Banking & Finance in Colombia

Colombia's banking and finance sector is governed by a sophisticated regulatory architecture that combines constitutional mandates, statutory law, and supervisory decrees. Foreign investors, lenders, and fintech operators entering this market face licensing requirements, capital controls, anti-money laundering obligations, and consumer protection rules that differ materially from those in common-law jurisdictions. This article maps the legal framework, identifies the key instruments available to market participants, and explains the practical risks of non-compliance - covering financial regulation, lending structures, project finance, AML obligations, and the evolving fintech regime.

Colombia's financial system rests on the Estatuto Orgánico del Sistema Financiero (Organic Statute of the Financial System, Decree 663 of 1993), which consolidates the rules governing credit institutions, insurance companies, and securities intermediaries. The Constitución Política de Colombia (Political Constitution) grants Congress the power to regulate financial activities in the public interest, and Article 335 of the Constitution classifies financial intermediation as a public-utility activity subject to state oversight.

Day-to-day supervision falls to the Superintendencia Financiera de Colombia (Financial Superintendency of Colombia, SFC). The SFC is the primary prudential and conduct regulator for banks, financial corporations, commercial financing companies, and trust entities. It issues binding circulars - the most important being the Circular Básica Jurídica and the Circular Básica Contable y Financiera - that translate statutory rules into operational requirements. The Banco de la República (Central Bank of Colombia) holds monetary policy authority and administers foreign exchange regulations under Law 9 of 1991 and its implementing decrees.

A second-tier regulator, the Unidad de Información y Análisis Financiero (Financial Intelligence Unit, UIAF), operates under the Ministry of Finance and coordinates anti-money laundering intelligence. Entities subject to AML obligations must report suspicious transactions to the UIAF within strict deadlines.

The Ministerio de Hacienda y Crédito Público (Ministry of Finance and Public Credit) sets overall financial policy and issues enabling decrees that the SFC then implements. This layered structure means that a single banking transaction can engage rules from at least three separate authorities, each with independent enforcement powers.

In practice, it is important to consider that foreign institutions often underestimate the SFC's broad discretionary authority to impose corrective measures, including management intervention and licence suspension, without prior judicial authorisation. A common mistake is treating SFC circulars as mere guidance rather than binding secondary legislation - non-compliance triggers the same sanctions as statutory violations.

Establishing a banking presence in Colombia requires a formal authorisation from the SFC. The Organic Statute distinguishes between several types of licensed entities:

• Establecimientos bancarios (commercial banks) - full-service deposit-taking and lending institutions.
• Corporaciones financieras (financial corporations) - focused on corporate lending and investment.
• Compañías de financiamiento (commercial financing companies) - consumer and commercial credit without deposit-taking.
• Sociedades fiduciarias (trust companies) - asset management and fiduciary services.

Each category carries distinct minimum capital requirements, activity restrictions, and governance obligations. The SFC sets minimum paid-in capital thresholds by regulation, and these are periodically adjusted. Lawyers' fees for a full licensing process usually start from the low thousands of USD, and the process itself typically takes between 90 and 180 calendar days from submission of a complete application, though complex cases extend beyond that range.

Foreign banks wishing to operate in Colombia may do so through a locally incorporated subsidiary, a branch (sucursal), or a representative office. A branch carries the same licensing requirements as a subsidiary but does not create a separate legal entity - the parent remains directly liable. A representative office may not conduct financial intermediation and is limited to promotional and liaison activities.

Cross-border lending - where a foreign bank extends credit to a Colombian borrower without establishing a local presence - is permitted under certain conditions but triggers foreign exchange registration obligations. Under the foreign exchange regime administered by the Banco de la República, cross-border loans must be registered as foreign debt (endeudamiento externo) within the prescribed period, generally before or at disbursement. Failure to register does not void the loan but prevents the borrower from legally remitting principal and interest payments abroad, creating a practical blockage that is difficult to unwind.

