for us and potentially fines and penalties by regulators, which could materially and adversely affect our results of operations and financial position.

We are subject to cyber-security risk.

We are subject to cyber-security risk, which includes the unauthorized access to privileged information, technological assaults on our infrastructure with the aim of stealing information, committing fraud or interfering with regular service, and the interruption of our services to some of our clients or users due to the exploitation and materialization of these vulnerabilities. Cyber-security risks for financial institutions have significantly increased because of the proliferation of new technologies, the use of the Internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists and other external parties. Our business is highly dependent on the security and efficacy of our infrastructure, computer and data management systems, as well as those of third-party service providers on whom we are highly dependent, and others with whom we interact.

As cyber-security threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities or incidents. Despite efforts to ensure the integrity of our systems and implement controls, processes, policies and other protective measures, we may not be able to anticipate all security breaches, nor may we be able to implement guaranteed preventive measures against such security breaches. Cyber-security threats are rapidly evolving and we may not be able to anticipate or prevent all such attacks and could be held liable for any security breach or loss. Even the most advanced internal control environment may be vulnerable to compromise. Targeted social engineering attacks and "spear phishing" attacks are becoming more sophisticated and are extremely difficult to prevent. In such an attack, an attacker will attempt to fraudulently induce colleagues, customers or other users of our systems to disclose sensitive information to gain access to our data or that of our clients. Persistent attackers may succeed in penetrating defenses given enough resources, time, and motive. The techniques used by cyber criminals change frequently, may not be recognized until launched and may not be recognized until well after a breach has occurred. The risk of a security breach caused by a cyber-attack at a vendor or by unauthorized vendor access has also increased in recent years. Additionally, the existence of cyber-attacks or security breaches at third-party vendors with access to our data may not be disclosed to us in a timely manner.

Any failure by us to detect or prevent cyber-security risk in a timely manner could result in a negative impact on our results of operations and financial position, or in problems with information, including data related to customers being lost, compromised, or delivered to our clients with delays or errors. The public perception that a cyber-attack on our systems has been successful, whether or not this perception is correct, may damage our reputation with customers and third parties with whom it does business. Hacking of personal information and identity theft risks, in particular, could cause serious reputational harm. A successful penetration or circumvention of system security could cause to us serious negative consequences, including loss of customers and business opportunities, significant business disruption to our operations and business, misappropriation or destruction of our confidential information and/or that of our customers, or damage to us or our customers’ and/or third parties’ computers or systems, and could result in a violation of applicable privacy laws and other laws, litigation exposure, regulatory fines, penalties or intervention, loss of confidence in our security measures, reputational damage, reimbursement or other compensatory costs.

Failures related to our information technology infrastructure and management information systems could adversely affect our competitiveness, reputation, financial condition and results of operations.

In the past, we faced technological failures that negatively affected our products and services availability in general, and in particular, our digital channel (including multiple offline periods). To mitigate potential failures and prevent future threats, we are implementing technological updates, controls and measures, such as enabling alternative channels to guarantee the clients’ uninterrupted access to our services. The improvements and continuity strategies we have implemented have resulted in greater stability of our products and services and, as a consequence, in better customer service.

We recognize the importance of having a business continuity management system and accordingly give high priority to the design of contingency plans to avoid service interruption risks. Any failure to effectively improve or upgrade our information technology infrastructure and information management systems in a timely and cost-effective manner could materially and adversely affect our competitiveness, reputation, financial condition and results of operations.

The occurrence of natural disasters in the regions where we operate could impair our ability to conduct business effectively and could impact our results of operations.

We are exposed to the risk of natural disasters such as earthquakes, volcanic eruptions, tornadoes, tropical storms, floods, wind and hurricanes in the regions where it operates. Although we have implemented disaster recovery systems, in the event of a natural disaster, unanticipated problems with said systems could have a material adverse effect on our ability to conduct business in the affected region, particularly if those problems affect our computer-based data processing, transmission, storage and retrieval systems and destroy valuable data. In addition, if a significant number of our local employees and managers became unavailable due to a natural disaster, our ability to effectively conduct business could be severely compromised. In addition, we may face added credit risk if our clients located in the affected region are not able to make timely payment on outstanding loans or other obligations to us. A natural disaster or multiple catastrophic events could have a material adverse effect on our business and results of operations in the affected region.

Loss of key talent or our inability to attract and retain additional talent could affect our operations.

