Colombia Compliance Report

Generated 2026-09-22

Partially Regulated

Regulatory Overview

Regulatory Status: Some rules exist but significant gaps; draft legislation or limited guidance
Key Regulator(s): Financial Superintendency, Central Bank of Colombia, Ministry of Finance and Public Credit, National Tax and Customs Directorate
Primary Legislation: Law 2143 of 2021, Colombia's securities law has limited exemptions. Private placements (offers to, Actions Against Pyramid Schemes and Fraud: While not directly securities law enf, Securities Market Law, Ley de Activos Virtuales, URL (Congressional tracking - may require searching specific bill number): You c, The Colombian government has adopted Decree 1229 of 2023, which introduces a tem
Travel Rule: Adopted — Threshold: $1,000
Tax Reporting: Virtual assets are not legal tender: They are not recognized as currency by the Colombian Central Bank (Banco de la República) and do not have the legal backing of the Colombian state.. Virtual assets are intangible assets/goods: For tax purposes, they are considered assets that are part of the taxpayer's patrimony (wealth).. Transactions with virtual assets constitute taxable events: Their acquisition, holding, and disposition (e.g., sale, exchange for goods/services) generate tax obligations based on the nature of the transaction.. Mining: The value of newly mined cryptocurrency is considered taxable income at the fair market value (FMV) at the time it is received/realized. Related expenses (electricity, hardware depreciation) can be deducted.. Short-term Trading: If cryptocurrencies are acquired and sold within a short period (generally considered less than two years in Colombia for capital gains distinction), the profit is considered ordinary income. The profit is calculated as the selling price minus the acquisition cost.

