On 8 September 2026, the Superintendence of Industry and Commerce (SIC) announced a public consultation to receive technical and legal input for the construction of guidelines, recommendations, and protocols on identity verification mechanisms and the processing of personal data in Colombia.
This initiative is part of the regulations to be issued by the SIC under Law 2573 of 2026, whose purpose is to strengthen the protection of individuals against negative reports in credit information bureaus arising from identity theft cases, particularly those related to obligations undertaken with telecommunications operators and financial institutions.
Key takeaways
- Through Law 2573 of 2026, the Colombia Congress adopted a set of measures aimed at strengthening the protection of individuals against negative reports in credit information bureaus arising from identity theft cases. These measures seek to prevent adverse effects on individuals' credit ratings, particularly when they result from obligations fraudulently incurred with telecommunications operators, financial institutions, or credit establishments (the "entities subject to these requirements").
- As part of this regulatory framework, Article 5 of Law 2573 of 2026 established an obligation for the entities subject to these requirements, and any other entity carrying out similar activities, to implement sufficient and reasonable digital security measures. These measures must make it possible to verify the identity of individuals and the authenticity of documents submitted for the acquisition of financial or credit products, services, or obligations.
- For the implementation of this article, its paragraph 1, granted the SIC and the Financial Superintendence of Colombia, in coordination with the Information and Communications Technologies Ministry, the authority to regulate protocols for the timely handling of reports of possible identity theft cases submitted to the entities subject to these requirements. As part of these regulations, the authorities must define the appropriate mechanisms, tools, and methodologies to ensure the proper identification of individuals.
In more detail
In compliance with this obligation, the SIC opened a public consultation addressed to all interested parties for the purpose of receiving technical and legal inputs to contribute to the preparation of protocols on identity verification mechanisms and the processing of personal data within the framework set forth in Law 2573 of 2026.
For this purpose, the authority made available a form through which it seeks to gather information on matters related to the identity verification technologies available in the market, including their effectiveness, accuracy, reliability, and the factors that may affect their performance. The questionnaire also addresses issues relating to the processing of personal data involved in these technologies and the risks that their implementation could pose to data subjects' rights.
Likewise, the consultation seeks to obtain comments and proposals on possible regulatory models, technical standards, international best practices, and considerations related to the implementation and operating costs of these tools, among other matters relevant to the future regulations.
For this purpose, the SIC established the following schedule for the public consultation:
| No. | Activity | Dates |
|---|---|---|
| 1 | Public consultation | Between 8 September and 25 September 2026, at 4:00 p.m. |
| 2 | Selection of participants | From 28 September to 2 October 2026 |
| 3 | Working sessions | From 5 October to 16 October 2026 |
| 4 | Publication of the proposed protocol for comments | 2 November 2026 |
|
5 |
Issuance of the regulations |
20 November 2026 |
Additional information
The press release issued by the SIC regarding this public consultation may be accessed, in Spanish, here, while the form enabled for submitting comments and observations is available here.
Please do not hesitate to contact us if you have any questions or require our assistance.