Colombia tightens fraud and Open Finance rules

New obligations in identity theft cases

A recent Colombian rule on financial identity theft says that once a possible impersonation is reported, the company must suspend charges tied to the product allegedly acquired without authorization and correct credit reports while the fraud investigation moves forward. In addition, the victim has 20 business days, counted from the moment the issue is reported to the merchant, to file a complaint with the competent authority and submit the required supporting documents.

The measure is meant to bring more order to how these cases are handled on the commercial side and in credit records during the period when the company is determining whether a fraudulent transaction occurred. During that time, the obligation to stop charges and update reports remains in effect while the documentation provided is reviewed.

Open Finance, SARLAFT and financial oversight

The regulatory change also adds to other compliance demands affecting financial entities supervised by Colombia’s Financial Superintendency, including Open Finance and SARLAFT, according to Facephi’s material on regulation in Colombia and Open Finance in 2026. Together, these frameworks strengthen requirements around data control, traceability, and identity verification in financial operations.

The update also comes as Colombia continues adjusting anti-money laundering controls with an impact on cryptocurrencies, according to CriptoNoticias material included among the available sources. While that content does not provide additional details in the research supplied, it is part of the regulatory backdrop surrounding supervised entities.

For regulated firms, the combination of identity theft controls, SARLAFT requirements, and Open Finance developments raises the bar for coordination between customer service, risk management, and compliance, especially when a possible stolen identity must be addressed quickly and the case documented.