Our business involves operations spanning a variety of disciplines and demanding a board of directors, key management team and employee workforce that is knowledgeable and innovative in many areas necessary for our operations. Globalization and interconnection through disruptive technologies have resulted in changes in the labor market. Younger generations seek workplaces with creativity, flexibility and high remuneration, which could translate into an increasing key talent migration rate.

While we have been successful in attracting experienced, skilled professionals, the loss of any key member of our management team or the failure to attract and retain additional such employees, could affect our operations and slow the execution of our business strategy, including the development of new products.

Acquisitions and strategic alliances may not perform in accordance with expectations or may disrupt our operations and adversely affect our profitability.

An element of our business strategy is to identify and pursue growth-enhancing strategic opportunities. We may base assessments of potential acquisitions and alliances on assumptions with respect to operations, profitability and other matters that may subsequently prove to be incorrect, and any future acquisitions, investments and alliances may not produce the anticipated synergies or perform in accordance with our expectations which could adversely affect our operations and profitability. In particular, we hold a minority financial investment in an infrastructure project located in Colombia through a private equity fund. In recent years, the main shareholder of the project and the concession company have faced negative press related to irregular practices. If any of these situations result in sanctions or convictions, the company in which we indirectly hold a minority stake, which is the holder of a toll road concession, may suffer a reputational harm, which in turn may have an adverse impact on our results of operations and financial condition and the return on our investment.

Our concentration in and reliance on short-term deposits may increase our funding costs.

Our principal source of funds is short-term deposits, which on a consolidated basis represented 72.17% of total liabilities as of September 30, 2019 compared to 73.47% as of December 31, 2018. Because we rely primarily on short-term deposits for our funding, in the event of a sudden or unexpected shortage of funds in the banking systems and money markets where we operate, we may not be able to maintain our current level of funding without incurring higher costs or selling assets at prices below their prevailing market value.

We face risks relating to compliance with regulatory compliance rules in general, and in particular with respect to laws relating to anti-competitive practices, consumer protection and protection of personal data.

We are subject to laws and regulations related to anti-competitive practices, including the formation of cartels and the abuse of our dominant position. Violation of these laws and regulations may result in significant administrative sanctions imposed by the Superintendency of Industry and Commerce.

We have created a special unit responsible for overseeing and ensuring regulatory compliance in general and, in particular, compliance with regulations related to anti-competitive practices, personal data protection and consumer protection.

Moreover, to ensure compliance with regulations regarding the use and protection of personal data, we are currently developing a comprehensive data protection program.

We may not be able to prevent all risks associated with regulatory compliance or detect all instances of non-compliance with the regulations described above. Any failure by us to detect and prevent the aforementioned practices in a timely manner could damage our reputation and facing substantial fines and penalties which could adversely affect our results of operations and financial position.

Our policies and procedures may not be able to detect money laundering, corruption and other illegal or improper activities fully or on a timely basis, which could damage our reputation and expose us to fines and other liabilities.

We are required to comply with applicable anti-money laundering, anti-terrorism laws and other regulations. These laws and regulations require us, among other things, to adopt and enforce “know your customer” policies and procedures and to report suspicious and large transactions to the applicable regulatory authorities. While we have adopted policies and procedures aimed at detecting and preventing the use of our banking network for money laundering activities and by terrorists and terrorist-related organizations and individuals generally, as the methods used by money launderers evolve and become increasingly sophisticated, such policies and procedures may not completely eliminate the risk that we may be used by other parties to engage in money laundering, corruption and other illegal or improper activities.

We are subject to laws and regulations relating to corrupt and illegal payments to public and private officials in the jurisdictions in which we operate, including the U.S. Foreign Corrupt Practices Act and Colombian regulations on transnational bribery. We have an anti-corruption program, which incorporates, among others, an anti-corruption policy, training, reporting channels, monitoring, internal investigations and sanctions. Such system does not completely eliminate the risk that our employees, providers, clients or agents may engage in corrupt practices.

If we fail to fully comply with applicable laws and regulations, we may face fines, penalties or other liabilities, including restrictions on our ability to conduct business. In addition, our business and reputation could suffer if we are not able to prevent and detect money laundering, corruption or other illegal practices.

We are subject to increasing competition, which may adversely affect our results of operations.

