Colombia (CO)

Operational Resilience & Critical Infrastructure

Colombia's operational-resilience and data-sharing regime is now anchored by a mandatory open-finance system. Decreto 0368 de 2026 was signed on 7 April 2026 by the Ministry of Finance, amending Decreto 2555 de 2010 pursuant to Art. 89 of Ley 2294 de 2023, and establishes the mandatory Sistema de Finanzas Abiertas (SFA) using automatic API data-exchange protocols, superseding the voluntary Decreto 1297 de 2022 scheme. Obligated entities have 12 months, extendable by 6, from each SFC standard to enable data access. This forces API-based interchange, strong authentication and resilient infrastructure on supervised entities, opening data-driven product competition.

The technical-resilience layer beneath the SFA decree is SFC Circular Externa 004 de 2024, which defined technical standards for architecture, security and technology, requiring purpose-built communications infrastructure ensuring full traceability and resilience under failure and peak-demand scenarios, with dual binding consent under arts. 2.35.8.3.2 and 2.35.8.3.3 of Decreto 2555.

Outlook

The regime is escalating: implementation runs through phased SFC technical-standard deadlines, with obligated entities holding 12-month (extendable 6) enablement windows per standard, pushing live data-access obligations into 2027. There is no DORA-equivalent overarching resilience statute; the resilience standards are embedded in the open-finance circular framework.

Payment Corridor Dynamics

Domestic corridor dynamics are now anchored by a live instant rail. Bre-B (SPBVI), Colombia's central-bank-led interoperable instant payments system, came into operation on 6 October 2025; its legal basis is Art. 104 of Ley 2294 de 2023, governed via the CIPI committee with the DICE alias directory and the MOL settlement mechanism, with Resolucion Externa 6 de 2023 and Circular Reglamentaria Externa DSP-465 providing the technical basis. A Pix/UPI-style fee-free instant rail reshapes domestic corridor economics and merchant electronic acceptance in a roughly 79%-cash market.

Cross-border corridors remain tightly controlled. Every cross-border payment must run through an authorised intermediary in the Formal Exchange Market (FEM) and be registered on Banco de la Republica's SIC platform, generating a Declaracion de Cambio; the export-FX repatriation deadline has been reduced from 60 to 30 days, and operating without permissions exposes firms to fines up to 200% of transaction value.

Outlook

The domestic corridor is opening rapidly via Bre-B, while the cross-border FEM corridor remains stable and tightly controlled. An emerging nCOP stablecoin remittance corridor is a watch item but operates against the FX-control backdrop. The asymmetry between an opening domestic rail and a controlled cross-border regime is the defining corridor tension.

Legal & Litigation

The most material live legal matter in the market is the SIC investigation against Visa and Mastercard. The SIC imposed precautionary measures in 2022 and formulated a pliego de cargos in 2023 against six Visa and Mastercard entities over conduct allegedly obstructing payment aggregators and the Local Collection Agent (LCA) cross-border model, citing breach of the general prohibition of Ley 155 de 1959 (Art. 1) and Art. 47.10 of Decreto 2153 de 1992, and ordered that the LCA model not be restricted. A live regulator action protecting aggregators and LCA cross-border models directly affects scheme conduct and merchant-acquiring market access, and represents a scheme-conduct precedent for LatAm payment-aggregation access.

Outlook

The matter is escalating and is the most material legal exposure in the market. Its resolution will set scheme-conduct precedent for payment-aggregation access across the region; the trajectory remains live with no final outcome evidenced this cycle.

Commercial Intelligence (M&A, Investment & Product)

Three discrete commercial events anchor the trailing-12-month commercial-intelligence baseline. On investment, Bold raised a US$50m Series C led by General Atlantic, with participation from InQLab, Amador and IFC, building on its US$55m Series B of February 2022; the raise was pending SFC approval and Bold had around 150,000 active merchant customers. Capital into a neo-acquirer accelerates disruption of the Redeban/Credibanco duopoly.

