What Fintech companies should know about legal regulations in Colombia

FinTech companies won’t face any legal difficulties in Colombia as long as they are able to identify all of the applicable dispositions according to the activity they perform and complying to them.


After a 61% growth last year, Colombia currently has the third biggest Fintech Industry in South America. Despite that, currently Colombia does not have a single proper Fintech regulation nor even a bill about it, even when the government and other sectors have widely acknowledged its importance, as they are currently becoming one of the decisive agents for the future of the worldwide financial industry.

It is relevant to mention that a bill for FinTech companies and particularly crowdfunding platforms was presented last year, but since the government and FinTech companies did not reach an agreement about it, it was finally stalled. However, right now Colombian FinTech companies are observing an ethical responsibility code, created by the Colombian Association of Technology and Innovation Companies as an autoregulation.

The thing is, the inexistence of a Fintech legal regulation does not mean there is not applicable law to Fintech companies, as they must observe the different dispositions applicable to them, which can be found all over the Colombian legal system. That means, they must be aware of their obligations in accordance of the Financial Protection Regimen, the Financial Habeas Data and Data Protection dispositions, Colombia’s Tax Regulation for digital industries, and Colombia’s Administration System for the Prevention of Money Laundering and Financing of Terrorism (SARLFT).

1.    Finance regulation

Among other legal entities, Colombia’s Organic Statute of the Financial System must be observed by any company that provides financial services. That means Fintech companies, as special financial service providers, must fulfil the obligations stated by the general financial regulation, and to comply to all the dispositions applicable to all companies, as they can be supervised by Colombia’s Financial Superintendence.

Whether it is online banking, digital stock markets or online collective financing, FinTech companies need an authorization from the Financial Superintendence in order to capture any inflow of money. Otherwise, the company would face several fines and the legal representative of the company could face up to 240 months of prison.

2.   The Financial Protection Regimen

The dispositions found in Act 1328 issued in 2009, establish that companies which provide special financial services (such as Fintech companies) must act with due diligence transparency and providing information that is true, sufficient and is presented on time, respect the freedom of choice, handle properly any conflict of interests, and provide appropriate education for the financial consumer. The same law habilitates the government to intervene in order to make sure the companies are properly complying and respecting the financial consumer’s rights.

3.   Financial Habeas Data and Data Protection

The Superintendence of Industry and Commerce, which is the competent entity to sanction the breach of Colombia’s Data Protection legislation, has recognized there is a special need to protect “financial habeas data”, must be observed by Fintech companies as direct agents of the financial system.

The financial habeas data is breached by: a) reporting to credit risk entities, information that does not correspond with reality e.g. reporting a person who is not a debtor or reporting him a debtor for a longer period that he has actually been, b) not updating on time the information related with the fulfilment of obligations of the users, e.g. not reporting on time payments made by users, or not informing immediately when someone may be supplanting a person, c) Not communicating to the user that he will be reported to a credit risk entity and therefore refusing the possibility of paying before he gets reported.

Of course, besides respecting the financial habeas data, Fintech companies must design a data protection protocol that guarantees the users’ rights according to Colombia’s general data protection legislation. Therefore, Fintech companies must be certain they are not using the information of their users without their authorization, that they are not exposed to security breaches that could result in the divulgation of someone’s data over the internet, or that their platform is protected against loss or robbery of the information stored in their databases.

4.   The tax regulation for FinTech companies

Our legislation has adopted rules to keep up with the challenges of the digital economy. Fintech companies may be legally incorporated in one jurisdiction, but they may still do business in Colombia and obtain income from Colombian source. Also, they may be incorporated in Colombia, derive income from Colombia, and from other jurisdictions. In any of those cases the tax code has rules that would indicate, basically, that any income obtain from Colombian source would pay taxes in Colombia, regardless the type of entity, with or without incorporation in Colombia. obviously, the digital economy poses challenges in different aspects, such as determining if there is in effect Colombian sourced income or not, and if the digital platform, even if operating abroad, should be considered a permanent establishment in Colombia.


Colombia’s Administration System for the Prevention of Money Laundering and Financing of Terrorism has established the need for the creation of a special protocol in each company based on the prevention of risk and eradication of the insertion of shady money to the country’s financial system. As agents of the financial system that are constantly making money transfers, FinTech companies must be particularly meticulous in the creation of this system, so they are able to inform where the money comes and where it goes.

For all that has been stated before, a FinTech company looking forward to running business in Colombia now, won’t be finding the applicable regimen in a single law nor will it find a specific FinTech regulation, as we’re still waiting for it. However, FinTech companies won’t face any legal difficulties in Colombia as long as they are able to identify all of the applicable dispositions according to the activity they perform and complying to them.

In Abusaid Gómez & Asociados, we have worked with Fintech companies and can give you advice on all the related requirements and regulations related with your investment in Colombia. If you need more information and assessment, send us an email to jose.abusaid@abusaidgomez.com or contact us.

Posición en Iberoamérica
Juan Esteban Saldarriaga
Vice President at Alianza FinTech Iberoamerica | Co-Founder Rapicredit | ColombiaFinTech.co
Diego Molano
Consultor internacional en temas de TIC e innovación
David Velez
Founder and CEO at Nubank
Martin Schrimpff
Co-Founder of Zinobe | Founder of PayU | Founder Pagosonline.net
Ángel Sierra
Director Ejecutivo en Asociación FinTech e InsurTech de Chile | Member of Alianza FinTech Iberoamerica
Paula Cardenas
Business Manager at AEFI | Founder Member FinTech IberoAmérica
Clementina Giraldo
FinTech & AgTech in Latin America
Juan Francisco Schultze-Kraft
Board Member – Vicepresident at Colombia FinTech | PayU Legal
Daniel Rojas
CEO & Co-Founder at Rocket.la
Alan Colmenares
Digital Transformation Enablement – Latam at Microsoft
Laura Gaviria Halaby
Global Head FinTech Acceleration at Citi | Chief Acceleration Officer at TheVentureCity
Diego Alejandro Guzman Guevara
CEO and Co Founder at Bankity
Andres Ramirez Sierra
CEO at Banlinea LATAM
Daniel Navarro
CEO & CoFounder at NIMMÖK
Fernando Sucre
CEO at ComparaMejor
Andres Villaquiran
Founder & CEO Alkanza
Carlos Castañeda Olaya
Open innovation leader at Accenture | Country Manager at Wayra
Marisol Camacho
Director of Corporate Relations at Bancóldex | Director of Mindset at iNNpulsa Colombia
Felipe Valencia
Partner at Veronorte
Conoce más de estas Fintechs
Las empresas Fintech mencionadas en este artículo ya no hacen parte de la Asociación. Por lo tanto, Colombia Fintech no puede dar una recomendación positiva o negativa de la calidad de sus ex miembros, ni asume ninguna responsabilidad por ello.
Las opiniones compartidas y expresadas por los analistas son libres e independientes, y de ellas son responsables sus autores. No reflejan ni comprometen el pensamiento u opinión de Colombia Fintech, por lo cual no pueden ser interpretadas como recomendaciones emitidas por la Asociación. Esta plataforma es un espacio abierto para promover la diversidad de puntos de vista sobre el ecosistema Fintech.