--- title: "Colombia Payments Regulation Monitor | World Payments Monitor" canonical: https://payments.gi/jurisdictions/colombia/ source_html: /jurisdictions/colombia/index.html description: "Colombia payments and e-money regulation: 14 modules, 60 sourced findings, updated 2026-10-26. Licensing, safeguarding, stablecoins, AML/CFT." generated_at: 2026-10-26T19:20:26Z content_sha256: ebd80633ae01cb415de860319ef5838a0e2231616bfdb3e247a6958740cf963c generator: "fe-fleet/md-twin@1.0" --- # Colombia CO schema world-payments-v1 trajectory: not yet assessed Last updated 2026-10-26 · 14 modules · 60 sourced findings · 118 sources in the cumulative register Download report (PDF) Expand all 14 Modules 0 Moved this cycle 2 Key judgments 2 Open gaps 60 Findings 34 Tier-1 sources Confidence mix 14 unpopulated (sums to 14 rendered modules; click to filter) No modules moved this cycle. ## Jurisdiction brief Jurisdiction lead brief 934 Full executive summary 422 ###### Latest update · 25 October 2026 #### Lead Signal Colombia's instant-payments rail Bre-B, operated by Banco de la Republica, has surpassed 100 million registered keys and 34 million users as of early October 2026, with non-face-to-face channels now accounting for 85.5% of total financial-transaction volume as of the second quarter of 2026 according to the Superintendencia Financiera. This scale-up sits on top of Circular Reglamentaria Externa DSP-465, most recently updated on 6 March 2026 to add interoperability standards for low-value immediate payment systems and to strengthen continuity and transparency obligations around technological-incident notification. The current maximum transaction value permitted on Bre-B is 1,000 UVB per transaction, equivalent to COP 12,110 for 2026, a cap that industry body Colombia Fintech has publicly asked the government to lift, alongside a gradual phase-out of the 4x1000 financial-transactions tax, in a request reported on 17 September 2026. #### Other Developments Commercial activity in Colombia's fintech and crypto-adjacent sector continued. Kraken expanded its Colombia access with local-peso payment integration, though the exact date of this expansion could not be confirmed. Separately, Tether led a USD 3 million seed round in Plenti, a Medellin-based fintech, with the announcement date likewise unconfirmed. #### Cross-Monitor Connections The scale and transaction-value cap on Bre-B, and Colombia Fintech's public request to lift that cap, carry a financial-integrity dimension worth noting for readers tracking anti-money-laundering and counter-terrorist-financing considerations, since any change to transaction-value limits on an instant-payments rail handling tens of millions of users touches the kind of threshold question that AML/CFT frameworks typically monitor. The crypto-adjacent commercial events, Kraken's local-currency integration and Tether's investment in Plenti, also intersect with the digital-asset regulatory questions tracked on the crypto side, given both events involve established crypto-sector firms deepening their presence in the Colombian market. #### Outlook Whether the government responds to Colombia Fintech's request to lift the Bre-B transaction cap, and to phase out the 4x1000 tax, is the clearest policy question to watch following the 17 September 2026 request. The continued scale-up of Bre-B, now past 100 million registered keys, also raises the question of whether Circular DSP-465 will see further updates to its interoperability or incident-notification standards as transaction volume on the rail continues to grow. 5 earlier updates not shown here. ###### Standing brief · as of 6 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Colombia's Bre-B instant-payments scheme has moved from national launch to broad institutional uptake this cycle. Banco de la Republica reports that the scheme reached 218 participating entities and five fully interoperating SPBVIs by January 2026, four months after coming into full national operation on 6 October 2025. A sixth entrant, Gou Payments, is expected to join the interoperating group per that same January update, though the timing of its formal entry remains unconfirmed. This onboarding pace responds to a historically cash-heavy payments culture: as of 2023, 78.6% of Colombian adults preferred cash, a preference Banco de la Republica links to low prior electronic-payment interoperability. Read together, the participant count, the pending sixth entrant, and the cash-preference baseline against which Bre-B is measured indicate that Colombia's instant-payments rail has achieved rapid institutional uptake within four months of full launch, positioning it as a credible Pix/SPEI-equivalent rail and materially improving payment-system contestability against that historically cash-dominant baseline. This is this cycle's baseline capture of Colombia's instant-payments infrastructure for the World Payments Monitor. #### Other Developments The statutory foundation underpinning Bre-B's interoperability mandate traces to Article 104 of Law 2294 of 2023, Colombia's National Development Plan, which grants Banco de la Republica the power to regulate interoperability of instant retail-value payment systems, known as SPBVI. Both bank and non-bank payment institutions fall within this licensing and interoperability architecture, a bank-PSP versus non-bank-PI/EMI distinction that Colombia's regulatory design treats symmetrically for Bre-B participation and for its underlying statutory mandate. That statutory grant, together with the Superintendencia Financiera de Colombia's supervisory role over banks and other regulated payment entities, forms the architecture this cycle establishes as Colombia's baseline licensing and market-access position. Layered onto the Bre-B mandate, a 2026 regulatory update requires participant entities to promptly and clearly communicate technological incidents that interrupt instant payments or transfers to users, an operational-resilience and consumer-disclosure obligation now attaching to scheme participants. Separately, the Superintendencia Financiera de Colombia's Open Finance mandate is reported to extend data-sharing obligations to all SFC-supervised entities, broadening beyond Open Banking accounts and cards into insurance, pensions, investments and crowdfunding. That characterisation currently rests on a single T4 vendor source, and it signals a broadening supervisory data-sharing perimeter that nonbank PSPs and fintechs should track closely, though it awaits corroboration from a T1/T2 SFC circular. #### Cross-Monitor Connections No cross-monitor flags were raised this cycle. Bre-B's build-out and the SFC's Open Finance expansion sit inside the World Payments Monitor's own instant-payments and regulatory-conduct trackers rather than triggering a linkage to a sister monitor at this stage. Any illicit-finance use of Bre-B's rails would fall to a financial-crime monitor's remit rather than to a World Payments Monitor conclusion, and this brief draws no such conclusion. #### Outlook Watch for confirmation of Gou Payments' entry as Bre-B's sixth interoperating participant, and for further alias-adoption and participant-count updates from Banco de la Republica in coming cycles. On the regulatory side, corroboration of the SFC's Open Finance mandate scope from a T1/T2 source would resolve the confidence gap flagged this cycle, while the incident-communication requirement layered onto Bre-B participants bears watching for enforcement specifics as it beds in. No CO-specific development was found this cycle on merchant-acquiring/high-risk-MCC activity or on settlement-finality and safeguarded-funds-insolvency plumbing; both remain open coverage gaps for future cycles. Read full brief · 934 words ###### Latest update · 28 September 2026 #### Regulatory Status Colombia's payments landscape this cycle is dominated by the maturation of Bre-B, Banco de la República's interoperable instant-payments system. Bre-B reached full-scale interoperability on 6 October 2026, with more than 218 participating entities (26 banks, 153 cooperatives, 4 SEDPEs) as of January 2026, and is set to add two further scheme operators, Drixi and Gou Payments, during 2026. Banco de la República paired this scaling with updated regulatory measures on technological-failure disclosure and user notification. The scheme is progressing toward recurring/automatic debit use-cases for school fees, insurance, and subscriptions, contingent on finalised authorisation and cancellation standards. Separately, the Superintendencia Financiera de Colombia has signalled a 2026 fintech agenda including a crowdfunding-rule update and a new FX/TRM data-capture model, though this rests on thin sourcing. #### Outlook Watch for the onboarding of Drixi and Gou Payments as Bre-B scheme operators, the finalisation of recurring-debit authorisation standards, and formal publication of the SFC's fintech agenda items. 