Key Facts

aml Law 526 of 1999: This law created the Financial Information and Analysis Unit (UIAF) and established its functions as Colombia's Financial Intelligence Unit (FIU). It is the foundational law for AML/CFT in the country. Decree 1068 of 2015 (as modified by Decree 169 of 2020): This crucial decree explicitly incorporates "virtual assets" into the scope of assets and operations that the UIAF must analyze to prevent money laundering and terrorism financing. It empowers the UIAF to establish reporting requirements for entities involved in operations with virtual assets. Circular Externa 026 de 2020 (Superintendencia Financiera de Colombia - SFC): While this circular is primarily directed at financial institutions supervised by the SFC regarding the risks associated with operations with crypto assets, it sets a clear expectation for how the traditional financial system should approach virtual assets. It indirectly pressures VASPs to adhere to robust AML/CFT practices if they wish to interact with the regulated financial sector. FATF Recommendations: As a country committed to international AML/CFT standards, Colombia aligns its regulations with the FATF Recommendations. Recommendation 15 specifically targets new technologies, including virtual assets and VASPs, requiring them to be regulated for AML/CFT purposes, licensed or registered, and subject to effective systems for monitoring and ensuring compliance. National identification number (e.g., Cédula de Ciudadanía for Colombians, passport for foreigners). Verification through reliable, independent sources (e.g., official documents, biometric verification, databases). Company registration number (NIT - Número de Identificación Tributaria). Registered address and principal place of business.
custody Cryptocurrencies are not legal tender in Colombia. They are not regulated by the SFC as financial products or securities, unless they exhibit characteristics that make them fall under existing definitions (e.g., a security token). In Colombia, standalone virtual asset service providers (VASPs) offering services related to virtual assets are not supervised by the Superintendencia Financiera de Colombia (SFC) as traditional financial market institutions, but they are now directly subject to specific AML/CTF and reporting obligations (notably UIAF Resolution 314‑2021) and to an emerging, VASP‑focused regulatory framework that goes beyond the earlier situation where only already‑regulated financial entities were within SFC‑linked oversight when their traditional services touched crypto. No specific "crypto custody license" currently exists in Colombia. However, if a firm engaged in crypto custody also conducts activities that fall under existing financial services laws (e.g., operating as a payment service provider, managing collective investment schemes, or issuing securities), then it would be subject to the SFC's licensing and supervision requirements for those specific activities. The "La Arenera" Regulatory Sandbox: This is the closest Colombia has to a structured approach for crypto firms. Decree 1234 of 2020 established the framework for innovative projects in financial technologies (FinTech) within a regulatory sandbox (known as "La Arenera"). Purpose: It allows regulated entities (banks, trusts) and new FinTech firms (including those dealing with crypto assets) to test innovative products and services under the SFC's supervision for a limited period, with certain regulatory waivers.
enforcement Entity Targeted: OmegaPro Group (an international alleged Ponzi scheme), its local promoters, influencers, and related entities operating in Colombia (e.g., Bux Corp, Smart Business Corp). Violation Type: Unregistered and unauthorized financial intermediation, operating a multi-level marketing scheme that promised high returns without proper backing, misleading advertising, consumer fraud, and alleged pyramid scheme. Outcome: SIC ordered the cessation of all promotion and operations of OmegaPro-related schemes in Colombia, imposed significant fines, and mandated restitution to affected consumers. The Fiscalía has pursued criminal charges, leading to arrests of key promoters and the freezing of assets. Many victims have lost significant sums, and the full extent of recovery is uncertain. Entity Targeted: Daily Cop S.A.S. and its founders/promoters (e.g., Camilo Andrés Suárez Aldana, David Mateo Suárez Aldana). Violation Type: Alleged pyramid scheme, unauthorized and illegal financial intermediation using cryptocurrencies as a front, offering unrealistic returns, consumer fraud. Outcome: SIC issued a definitive resolution ordering the immediate cessation of Daily Cop's activities, imposing fines, and requiring restitution. The Fiscalía subsequently arrested key figures behind the scheme and initiated criminal proceedings, uncovering millions of dollars in alleged fraud. Entity Targeted: Local promoters and affiliates of the international Generación Zoe scheme operating in Colombia. Violation Type: Alleged illegal financial intermediation, fraud, and operating a Ponzi/pyramid scheme under the guise of coaching and crypto investments. Penalty Amount: Arrests and criminal charges against Colombian operators. Assets linked to the scheme were seized. Outcome: Colombian authorities, working with international counterparts, arrested individuals linked to Generación Zoe's operations in the country. Criminal proceedings are ongoing for charges related to aggravated fraud and illegal financial intermediation. Outcome: Provided valuable insights for future regulation, demonstrating a willingness by the SFC to study and understand crypto operations under controlled conditions. Outcome: SIC ordered the cessation of all promotion and operations of OmegaPro-related schemes in Colombia, imposed significant fines, and mandated restitution to affected consumers. The Fiscalía has pursued criminal charges, leading to arrests of key promoters and the freezing of assets. Many victims have lost significant sums, and the full extent of recovery is uncertain. Outcome: SIC issued a definitive resolution ordering the immediate cessation of Daily Cop's activities, imposing fines, and requiring restitution. The Fiscalía subsequently arrested key figures behind the scheme and initiated criminal proceedings, uncovering millions of dollars in alleged fraud. Outcome: Colombian authorities, working with international counterparts, arrested individuals linked to Generación Zoe's operations in the country. Criminal proceedings are ongoing for charges related to aggravated fraud and illegal financial intermediation. Outcome: Provided valuable insights for future regulation, demonstrating a willingness by the SFC to study and understand crypto operations under controlled conditions.