A non-obvious risk for foreign lenders is the interaction between the foreign exchange regime and Colombia's usury ceiling. The Superintendencia Financiera publishes a monthly certificación de la tasa de usura (usury rate certificate) that caps the maximum interest rate on peso-denominated loans. For foreign-currency loans, different rate benchmarks apply, but the SFC monitors effective yields and can reclassify transactions. Structuring a cross-border facility without local counsel familiar with both regimes frequently results in unenforceable interest provisions.

To receive a checklist on licensing and market entry requirements for financial institutions in Colombia, send a request to info@vlolawfirm.com.

Colombian lending law draws on the Código de Comercio (Commercial Code) and the Código Civil (Civil Code) for the formation and enforcement of credit agreements. Secured lending relies on a set of instruments whose enforceability depends heavily on correct registration and perfection.

The garantía mobiliaria (movable asset security) regime was modernised by Law 1676 of 2013, which introduced a unified registry - the Registro de Garantías Mobiliarias - administered by the Confederación Colombiana de Cámaras de Comercio (Confecámaras). Under Article 3 of Law 1676, a security interest in movable assets is perfected by registration and takes priority over subsequently registered interests and unperfected claims. The registry is electronic and publicly searchable, which represents a significant improvement over the pre-2013 fragmented system.

Real property security takes the form of a hipoteca (mortgage) governed by the Civil Code. A mortgage must be executed by public deed (escritura pública) before a notary and registered at the Oficina de Registro de Instrumentos Públicos (Public Instruments Registry Office) for the relevant municipality. Priority runs from the date of registration, not execution. Lawyers' fees for mortgage documentation and registration vary by transaction size but generally start from the low thousands of USD for mid-market transactions.

Enforcement of security in Colombia can proceed through two main channels. The first is the proceso ejecutivo (enforcement proceeding) before a civil court, governed by the Código General del Proceso (General Procedural Code, Law 1564 of 2012). Under Article 422 of Law 1564, a creditor holding an executive title - which includes a notarised loan agreement, a promissory note (pagaré), or a court judgment - may initiate enforcement without a prior declaratory phase. The court issues a payment order (mandamiento de pago) and, if the debtor does not pay or oppose within ten business days, proceeds to asset seizure and auction.

The second channel is extrajudicial enforcement of movable asset security under Law 1676, which allows a secured creditor to take possession of and sell collateral without court involvement, provided the security agreement contains an explicit extrajudicial enforcement clause and the debtor has been given prior notice. This mechanism is faster - in practice, extrajudicial enforcement can be completed in weeks rather than months - but it requires meticulous drafting of the security agreement and compliance with the notice requirements of Articles 59 to 65 of Law 1676.

A common mistake by international lenders is relying on foreign-law governed security documents without obtaining Colombian law opinions confirming local enforceability. Colombian courts apply the lex situs (law of the place where the asset is located) to the creation and enforcement of security over Colombian assets, regardless of the governing law chosen for the underlying loan agreement. A security package that is valid under New York or English law may be entirely unenforceable in Colombia if it was not created and perfected in accordance with Colombian law.

Practical scenario one: a European bank extends a USD 20 million term loan to a Colombian manufacturing company, taking a mortgage over the company's plant and a movable asset security over its machinery. The bank uses its standard English-law security documents without local adaptation. When the borrower defaults, the bank discovers that neither the mortgage nor the movable security was registered in Colombia. The bank must initiate a new security perfection process - which the borrower, now insolvent, contests - while unsecured creditors advance their claims. The cost of this mistake, measured in legal fees, delay, and reduced recovery, far exceeds the cost of proper structuring at the outset.

Colombia's anti-money laundering regime is among the most developed in Latin America. The core obligation for supervised entities is to implement a Sistema de Administración del Riesgo de Lavado de Activos y de la Financiación del Terrorismo (Risk Management System for Money Laundering and Terrorism Financing, SARLAFT). The SARLAFT framework is mandated by SFC Circular Externa 026 of 2008 and its subsequent amendments, and it applies to all entities under SFC supervision.

