Colombia · SFC · Banco de la Republica · UIAF

Colombia financial licences and regulator dossier

Superintendencia Financiera de Colombia authorises and supervises banks, finance companies, SEDPE, fiduciary companies, securities intermediaries and infrastructure, investment funds, insurers, pension administrators and collaborative-financing companies. Banco de la Republica controls monetary, exchange and specified payment-system matters. UIAF leads the financial- intelligence and AML-reporting framework.

Talk to an advisor Browse entities for sale

Route facts

Jurisdiction facts

Integrated supervisor

SFC grants certificates or authorisations for financial, securities and insurance entities

Electronic deposits

SEDPE are specialised deposit and electronic-payment companies, not full banks

Fiduciary sector

Sociedades fiduciarias are separately authorised financial institutions

Collaborative finance

SFC supervises sociedades de financiacion colaborativa under their own category

Crypto boundary

SFC stated in 2026 that it had not authorised a general crypto custody, dealing or investment route

Capital basis

Entity class and risk determine minimum capital, solvency, reserves and customer-asset protection

Territorial reach

Colombian authorisation creates no automatic operating right outside Colombia

Review date

Regulatory position reviewed as of 11 July 2026

Regulatory perimeter

A fintech uses an existing regulated category

Colombia does not issue a single fintech licence. A digital savings or transaction model can require a bank, finance company, financial corporation, cooperative or specialised electronic- deposit and payment company. SEDPE have an exclusive statutory object: electronic deposits, payments and transfers, borrowing for their own operation and qualifying remittance. Their customer deposits and permitted activities are narrower than a bank's. A software wallet or technology supplier has no financial permission merely because it connects to an authorised entity.

SFC also regulates broker-dealers, exchanges, clearing and depository infrastructure, collaborative-financing companies, fiduciaries, fund managers, insurers and pension administrators. As of its official April 2026 innovation guidance, SFC had not authorised a general regime for supervised firms to custody, invest in, intermediate or operate virtual- currency business. Colombia should therefore not be sold as having an SFC VASP licence. A token can still trigger securities, payments, FX, consumer, AML or illegal-deposit-taking rules.