2 earlier updates not shown here. ###### Standing brief · as of 6 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Regulatory Status Colombia's payments regulatory architecture centres on Banco de la Republica and the Superintendencia Financiera de Colombia. Banco de la Republica's statutory mandate to regulate interoperability of instant retail-value payment systems, granted under Article 104 of Law 2294 of 2023, underpins Bre-B, the country's national instant-payments scheme. Bre-B came into full national operation on 6 October 2025 and by January 2026 had grown to 218 participating entities and five fully interoperating SPBVIs, with Gou Payments expected to join as a sixth. That growth addresses a historically cash-dominant payments culture, in which 78.6% of Colombian adults preferred cash as of 2023. A 2026 regulatory update additionally requires Bre-B participants to promptly and clearly communicate technological incidents that interrupt payments to users. Separately, the Superintendencia Financiera de Colombia's Open Finance mandate is reported to extend data-sharing obligations across all SFC-supervised entities, into insurance, pensions, investments and crowdfunding, though that characterisation currently rests on a single T4 vendor source pending T1/T2 corroboration. #### Outlook Colombia's trajectory this cycle is one of liberalising, improving regulatory direction: Bre-B's rapid institutional uptake and the SFC's expanding Open Finance mandate both point toward broader payment-system contestability and a wider supervisory data-sharing perimeter. Watch for confirmation of Gou Payments' entry, for T1/T2 corroboration of the Open Finance mandate's scope, and for further detail on Bre-B's incident-disclosure enforcement. No CO-specific development was found this cycle on merchant-acquiring/high-risk-MCC activity or settlement-finality/safeguarded-funds-insolvency plumbing. Read full brief · 422 words × 14 of 14 modules Signal Moved Judgment Gap Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### W1aLicensing, Authorisation & Market Access1 gapProbableconfirmed 2026-06-27▾# Colombia's payments regulatory architecture centers on Banco de la Republica (Bre-B interoperable instant-payments scheme under Law 2294/2023 Art.104 mandate) and the SFC (licensing/supervision of banks, EMIs/SEDPEs, and other entities under an expanding Open Finance mandate). Open gap — wpm-int-2 No EMI/PI licensing-regime delta or stablecoin/digital-money regime delta was found this cycle; both vectors were under-searched given the pooled budget. Private-company signals are a known under-index vector per methodology §11. Horizon · 2026-Q4 (± six months) Additional SPBVI operators (Drixi, Gou Payments) expected to join Bre-B Adopted, not yet in force · Tier 1 source Standing sub-brief · as of 6 August 2026 233 words · last cycle 2026-09-03 #### Licensing, Authorisation & Market Access Colombia's payments licensing and market-access architecture centres on Banco de la Republica and the Superintendencia Financiera de Colombia. Banco de la Republica's authority to regulate interoperability of instant retail-value payment systems, the SPBVI, derives from Article 104 of Law 2294 of 2023, Colombia's National Development Plan. This statutory grant is the basis for Bre-B's interoperability mandate and now forms this cycle's baseline capture of Colombia's W1a position. The architecture treats bank and non-bank payment institutions as falling within the same licensing and interoperability framework, carrying the bank-PSP versus non-bank-PI/EMI distinction through to Bre-B participation rather than segregating access by institution type. Separately, the Superintendencia Financiera de Colombia's Open Finance mandate is reported to extend data-sharing obligations across all SFC-supervised entities, broadening beyond Open Banking accounts and cards into insurance, pensions, investments and crowdfunding, a scope expansion that would sit within this same licensing and market-access domain. That broader characterisation currently rests on a single T4 vendor source pending corroboration from a T1/T2 SFC circular, and the exact enactment date of Law 2294 of 2023 has not been established from available sources this cycle. #### Outlook Watch for a T1/T2 SFC circular or Banco de la Republica publication that corroborates or narrows the reported Open Finance mandate scope, and for any dating clarification on Law 2294 of 2023's Article 104 provision. Both would firm up this cycle's baseline W1a capture. Read full sub-brief · 233 words Periodic update · new data 2026-09-21 #### Licensing, Authorisation & Market Access Market access to Colombia's Bre-B scheme continues to expand within the existing scheme-participation rules rather than through any new licensing statute. Two additional SPBVI operators, Drixi and Gou Payments, are expected to begin operating on Bre-B in 2026. Drixi is notable in that it is operated by Banco de la República itself, meaning the central bank that operates and regulates the scheme is also expanding its own direct participation footprint, alongside a commercial entrant in Gou Payments. This expansion sits atop a base of 218 participating entities recorded as of January 2026, of which five were, at that point, fully interoperating SPBVI operators. The bank-PSP versus non-bank-PI/EMI distinction is relevant here: Bre-B's scheme design already accommodates both bank and non-bank participant types, and the two incoming operators join a scheme architecture that was built for mixed bank/non-bank interoperability from the outset rather than one requiring a fresh statutory carve-out for non-bank entrants. No new market-access statute or licensing framework accompanies this expansion on the evidence available this cycle; the growth is scheme-level onboarding rather than regulatory-perimeter change. #### Outlook Watch for confirmation that Drixi and Gou Payments complete onboarding within the expected 2026 window, and for whether their entry further shifts the balance between bank and non-bank participation within the scheme. Any statutory change to the market-access framework itself, as distinct from scheme-level onboarding, would be a materially different development and has not been identified this cycle. 1 earlier distinct update(s) Periodic update · new data 2026-08-11 #### Licensing, Authorisation & Market Access Colombia's instant-payments interoperability framework rests on Article 104 of Law 2294 of 2023, the country's National Development Plan, which grants Banco de la Republica the statutory power to regulate interoperability among instant retail-value payment systems, domestically classified as SPBVI. This is a market-access-relevant detail: the authority governing interoperability sits inside a general economic-development statute rather than a dedicated payments-licensing act, meaning any future amendment to the interoperability mandate runs through the National Development Plan legislative vehicle. Operating under that mandate, Banco de la Republica has overseen Bre-B's transition from statutory design to full national operation, reaching 218 participating entities by January 2026 across five fully interoperating payment systems, with a sixth participant expected to join. The scale of participation — reaching well over two hundred entities within roughly a quarter of full operation — indicates that market access under the Bre-B interoperability framework has been broad rather than narrowly piloted, though the evidence available this cycle does not itemise the participant list by bank-PSP versus non-bank-PI/EMI status, a distinction that matters for assessing whether market access has been genuinely open to non-bank payment institutions and electronic-money issuers or has remained concentrated among traditional bank participants. Both claims underpinning this module's assessment carry content_tier classification as standing-brief material and are sourced to Banco de la Republica publications at source-tier one, the highest evidentiary tier in this cycle's register; the underlying claims are also coded bank_or_nonbank: both, indicating the statutory mandate and the interoperability scheme apply across bank and non-bank payment-service-provider populations rather than being confined to one class of institution. This is a national_federal regulatory-layer development, with Banco de la Republica as the central-bank authority exercising the mandate rather than a sub-national or scheme-level body. #### Outlook The market-access question to track is whether Banco de la Republica issues further interoperability regulation under its Article 104 mandate as Bre-B matures beyond its first full year of national operation, and whether future participant disclosures clarify the bank-versus-non-bank composition of the scheme's now more than two-hundred-strong participant base. Evidence 4 Sources and findings (4) - T3[https://resourcehub.bakermckenzie.com/en/resources/global-financial-services-regulatory-guide/latin-america/colombia/](https://resourcehub.bakermckenzie.com/en/resources/global-financial-services-regulatory-guide/latin-america/colombia/) - T3[https://www.fundacionmicrofinanzasbbva.org/revistaprogreso/en/financial-inclusion-electronic-payment-and-deposit-companies-sedpes/](https://www.fundacionmicrofinanzasbbva.org/revistaprogreso/en/financial-inclusion-electronic-payment-and-deposit-companies-sedpes/)retrieved 2026-06-27 - T1[https://www.funcionpublica.gov.co/eva/gestornormativo/norma.php?i=153787](https://www.funcionpublica.gov.co/eva/gestornormativo/norma.php?i=153787)retrieved 2026-06-27 - T3[https://iclg.com/practice-areas/fintech-laws-and-regulations/colombia/](https://iclg.com/practice-areas/fintech-laws-and-regulations/colombia/)retrieved 2026-06-27 ### W1bConduct, Safeguarding & PromotionsProbableconfirmed 2026-06-27▾# Financial-consumer conduct is governed primarily by Ley 1328 de 2009 (the financial consumer protection statute) and the SFC's Sistema de Atención al Consumidor Financiero (SAC), with each supervised entity required to have an independent Defensor del Consumidor Financiero. The SFC issues conduct circulars (e.g. CE 015 de 2010 on SAC, CE 029 de 2014 on the Defensoría) and operates jurisdictional functions to resolve contractual disputes. SARLAFT 4.0 (CE 027 de 2020) sets the KYC/onboarding conduct baseline for supervised entities. Standing sub-brief · as of 27 June 2026 175 words · last cycle 2026-09-03 #### Conduct, Safeguarding & Financial Promotions The financial-consumer conduct regime is anchored by Ley 1328 de 2009, which establishes the financial-consumer protection regime. Art. 13 requires most SFC-supervised entities to maintain an independent Defensor del Consumidor Financiero handling complaints, conciliation and recommendations, operationalised via SFC circulars CE 015/2010 (SAC), CE 016/2010 and CE 029/2014. This sets a per-entity consumer-redress obligation that any licensed payments provider, whether a bank-PSP or a non-bank PI/EMI, must staff and fund. The onboarding-conduct baseline is set by SFC Circular Externa 027 de 2020 (SARLAFT 4.0), a risk-based customer-knowledge and KYC onboarding standard for SFC-supervised entities, including digital identity per FATF guidance, with provisions effective from 1 March 2022 following a 12-month implementation window from publication. The conduct and onboarding lens is carried here; the AML risk-system dimension of SARLAFT is carried separately under W11 via the Sentinel feed. #### Outlook The conduct framework is stable, with the Defensor regime and SARLAFT 4.0 onboarding baseline establishing settled per-entity obligations. No live safeguarding or promotions reform is evidenced