Colombia SFC Regulates Financial Cybersecurity

Colombia’s financial sector cybersecurity rules are led by the Superintendence of Finance of Colombia through External Circular 007 of 2018 and External Circular 005 of 2023, according to Computer Weekly en Español. The same report says supervised entities must report significant incidents to the Superintendence and colCERT immediately, within the first hours after detecting an intrusion or failure, although the available material does not specify the exact legal text or a precise deadline.

What framework regulates supervised financial entities today?

The Superintendence of Finance of Colombia sets the current framework through two specific circulars, 007 of 2018 and 005 of 2023, according to Computer Weekly en Español. In that reading, the authority appears as the body that defines the cybersecurity requirements applied to the financial sector.

The available material does not spell out the full content of those circulars, but it does identify them as the sector’s main reference points. That points to a continuous regulatory line between the two rules, rather than an isolated measure.

What happens after a significant incident?

Computer Weekly says supervised entities must report significant incidents to the Superintendence of Finance and to colCERT immediately, within the first hours after detecting the intrusion or failure. The obligation is described in operational terms, although the available source does not specify the exact deadline or reproduce the regulatory text.

The information also shows that the notice is not limited to a single channel. Communication reaches both the financial supervisor and the national response team, which suggests a two-recipient notification process.

What does the update to the Basic Legal Circular add?

Colombia’s National Institute of Public Accountants published a note on the new version of the Basic Legal Circular issued by the Superintendence of Finance. In the available results, that reference appears as part of the regulatory framework surrounding supervised entities, although the material provided does not confirm new adjustment deadlines or recent sanctions.

Based on what is available, the update serves as regulatory context, but not as a source for stating additional changes in reporting obligations or the sanctions regime. For this review, the firmest data remains the central role of Circulars 007 of 2018 and 005 of 2023 in supervising cybersecurity in the sector.