Permission map

Colombia licence and authorisation families

Permission family	Regulator and instrument	Activities and exclusions	Eligibility, capital and control
Permission family Banks and deposit taking	Regulator and instrument SFC authorisation to constitute and certificate to operate as an establecimiento bancario under the Financial System Organic Statute	Activities and exclusions Accept deposits, lend and conduct approved banking and payment activities; fiduciary, insurance and securities services can require separate entities or status	Eligibility, capital and control Colombian corporation, suitable shareholders and management, source of funds, viable plan, governance and statutory minimum and risk-based capital, liquidity and deposit insurance
Permission family Finance companies, financial corporations and cooperatives	Regulator and instrument SFC authorisation for the applicable credit-establishment or financial-cooperative category	Activities and exclusions Provide financing, leasing or permitted deposit and credit services within the class; no unrestricted commercial-bank powers	Eligibility, capital and control Prescribed Colombian legal form, approved owners and officers, local operations, risk and AML systems and category-specific minimum capital and prudential ratios
Permission family Electronic deposits and payments	Regulator and instrument SFC authorisation and operating certificate as a Sociedad Especializada en Depositos y Pagos Electronicos under Law 1735 of 2014 and Decree 2555	Activities and exclusions Take ordinary and low-value electronic deposits, make payments and transfers, borrow for operations and send or receive qualifying remittances; no general lending from deposits	Eligibility, capital and control Colombian corporation with exclusive object, suitable owners and management, technology, safeguarding, AML/CFT and minimum capital and deposit-to-equity limits under current rules
Permission family Payment systems, acquiring and payment initiation	Regulator and instrument SFC or Banco de la Republica authorisation, registration or oversight for low-value payment-system administrator, acquirer, payment initiator or other regulated role	Activities and exclusions Operate the approved payment or settlement function; participation or technical services do not create a bank or SEDPE status	Eligibility, capital and control Local eligibility, owners and managers, system governance, access, settlement, resilience, safeguarding, cyber, AML/CFT and resources proportionate to the function
Permission family Money transfer and foreign exchange	Regulator and instrument SFC-regulated financial institutions and authorised exchange-market intermediaries operate under Banco de la Republica exchange rules; money transfer follows the relevant financial category	Activities and exclusions Conduct only permitted remittance and FX operations; a SEDPE or payment role does not confer every exchange activity	Eligibility, capital and control Eligible Colombian institution, approved management, transaction systems, AML/CFT, exchange reporting and capital or guarantee under the parent category
Permission family Securities brokerage, dealing and advice	Regulator and instrument SFC authorisation or registration for stockbroker, investment adviser and other securities-market participant under securities law and Decree 2555	Activities and exclusions Deal, arrange, advise, underwrite or manage within the recorded category; no deposits, insurance or general crypto authority	Eligibility, capital and control Colombian company or eligible professional, suitable owners and responsible officers, conduct, conflicts, client assets, technology and category-specific capital
Permission family Exchanges, clearing and depositories	Regulator and instrument SFC authorisation for stock exchange, central counterparty, central securities depository, trading or registration system and other market infrastructure	Activities and exclusions Operate the approved facility with access, surveillance, settlement and default rules; participation and operation are separate statuses	Eligibility, capital and control Colombian operator, ownership and management review, resilient technology, market, settlement and default controls, governance and financial resources
Permission family Fiduciary companies and custody	Regulator and instrument SFC authorisation and operating certificate for a sociedad fiduciaria under the Financial System Organic Statute	Activities and exclusions Conduct authorised trust, fiduciary administration, collective-investment or custody functions; ordinary company services grant no public fiduciary authority	Eligibility, capital and control Colombian corporation, suitable controllers and management, fiduciary governance, client-asset separation, operational systems and minimum and risk-based capital
Permission family Collective investment funds and managers	Regulator and instrument SFC approval or registration of collective investment fund and authorisation of eligible administrator, custodian and distributor under Decree 2555	Activities and exclusions Establish, manage, distribute or safeguard the approved fund within its rules; provider roles remain separate	Eligibility, capital and control Eligible fiduciary, broker or investment-management entity, fund rules, governance, valuation, custody, audit, disclosure and financial resources
Permission family Collaborative financing	Regulator and instrument SFC authorisation for a sociedad de financiacion colaborativa and approval or registration for qualifying securities-based projects	Activities and exclusions Operate the authorised collaborative-financing platform within statutory project and investor rules; no deposit taking, lending or custody by implication	Eligibility, capital and control Colombian corporation with exclusive or permitted object, suitable owners and officers, technology, conflicts, disclosures, investor controls, minimum capital and reporting
Permission family Insurance, reinsurance and intermediaries	Regulator and instrument SFC authorisation for general or life insurer, reinsurer or insurance cooperative and registration or supervision for brokers and other intermediaries	Activities and exclusions Underwrite, reinsure or intermediate approved lines and products; broker status does not permit assumption of insurance liabilities	Eligibility, capital and control Colombian company or permitted foreign route, suitable owners and executives, actuarial and risk functions, solvency capital, technical reserves, reinsurance and audit
Permission family Pensions and severance funds	Regulator and instrument SFC authorisation and supervision for pension and severance-fund administrator and the applicable mandatory or voluntary fund products	Activities and exclusions Administer and invest pension or severance assets within the approved system and investment regime; no general banking or securities-dealing power	Eligibility, capital and control Colombian company, suitable controllers and management, governance, operational systems, minimum capital, reserves, custody, investment and beneficiary protection
Permission family Consumer, mortgage, leasing and factoring credit	Regulator and instrument Banks, finance companies and other supervised entities use parent authorisation; own-funds commercial lenders remain subject to consumer and commerce law without a universal SFC lender licence	Activities and exclusions Lend, mortgage, lease or factor within the entity's legal capacity and funding model; no deposits or payment issuance without the relevant status	Eligibility, capital and control Correct vehicle and funding, contracts, rates and fees, credit-risk and complaints controls, AML duties and prudential capital where the supervised category applies
Permission family Virtual assets and AML-only obligations	Regulator and instrument No general SFC VASP licence or authorisation was identified as of 11 July 2026; UIAF reporting or sandbox participation is not operating permission	Activities and exclusions No general SFC authority to custody, invest, intermediate or operate virtual-currency business; securities, payments, FX and deposit-taking law may still apply	Eligibility, capital and control Do not market an SFC crypto licence. Complete the underlying perimeter analysis and satisfy any financial-category, AML/CFT, cyber, custody and consumer requirements actually triggered
Permission family Trust and corporate service providers	Regulator and instrument Public financial fiduciary activity requires an SFC-authorised sociedad fiduciaria; no general TCSP financial licence applies to ordinary company formation and administration	Activities and exclusions A fiduciary may perform only its approved financial trust services; corporate administration grants no custody, fund, payment or investment permission	Eligibility, capital and control Obtain sociedad fiduciaria status for reserved public fiduciary business, or apply ordinary corporate and professional rules plus AML obligations to non-financial services
Permission family Gambling and gaming	Regulator and instrument Coljuegos authorisation for national games of chance and online gaming, with territorial authorities for local games, outside SFC financial licensing	Activities and exclusions Only the authorised game, platform and channels; payment or financial status does not authorise gambling	Eligibility, capital and control Eligible Colombian operator, suitable owners and managers, technical certification, responsible-gaming, AML/CFT, player funds, guarantee and concession requirements