On market expansion, MOVii entered Peru to operate as a neo-acquirer in its first international expansion, as part of a strategy to become a key LatAm digital-payments player with Chile and Mexico next; the deal value is not publicly disclosed. This first Colombian neo-acquirer LatAm expansion signals regional scaling of the neo-acquiring model.

On product release, Cobre launched real-time B2B payments in Colombia, becoming the first to enable real-time B2B payments in the market, including over Bre-B; no transaction value is applicable. This builds commercial use cases on top of Bre-B infrastructure.

Outlook

The commercial pipeline is active, with neo-acquirer funding and regional expansion the dominant threads. Funding figures and the MOVii Peru deal value rely on single Tier-3 sources without disclosed terms; post-money valuations and exact close dates are not fully confirmed and remain under-indexed.

Licensing, Authorisation & Market Access

Colombia operates a dual-supervisor architecture rather than a standalone fintech law. The Superintendencia Financiera de Colombia (SFC) is the frontline licensing authority for financial, insurance and securities institutions, including SEDPE non-bank e-money licensing; the URF (MinHacienda) prepares regulation and Banco de la Republica is the monetary and FX authority under Constitution arts. 371-373. The bank-PSP route runs through the universal banking licence, while the non-bank PI/EMI route is anchored by the SEDPE (Sociedad Especializada en Depositos y Pagos Electronicos) licence, the dedicated non-bank financial-inclusion e-money licence supervised by the SFC. The absence of a consolidated fintech statute means entrants must navigate dispersed dispositions to establish market access.

The acquiring layer was restructured by Decreto 1692 de 2020, which amended Decreto 2555 de 2010, removed the EASPBV minimum-capital requirement, separated acquiring and issuing from clearing-and-settlement, and created a Registro de Adquirente no Vigilados permitting non-SFC-supervised acquiring. This opened acquiring to non-supervised neo-acquirers such as MOVii and Bold, reshaping merchant economics in a historically Redeban/Credibanco-concentrated market. The bank versus non-bank distinction is therefore explicit at the market-access layer: supervised banks and licensed SEDPEs sit inside the SFC perimeter, while non-supervised acquirers operate through the dedicated register subject to solvency and capital requirements.

Outlook

The licensing architecture is established and stable, but the practical access frontier is being reshaped by the acquiring opening rather than by new licence categories. Continued non-supervised acquirer entry under Decreto 1692 is the principal market-access dynamic to monitor.

Conduct, Safeguarding & Financial Promotions

The financial-consumer conduct regime is anchored by Ley 1328 de 2009, which establishes the financial-consumer protection regime. Art. 13 requires most SFC-supervised entities to maintain an independent Defensor del Consumidor Financiero handling complaints, conciliation and recommendations, operationalised via SFC circulars CE 015/2010 (SAC), CE 016/2010 and CE 029/2014. This sets a per-entity consumer-redress obligation that any licensed payments provider, whether a bank-PSP or a non-bank PI/EMI, must staff and fund.

The onboarding-conduct baseline is set by SFC Circular Externa 027 de 2020 (SARLAFT 4.0), a risk-based customer-knowledge and KYC onboarding standard for SFC-supervised entities, including digital identity per FATF guidance, with provisions effective from 1 March 2022 following a 12-month implementation window from publication. The conduct and onboarding lens is carried here; the AML risk-system dimension of SARLAFT is carried separately under W11 via the Sentinel feed.

Outlook

The conduct framework is stable, with the Defensor regime and SARLAFT 4.0 onboarding baseline establishing settled per-entity obligations. No live safeguarding or promotions reform is evidenced this cycle; the area is monitored.

Stablecoins & Digital Money

As of mid-2026 Colombia has no comprehensive in-force crypto or stablecoin framework. Crypto-assets remain unregulated and are treated as intangible digital assets, not legal tender, currency or securities, a position maintained by the SFC and Banco de la Republica. SEDPE e-money deposits are the in-force regulated digital-money product. Peso stablecoins, including Wenia COPW, Minteo COPM and Num Finance nCOP, are launching into this legal vacuum, creating regulatory-arbitrage and reserve-integrity questions for payments operators. The stablecoin-as-payment-instrument dimension is in WPM scope, while illicit-finance use routes to FIM.

