Colombia orders banks to cover card fraud

Colombia’s Superintendency of Finance said banks must absorb card fraud losses and return money stolen from users when they fail to meet security rules. The ruling points to cases involving no early alerts, failures in control protocols, including two-factor authentication, and delays in blocking financial products after a customer report.

What did the Superfinanciera say about card fraud?

The agency said liability falls on banks when it is proven that they did not meet their security obligations. According to Noticias RCN, the rule applies when there were no early alerts, control protocols failed, or the financial product was not blocked in time after the user reported the incident.

That standard puts the focus on the financial institution’s operational response and its ability to react to unauthorized activity. The material reviewed did not identify specific cases, but it did outline the regulator’s general position on when customers should be reimbursed.

What happened with Coltefinanciera?

In September 2026, the Superintendency of Finance confirmed a sanction against Coltefinanciera S.A. and set a fine of 295.5 million pesos for failures in its approval processes for politically exposed persons, or PEPs, and in monitoring certain users.

La República reported that those failures were identified during a Superintendency visit in early 2024. The sanction was formalized in Resolution 1299 of September 7, 2026, where the regulator ruled on the company’s appeal and upheld the fine, although at a lower amount than the first-instance penalty.

According to Coltefinanciera, as reported to La República, the case is directly tied to Sarlaft compliance failures. The company cited shortcomings in the approval of two PEPs and in the monitoring of certain users, in a case that reinforces regulatory scrutiny of anti-money laundering and terrorist financing risk management.

La República also said the 295,560,362 peso fine must be paid to the National Treasury, which sets the fiscal destination of the penalty imposed by the Superintendency.

How does this fit into the regulator’s agenda?

The latest decisions align with the public message from the financial superintendent, who has called for a more efficient, competitive, and dynamic financial system, with emphasis on security and protection for financial consumers.

Caracol Radio reported that security, consumer protection, and financial stability are pillars of that agenda. In that context, requirements on transaction security, client monitoring, and compliance are not isolated measures, but part of a broader regulatory roadmap for Colombia’s financial system.