this cycle; the area is monitored. Read full sub-brief · 175 words Periodic update · new data 2026-09-21 #### Conduct, Safeguarding & Financial Promotions Banco de la República updated the Bre-B regulatory framework in 2026 to require financial institutions participating in the scheme to give clearer, more timely disclosure of the origin of technological failures, alongside stronger user-notification protocols when such failures occur. This is a conduct-tightening delta layered onto an already-live and rapidly scaling scheme, rather than a conduct rule introduced alongside the scheme's initial launch; the timing indicates a regulator responding to lived operating experience with an already-major payments rail rather than anticipating problems before launch. The requirement applies across both bank and non-bank participants in the scheme, consistent with Bre-B's mixed-participant architecture, and does not appear from the evidence available this cycle to differentiate obligations by participant type. The practical effect is that Bre-B participants must now be able to identify and communicate the origin of a technological failure with greater speed and clarity than previously required, and must notify affected users of such failures under a strengthened protocol. This tightening arrives at a moment of considerable scale: Bre-B had already processed more than 500 million transactions and registered over 100 million payment keys within roughly five months of full interoperability, meaning any given technological failure now has the potential to affect a very large transaction and user base, which plausibly explains the regulator's decision to strengthen disclosure and notification obligations at this point in the scheme's lifecycle rather than earlier. #### Outlook The test of this conduct-tightening will come with the next reported technological incident on the Bre-B rail: whether participants meet the new disclosure-origin and user-notification timelines under real operating conditions is not yet established. Continued scheme growth, including the expected 2026 entry of Drixi and Gou Payments, will further raise the stakes of any future incident-disclosure failure. Evidence 4 Sources and findings (4) - T1[https://www.superfinanciera.gov.co/preguntas-frecuentes/5/5-defensor-del-consumidor-financiero/](https://www.superfinanciera.gov.co/preguntas-frecuentes/5/5-defensor-del-consumidor-financiero/)retrieved 2026-06-27 - T1[https://x86.superfinanciera.gov.co/publicaciones/11222/defensor-del-consumidor-financiero/](https://x86.superfinanciera.gov.co/publicaciones/11222/defensor-del-consumidor-financiero/)retrieved 2026-06-27 - T1[https://www.uiaf.gov.co/sites/default/files/inline-images/2020_ce027_1.pdf](https://www.uiaf.gov.co/sites/default/files/inline-images/2020_ce027_1.pdf)retrieved 2026-06-27 - T3[https://www.findeter.gov.co/system/files/internas/Canales%20de%20atencio%CC%81n%20DCF%20%20FINDETER%2022012021.pdf](https://www.findeter.gov.co/system/files/internas/Canales%20de%20atencio%CC%81n%20DCF%20%20FINDETER%2022012021.pdf)retrieved 2026-06-27 ### W2Stablecoins & Digital MoneyProbableconfirmed 2026-06-27▾# As of mid-2026 Colombia has NO comprehensive in-force crypto/stablecoin law. SFC and Banco de la República have repeatedly stated crypto-assets are not legal tender, currency or securities; the SFC historically restricted supervised entities from holding/intermediating crypto (Circular 29 de 2014). A regulatory sandbox ('la Arenera') ran 2021-2024. A comprehensive draft bill (Proyecto de Ley 510 de 2024/2025, advanced in early debate) would regulate Virtual Asset Service Providers (PSAV), with the SFC supervising specialised entities, DIAN requiring registration, and Banco de la República leading on stablecoins given their monetary impact. CAUTION: this bill is PROPOSED, not enacted. SEDPE e-money deposits are the in-force regulated digital-money product. Horizon · 2026-H2 (± a year) Proyecto de Ley 510 de 2024/2025 — comprehensive VASP/stablecoin framework Consultation · Tier 3 source Standing sub-brief · as of 27 June 2026 236 words · last cycle 2026-06-27 #### Stablecoins & Digital Money As of mid-2026 Colombia has no comprehensive in-force crypto or stablecoin framework. Crypto-assets remain unregulated and are treated as intangible digital assets, not legal tender, currency or securities, a position maintained by the SFC and Banco de la Republica. SEDPE e-money deposits are the in-force regulated digital-money product. Peso stablecoins, including Wenia COPW, Minteo COPM and Num Finance nCOP, are launching into this legal vacuum, creating regulatory-arbitrage and reserve-integrity questions for payments operators. The stablecoin-as-payment-instrument dimension is in WPM scope, while illicit-finance use routes to FIM. The principal forward item is the Proyecto de Ley 510 de 2024/2025 (PSAV bill), which is proposed and not enacted. It would regulate Virtual Asset Service Providers (PSAV) across 19 articles spanning supervision, consumer protection, AML/CFT and financial education, with the SFC supervising specialised entities, DIAN registration, an SFC-supervised sandbox, and Banco de la Republica leading on stablecoins under a 'same activity, same risk, same regulation' principle. It has passed first debate. If enacted, it would be Colombia's first VASP and stablecoin framework, materially altering market-access conditions for crypto-payment providers. #### Outlook The trajectory is advancing but uncertain. The PSAV bill has cleared only first debate, and the precise legislative status, alongside a flagged attribution conflict around Decreto 1297 de 2023, is not confirmed against a Tier-1 Congress source. Enactment is assessed for 2026-H2 with year-level uncertainty; until then the legal vacuum persists for launching peso stablecoins. Read full sub-brief · 236 words no periodic updates on record for this sub-brief Evidence 5 Sources and findings (5) - T3[https://cms.law/en/int/expert-guides/cms-expert-guide-to-crypto-regulation/colombia](https://cms.law/en/int/expert-guides/cms-expert-guide-to-crypto-regulation/colombia)retrieved 2026-06-27 - T3[https://es.beincrypto.com/regulacion-criptomonedas-colombia-marco-legal-marzo-2026/](https://es.beincrypto.com/regulacion-criptomonedas-colombia-marco-legal-marzo-2026/)retrieved 2026-06-27 - T3[https://www.forvismazars.com/co/es/acerca-de-nosotros/noticias-publicaciones-y-media/nuestras-publicaciones/governace-compliance-and-risk-management/regulacion-de-criptomonedas](https://www.forvismazars.com/co/es/acerca-de-nosotros/noticias-publicaciones-y-media/nuestras-publicaciones/governace-compliance-and-risk-management/regulacion-de-criptomonedas)retrieved 2026-06-27 - T3[https://www.muralpay.com/blog/stablecoin-compliance-checklist-for-colombian-psps-uiaf-sfc-rules](https://www.muralpay.com/blog/stablecoin-compliance-checklist-for-colombian-psps-uiaf-sfc-rules)retrieved 2026-06-27 - T3[https://abogadoblockchain.com/regulacion-criptomonedas-colombia/](https://abogadoblockchain.com/regulacion-criptomonedas-colombia/)retrieved 2026-06-27 ### W3Operational Resilience & Critical InfraProbableconfirmed 2026-06-27▾# Colombia's operational-resilience/data-sharing regime is anchored by the mandatory Sistema de Finanzas Abiertas (Decreto 0368 de 2026, signed 7 Apr 2026, amending Decreto 2555/2010 per Art. 89 Ley 2294/2023), superseding the voluntary Decreto 1297/2022 scheme and building on SFC CE 004/2024 technical/resilience standards. API-based interchange, strong authentication, dual consent and resilient infrastructure are mandated; 12-month (extendable 6) enablement windows per SFC standard. Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. [Open this jurisdiction's page on Dataprotection.gi →](https://dataprotection.gi/jurisdictions/colombia/) Horizon · 2027 (± a year) Decreto 0368 de 2026 SFA — phased data-access enablement deadlines Adopted, not yet in force · Tier 1 source Horizon · 2027 (± a year) Decreto 0368 de 2026 SFA — phased data-access enablement deadlines Adopted, not yet in force · Tier 1 source Standing sub-brief · as of 6 August 2026 84 words · last cycle 2026-08-05 #### Consumer Protection & Operational Resilience A 2026 regulatory update to Bre-B requires participant entities to promptly and clearly communicate technological incidents that interrupt instant payments or transfers to users. The requirement layers an operational-resilience and consumer-disclosure obligation onto banks and non-bank participants alike within the Bre-B scheme, tracking the scheme's rapid growth in participants and transaction volumes with a corresponding expectation of incident transparency toward end users. #### Outlook Watch for enforcement specifics and any published incident-disclosure statistics as Bre-B's participant base continues to expand. Read full sub-brief · 84 words no periodic updates on record for this sub-brief Evidence 4 Sources and findings (4) - T3[https://www.bu.com.co/en/insights/noticias/colombia-launches-its-mandatory-open-finance-system](https://www.bu.com.co/en/insights/noticias/colombia-launches-its-mandatory-open-finance-system)retrieved 2026-06-27 - T1[https://www.urf.gov.co/w/colombia-consolida-el-sistema-de-finanzas-abiertas-obligatorio](https://www.urf.gov.co/w/colombia-consolida-el-sistema-de-finanzas-abiertas-obligatorio)retrieved 2026-06-27 - T3[https://latinia.com/en/resources/open-finance-colombia-mandatory-regulation-latin-america](https://latinia.com/en/resources/open-finance-colombia-mandatory-regulation-latin-america)retrieved 2026-06-27 - T3[https://www.hklaw.com/en/insights/publications/2024/12/proyecto-de-decreto-busca-modificar-el-ecosistema-de-pagos](https://www.hklaw.com/en/insights/publications/2024/12/proyecto-de-decreto-busca-modificar-el-ecosistema-de-pagos)retrieved 2026-06-27 ### W4Scheme & Network ComplianceProbableconfirmed 2026-06-27▾# Card-scheme compliance runs through Visa and Mastercard franchises plus the two domestic acquiring/processing networks Redeban and Credibanco, a historically concentrated duopoly. Interchange (the Interbank Interchange Fee / IIF) was historically set by Visa/MasterCard committees — conduct the SIC flagged as anti-competitive — and must be regulated by the competent authority. Decreto 1692 de 2020 restructured scheme participation, separating clearing/settlement