Colombia SFC opens comment period on open finance

The Superintendencia Financiera de Colombia has published draft External Circular 14 of 2026, which sets out instructions for managing conduct risks that affect financial consumers, while also opening two draft circular letters on the timetable for issuing information exchange standards in the open finance system. In both cases, comments are due Tuesday, Sept. 15, 2026, at 5:00 p.m.

What does the proposal on financial consumers ask for?

Draft External Circular 14 of 2026 sets out instructions for managing the risk of conduct that harms financial consumers, under the GERCO framework. The SFC's official notice says the document will remain open for comment until Sept. 15, 2026, at 5:00 p.m.

The regulator also kept active a supervisory line focused on assistance for people affected by disaster situations. On its page for "Jornadas de atención a la ciudadanía," the agency lays out instructions to reduce the impact of these events on financial consumers, with operational measures and special service channels.

What did it set out on open finance?

The SFC published two draft circular letters tied to the timetable for issuing information exchange standards in the open finance system, both dated Aug. 31, 2026. In both cases, suggestions must be sent through a completed matrix to finanzasabiertas@superfinanciera.gov.co, and the deadline is Sept. 15, 2026, at 5:00 p.m.

The agency reinforced that same deadline in a post on its official X account, where it reminded users that comments on the information exchange standards are due that day. The public reminder echoed the schedule already set out in the drafts posted on its institutional website.

How does this fit into its supervisory strategy?

The SFC describes its "Arenera" as a controlled testing space for understanding changes in financial products and services, identifying risks and generating evidence to strengthen supervision and regulation. In its official communication on that mechanism, the agency includes technological innovation among the factors relevant to cybersecurity and technology risk management in Colombia's financial system.

That approach sits alongside an active regulatory cycle. The vLex legal repository records External Circular 008 from the Superintendencia Financiera, dated Sept. 1, 2026, showing that the agency continued issuing rules in sequence during those days.

What market context does fraud and cybersecurity provide?

The regulatory debate comes amid figures showing pressure on the financial sector. Lavibrante cited a report on digital fraud in Colombia saying that, during 2024, 80% of fraud complaints filed by users with banks occurred over the internet, and the amount claimed reached 679 billion pesos.

At the same time, El Universal reported that, according to data presented at the 60th Asobancaria Banking Convention, banks invested 3.6 trillion pesos in 2025 in digital innovation and cybersecurity, up from 3.3 trillion pesos in 2024. The outlet added that 65.7% of the banking sector reported using artificial intelligence, machine learning, or other advanced analytics tools for early threat detection, an increase of 13.6 percentage points from 2024.

The same coverage said Asobancaria attributed those investments to keeping 99.9% of transactions free of fraud, with only 7 pesos out of every 100,000 transacted subject to fraud claims.

How does the fintech case fit in?

PPU Legal said fintech companies supervised by the Superintendencia Financiera are subject to the Financial Consumer Statute, while unsupervised firms fall under the general Consumer Statute overseen by the Superintendence of Industry and Commerce. In that framework, the firm described the coexistence of two consumer-protection regimes applying to financial and technology services.

The same analysis also qualified the scope of the "Arenera" created by Decree 1234 of 2020. According to PPU Legal, it has been a valuable milestone but one with limited practical impact, because it allowed testing with cryptoassets and the first issuance of a bond on blockchain, although it did not serve as a direct bridge to permanent licenses.