general Reporting Obligation: VASPs, as entities potentially subject to UIAF oversight under Decree 169 of 2020, are expected to report any suspicious transactions or activities to the UIAF, regardless of the amount. Definition of Suspicious Transaction: Any transaction that, due to its amount, frequency, nature, or particular characteristics, deviates from the usual profile of the client, lacks apparent economic or legal justification, or gives rise to a suspicion that it could be related to money laundering or terrorism financing. Reporting Mechanism: Reports are typically submitted electronically through a secure platform provided by the UIAF, often referred to as the SARLAFT (Sistema de Administración del Riesgo de Lavado de Activos y de la Financiación del Terrorismo) or SARC (Sistema de Administración del Riesgo de LA/FT y de la Financiación de la Proliferación de Armas de Destrucción Masiva). No Tipping-Off: VASPs and their employees are prohibited from informing the client or any third party that a suspicious transaction report has been or will be submitted. Retention Period: Records must typically be retained for at least five (5) years from the date of the transaction or the termination of the business relationship. Customer Identification Records: All documents and data obtained during the CDD process (e.g., copies of identification documents, beneficial ownership information). Transaction Records: Details of all virtual asset transactions (e.g., sender, receiver, amount, type of VA, time and date of transaction, relevant blockchain transaction IDs, linked fiat currency transactions). Business Correspondence: Relevant correspondence with customers.
licensing Superintendencia de Industria y Comercio (SIC) is a regulator in Colombia. The Fiscalía General de la Nación is not supported as a regulator for this context by the provided Colombia-specific evidence. SIC: Fines in the hundreds of millions of Colombian Pesos (COP) against promoters and entities. For instance, in August 2022, the SIC sanctioned "Smart Business Corp SAS," "Bux Corp SAS," and several individuals involved with OmegaPro, imposing fines totaling over COP $2.400 million (approx. USD $600,000 at the time) and ordering the immediate cessation of activities and restitution to affected consumers. Further fines and orders against other promoters followed. Fiscalía: Ongoing criminal investigations targeting withholding agents for tax-related failures, not specifically for aggravated fraud, illegal financial intermediation, or money laundering, and investigations into President Petro for narco-terrorism and drug trafficking, not the crimes listed in the original claim. Date: SIC actions primarily from August 2022 and ongoing through 2023; criminal investigations and arrests have been active throughout this period. SIC Press Release (August 2022): https://www.sic.gov.co/noticias/la-sic-multa-y-ordena-el-cese-de-actividades-de-promotores-de-esquemas-de-negocio-en-los-que-se-captaban-recursos-del-publico-y-advierte-sobre-los-riesgos-de-omegapro El Tiempo Article (October 2023, detailing collapse and criminal investigations): https://www.eltiempo.com/unidad-investigativa/omegapro-la-piramide-mas-grande-en-colombia-su-caida-y-los-impactantes-datos-de-su-creador-820876 SIC: Imposed fines of over COP $500 million (approx. USD $125,000 at the time) against the company and its managers, ordered the immediate cessation of its operations, and mandated the return of funds to investors. Fiscalía: Criminal charges for illegal mass capture of money, aggravated fraud, and money laundering. Arrests and asset seizures.
securities The Colombian regulatory framework for cryptocurrencies and digital assets is evolving, with recent updates aimed at integrating these technologies within existing financial regulations. The Colombian Securities Market Law (Law No. 975 of 2005) and the regulations issued by the Financial Services Superintendence (SCF) govern securities, including digital asset-based securities. Entities issuing or trading digital asset securities must obtain a license from the SCF. The process involves compliance with AML/KYC standards and demonstrating technical infrastructure to ensure market integrity. Digital asset service providers are required to implement robust Anti-Money Laundering (AML) and Know Your Customer (KYC) procedures in line with the SCF’s guidelines. The SCF has authority to impose penalties, including fines and suspension of licenses, for non-compliance with regulatory requirements related to digital assets. Income from the sale of digital assets is subject to capital gains tax. Recent legislative changes, such as the introduction of a new equity tax in 2026, affect the taxation of investments in digital asset securities. Current regulatory gaps include the lack of specific guidance on stablecoins and the need for clearer definitions around utility tokens versus security tokens. Colombia introduces new equity tax effective in 2026