from acquiring/issuing and admitting non-supervised acquirers. The SFC issued instructions (2023 circular developing Decreto 1692) on EASPBV board composition, connected activities and non-supervised participants. Standing sub-brief · as of 27 June 2026 174 words · last cycle 2026-06-27 #### Scheme & Network Compliance Scheme-level compliance in Colombia is defined by a historically concentrated card-acceptance structure and a landmark interchange finding. The Colombian Interbank Interchange Fee (IIF) case established that Redeban Multicolor S.A. and the banks on the Visa/MasterCard IIF committees jointly fixed the interchange fee, and the SIC found this anti-competitive on the basis that such fees must be regulated by the competent authority. Interchange-setting governance therefore affects acquirer and merchant economics across the Redeban/Credibanco duopoly. The acquiring and processing market is concentrated around Redeban and Credibanco, a historically concentrated duopoly now being disrupted by neo-acquirers. The SFC issued a 2023 circular developing Decreto 1692 on EASPBV board composition, connected activities, non-supervised participants and consumer-protection and disclosure duties, shaping how both bank and non-bank participants engage scheme infrastructure. #### Outlook The module is stable in structure but carries an evidence gap: whether and how the competent authority has set the IIF following the SIC finding is not evidenced this cycle. The broader live SIC action against Visa and Mastercard is tracked under W7. Monitored. Read full sub-brief · 174 words no periodic updates on record for this sub-brief Evidence 4 Sources and findings (4) - T1[https://one.oecd.org/document/DAF/COMP/LACF(2021)5/en/pdf](https://one.oecd.org/document/DAF/COMP/LACF(2021)5/en/pdf) Applies beyond this jurisdiction (OECD)retrieved 2026-06-27 - T3[https://www.akua.la/en/blog/conozca-a-los-actores-clave-en-la-industria-de-pagos-con-tarjetas-electronicas](https://www.akua.la/en/blog/conozca-a-los-actores-clave-en-la-industria-de-pagos-con-tarjetas-electronicas)retrieved 2026-06-27 - T2[https://www.garrigues.com/es_ES/noticia/superintendencia-financiera-colombia-impartio-instrucciones-relacionadas-sistemas-pago-valor](https://www.garrigues.com/es_ES/noticia/superintendencia-financiera-colombia-impartio-instrucciones-relacionadas-sistemas-pago-valor)retrieved 2026-06-27 - T1[https://www.funcionpublica.gov.co/eva/gestornormativo/norma_pdf.php?i=153787](https://www.funcionpublica.gov.co/eva/gestornormativo/norma_pdf.php?i=153787)retrieved 2026-06-27 ### W5Payment Corridor Dynamics1 judgmentProbableconfirmed 2026-06-27▾# Bre-B surpassed 100 million registered keys and 34 million users as of early October 2026; non-face-to-face channels now carry 85.5% of financial-transaction volume per Superfinanciera. Governing Circular DSP-465 was last updated 6 March 2026 to add SPBVI interoperability standards and strengthen incident-notification obligations. Key judgment — Probable · impact Bre-B has reached genuine national scale in its first year, with over a billion transactions and 116 million keys, positioning Colombia as a leading instant-payments market in the region. claims: none recorded Horizon · 2026-10-06 (± a quarter) Bre-B full-scale interoperability transition In force · Tier 1 source Standing sub-brief · as of 6 August 2026 200 words · last cycle 2026-10-25 #### Payment Corridor Dynamics / Emerging-Market Instant Payment Rails Bre-B, Banco de la Republica's interoperable instant-payments scheme, came into full national operation on 6 October 2025. By January 2026 it had 218 participating entities and five fully interoperating SPBVIs, with Gou Payments expected to join as a sixth entrant. The scheme is designed to function as a Pix/SPEI-equivalent rail, using registrable payment aliases to lower the friction of retail electronic payments. That design responds to a historically cash-dominant baseline: as of 2023, 78.6% of Colombian adults preferred cash, a preference Banco de la Republica attributes in part to low prior electronic-payment interoperability. Colombia's Bre-B has achieved rapid institutional uptake within four months of full launch, positioning it as a credible Pix/SPEI-equivalent rail and materially improving payment-system contestability against that historically cash-dominant baseline. A 2026 regulatory update also requires Bre-B participant entities to promptly and clearly communicate technological incidents that interrupt instant payments or transfers to users, layering an operational-resilience obligation onto the scheme's rapid expansion. #### Outlook Watch for confirmation of Gou Payments' formal entry as Bre-B's sixth interoperating participant, and for further BanRep updates on participant counts and alias adoption as the scheme matures beyond its first year of full operation. Read full sub-brief · 200 words Periodic update · new data 2026-10-25 #### Payment Corridor Dynamics Bre-B, the instant-payments rail operated by Banco de la Republica, has surpassed 100 million registered keys and 34 million users as of early October 2026, a scale that places it among the most widely adopted instant-payment systems in the region relative to Colombia's population. The non-face-to-face channel share of total financial-transaction volume reached 85.5% as of the second quarter of 2026, according to the Superintendencia Financiera, indicating that the shift toward digital and remote payment initiation in Colombia is now the dominant mode of transacting rather than a growing minority behaviour. The governing scheme-rule instrument for this growth is Circular Reglamentaria Externa DSP-465, most recently updated on 6 March 2026. That update added interoperability standards for low-value immediate payment systems, known locally as SPBVI, and separately strengthened continuity and transparency obligations around technological-incident notification for participating financial institutions. Both bank and non-bank payment institutions participating in Bre-B and SPBVI are subject to these interoperability and incident-notification standards under the March 2026 update. A persistent constraint on the rail's growth is its transaction-value ceiling: the current maximum Bre-B transaction value is 1,000 UVB, equivalent to COP 12,110 for 2026. Colombia Fintech, the industry body, publicly asked the government, in a request reported 17 September 2026, to lift this cap and to allow state revenue collection through the rail, alongside a gradual phase-out of the 4x1000 financial-transactions tax. Neither request has yet been reflected in any regulatory change. #### Outlook Whether the government responds to Colombia Fintech's request to raise or remove the Bre-B transaction cap is the clearest near-term question for this corridor. Given the rail's continued scale-up past 100 million registered keys, further updates to Circular DSP-465's interoperability or incident-notification standards are also plausible as transaction volume continues to grow, though none has yet been announced beyond the March 2026 update. 5 earlier distinct update(s) Periodic update · new data 2026-10-11 #### Payment Corridor Dynamics Bre-B, Colombia's account-to-account instant-payments system operated under Banco de la Republica, published one-year operational statistics on 7 October 2026, marking the anniversary of its launch on 6 October 2025. The system has registered more than 116 million keys and more than 36 million users, processing over one billion transactions, with 62 percent of operations valued below COP 50,000, indicating a payments rail dominated by low-value, high-frequency retail transactions rather than wholesale or corporate flows. As of January 2026, 218 entities were linked to the scheme: 26 banks, 153 cooperatives and 4 SEDPEs, reflecting a participant base that spans both bank and non-bank payment-service-provider models in roughly comparable numbers of cooperative and bank participants, with SEDPEs forming a smaller but present non-bank segment. The maximum value permitted for a single Bre-B transaction in 2026 is set at 1,000 basic value units, equivalent to COP 12,110, a ceiling that applies uniformly across all 218 linked entities regardless of their bank or non-bank status. Separately, an earlier regulatory measure reported in March 2026 updated the Bre-B framework to require clearer and more timely disclosure to customers regarding the origin of any technological failure, together with more precise incident-notification protocols; this measure remains the standing operational-resilience baseline for the scheme and was not amended further this cycle. #### Outlook With Bre-B now operating at genuine national scale after one year, the development to watch is whether transaction-value and participant-count growth continues at a comparable pace into its second year, and whether the 1,000 UVB per-transaction ceiling is revisited as usage patterns mature. The low-value, high-frequency transaction profile observed this cycle (62 percent of operations below COP 50,000) suggests the corridor is serving primarily retail, person-to-person and small-merchant use cases rather than higher-value commercial settlement, a distinction relevant to how the corridor's growth trajectory should be read going forward. Periodic update · new data 2026-09-28 #### Payment Corridor Dynamics Bre-B, Colombia's interoperable instant-payments system operated by Banco de la República and explicitly modelled on Brazil's Pix, reached full-scale interoperability on 6 October 2026. As of January 2026 the scheme counted more than 218 participating entities, comprising 26 banks, 153 cooperatives, and 4 SEDPEs (Sociedades Especializadas en Depósitos y Pagos Electrónicos), reflecting a participation base that spans both bank and non-bank payment-institution types from the outset. Alongside the interoperability milestone, Banco de la República updated the Bre-B regulatory framework to require clearer and more timely disclosure of the origin of technological failures and more precise user-notification protocols, an operational-resilience and consumer-transparency measure introduced as the scheme moves from a launch phase into full-scale operation. The corridor's technical design documentation, published in February 2026, confirms that two further