SARLAFT requires each institution to implement four stages: identification, measurement, control, and monitoring of ML/TF risk. Concretely, this means:

• Customer due diligence (CDD) and enhanced due diligence (EDD) for high-risk clients.
• Transaction monitoring systems calibrated to the institution's risk profile.
• Suspicious transaction reporting (Reporte de Operaciones Sospechosas, ROS) to the UIAF within the deadlines set by the UIAF's own instructions.
• Periodic risk assessments and board-level governance of the SARLAFT programme.

The UIAF, established by Law 526 of 1999, receives financial intelligence reports and shares them with law enforcement. Under Article 102 of the Organic Statute, financial institutions that fail to implement adequate AML controls face administrative sanctions from the SFC, including fines, suspension of operations, and revocation of licences. Individual officers responsible for compliance can face personal liability.

Many underappreciate the extraterritorial dimension of Colombian AML law. Colombian banks with correspondent relationships with foreign institutions must apply SARLAFT standards to those relationships and can be held responsible for facilitating transactions that, while legal in the foreign jurisdiction, constitute predicate offences under Colombian law. This creates a compliance burden for international banks seeking correspondent banking access in Colombia.

A non-obvious risk is the interaction between SARLAFT and Colombia's politically exposed persons (PEP) regime. Colombia maintains an extensive PEP list that includes not only government officials but also their family members and close associates up to a defined degree of relationship. Onboarding a Colombian PEP without enhanced due diligence - even for a routine commercial loan - constitutes a SARLAFT violation regardless of whether any actual ML/TF risk materialises.

Practical scenario two: a mid-sized Colombian commercial financing company onboards a new corporate client without conducting adequate beneficial ownership verification. The client's ultimate beneficial owner is a PEP. The company processes several transactions before the UIAF flags the relationship. The SFC opens an administrative investigation. The company faces fines and a mandatory remediation programme. The compliance officer is personally sanctioned. The entire episode could have been avoided with a robust CDD process at onboarding.

To receive a checklist on SARLAFT implementation and AML compliance for financial institutions in Colombia, send a request to info@vlolawfirm.com.

Colombia has developed one of the most active fintech regulatory environments in Latin America. The SFC operates a regulatory sandbox - the Espacio Controlado de Prueba (Controlled Testing Space) - introduced under Decree 1234 of 2020. The sandbox allows fintech companies to test innovative financial products and services under a temporary authorisation, with relaxed prudential requirements, for a defined period generally not exceeding two years.

Participation in the sandbox does not exempt a company from all regulation. The SFC issues a specific authorisation that defines the permitted activities, the maximum number of clients, the transaction limits, and the reporting obligations during the testing period. At the end of the period, the company must either obtain a full licence or cease the regulated activity.

The most commercially significant fintech categories in Colombia are:

• Plataformas de financiación colaborativa (crowdfunding platforms) - regulated under Decree 1357 of 2018, which permits both equity crowdfunding and debt crowdfunding (lending-based crowdfunding) subject to SFC registration and investor protection rules.
• Proveedores de servicios de pago (payment service providers, PSPs) - regulated under the payment systems framework administered jointly by the SFC and the Banco de la República.
• Entidades de depósito electrónico de dinero (electronic money institutions, EMIs) - authorised to issue electronic money and operate digital wallets under SFC supervision.

Crowdfunding platforms operating under Decree 1357 must register with the SFC, maintain minimum capital, implement investor suitability assessments, and cap individual investor exposure per project. The decree sets maximum fundraising limits per project, which the SFC can adjust by circular. Platforms that exceed these limits without authorisation are treated as unlicensed financial intermediaries and face the full range of administrative and criminal sanctions.