The principal forward item is the Proyecto de Ley 510 de 2024/2025 (PSAV bill), which is proposed and not enacted. It would regulate Virtual Asset Service Providers (PSAV) across 19 articles spanning supervision, consumer protection, AML/CFT and financial education, with the SFC supervising specialised entities, DIAN registration, an SFC-supervised sandbox, and Banco de la Republica leading on stablecoins under a 'same activity, same risk, same regulation' principle. It has passed first debate. If enacted, it would be Colombia's first VASP and stablecoin framework, materially altering market-access conditions for crypto-payment providers.

Outlook

The trajectory is advancing but uncertain. The PSAV bill has cleared only first debate, and the precise legislative status, alongside a flagged attribution conflict around Decreto 1297 de 2023, is not confirmed against a Tier-1 Congress source. Enactment is assessed for 2026-H2 with year-level uncertainty; until then the legal vacuum persists for launching peso stablecoins.

Scheme & Network Compliance

Scheme-level compliance in Colombia is defined by a historically concentrated card-acceptance structure and a landmark interchange finding. The Colombian Interbank Interchange Fee (IIF) case established that Redeban Multicolor S.A. and the banks on the Visa/MasterCard IIF committees jointly fixed the interchange fee, and the SIC found this anti-competitive on the basis that such fees must be regulated by the competent authority. Interchange-setting governance therefore affects acquirer and merchant economics across the Redeban/Credibanco duopoly.

The acquiring and processing market is concentrated around Redeban and Credibanco, a historically concentrated duopoly now being disrupted by neo-acquirers. The SFC issued a 2023 circular developing Decreto 1692 on EASPBV board composition, connected activities, non-supervised participants and consumer-protection and disclosure duties, shaping how both bank and non-bank participants engage scheme infrastructure.

Outlook

The module is stable in structure but carries an evidence gap: whether and how the competent authority has set the IIF following the SIC finding is not evidenced this cycle. The broader live SIC action against Visa and Mastercard is tracked under W7. Monitored.

Industry Structure & Commercial Dynamics

Colombia hosts the third-largest fintech ecosystem in LatAm, with 300-380+ active fintech startups and around 18% annual growth. Neobanking is led by Nequi (24m+ users, Bancolombia origin, independent since 2022), DaviPlata (~19m, Davivienda), MOVii and Nubank Colombia (~3.4m). Financial penetration rose from 67.2% in 2012 to 92.3% in 2022, with around 20m people still excluded or under-included. This structural landscape is distinct from the discrete commercial events carried under W13 and maps the competitive structure into which new acquirers and international entrants such as Uala and Revolut are scaling.

This is a non-bank PI/EMI-led competitive surface: the leading neobanking players operate outside the traditional bank perimeter even where bank-origin (Nequi, DaviPlata), while card-acquiring incumbents Redeban and Credibanco anchor the bank-aligned infrastructure.

Outlook

The industry structure is stable but competitively active, with substantial residual under-inclusion providing the growth runway. International entrants scaling into the neobanking and acquiring layers are the principal structural watch items; specific deals are tracked under W13.

Merchant Acquiring & Risk

Merchant acquiring was opened by Decreto 1692 de 2020, which created a Registro de Adquirente no Vigilados allowing non-SFC-supervised actors to perform acquiring subject to solvency and capital requirements, or to act as payment-service providers if those are unmet. Cash remains roughly 78-79% of transactions, shaping high merchant onboarding and risk profiles. MOVii has processed about 60% of Colombian e-commerce in three years via neo-acquiring. The non-supervised acquiring register plus the high-cash baseline together define the merchant-onboarding economics that neo-acquirers are exploiting.

The bank versus non-bank distinction is sharp here: supervised banks acquire inside the SFC perimeter, while non-supervised neo-acquirers operate through the dedicated register, with the solvency threshold determining whether an entrant acquires directly or operates as a payment-service provider.