payment-scheme operators, Drixi (a Banco de la República vehicle) and Gou Payments (linked to Grupo AVAL), are expected to begin operating within the Bre-B ecosystem during 2026, which would extend the scheme's operator base beyond its initial roster of participants. The combination of full-scale interoperability, an expanding operator base, and tightened disclosure obligations marks Bre-B's transition from a launch-phase interoperable rail into a maturing piece of critical payments infrastructure for Colombia, carrying both bank and non-bank participation from the outset in a manner distinct from card-rail-centric corridors. #### Outlook Watch for confirmation that Drixi and Gou Payments have actually commenced operations as Bre-B scheme operators during 2026, and for any further regulatory measures addressing operational resilience as transaction volume grows following the full-scale interoperability transition. Periodic update · new data 2026-09-21 #### Payment Corridor Dynamics Colombia's Bre-B instant-payment scheme has scaled at a pace that marks it as one of the fastest national interoperable instant-payments rollouts observed. Live since 6 October 2025, the scheme reached 218 participating entities by January 2026, with five SPBVI operators fully interoperating at that point. By mid-2026, roughly five months after achieving full interoperability, Bre-B had processed more than 500 million transactions and registered over 100 million payment keys. This trajectory places Colombia among the more consequential instant-payments corridor stories globally this cycle, not for any single transaction-flow or cross-border dimension but for the sheer domestic adoption velocity of an interoperable rail spanning 218 entities. The scheme's expansion continues, with Drixi and Gou Payments expected to add two further SPBVI operators to the interoperating base during 2026, which would extend both the entity count and, plausibly, the transaction and payment-key totals further beyond their already-substantial mid-2026 levels. Banco de la República's parallel tightening of incident-disclosure and user-notification conduct rules for scheme participants should be read as a direct function of this scale: a payments corridor processing hundreds of millions of transactions across well over a hundred million registered payment keys generates materially higher stakes for any single technological failure than the same scheme would have at launch, and the regulator's 2026 conduct update reflects that shift in stakes. #### Outlook The corridor-dynamics story to watch is whether Bre-B's growth rate sustains as the participant base grows further with the addition of Drixi and Gou Payments, and whether transaction and payment-key totals continue to scale at a comparable pace through the remainder of 2026. Any slowdown in adoption velocity, or any technological incident testing the newly tightened conduct rules, would be the natural next data points for this corridor. Periodic update · new data 2026-09-04 #### Payment Corridor Dynamics Bre-B, Colombia's interoperable instant-payments scheme, reached full operation in October 2025 under the operational stewardship of Banco de la Republica, running on ACI Worldwide's processing infrastructure. Within five months of reaching full operation, the scheme had processed more than 500 million transactions and registered over 100 million payment keys, a scale of adoption that positions Bre-B as a genuine national payments utility rather than a pilot-stage initiative. The registered-keys figure is particularly significant because payment keys (simple identifiers such as phone numbers or national ID numbers linked to bank accounts) are the mechanism that allows instant, account-to-account transfers without exchanging full account details, and a base of over 100 million keys implies broad-based consumer and institutional enrolment across the scheme in a very short window post-launch. The scheme's architecture is also evolving beyond its initial single-operator design. A second private instant-payments operator, Gou Payments, backed by Grupo AVAL, is currently in connection testing, while a forthcoming public operator, Drixi, is being brought online by Banco de la Republica itself. This move toward a multi-operator structure is a deliberate design choice by the central bank rather than an incidental development: it signals an intent to build competitive plurality and resilience into Colombia's instant-payments layer, avoiding a single-processor dependency as transaction volume continues to scale. For payments-sector participants, this corridor dynamic is best read as Colombia consolidating a domestically-controlled, central-bank-anchored instant-payments rail as the default channel for real-time transfers, with private operators layered on top of, rather than competing directly against, the public infrastructure. The technical document underpinning these figures was published directly by Banco de la Republica in February 2026, giving this finding a Tier-1 primary-source anchor alongside corroborating T3 press coverage, which supports a High confidence rating for both the transaction-volume and multi-operator-expansion findings. #### Outlook The marker to watch over the coming cycles is whether Gou Payments completes connection testing and begins live processing, and whether Drixi's public-operator launch proceeds on the timeline implied by Banco de la Republica's February 2026 technical documentation. Continued transaction-volume growth at or above the pace observed in Bre-B's first five months of full operation would further cement the scheme's position as Colombia's dominant real-time payments rail. Periodic update · new data 2026-08-11 #### Payment Corridor Dynamics Bre-B, Colombia's interoperated instant retail-value payment system, came into full national operation on 6 October 2025. By January 2026, Banco de la Republica reported 218 participating entities and five fully interoperating SPBVIs, with a sixth participant, Gou Payments, expected to complete the interoperating set. This trajectory sits against a historically cash-dominant baseline: as of 2023 data, 78.6% of Colombian adults reportedly preferred cash, reflecting Colombia's low prior level of electronic-payment interoperability. Read together, the corridor-dynamics signal this cycle is that Colombia has moved from a cash-preference baseline toward a functioning, broadly-participated instant-payments rail within a compressed post-launch period, positioning Bre-B as a credible domestic equivalent to regional account-to-account rails such as Pix in Brazil and SPEI in Mexico. The claims underpinning this read are both sourced to Banco de la Republica at source-tier one and classified as high-confidence, giving this corridor-dynamics assessment a stronger evidentiary footing than lower-tier claims affecting other modules this cycle. Both claims carry instrument_type classifications of account-to-account and other respectively, consistent with Bre-B's structure as a bank-account-linked interoperable rail rather than a card-based or stablecoin-based payment instrument, and both are tagged jurisdiction CO with a national_federal regulatory layer, reflecting Banco de la Republica's central role as both scheme overseer and monetary authority. #### Outlook The next corridor-dynamics indicators to watch are whether Gou Payments completes its expected entry as the sixth fully interoperating participant, and whether participation growth continues beyond the initial post-launch uptake curve, which would confirm that Colombia's instant-payments corridor has moved from a launch-phase adoption spike to a durable structural feature of the payments landscape. Evidence 4 Sources and findings (4) - T1[https://www.banrep.gov.co/en/blog/bre-b-brief-history-interoperated-instant-payment-system](https://www.banrep.gov.co/en/blog/bre-b-brief-history-interoperated-instant-payment-system)retrieved 2026-06-27 - T3[https://www.trade.gov/country-commercial-guides/colombia-trade-financing](https://www.trade.gov/country-commercial-guides/colombia-trade-financing)retrieved 2026-06-27 - T2[https://www.garrigues.com/es_ES/garrigues-digital/asi-avanza-regulacion-fintech-colombia-chile-mexico-peru](https://www.garrigues.com/es_ES/garrigues-digital/asi-avanza-regulacion-fintech-colombia-chile-mexico-peru)retrieved 2026-06-27 - T3[https://www.rapyd.net/blog/colombia-payments-guide/](https://www.rapyd.net/blog/colombia-payments-guide/)retrieved 2026-06-27 ### W6Industry Structure & Commerciallimited signalProbableconfirmed 2026-06-27▾# Colombia is Latin America's third-largest fintech ecosystem (300+ active startups), led by bank-origin and independent neobanks: Nequi (Bancolombia origin, 24m+ users), DaviPlata (Davivienda, ~19m), MOVii and Nubank Colombia (~3.4m). Traditional banking remains concentrated around Bancolombia, Banco de Bogotá and Davivienda. Acquiring/processing has historically been concentrated in Redeban and Credibanco, now being disrupted by neo-acquirers (MOVii, Bold) and B2B-payments fintechs (Cobre). Financial penetration rose from 67.2% (2012) to 92.3% (2022). International entrants (Ualá, Revolut) are expanding into the market. Standing sub-brief · as of 27 June 2026 164 words · last cycle 2026-09-28 #### Industry Structure & Commercial Dynamics Colombia hosts the third-largest fintech ecosystem in LatAm, with 300-380+ active fintech startups and around 18% annual growth. Neobanking is led by Nequi (24m+ users, Bancolombia origin, independent since 2022), DaviPlata (~19m, Davivienda), MOVii and Nubank Colombia (~3.4m). Financial penetration rose from 67.2% in 2012 to 92.3% in 2022, with around 20m people still excluded or under-included. This structural landscape is distinct from the discrete commercial events carried under W13 and maps the competitive structure into which new acquirers and international entrants such as Uala and Revolut are scaling. This is a non-bank PI/EMI-led competitive surface: the leading neobanking players operate outside the traditional bank perimeter even where bank-origin (Nequi, DaviPlata), while card-acquiring incumbents Redeban and Credibanco anchor the bank-aligned infrastructure. #### Outlook The industry structure is stable but competitively active, with substantial residual under-inclusion