A common mistake by foreign fintech operators is assuming that a payment institution licence from another jurisdiction - including a European EMI licence or a Singaporean major payment institution licence - provides any form of mutual recognition in Colombia. It does not. Each activity must be separately authorised by the SFC, and the application process requires Colombian legal presence, local directors, and documentation in Spanish.

The lending-based crowdfunding regime deserves particular attention from international investors. Under Decree 1357, a crowdfunding platform may facilitate loans between Colombian resident borrowers and investors, including foreign investors, provided the platform is registered with the SFC and the foreign exchange implications of cross-border flows are managed in accordance with the Banco de la República's foreign debt registration rules. In practice, structuring a cross-border lending-based crowdfunding product that is simultaneously compliant with SFC rules, foreign exchange regulations, and SARLAFT requires multi-disciplinary legal input from the outset.

Practical scenario three: a European fintech company launches a lending-based crowdfunding platform targeting Colombian SMEs, relying on its EU authorisation and a technology partnership with a local company. It begins onboarding Colombian borrowers before obtaining SFC registration. The SFC issues a public warning, orders the platform to cease operations, and initiates an administrative investigation. The local partner faces joint liability. The company must unwind existing loan agreements and negotiate a remediation plan with the SFC before it can reapply for authorisation. The reputational and financial cost of this sequence substantially exceeds the cost of proper pre-launch legal structuring.

We can help build a strategy for fintech market entry and regulatory authorisation in Colombia. Contact info@vlolawfirm.com.

Colombia has a well-established project finance market, driven primarily by the government's large-scale infrastructure concession programme known as the Cuarta Generación (Fourth Generation, 4G) and its successor, the Quinta Generación (5G) programme. These programmes involve public-private partnerships (PPP) structured under Law 1508 of 2012, which governs concession agreements and risk allocation between the state and private sponsors.

Project finance in Colombia follows the standard limited-recourse structure: a special purpose vehicle (SPV) - typically a sociedad por acciones simplificada (simplified joint-stock company, SAS) or a sociedad anónima (SA) - is incorporated to hold the concession, enter into the loan agreements, and grant security over project assets and revenues. The choice between SAS and SA has governance implications: the SAS offers greater flexibility in shareholder agreements and management structures, while the SA is required for entities that wish to list securities publicly.

Security packages in Colombian project finance typically include:

• A hipoteca sobre bienes inmuebles (real property mortgage) over the project site.
• A garantía mobiliaria over movable assets, equipment, and receivables.
• A pledge (prenda) over the shares of the SPV.
• An assignment of the concession agreement's economic rights, subject to the grantor's consent.
• A direct agreement with the grantor (typically the Agencia Nacional de Infraestructura, ANI) allowing lenders to step in and cure defaults before the grantor terminates the concession.

The Agencia Nacional de Infraestructura (National Infrastructure Agency, ANI) is the counterparty for road, port, and airport concessions. The Agencia Nacional de Minería (National Mining Agency, ANM) governs mining concessions. Each agency has its own standard concession terms, and the negotiation of lender-protective provisions - particularly step-in rights and cure periods - requires direct engagement with the relevant agency.

Colombian project finance lenders must also navigate the foreign exchange regime carefully. Loan disbursements from foreign lenders to a Colombian SPV constitute foreign debt and must be registered with the Banco de la República. Debt service payments - principal, interest, and fees - can only be remitted abroad through the foreign exchange market (mercado cambiario) using authorised financial intermediaries. Any payment outside the mercado cambiario is illegal and triggers sanctions under the foreign exchange control regime.

A non-obvious risk in infrastructure project finance is the interaction between the PPP law and Colombia's administrative law regime. Concession agreements are administrative contracts (contratos estatales) governed by Law 80 of 1993 (Estatuto General de Contratación de la Administración Pública) and Law 1150 of 2007. The grantor retains unilateral modification and termination powers (potestades exorbitantes) that do not exist in private contracts. While Law 1508 limits the exercise of these powers in PPP concessions and provides for compensation, lenders must ensure that the direct agreement and the security documents address the financial consequences of a unilateral modification or early termination event.