Outlook

The module is established. The neo-acquiring disruption enabled by the non-supervised register is the live dynamic, with the high-cash baseline still providing substantial conversion headroom for electronic acceptance.

Product Innovation & Market Development

Product innovation is dominated by rapid Bre-B uptake. As of 29 September 2025, more than 31 million people and businesses had registered an average of 2.5 keys, exceeding 76 million keys in total, with around 1.7 million corporate merchants enabled. The user fee-free scheme is maintained until at least 2029. Cobre became the first to enable B2B payments over Bre-B, and the rail interoperates Transfiya, Entrecuentas and Visionamos as connecting nodes. This adoption velocity signals a structural shift in retail and B2B payment flows away from cards and cash. This thematic product-development lens is distinct from the rail itself, which is carried under W5, and from discrete product-launch events under W13.

Outlook

Adoption is escalating, with the fee-free guarantee through 2029 underpinning continued migration. The build-out of B2B and value-added use cases over the open instant rail is the principal innovation frontier; the open-finance regime under W3 will further enable data-driven products.

Consumer Protection & APP Fraud

Consumer protection in payments runs through Ley 1328 de 2009, the SFC's SAC, per-entity Defensores and the jurisdictional Accion de Proteccion al Consumidor Financiero (maximum one year, extendable six months). Critically, there is no dedicated mandatory APP-fraud reimbursement regime equivalent to the UK PSR model. The SFC launched 'Protegete de los fraudes' on 11 June 2026, an education and disclosure approach. The absence of mandatory reimbursement shifts instant-payment fraud loss allocation onto consumers and firms, a divergence from Anglosphere norms, even as instant-settlement fraud on Bre-B is a recognised emerging concern.

Outlook

The regime is stable but the forward trajectory is uncertain: there is no evidence this cycle on whether instant-settlement fraud on Bre-B has prompted any proposed reimbursement or liability-allocation rule. As instant settlement scales, the loss-allocation gap relative to the Anglosphere is the key watch item.

AML/CFT & Financial Crime

This module is sourced from the Sentinel feed and is carried as provenance only; original illicit-finance analysis routes to FIM. As reported via Sentinel, Colombia's AML/CFT payments posture rests on SARLAFT 4.0 (SFC CE 027/2020) for SFC-supervised entities and SAGRILAFT (Supersociedades CE 100-000016/2020) for the real sector including certain VASPs. The UIAF (Ley 526/1999, Decreto 1497/2014) is the FIU receiving ROS, with crypto transactions over USD 150 reportable. Colombia is a GAFILAT member, is not on FATF strategic-deficiency lists, and is rated Compliant for 14 and Largely Compliant for 16 of the FATF 40 Recommendations. Source: Sentinel feed (sentinel.gi), UIAF Circular Externa 027 de 2020.

Outlook

The AML/CFT surface is stable. WPM carries this as a cross-reference to FIM, which owns money-laundering-typology, sanctions and illicit-finance analysis; the W2 crypto-reporting threshold and W5 cross-border corridors are the connected surfaces flagged to FIM.

Correspondent Banking, Settlement & Access

The analytical spine of this module is the bank versus non-bank settlement-access asymmetry. Banco de la Republica operates core settlement and access, providing deposit and settlement of securities, deposit-account systems, electronic funds transfers, interbank clearing and intraday liquidity to authorised financial institutions. Cross-border settlement runs only through FEM authorised intermediaries, mostly supervised banks and licensed fintechs, with daily compensation-account tracking, while Bre-B's MOL provides domestic 24/7 settlement. FATF Recommendation 13 on cross-border correspondent banking has been re-rated compliant.

Non-bank PSP access to settlement is therefore gated through authorised intermediaries: settlement access mediated by these intermediaries shapes which non-bank PSPs can clear cross-border flows, and de-risking pressure on remittance and smaller players is noted as a cross-border risk.

Outlook

The settlement architecture is stable. De-risking pressure on Colombian remittance and correspondent relationships is asserted as a recognised risk but is not evidenced with specific corridor or counterparty data this cycle, leaving it an under-indexed watch item.