Colombia: technology regulation at a glance

Framework: Proyecto de Ley 510/2025 (PSAV bill, pending Congress); DIAN Resolution 000240 of 24 Dec 2025; SFC regulatory guidance and closed sandbox

Cryptocurrency is legal in Colombia but operates in a regulatory grey area: no single comprehensive statute governs virtual assets as of May 2026. A landmark VASP licensing bill (Bill 510/2025) remained pending in Congress as of late 2025, while DIAN enacted mandatory crypto-transaction reporting rules (Resolution 000240, December 2025) aligned with the OECD CARF framework. Supervised financial institutions remain prohibited by the SFC from holding or facilitating crypto assets pending new legislation.

Framework: Proyecto de Ley 043 de 2025 (pending Senate approval); CONPES 4144 (National AI Policy, February 2025); Joint Directive 007 (2025) on algorithmic transparency; Law 2502 of 2025 (AI-aggravated identity fraud)

Colombia does not yet have a comprehensive, enacted AI law. The government submitted Proyecto de Ley 043 de 2025 to the Senate in July 2025, a risk-based framework modelled on the EU AI Act, which remained in legislative debate as of early 2026. In parallel, the country operates under CONPES 4144 (February 2025), a binding national AI policy through 2030, Joint Directive 007 (2025) requiring algorithmic transparency in the public sector, and Law 2502 of 2025 which introduced AI-related aggravating factors in criminal identity fraud.

Framework: Statutory Law 1581 of 2012 (Ley Estatutaria 1581 de 2012), supplemented by Law 1266 of 2008 for financial/credit data, with the Superintendencia de Industria y Comercio (SIC) as the supervisory authority

Colombia operates a comprehensive personal data protection regime anchored in Article 15 of the Constitution (habeas data right) and Statutory Law 1581 of 2012, which governs collection, storage, use, and circulation of personal data across public and private sectors. The SIC enforces the law through its Deputy Superintendence for the Protection of Personal Data, handling thousands of complaints annually and issuing significant sanctions. As of August 2025, two reform bills (214/2025 and 274/2025) are before Congress to modernise the law, introducing GDPR-aligned rights and extraterritorial scope.

Framework: Superintendencia Financiera de Colombia (SFC) and Banco de la República; SEDPE regime (Law 1735 of 2014), low-value payment systems & acquiring (Decree 1692 of 2020), open finance (Decree 1297 of 2022, now mandatory under Decree 0368 of 2026), and the Bre-B instant payment rail.

Colombia has a clear, in-force licensing regime for digital payments and e-money. Specialized Electronic Deposit and Payment Companies (SEDPEs) are licensed and supervised by the Superintendencia Financiera under Law 1735 of 2014, low-value payment systems and the acquiring activity are regulated by Decree 1692 of 2020, open finance moved from voluntary (Decree 1297 of 2022) to mandatory (Decree 0368 of 2026), and the central bank's interoperable instant-payment rail Bre-B went live in October 2025. BNPL, by contrast, has only supervisory guidance and no dedicated statute.

Framework: Resolución 5477 de 2022 (Ministerio de Relaciones Exteriores / Cancillería), Artículo 46, Visa V Nómadas Digitales; supplemented by Resolución 5488 de 2022

Colombia introduced a formal Visa V Nómadas Digitales (Digital Nomads Visitor Visa) via Resolución 5477 of 22 July 2022, Article 46, issued by the Cancillería (Ministry of Foreign Affairs). It permits remote workers from visa-exempt nationalities to reside in Colombia for up to two years while working exclusively for foreign employers or clients. Time on this visa does not accrue toward permanent residency, but other Migrant (M-class) visa routes, including investor and family pathways, can lead to Type R permanent residency after five years.

Framework: Ley 2489 de 2025 (Digital Safe Environments for Children and Adolescents); Law 679 of 2001 (Internet Protection Law); MinTIC (Ministry of ICT) and CRC (Communications Regulatory Commission) as primary regulators

Colombia has a partial online safety framework anchored by sector-specific legislation rather than a DSA-style comprehensive law. Ley 2489 de 2025, enacted July 2025, imposes age-verification, privacy-by-design, parental-control, and bi-annual-reporting obligations on digital platforms with respect to minors. No general intermediary liability statute exists, and the internet is rated 'Free' by Freedom House (2025) with no systemic government censorship or blocking.

Framework: CONPES 3995 (2020), National Digital Trust and Security Policy; Decree 338 of 2022, Digital Security Governance and Critical Infrastructure; Law 1581 of 2012, Personal Data Protection with breach notification; MinTIC / ColCERT as primary governance bodies; National Digital Security Strategy 2025-2027

Colombia does not yet have a single comprehensive cybersecurity law. Its framework rests on a national policy instrument (CONPES 3995, 2020), a regulatory decree on critical cyber infrastructure and incident management (Decree 338, 2022), and data-protection law (Law 1581, 2012) enforced by the Superintendence of Industry and Commerce (SIC). Draft bills to create a National Digital Security Agency and a standalone cybersecurity statute have been filed in Congress but remain unenacted as of mid-2026, while the government launched a National Digital Security Strategy 2025-2027 as an executive roadmap.

Framework: Law 1258 of 2008 (SAS regime); Decree 1068 of 2015 as amended by Decree 119 of 2017 (foreign investment regime); Banco de la República foreign exchange regulations; Cámara de Comercio commercial registry

Colombia permits up to 100% foreign ownership in virtually all economic sectors, with the Sociedad por Acciones Simplificada (SAS) being the dominant vehicle for incorporation, it requires no minimum paid-in capital, no public deed, and can be formed online through the Cámara de Comercio's virtual platform. The national single-investment window (VUI) coordinates procedures across the Chamber of Commerce, DIAN (tax authority), and Banco de la República, making the core registration achievable in 3-7 business days, though foreign investors must also register their capital with the Banco de la República within prescribed exchange-control timelines.