We operate in a highly competitive environment and management expects competition to increase in the jurisdictions where we operate. Intensified merger activity in the financial services industry has produced larger, better capitalized and more geographically diverse firms that are capable of offering a wider array of financial products and services at more competitive prices. Also, the emergence of new financial technologies, unregulated financial intermediaries (known as “shadow banking”) and the recent enactment of regulations aimed at enabling non-Colombian residents (other than individuals) to offer loans in COP, may increase competition for us. Our ability to maintain our competitive position depends mainly on our ability to fulfill new customers’ needs through the development of new products and services, our ability to offer adequate services and strengthen our customer base through cross-selling and our ability to bring in and retain human talent. Our business will be adversely affected if we are not able to maintain efficient service strategies. In addition, our efforts to offer new services and products may not succeed if product or market opportunities develop more slowly than expected or if the profitability of opportunities is undermined by competitive pressures. 

Downgrades in our credit ratings or those of our subsidiaries would increase our cost of borrowing funds and make our ability to raise new funds, attract deposits or renew maturing debt more difficult.

Our credit ratings and those of our subsidiaries’ are an important component of the liquidity profile of each entity, and our ability to successfully compete depends on various factors, including our financial stability as reflected by our credit ratings. A downgrade in any of these credit ratings would increase our cost of raising funds from other banks or in the capital markets. Purchases by institutional investors of our debt securities and those of our subsidiaries could be reduced if we suffer a decline in our credit ratings. Our ability to renew our maturing debt of that of our subsidiaries could become restricted and the terms for such renewal more expensive if our credit ratings were to decline. We and our subsidiaries’ counterparties in derivative transactions are sensitive to the risk of a credit rating downgrade, as well. A downgrade in our credit rating or those of our subsidiaries may adversely affect perception of our financial stability and their ability to raise deposits, which could make each entity less successful when competing for deposits and loans in the market place.

The Central Bank may impose requirements on our (and other Colombian residents) ability to obtain loans in foreign currency.

The Central Bank may impose certain mandatory deposit requirements in connection with foreign currency denominated loans obtained by Colombian residents, including us, although no such mandatory deposit requirement is currently in effect. We cannot predict or control future actions by the Central Bank in respect of deposit requirements, which may involve the establishment of a mandatory deposit percentage, and the use of such measures by the Central Bank may raise our cost of raising funds and reduce our financial flexibility.

Discontinuation of the London InterBank Offered Rate (“LIBOR”), and the regulation and implementation of a replacement benchmark rate could adversely affect our business, financial condition and result of operations.

In 2017, the U.K. Financial Conduct Authority announced that it would no longer persuade or require banks to submit rates for the calculation of the Libor benchmark after 2021. This announcement has resulted in uncertainty about the future of Libor which is used as interest rate benchmark. These actions and uncertainties may trigger future changes in the rules or methodologies used to calculate benchmarks or lead to the discontinuation or unavailability of benchmarks.

Bancolombia holds exposures to assets and liabilities linked to Libor. As of September 30, 2019, Bancolombia’s Libor-linked liabilities amounted to 4.75% of its total liabilities.

Any failure by market participants, such as Bancolombia, and regulators to successfully introduce benchmark rates to replace Libor and implement effective transitional arrangements to address the discontinuation of Libor could result in disruption in the financial and capital markets. In addition, the transition process to an alternative reference rate could impact our business, financial condition or result of operations, as a result of:

RISKS RELATING TO THE NOTES

It may be difficult to enforce your rights if we enter into a bankruptcy, liquidation or similar proceeding in Colombia.

The insolvency laws of Colombia, particularly as they relate to the priority of creditors (secured or unsecured), the ability to obtain post-petition interest and the duration of insolvency proceedings, may be less favorable to your interests than the bankruptcy laws of the United States. As a result, your ability to recover payments due on the Notes may be more limited than would be the case under U.S. bankruptcy law. The following is a brief description of certain aspects of insolvency laws in Colombia.

Your ability to enforce your rights under the Notes may be limited if we become subject to the proceedings set forth in Decree 663 of 1993 and Decree 2555 of 2010, as amended from time to time, which establish the events under which the SFC may initiate a Taking of Possession (toma de posesión) proceeding either to administer us or to liquidate us.

Under Colombian banking laws, the SFC can take control of financial institutions under certain circumstances. The following grounds for takeover are considered to be “automatic” in the sense that, if the SFC discovers their existence, the SFC is obligated to step in and take over the respective financial institution: (i) if the financial institution’s Technical Capital falls below 40% of the legal minimum or (ii) the expiration of the term of any then current recovery plans or the non-fulfillment of the goals set forth in such plans. Additionally, the SFC also conducts periodic visits to financial institutions and, as a consequence of these visits, the SFC can impose capital or solvency obligations on financial institutions without taking control of the financial institution. 