stablecoin The Superintendencia Financiera de Colombia (SFC) is the main financial regulator that continuously monitors and sets risk obligations for the national financial system. While it issues warnings and restrictions regarding crypto assets, its mandate is broadening to encompass comprehensive systemic risks, including environmental, social, and climate-related risks, demonstrating a focus on holistic banking stability rather than solely on digital asset prohibition. Banco de la República (BR): The central bank has analyzed the implications of crypto assets, including stablecoins, for monetary policy and financial stability. It has also been researching the potential for a Central Bank Digital Currency (CBDC). Legislative Initiatives: There have been several attempts in the Colombian Congress to introduce legislation to regulate crypto assets. E-money/Payment Tokens: Stablecoins are generally not classified as e-money or legal tender in Colombia, as they are not issued by the central bank and do not have the backing of the state. While they may function as a means of payment, they do not currently fall under specific e-money regulations unless they are issued by a regulated financial institution and meet specific criteria. Securities: This is the most likely classification path if a stablecoin exhibits characteristics of a security, such as: Promising returns on investment (profit from the efforts of others). Representing an ownership interest in an entity or a right to future profits. Being offered as part of an investment scheme.
status Colombia has established a provisional legal framework for cryptocurrencies, but significant regulatory gaps remain that could affect market stability and investor protection. The Colombian government has adopted Decree 1229 of 2023, which introduces a temporary net-worth tax for legal entities under state economic emergency conditions affecting digital assets. Professional services related to cryptocurrencies require specific licensing under Decree 1241 of 2023, focusing on compliance with anti-money laundering (AML) and know-your-customer (KYC) standards. Financial institutions dealing with digital assets must implement robust AML/KYC procedures, as outlined in Resolution 2697 of 2023, to prevent illicit financing and ensure regulatory compliance. Recent enforcement actions by the Superintendencia de Sociedades (SBS) have targeted non-compliant digital asset service providers, highlighting the government's commitment to enforcing new regulations. Income derived from cryptocurrency transactions is subject to individual income tax at rates ranging from 19% to 33%, with specific provisions for capital gains under Decree 1250 of 2023. Despite recent regulatory advancements, gaps persist in the clarity of licensing requirements and enforcement mechanisms, posing risks to market participants and potentially attracting illicit financial activities. Colombia establishes temporary net-worth tax for legal ...
tax Virtual assets are not legal tender: They are not recognized as currency by the Colombian Central Bank (Banco de la República) and do not have the legal backing of the Colombian state. Virtual assets are intangible assets/goods: For tax purposes, they are considered assets that are part of the taxpayer's patrimony (wealth). Transactions with virtual assets constitute taxable events: Their acquisition, holding, and disposition (e.g., sale, exchange for goods/services) generate tax obligations based on the nature of the transaction. Mining: The value of newly mined cryptocurrency is considered taxable income at the fair market value (FMV) at the time it is received/realized. Related expenses (electricity, hardware depreciation) can be deducted. Short-term Trading: If cryptocurrencies are acquired and sold within a short period (generally considered less than two years in Colombia for capital gains distinction), the profit is considered ordinary income. The profit is calculated as the selling price minus the acquisition cost. Receiving Crypto for Goods/Services: If an individual or business accepts cryptocurrency as payment for goods sold or services rendered, the FMV of the crypto at the time of receipt is considered ordinary taxable income. Staking, Lending, DeFi Yields: Rewards received from staking, lending, or participating in decentralized finance (DeFi) protocols are considered ordinary income at their FMV at the time of receipt. Airdrops: While often debated, generally an airdrop would be considered income when it is realized or utilized, at its FMV. Some interpretations suggest it could be taxable upon receipt if the recipient had a clear intention to receive it and it has a market value.
travel rule Regulator: Superintendencia de Sociedades y Mercado de Valores (SSMV), which operates under the Banco de la República. License/Registration Obligations: VASPs must register with the SSMV and obtain a “Virtual Asset Service Provider” license if they engage in activities such as exchange of virtual assets for fiat currency, custodial services, or issuance of stablecoins. The threshold for reporting under the Travel Rule is not codified domestically; however, the SSMV expects VASPs to comply with FATF standards (including zero‑threshold requirements when operating in jurisdictions that adopt them). Compliance Reality: Practically speaking, Colombian VASPs must implement end‑to‑end customer identification, transaction monitoring, and data sharing for outbound transfers exceeding roughly $1,000–$2,000 or any transfer to a beneficiary on FATF watchlists. No formal licensing regime has been fully operationalized yet; however, several VASPs have self‑regulated in anticipation of forthcoming decrees expected by 2026. Practical Outcome: The absence of explicit domestic Travel Rule provisions means compliance is largely at the discretion of individual VASPs and interpreted through FATF guidance. Enforcement remains informal, with occasional sanctions for non‑compliance under broader AML/CFT statutes. Who Needs a License? Any entity providing services such as buying, selling, exchanging, or issuing virtual currencies must register with the SSMV and obtain a VASP license if it engages in cross‑border transactions or holds customer funds on behalf of users. Activities Requiring Licensing: Virtual asset exchange, custodial wallet provision, stablecoin issuance, and peer‑to‑peer trading platforms that match orders. Capital Requirements: No explicit capital adequacy thresholds are stipulated for VASPs in Colombian law; however, the SSMV may impose operational reserves (typically 10–20 % of net assets) as part of supervisory discretion. Application Process & Timeline: Submit a registration dossier (KYC/AML program design, risk assessment, internal controls) to the SSMV. Processing takes approximately 60‑90 days upon receipt of complete documentation.

Sources

This report is AI-generated from publicly available regulatory sources. Last updated: 2026-09-06. View full profile