Technology, Fintech

What Fintech companies should know about legal regulations in Colombia.


After a 61% growth last year, Colombia currently has the third biggest Fintech Industry in South America. Despite that, currently Colombia does not have a single proper Fintech regulation nor even a bill about it, even when the government and other sectors have widely acknowledged its importance, as they are currently becoming one of the decisive agents for the future of the worldwide financial industry.

It is relevant to mention that a bill for FinTech companies and particularly crowdfunding platforms was presented last year, but since the government and FinTech companies did not reach an agreement about it, it was finally stalled. However, right now Colombian FinTech companies are observing an ethical responsibility code, created by the Colombian Association of Technology and Innovation Companies as an autoregulation.

The thing is, the inexistence of a Fintech legal regulation does not mean there is not applicable law to Fintech companies, as they must observe the different dispositions applicable to them, which can be found all over the Colombian legal system. That means, they must be aware of their obligations in accordance of the Financial Protection Regimen, the Financial Habeas Data and Data Protection dispositions, Colombia’s Tax Regulation for digital industries, and Colombia’s Administration System for the Prevention of Money Laundering and Financing of Terrorism (SARLFT).

  1. Finance regulation

Among other legal entities, Colombia’s Organic Statute of the Financial System must be observed by any company that provides financial services. That means Fintech companies, as special financial service providers, must fulfil the obligations stated by the general financial regulation, and to comply to all the dispositions applicable to all companies, as they can be supervised by Colombia’s Financial Superintendence.

Whether it is online banking, digital stock markets or online collective financing, FinTech companies need an authorization from the Financial Superintendence in order to capture any inflow of money. Otherwise, the company would face several fines and the legal representative of the company could face up to 240 months of prison.

  1. The Financial Protection Regimen


The dispositions found in Act 1328 issued in 2009, establish that companies which provide special financial services (such as Fintech companies) must act with due diligence transparency and providing information that is true, sufficient and is presented on time, respect the freedom of choice, handle properly any conflict of interests, and provide appropriate education for the financial consumer. The same law habilitates the government to intervene in order to make sure the companies are properly complying and respecting the financial consumer’s rights.

  1. Financial Habeas Data and Data Protection

The Superintendence of Industry and Commerce, which is the competent entity to sanction the breach of Colombia’s Data Protection legislation, has recognized there is a special need to protect “financial habeas data”, must be observed by Fintech companies as direct agents of the financial system.

The financial habeas data is breached by: a) reporting to credit risk entities, information that does not correspond with reality e.g. reporting a person who is not a debtor or reporting him a debtor for a longer period that he has actually been, b) not updating on time the information related with the fulfilment of obligations of the users, e.g. not reporting on time payments made by users, or not informing immediately when someone may be supplanting a person, c) Not communicating to the user that he will be reported to a credit risk entity and therefore refusing the possibility of paying before he gets reported.

Of course, besides respecting the financial habeas data, Fintech companies must design a data protection protocol that guarantees the users’ rights according to Colombia’s general data protection legislation. Therefore, Fintech companies must be certain they are not using the information of their users without their authorization, that they are not exposed to security breaches that could result in the divulgation of someone’s data over the internet, or that their platform is protected against loss or robbery of the information stored in their databases.

  1. The tax regulation for FinTech companies

Our legislation has adopted rules to keep up with the challenges of the digital economy. Fintech companies may be legally incorporated in one jurisdiction, but they may still do business in Colombia and obtain income from Colombian source. Also, they may be incorporated in Colombia, derive income from Colombia, and from other jurisdictions. In any of those cases the tax code has rules that would indicate, basically, that any income obtain from Colombian source would pay taxes in Colombia, regardless the type of entity, with or without incorporation in Colombia. obviously, the digital economy poses challenges in different aspects, such as determining if there is in effect Colombian sourced income or not, and if the digital platform, even if operating abroad, should be considered a permanent establishment in Colombia.


Colombia’s Administration System for the Prevention of Money Laundering and Financing of Terrorism has established the need for the creation of a special protocol in each company based on the prevention of risk and eradication of the insertion of shady money to the country’s financial system. As agents of the financial system that are constantly making money transfers, FinTech companies must be particularly meticulous in the creation of this system, so they are able to inform where the money comes and where it goes.


For all that has been stated before, a FinTech company looking forward to running business in Colombia now, won’t be finding the applicable regimen in a single law nor will it find a specific FinTech regulation, as we’re still waiting for it. However, FinTech companies won’t face any legal difficulties in Colombia as long as they are able to identify all of the applicable dispositions according to the activity they perform and complying to them.




Count on us for your next business decision in Colombia. Let us know more about your situation. You will hear from us within the next 24 business hours to arrange for a free consultation.

Diseño y Desarrollo: Náutica Digital