Additionally, and subject to the approval of the Ministry of Finance, the SFC may, at its discretion, initiate intervention procedures under the following circumstances: (i) suspension of payments; (ii) failure to pay deposits; (iii) refusal to submit its files, accounts and supporting documentation for inspection by the SFC; (iv) repeated failure to comply with orders and instructions from the SFC; (v) repeated violations of applicable laws and regulations or of the bank’s by-laws; (vi) unauthorized or fraudulent management of the bank’s business; (vii) reduction of the bank’s net worth below 50% of its subscribed capital; (viii) failure to comply with minimum capital requirements set forth in the Colombian Financial Statute; (ix) failure to comply with the recovery plans that were adopted by the bank; (x) failure to comply with the order of exclusion of certain assets and liabilities to another institution designated by the SFC; and (xi) failure to comply with the order of progressive unwinding (desmonte progresivo) of the operations of the bank.

A takeover by the SFC may have one of two different purposes: (i) to manage the financial institution, in which case the financial institution will be allowed to continue its activities subject to the administration of the authorities; or (ii) to liquidate the financial institution. The SFC must decide if it will either manage or liquidate the financial institution within two months following the takeover in the event of a bankruptcy, liquidation or similar proceeding.

In view of the broad discretionary powers of the SFC it is impossible to predict how long payments under the Notes could be delayed and whether or to what extent you would be compensated for any delay if any of the actions described above were to be taken with respect to us.

The obligations under the Notes will be subordinated to statutory preferences.

Under Colombian law, the obligations under the Notes are subordinated, among others, to specified statutory priorities, including, for example, client’s deposits, salaries, wages, social security, taxes, court fees and expenses and suppliers necessary for the rendering of services. In the event of our liquidation, these obligations will have priority over any other claims, including claims by any holder in respect of the Notes and, as a result, holders of Notes may be unable to fully recover amounts due under the Notes.

Because we are located in an emerging market country, any market for the Notes may be adversely affected by economic and market conditions in other emerging market economies.

Colombia is generally considered by investors to be an “emerging market country,” and securities of Colombian issuers have been, to varying degrees, influenced by economic and market conditions in other emerging market countries. Although economic conditions are different in each country, investors’ reactions to developments in one country may materially affect the prices of securities of issuers in other countries, including Colombia. Events elsewhere that are unrelated to our financial performance, especially in other emerging market countries, could adversely affect any market for the Notes that may develop.

An active trading market may not develop for the Notes.

Prior to this offering, there was no market for the Notes. Although we will apply to list the Notes on the NYSE, there is no guarantee that we will be able to list the Notes. Even if the Notes are listed, there may be a limited secondary market or none at all for the Notes. Even if a secondary market for the Notes develops, it may not provide significant liquidity, and we expect transaction costs would be high.

The underwriters have informed us that they intend to make a market in the Notes after this offering is completed. The underwriters, however, may cease their market-making at any time without notice. The price at which the Notes may trade will depend on many factors, including, but not limited to, prevailing interest rates, general economic conditions, our performance and financial results and markets for similar securities. Historically, the markets for debt such as the Notes have been subject to disruptions that have caused substantial volatility in their prices. The market, if any, for the Notes may be subject to similar disruptions, which may have an adverse effect on the holders of the Notes.

There are no restrictive covenants in the indenture for the Notes limiting our ability to incur future indebtedness or complete other transactions that are adverse to the interests of holders of the Notes.

The indenture governing the Notes does not contain any financial or operating covenants or restrictions on the payment of dividends, the incurrence of indebtedness, change of control, transactions with affiliates, incurrence of liens or the issuance or repurchase of securities by us or any of our subsidiaries. We therefore may incur additional indebtedness, including senior indebtedness, and engage in other transactions that may not be in the interests of the noteholders.

The ratings of the Notes may be lowered or withdrawn depending on various factors, including the rating agency’s assessments of our financial strength and Colombian sovereign risk.

One or more independent credit rating agencies may assign credit ratings to the Notes. The ratings address the timely payment of principal and interest on each payment date. The ratings of the Notes are not a recommendation to purchase, hold or sell the Notes, and the ratings do not comment on market price or suitability for a particular investor. The ratings of the Notes are subject to change and may be lowered or withdrawn. A downgrade in or withdrawal of the ratings of the Notes will not be an Event of Default under the indenture. The assigned ratings may be raised or lowered depending, among other things, on the rating agency’s assessment of our financial strength, as well as its assessment of Colombian sovereign risk generally.