providing the growth runway. International entrants scaling into the neobanking and acquiring layers are the principal structural watch items; specific deals are tracked under W13. Read full sub-brief · 164 words Periodic update · new data 2026-09-28 #### Industry Structure & Commercial Dynamics The Superintendencia Financiera de Colombia has signalled a 2026 fintech regulatory agenda that includes updating the crowdfunding rule under Decreto 034 de 2025 and introducing a new technological model for capturing foreign-exchange-market and TRM (representative market rate) data. This item is sourced from a single Tier-3 outlet and should be treated as a dated agenda item within the SFC's broader fintech-transformation roadmap rather than a confirmed structural development; no further corroborating detail on the scope or timeline of either the crowdfunding-rule update or the FX/TRM data-capture model was available this cycle. Separately, and more substantively evidenced, Bre-B's operator base is set to broaden in 2026 with the addition of Drixi and Gou Payments as scheme operators, alongside the existing base of 26 banks, 153 cooperatives, and 4 SEDPEs already participating as of January 2026. This expanding, mixed bank/non-bank operator and participant structure is itself a commercial-dynamics signal: Colombia's instant-payments infrastructure is being built with deliberately broad institutional participation rather than a bank-only or single-operator model. #### Outlook Watch for formal publication of the SFC's crowdfunding-rule update and FX/TRM data-capture initiative, neither of which was confirmed beyond a single Tier-3 source this cycle, and for further detail on how Drixi's and Gou Payments' entry as Bre-B scheme operators will affect competitive dynamics among existing participants. Evidence 4 Sources and findings (4) - T3[https://fintechnews.am/fintech-colombia/54903/nequi-daviplata-and-movii-dominate-colombias-neobanking-market-but-new-challengers-emerge/](https://fintechnews.am/fintech-colombia/54903/nequi-daviplata-and-movii-dominate-colombias-neobanking-market-but-new-challengers-emerge/)retrieved 2026-06-27 - T3[https://facephi.com/observatory/regulacion-fintech-colombia-2026/](https://facephi.com/observatory/regulacion-fintech-colombia-2026/)retrieved 2026-06-27 - T3[https://www.akua.la/en/blog/conozca-a-los-actores-clave-en-la-industria-de-pagos-con-tarjetas-electronicas](https://www.akua.la/en/blog/conozca-a-los-actores-clave-en-la-industria-de-pagos-con-tarjetas-electronicas)retrieved 2026-06-27 - T3[https://www.trade.gov/country-commercial-guides/colombia-trade-financing](https://www.trade.gov/country-commercial-guides/colombia-trade-financing)retrieved 2026-06-27 ### W7Legal & LitigationProbableconfirmed 2026-06-27▾# Live competition matter: SIC precautionary measures (2022) and pliego de cargos (2023) against six Visa/Mastercard entities over conduct obstructing payment aggregators and the LCA cross-border model (breach of Ley 155/1959 Art. 1 and Art. 47.10 Decreto 2153/1992). Historic IIF interchange-fixing line vs Visa/MasterCard committees and Redeban. AML enforcement active (>US$10m fines in 2023). Standing sub-brief · as of 27 June 2026 150 words · last cycle 2026-06-27 #### Legal & Litigation The most material live legal matter in the market is the SIC investigation against Visa and Mastercard. The SIC imposed precautionary measures in 2022 and formulated a pliego de cargos in 2023 against six Visa and Mastercard entities over conduct allegedly obstructing payment aggregators and the Local Collection Agent (LCA) cross-border model, citing breach of the general prohibition of Ley 155 de 1959 (Art. 1) and Art. 47.10 of Decreto 2153 de 1992, and ordered that the LCA model not be restricted. A live regulator action protecting aggregators and LCA cross-border models directly affects scheme conduct and merchant-acquiring market access, and represents a scheme-conduct precedent for LatAm payment-aggregation access. #### Outlook The matter is escalating and is the most material legal exposure in the market. Its resolution will set scheme-conduct precedent for payment-aggregation access across the region; the trajectory remains live with no final outcome evidenced this cycle. Read full sub-brief · 150 words no periodic updates on record for this sub-brief Evidence 4 Sources and findings (4) - T1[https://www.sic.gov.co/slider/superindustria-impone-medidas-cautelares-visa-y-mastercard-para-proteger-la-libre-competencia-en-pagos-internacionales](https://www.sic.gov.co/slider/superindustria-impone-medidas-cautelares-visa-y-mastercard-para-proteger-la-libre-competencia-en-pagos-internacionales)retrieved 2026-06-27 - T3[https://www.larepublica.co/finanzas/sic-formula-cargos-a-visa-y-mastercard-por-supuestamente-afectar-la-libre-competencia-3708126](https://www.larepublica.co/finanzas/sic-formula-cargos-a-visa-y-mastercard-por-supuestamente-afectar-la-libre-competencia-3708126)retrieved 2026-06-27 - T1[https://one.oecd.org/document/DAF/COMP/LACF(2021)5/en/pdf](https://one.oecd.org/document/DAF/COMP/LACF(2021)5/en/pdf) Applies beyond this jurisdiction (OECD)retrieved 2026-06-27 - T3[https://www.muralpay.com/blog/what-colombian-businesses-need-to-know-about-international-payment-regulations](https://www.muralpay.com/blog/what-colombian-businesses-need-to-know-about-international-payment-regulations)retrieved 2026-06-27 ### W8Merchant Acquiring & RiskProbableconfirmed 2026-06-27▾# Acquiring was historically restricted to SFC-supervised entities operating through Redeban/Credibanco; Decreto 1692 de 2020 opened it by creating a Registro de Adquirente no Vigilados, allowing non-supervised actors to perform acquiring subject to solvency/capital requirements (or to act as payment-service providers if they cannot meet them). The 2023 SFC circular developing Decreto 1692 added EASPBV governance, defined non-supervised participants and consumer-protection/disclosure duties for acquiring. Cash remains dominant (~78% of transactions), shaping high merchant onboarding and risk profiles. Neo-acquirers (MOVii, Bold) and B2B fintech Cobre are reshaping merchant economics. Standing sub-brief · as of 27 June 2026 154 words · last cycle 2026-06-27 #### Merchant Acquiring & Risk Merchant acquiring was opened by Decreto 1692 de 2020, which created a Registro de Adquirente no Vigilados allowing non-SFC-supervised actors to perform acquiring subject to solvency and capital requirements, or to act as payment-service providers if those are unmet. Cash remains roughly 78-79% of transactions, shaping high merchant onboarding and risk profiles. MOVii has processed about 60% of Colombian e-commerce in three years via neo-acquiring. The non-supervised acquiring register plus the high-cash baseline together define the merchant-onboarding economics that neo-acquirers are exploiting. The bank versus non-bank distinction is sharp here: supervised banks acquire inside the SFC perimeter, while non-supervised neo-acquirers operate through the dedicated register, with the solvency threshold determining whether an entrant acquires directly or operates as a payment-service provider. #### Outlook The module is established. The neo-acquiring disruption enabled by the non-supervised register is the live dynamic, with the high-cash baseline still providing substantial conversion headroom for electronic acceptance. Read full sub-brief · 154 words no periodic updates on record for this sub-brief Evidence 4 Sources and findings (4) - T1[https://www.funcionpublica.gov.co/eva/gestornormativo/norma.php?i=153787](https://www.funcionpublica.gov.co/eva/gestornormativo/norma.php?i=153787)retrieved 2026-06-27 - T3[https://ccce.org.co/noticias/comunicado-oficial-decreto-1692-de-2020-sistemas-de-pago-de-bajo-valor/](https://ccce.org.co/noticias/comunicado-oficial-decreto-1692-de-2020-sistemas-de-pago-de-bajo-valor/)retrieved 2026-06-27 - T3[https://financialit.net/news/payments/colombian-fintech-movii-enters-peru-operate-neo-acquirer-marking-beginning-its](https://financialit.net/news/payments/colombian-fintech-movii-enters-peru-operate-neo-acquirer-marking-beginning-its)retrieved 2026-06-27 - T1[https://www.banrep.gov.co/en/publications-research/report-board-directors-congress/box4-february-2025](https://www.banrep.gov.co/en/publications-research/report-board-directors-congress/box4-february-2025)retrieved 2026-06-27 ### W9Product Innovation & Market DevelopmentProbableconfirmed 2026-06-27▾# Colombia's payments innovation agenda for 2026-2030 rests on three reinforcing pillars: mandatory open finance (Decreto 0368 de 2026), interoperable instant payments via Bre-B (live October 2025), and partial usury-rate liberalisation. Bre-B drew on Pix (Brazil) and UPI (India), uses alias-based 'llaves', is fee-free for users until at least 2029, and reached tens of millions of registered keys at launch. Payment-initiation services were enabled via Decreto 1297 de 2022. An SFC crypto sandbox ('la Arenera') ran 2021-2024. New product launches include Cobre's B2B real-time Bre-B payments and peso stablecoins. Standing sub-brief · as of 6 August 2026 101 words · last cycle 2026-09-28 #### Open Banking, BaaS & Product-Access Regulation The Superintendencia Financiera de Colombia's Open Finance mandate is reported to cover all SFC-supervised entities, extending data-sharing obligations beyond traditional Open Banking accounts and cards into insurance, pensions, investments and crowdfunding. That broader scope signals a materially expanded supervisory data-sharing perimeter for nonbank PSPs and fintechs operating in Colombia. The characterisation currently rests on a single T4 vendor source, however, and awaits corroboration from a T1/T2 SFC circular before it can be treated as confirmed policy. #### Outlook Watch for a T1/T2 SFC publication that confirms or narrows the reported scope of the Open Finance mandate. Read full sub-brief · 101 words Periodic update · new data 2026-09-28 #### Product Innovation & Market Development Bre-B is progressing toward recurring and automatic debit use-cases, including school fees, insurance premiums, and subscription payments, all without reliance on card rails. This product direction was reported in July 2026 and is reinforced by Banco de la República's own regulatory update requiring clearer disclosure and notification standards, which are described as a precondition for the recurring-debit use-cases to mature into live product features. The significance of this development is that it represents Bre-B evolving from a peer-to-peer and person-to-business instant-transfer rail into a potential substitute for card-based direct-debit arrangements across recurring-payment categories that have historically depended on card infrastructure in Colombia. This product-innovation trajectory is distinct from, but reinforced by, the corridor's full-scale interoperability milestone reached on 6 October 2026 and the expanding operator base that will include Drixi and Gou Payments during 2026: a broader, more interoperable, and more heavily populated scheme is the infrastructural precondition for recurring/automatic debit use-cases to scale credibly across sectors such as education and insurance. #### Outlook The recurring/automatic debit use-case remains contingent on Banco de la República finalising clearer authorisation, cancellation, and notification standards; this cycle's evidence describes a direction of travel rather than a launched feature. Watch for the publication of finalised standards and for early adopter sectors (school fees, insurance, subscriptions) to begin piloting Bre-B-based recurring debits. 