Colombia

The Superintendencia Financiera de Colombia or “SFC” (Financial Superintendence of Colombia) is the primary financial supervisory authority in Colombia responsible for the supplementary regulation (at the circular level), inspection and supervision of financial institutions, including banking and credit institutions, insurance, pension funds, capital markets, and certain payments processors.

The Unidad de Regulación Financiera or “URF” (Financial Regulation Unit) is the governmental entity within the Ministry of Finance and Public Credit responsible for the core regulations (at the decree level) of financial institutions, including banking and credit institutions, insurance, pension funds, and capital markets.

The Banco de la República (Central Bank of Colombia) is the country’s monetary, and financial stability authority. It contributes to the proper functioning of payment systems, regulating and operating the national payment systems infrastructure, including the CUD (large-value payment system) and the Bre-B instant payment platform launched in October 2025. Under Decreto 1069 of 2025, the Banco de la República plays a key role in overseeing instant inter-entity settlement systems.

Financial institutions in Colombia may be subject to a number of different legal and regulatory requirements when they use cloud services. Relevant regulations include:

• Circular Externa 007 of June 5, 2018 (which amended the Legal Basic Circular 029 of 2014), establishes the minimum requirements for information security and cybersecurity management that financial institutions and other entities subject to the regulatory oversight of the SFC must adopt.

• Circular Externa 005 of March 11, 2019 (which amended the Legal Basic Circular 029 of 2014), establishes the rules that financial institutions and other entities subject to the regulatory oversight of the SFC must follow when using cloud services to support material activities related to their corporate purpose or their financial and accounting management.

• Circular Externa 004 of February 7, 2024 establishes the technological, security and other standards necessary to promote interoperability and the development of open finance.

• Circular Externa 006 of 2025 (New Legal Basic Circular) completes the SFC’s regulatory streamlining process, reissuing and consolidating the entire Legal Basic Circular. It integrates, updates, and simplifies over five decades of financial regulation, including the cloud services (CE 005/2019) and cybersecurity (CE 007/2018) requirements previously part of LBC 029 of 2014.

• Decreto 0368 of April 7, 2026 (Mandatory Open Finance System) establishes Colombia’s mandatory Open Finance System (SFA), amending Decreto 2555 of 2010. It requires credit institutions, SEDPEs, trust companies, pension fund managers, insurers, and other supervised entities to share customer data with authorized third parties via standardized APIs, replacing the previous voluntary framework under Decreto 1297 of 2022.

• Circular Externa 001 of February 3, 2026 (Open Finance Transition Regime) extends the deadlines for supervised entities to implement the architecture, security and technology standards required under the open finance framework (CE 004/2024). It provides a transition period for entities to comply with interoperability and API requirements.

• Decreto 1069 of October 15, 2025 (Instant Payments Regulation) introduces the regulatory framework for payment orders and funds transfers. It mandates that entities with more than 1.5 million active demand deposit accounts offer instant inter-entity transfers, creates the National Payments Council, sets service availability levels (99.0%–99.5%), and regulates refunds, reversals, and fraud management.

• Law 2294 of 2023 (Article 89) provides the legislative mandate for Colombia's mandatory Open Finance system, authorizing the government to issue implementing decrees for the establishment of a comprehensive open data-sharing framework for the financial sector.
  

Customers that have questions about the applicable regulations and guidelines, including how these may apply to their use of AWS services or how they can leverage AWS services to support their compliance, can reach out to their account representative.

Regulations are changing rapidly in this space, and AWS is working to help customers proactively respond to new rules and guidelines. AWS encourages its customers to obtain appropriate advice on their compliance with all regulatory and legal requirements that are relevant to their business, and local regulations, guidelines and laws.

AWS is committed to offering customers a strong compliance framework and advanced tools and security measures that customers can use to evaluate meet, and demonstrate compliance with applicable legal and regulatory requirements.

Financial institutions who are using or planning to use AWS services can take the following steps to better understand their compliance needs:

1. Consider the purpose of the workload(s) under consideration and the relevant categories of data in order to anticipate which legal and regulatory requirements may apply.

2. Assess the materiality or criticality of the relevant workload(s) in light of local requirements. For example, Circular Externa 005 of March 11, 2019 requires financial institutions to submit certain information to the SFC before moving certain material workloads and processes to the cloud.

3. Review the AWS Shared Responsibility Model and map AWS responsibilities and customer responsibilities according to each AWS service that will be used. Customers can also use AWS Artifact to access AWS’s audit reports and conduct their assessment of the control responsibilities.

Customers who have further questions about how AWS services can enable their security and compliance needs, or who would like more information, can contact their account representative.

Financial institutions in Colombia using AWS services should also consider applicable privacy requirements, including Colombia’s personal data protection law, Ley Estatutaria 1581 of 2012, as regulated by decree No. 1377/2013 and decree No. 1074/2015, as well as Ley Estatutaria 1266 of 2008.

The Superintendencia de Industria y Comercio or “SIC” is Colombia’s National Data Protection Authority, responsible for monitoring and ensuring compliance with Laws 1266 of 2008 and 1581 of 2012. The SIC has the power to impose sanctions, issue guidelines, and investigate complaints regarding the processing of personal data by both public and private entities, including financial institutions.

SIC Circular Externa No. 003 of December 19, 2025 introduces optional model contractual clauses for international transfers and transmissions of personal data. This provides one additional, pre-approved pathway for data transfers to countries without adequate protection levels per Article 26 of Law 1581.

SIC Circular Externa No. 002 of October 7, 2025 establishes new guidelines and requirements for registration of technology transfer contracts involving personal data. It requires a data protection assessment when technology transfers include datasets with personal data or when the technology enables processing of personal data.

The AWS whitepaper, Using AWS in the Context of Common Privacy and Data Protection Considerations provides useful information to customers using AWS cloud services to store or process personal data.