State duties and registration costs for project finance security packages vary depending on the value of the assets and the number of instruments involved. Lawyers' fees for a full project finance transaction - covering due diligence, documentation, security perfection, and regulatory filings - typically start from the mid-to-high tens of thousands of USD for transactions above USD 50 million.

Many underappreciate the importance of obtaining a legal opinion from Colombian counsel on the enforceability of the entire security package before financial close. International lenders sometimes rely on opinions from their home-jurisdiction counsel that address only the loan agreement, leaving the Colombian security documents unreviewed. When enforcement becomes necessary, gaps in the security package emerge that could have been identified and remedied during the documentation phase.

To receive a checklist on project finance structuring and security perfection in Colombia, send a request to info@vlolawfirm.com.

What is the main practical risk for a foreign bank extending a loan to a Colombian borrower without local counsel?

The principal risk is that the security package - mortgages, movable asset security, and share pledges - may be unenforceable in Colombia if it was not created and perfected in accordance with Colombian law, regardless of the governing law chosen for the loan agreement. Colombian courts apply the lex situs to security over Colombian assets. Beyond enforceability, the foreign bank may also fail to register the loan as foreign debt with the Banco de la República, which prevents legal remittance of debt service payments abroad. These two errors together can render a secured cross-border loan effectively unsecured and illiquid. Engaging Colombian counsel before disbursement is the only reliable way to avoid this outcome.

How long does it take and what does it cost to obtain an SFC licence for a fintech company in Colombia?

The timeline for a standard SFC authorisation - outside the sandbox - ranges from approximately 90 to 180 calendar days from submission of a complete application, and complex cases can take longer if the SFC requests additional information. The sandbox process is faster in terms of initial authorisation but imposes ongoing reporting obligations and a hard deadline for transitioning to a full licence. Legal fees for the authorisation process, including preparation of the application, regulatory engagement, and documentation, usually start from the low thousands of USD and scale with the complexity of the business model. Capital requirements vary by entity type and are set by SFC regulation. Budgeting only for legal fees without accounting for minimum capital and ongoing compliance infrastructure is a common planning error.

When should a project finance lender consider international arbitration rather than Colombian court litigation for dispute resolution?

International arbitration is generally preferable for disputes involving a Colombian state entity as counterparty - such as a concession granted by the ANI - because it provides a neutral forum and limits the procedural advantages that state entities enjoy in domestic administrative courts. Colombia is a signatory to the New York Convention on the Recognition and Enforcement of Foreign Arbitral Awards, and Colombian courts have a generally cooperative record on enforcement of foreign awards. For purely private disputes between commercial parties, domestic arbitration before the Centro de Arbitraje y Conciliación of the Cámara de Comercio de Bogotá is faster and less expensive than international arbitration, and awards are enforceable through the Colombian courts under the same framework as foreign awards. The choice between forums should be made at the contract drafting stage, not after a dispute arises.

Colombia's banking and finance legal framework rewards careful preparation and penalises improvisation. The combination of a sophisticated supervisory regime, a mandatory AML system, a foreign exchange control architecture, and a developing but active fintech regulation creates a market where legal structuring is not a formality but a commercial necessity. Foreign investors, lenders, and fintech operators who engage Colombian legal expertise at the outset - on licensing, security perfection, AML compliance, and project finance structuring - consistently achieve better outcomes than those who attempt to adapt foreign-law templates to a jurisdiction with materially different rules.

We can assist with structuring the next steps for your banking or finance matter in Colombia. Contact info@vlolawfirm.com.

Our law firm VLO Law Firm has experience supporting clients in Colombia on banking, finance, and regulatory matters. We can assist with SFC licensing applications, cross-border lending structuring, SARLAFT compliance programmes, fintech regulatory authorisations, and project finance documentation. To receive a consultation, contact: info@vlolawfirm.com.