1 earlier distinct update(s) Periodic update · new data 2026-09-04 #### Product Innovation & Market Development Decree 0368 marks a structural shift in Colombia's Open Finance policy, converting what had previously been a voluntary participation scheme into a mandatory regime binding the entire supervised financial system. Under the decree, the Financial Superintendence has up to six months to publish the technical standards that will govern data-sharing and access mechanics under the mandatory regime, and covered entities then have a further twelve months from that publication to enable access. Taken together, this sequencing gives the sector an eighteen-month outer horizon from the decree's issuance to full operational compliance, compressing what had been an optional, self-paced participation model into a fixed regulatory timeline. This development sits within a broader 2026-2030 fintech-modernisation agenda targeting full interoperability across all payment operators in Colombia, including digital wallets and neobanks, not solely traditional banks. The agenda explicitly builds on existing rails — ACH Colombia and Transfiya — alongside the newly-scaled Bre-B instant-payments system, suggesting Colombian policymakers are treating Open Finance mandation and instant-payments infrastructure build-out as two components of a single coherent modernisation programme rather than as independent initiatives. For product and market-development teams, the practical implication is that data-access obligations under the mandatory Open Finance regime will need to be planned for on a similar timeline to continued instant-payments-rail integration work, rather than treated as a separate compliance track. This finding carries Probable rather than High confidence: it is sourced from a single T3 secondary publication (Facephi Observatory) rather than a directly-reached Financial Superintendence or Presidential decree text, and the decree's precise technical content beyond the stated timelines was not independently corroborated this cycle. #### Outlook The technical-standards publication, expected within six months of the decree per the sourced timeline, is the near-term marker that will determine the substantive content of the mandatory Open Finance regime. The subsequent twelve-month access-enablement window for covered entities is the second marker, and together the two form the operative compliance runway for the sector through the next twelve to eighteen months. Evidence 4 Sources and findings (4) - T2[https://www.accion.org/instant-payments-connecting-and-transforming-colombias-financial-ecosystem/](https://www.accion.org/instant-payments-connecting-and-transforming-colombias-financial-ecosystem/)retrieved 2026-06-27 - T3[https://paymentscmi.com/insights/bre-b-impact-in-colombia/](https://paymentscmi.com/insights/bre-b-impact-in-colombia/)retrieved 2026-06-27 - T2[https://www.garrigues.com/es_ES/garrigues-digital/asi-avanza-regulacion-fintech-colombia-chile-mexico-peru](https://www.garrigues.com/es_ES/garrigues-digital/asi-avanza-regulacion-fintech-colombia-chile-mexico-peru)retrieved 2026-06-27 - T3[https://abogadoblockchain.com/regulacion-criptomonedas-colombia/](https://abogadoblockchain.com/regulacion-criptomonedas-colombia/)retrieved 2026-06-27 ### W10Consumer Protection & APP FraudProbableconfirmed 2026-06-27▾# Financial-consumer protection is governed by Ley 1328 de 2009 and operationalised through the SFC's SAC, the per-entity Defensor del Consumidor Financiero, and the SFC's jurisdictional Acción de Protección al Consumidor Financiero (capped resolution time of one year). Colombia has no dedicated mandatory APP-fraud reimbursement regime equivalent to the UK PSR model; fraud is addressed via consumer-education and disclosure (the SFC launched 'Protégete de los fraudes' in June 2026 covering phishing/smishing/vishing). Instant-settlement fraud risk on Bre-B is a recognised emerging concern. Standing sub-brief · as of 27 June 2026 143 words · last cycle 2026-06-27 #### Consumer Protection & APP Fraud Consumer protection in payments runs through Ley 1328 de 2009, the SFC's SAC, per-entity Defensores and the jurisdictional Accion de Proteccion al Consumidor Financiero (maximum one year, extendable six months). Critically, there is no dedicated mandatory APP-fraud reimbursement regime equivalent to the UK PSR model. The SFC launched 'Protegete de los fraudes' on 11 June 2026, an education and disclosure approach. The absence of mandatory reimbursement shifts instant-payment fraud loss allocation onto consumers and firms, a divergence from Anglosphere norms, even as instant-settlement fraud on Bre-B is a recognised emerging concern. #### Outlook The regime is stable but the forward trajectory is uncertain: there is no evidence this cycle on whether instant-settlement fraud on Bre-B has prompted any proposed reimbursement or liability-allocation rule. As instant settlement scales, the loss-allocation gap relative to the Anglosphere is the key watch item. Read full sub-brief · 143 words no periodic updates on record for this sub-brief Evidence 4 Sources and findings (4) - T1[https://www.superfinanciera.gov.co/preguntas-frecuentes/23/23-accion-jurisdiccional-de-proteccion-al-consumidor-financiero/](https://www.superfinanciera.gov.co/preguntas-frecuentes/23/23-accion-jurisdiccional-de-proteccion-al-consumidor-financiero/)retrieved 2026-06-27 - T1[https://www.superfinanciera.gov.co/publicaciones/10116157/colombianos-cuentan-con-una-nueva-herramienta-para-reforzar-la-defensa-frente-al-fraude-financiero/](https://www.superfinanciera.gov.co/publicaciones/10116157/colombianos-cuentan-con-una-nueva-herramienta-para-reforzar-la-defensa-frente-al-fraude-financiero/)retrieved 2026-06-27 - T1[https://www.superfinanciera.gov.co/publicaciones/10110761/atencion-y-servicios-a-la-ciudadaniaatencion-al-ciudadanoformulario-solicitudes-y-pqrsf-10110761/](https://www.superfinanciera.gov.co/publicaciones/10110761/atencion-y-servicios-a-la-ciudadaniaatencion-al-ciudadanoformulario-solicitudes-y-pqrsf-10110761/)retrieved 2026-06-27 - T3[https://paymentexpert.com/2025/09/24/bre-b-factsheet/](https://paymentexpert.com/2025/09/24/bre-b-factsheet/)retrieved 2026-06-27 ### W11AML/CFT & Financial CrimeSourced from Sentinel.gi ↗Probableconfirmed 2026-06-27▾# sentinel.: Colombia's AML/CFT payments posture rests on SARLAFT 4.0 (SFC Circular Externa 027 de 2020) for SFC-supervised entities and SAGRILAFT (Supersociedades CE 100-000016 de 2020) for the real sector, including certain VASPs. The UIAF (Ley 526 de 1999, Decreto 1497 de 2014) is the FIU receiving suspicious-transaction reports (ROS); crypto transactions over USD 150 are reportable. Colombia is a GAFILAT member, re-rated Compliant/Largely Compliant on most FATF recommendations in its 2022-2023 follow-up. Penalties reach 200 minimum monthly wages per violation; 2023 saw >US$10m in AML fines. Standing sub-brief · as of 27 June 2026 145 words · last cycle 2026-06-27 #### AML/CFT & Financial Crime This module is sourced from the Sentinel feed and is carried as provenance only; original illicit-finance analysis routes to FIM. As reported via Sentinel, Colombia's AML/CFT payments posture rests on SARLAFT 4.0 (SFC CE 027/2020) for SFC-supervised entities and SAGRILAFT (Supersociedades CE 100-000016/2020) for the real sector including certain VASPs. The UIAF (Ley 526/1999, Decreto 1497/2014) is the FIU receiving ROS, with crypto transactions over USD 150 reportable. Colombia is a GAFILAT member, is not on FATF strategic-deficiency lists, and is rated Compliant for 14 and Largely Compliant for 16 of the FATF 40 Recommendations. Source: Sentinel feed (sentinel.gi), UIAF Circular Externa 027 de 2020. #### Outlook The AML/CFT surface is stable. WPM carries this as a cross-reference to FIM, which owns money-laundering-typology, sanctions and illicit-finance analysis; the W2 crypto-reporting threshold and W5 cross-border corridors are the connected surfaces flagged to FIM. Read full sub-brief · 145 words no periodic updates on record for this sub-brief Evidence 6 Sources and findings (6) - T?FIM (sentinel.gi) per-JID baseline profile — Colombia — Colombia operates SARLAFT (risk-based AML/CFT framework for financial institutions, overseen by the Financial Superintendence) and a 2021-era Registro Único de Beneficiarios (RUB) beneficial-ownership registry administered by DIAN. UIAF is the FIU. The 2018 GAFILAT/FATF mutual evaluation found technical-compliance improvements via subsequent enhanced follow-up but persistent effectiveness gaps, especially on beneficial-ownership verification and territorial enforcement. - T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-004) — Gap: sourcing-thinness - T2FIM (sentinel.gi) sanctions_change_register (issue FIM-BASE-SANC-003) — Sanctions: OFAC wind-down - T1FIM (sentinel.gi) sanctions_change_register (issue FIM-BASE-SANC-004) — Sanctions: OFAC delisting - T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-001) — Gap: enforcement-absence - T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-003) — Gap: political-constraint ### W12Correspondent Banking, Settlement & AccessProbableconfirmed 2026-06-27▾# Settlement-system access and correspondent banking are governed by Banco de la República, which operates deposit and securities settlement, electronic funds transfers, interbank clearing, deposit-account systems and intraday liquidity for authorised financial institutions. Cross-border settlement runs through FEM authorised intermediaries (mostly supervised banks/licensed fintechs) with SIC-platform registration. De-risking pressure on remittance providers and smaller players is a recognised cross-border risk; FATF R.13 requires enhanced measures for cross-border correspondent banking, an area where Colombia was re-rated compliant. Bre-B's MOL provides domestic 24/7 settlement. Standing sub-brief · as of 27 June 2026 160 words · last cycle 2026-06-27 #### Correspondent Banking, Settlement & Access The analytical spine of this module is the bank versus non-bank settlement-access asymmetry. Banco de la Republica operates core settlement and access, providing deposit and settlement of securities, deposit-account systems, electronic funds transfers, interbank clearing and intraday liquidity to authorised financial institutions. Cross-border settlement runs only through FEM authorised intermediaries, mostly supervised banks and licensed fintechs, with daily compensation-account tracking, while Bre-B's MOL provides domestic 24/7 settlement. FATF Recommendation 13 on cross-border correspondent banking has been re-rated compliant. Non-bank PSP access to settlement is therefore gated through authorised intermediaries: settlement access mediated by these intermediaries shapes which non-bank PSPs can clear cross-border flows, and de-risking pressure on remittance and smaller players is noted as a cross-border risk. #### Outlook The settlement architecture is stable. De-risking pressure on Colombian remittance and correspondent relationships is asserted as a recognised risk but is not evidenced with specific corridor or counterparty data this cycle, leaving it an under-indexed watch item. Read full sub-brief · 160 words no periodic updates on record for this sub-brief Evidence 4 Sources and findings (4) - T1[https://www.banrep.gov.co/en/payment-systems](https://www.banrep.gov.co/en/payment-systems)retrieved 2026-06-27 - T1[https://www.banrep.gov.co/en/bank/functions](https://www.banrep.gov.co/en/bank/functions)retrieved 2026-06-27 - T3[https://www.rapyd.net/blog/colombia-payments-guide/](https://www.rapyd.net/blog/colombia-payments-guide/)retrieved 2026-06-27 - T3[https://sumsub.com/blog/aml-regulations-colombia/](https://sumsub.com/blog/aml-regulations-colombia/)retrieved 2026-06-27 ### W13Commercial Intelligence (M&A, Investment & Product)1 judgment1 gaplimited signalProbableconfirmed 2026-06-27▾# Colombia remains Latin America's most active fintech-investment destination, with Nu, Plata and Revolut all announcing deepened commitments in late September 2026. Key judgment — Probable · impact Colombia continues to attract substantial fintech capital commitments from regional and global players (Nu, Plata, Revolut), reinforcing its position as Latin America's most active fintech-investment destination this cycle. claims: none recorded Open gap — wpm-int-1 Exact announcement dates for the Kraken COP integration and the Tether-led Plenti seed round could not be confirmed to day-level this cycle. Emerging-market crypto frameworks under-covered by Tier-1 channels; attribution conflict on Decreto 1297/2023 flagged as Assessed. Standing sub-brief · as of 6 August 2026 55 words · last cycle 2026-10-25 #### Commercial Intelligence (M&A, Investment & Product) Gou Payments is expected to join Bre-B as the sixth fully interoperating SPBVI participant, per Banco de la Republica's January 2026 update on the scheme's participant roster. Terms and integration timing were not publicly disclosed. #### Outlook Confirm Gou Payments' formal go-live as a Bre-B participant in the next cycle. Periodic update · new data 2026-10-25 #### Commercial Intelligence & Fintech Two discrete commercial events touched Colombia's crypto-adjacent payments sector, though neither carries a confirmed date. Kraken expanded its Colombia access with local-peso (COP) payment integration, a product release that would deepen the exchange's ability to serve Colombian customers in their local currency rather than requiring conversion through an intermediary currency; the exact date of this launch is not publicly disclosed in material available. Separately, Tether led a USD 3 million seed round in Plenti, a Medellin-based fintech, an investment event in which Tether is recorded as lead investor and Plenti as the investee. As with the Kraken development, the precise announcement date for this round is not publicly disclosed in material reviewed, and the amount should be read as a reported figure rather than one independently confirmed against a primary disclosure. Both events reflect continued commercial interest from established crypto-sector firms in deepening their presence in the Colombian payments and fintech market, distinct from any structural shift in market concentration or competitive dynamics, which would fall outside this specific commercial-events reading. #### Outlook Confirmation of exact dates for both the Kraken integration and the Plenti seed round would sharpen the commercial-intelligence picture for Colombia's crypto-adjacent payments sector. Continued monitoring for further discrete commercial events, deals, launches or investments, in this space is warranted given the pace of activity evidenced. 1 earlier distinct update(s) Periodic update · new data 2026-10-11 #### Commercial Intelligence & Fintech Three distinct commercial developments, each reported around 24 September 2026, point to escalating fintech investment activity in Colombia. Nu, operating as Nubank, announced it will invest approximately USD 1.6 billion in Colombia through 2030, marking five years of operation in the country and reporting approximately USD 3.4 billion in deposits accumulated over that period; this is a capital-commitment announcement rather than a completed transaction, and the amount is disclosed. Plata doubled its planned investment in Colombia to USD 120 million, an announcement made days after the company launched savings and term-deposit products in the Colombian market; credit cards and loan products are reported as due in 2027, giving a specific forward product-roadmap marker to track. Revolut separately unveiled a Colombia launch plan, having secured a Colombian banking licence; the specific licensing authority involved was not disclosed in the source reviewed, so the regulatory-review detail behind that licence grant remains unconfirmed. These three events, while independent of one another, together signal that Colombia is attracting commitment from both Latin American-domiciled players (Plata, domiciled in Mexico) and global players (Nu, domiciled in Brazil, and Revolut, domiciled in the UK), spanning digital banking, consumer savings products and account-based banking licensing. None of the three events is confirmed as completed in the sense of capital having been deployed in full; each is an announced commitment or plan as of the source date. #### Outlook The near-term commercial-intelligence markers to track are whether Revolut's secured banking licence converts into an operational product launch in Colombia, whether Plata follows through on its planned 2027 credit-card and lending products, and whether Nu's USD 1.6 billion commitment through 2030 is disclosed in tranches as it is deployed. Each of these is a distinct, trackable commercial event rather than a structural market-wide trend. Evidence 5 Sources and findings (5) - T3[https://www.fintechfutures.com/venture-capital-funding/colombia-s-bold-bags-50m-series-c-for-next-phase-of-growth](https://www.fintechfutures.com/venture-capital-funding/colombia-s-bold-bags-50m-series-c-for-next-phase-of-growth)retrieved 2026-06-27 - T3[https://latamlist.com/colombian-fintech-bold-raises-40m-funding-round/](https://latamlist.com/colombian-fintech-bold-raises-40m-funding-round/)retrieved 2026-06-27 - T3[https://financialit.net/news/payments/colombian-fintech-movii-enters-peru-operate-neo-acquirer-marking-beginning-its](https://financialit.net/news/payments/colombian-fintech-movii-enters-peru-operate-neo-acquirer-marking-beginning-its)retrieved 2026-06-27 - T3[https://fintech.global/2025/07/14/cobre-launches-real-time-b2b-payments-in-colombia/](https://fintech.global/2025/07/14/cobre-launches-real-time-b2b-payments-in-colombia/)retrieved 2026-06-27 - T3[https://iclg.com/practice-areas/fintech-laws-and-regulations/colombia/](https://iclg.com/practice-areas/fintech-laws-and-regulations/colombia/)retrieved 2026-06-27 No modules match. Filters combine as OR inside a group and AND across groups. Reset all filters ## Provenance and declared absence Disclosure model: module cards load OPEN; standing positions render in full; sub-briefs and jurisdiction briefs load as a clamped teaser with an explicit “read full” control carrying the true word count; earlier updates stay collapsed behind a counted summary. No text is hidden without disclosing how much of it there is. Sentinel-fed modules receive no special rendering treatment. sentinel_feed is an attribution chip only: it does not suppress content, does not generate an absence reason code, and does not exclude the module from any count, filter, search index or export on this page. Family taxonomy is renderer-level presentation config, not a JID field. Colour is always duplicated in text and is never the sole carrier of meaning. Suppressed by doctrine: derived risk score; per-module RAG traffic light. Not shown on this page. Band honesty: uncertainty bands are computed against a frozen build clock of 2026-10-26. A year-precision row is never promoted into a tighter band. Orphan deltas: 1 cycle_delta row(s) target non-module objects and are listed in the rail rather than attached to a card. Envelope: baseline resolved at jurisdiction_json.baseline ; 14 module(s), 60 finding(s), 118 source(s) in the cumulative register. Think something on this page is wrong? [Report an error](/legal/#contact).