Entry file

Constitution, operating certificate and capital

SFC licensing normally distinguishes authorisation to constitute the entity from the certificate permitting operation. Applicants should not treat the first corporate step as customer-facing authority. The file identifies beneficial owners, direct and indirect controllers, source of funds, directors, executives and responsible officers and demonstrates fitness, competence and financial soundness. Governance, risk, AML/CFT, sanctions, consumer protection, accounting, audit, cybersecurity, outsourcing, continuity, complaints and records must fit the entity.

Capital varies by class. Banks, finance companies, SEDPE, brokers, fiduciaries, insurers, pension administrators and collaborative-financing companies use different minimum and risk- based calculations. SEDPE also have exclusive-object, electronic-deposit and asset-protection rules. Securities, fund and pension assets, insurance reserves and payment deposits each use distinct custody or safeguarding mechanisms. The current SFC annual minimum-capital update, Banco de la Republica rule and official fee or filing method control the application.

Application process

From perimeter to activation

1. Select the supervised category
Map deposits, electronic payments, credit, securities, funds, fiduciary, insurance, pensions, virtual assets and gaming to each legal status.
2. Prepare the constitution case
Document the Colombian vehicle, owners, controllers, source of funds, directors, executives, group structure and business viability.
3. Build operational evidence
Prepare capital method, governance, AML/CFT, cyber, safeguarding, conduct, audit, recovery, outsourcing and wind-down material.
4. Complete authorisation and certificate stages
Use the current SFC and other authority procedures and distinguish permission to constitute, register and begin operations.
5. Activate only after every status is effective
Fund resources, appoint accepted people, test systems and reporting, and confirm final scope, conditions and registers before activity.

Continuing supervision

Returns, acquisitions and crypto claims

Ongoing duties can include capital and solvency, liquidity, audited statements, regulatory returns, AML/CFT and sanctions reporting, consumer and market conduct, complaints, cybersecurity, incidents, client-asset reconciliation and outsourcing oversight. A firm must obtain any new status or variation before expanding its object or services. SEDPE cannot add unrestricted lending, and a supervised firm cannot add crypto custody merely because it has a technology platform.

Acquisitions, qualifying holdings and changes in owners, controllers, directors or key officers follow SFC or other competent-authority approval and notice mechanics. The entity retains its certificate and its regulatory history after a share acquisition. Buyers should reconcile the certificate, authorised object, capital, customer assets, prudential filings, complaints, enforcement and remediation. SFC's 2026 public guidance continued to reject claims of a general crypto authorisation, so any contrary marketing statement should be removed unless enacted law changes.

Verify it yourself

Primary sources

Superintendencia Financiera de Colombia
SFC licensing pages, supervised-entity lists, Decree 2555 instructions and capital updates govern the principal financial sectors.
Banco de la Republica
Official payment-system, exchange and monetary regulations govern functions within the central bank's statutory perimeter.
SFC innovation guidance
The official elHub and virtual-currency notices state the limits of SFC authorisation and identify established categories available to fintechs.
UIAF, Coljuegos and enacted legislation
UIAF governs AML reporting, Coljuegos governs national gaming, and official statutes control where summaries differ.

FAQ

Colombia licensing questions

01 Is a SEDPE a bank?

No. It has an exclusive electronic-deposit and payment object with limited permitted operations. A bank has a broader prudential and activity perimeter.

02 Does Colombia offer an SFC crypto licence?

No general authorisation was identified as of 11 July 2026. SFC stated that it had not authorised supervised entities for general custody, investment or intermediation in virtual currencies.

03 Can a fintech apply directly to SFC?

Yes if its activity belongs to an existing supervised category such as bank, SEDPE, finance company, fiduciary or collaborative-financing company. The category determines the file.

04 What capital is required?

It depends on the institution and current annual SFC calculation. Use the live minimum and risk-based rules for the exact category.

05 What happens when an authorised entity is acquired?

The entity retains its certificate, while incoming controllers and management complete applicable review and inherit all conditions and supervisory history.

Reviewed by the SKY7 advisory team. Last reviewed: 11 July 2026. Regulatory statements are made as of July 2026. Colombia's payment and open-finance rules continue to develop, while no general SFC VASP licence was identified. This page is general information only, not legal, regulatory, tax, investment or financial advice. Verify current certificates, registers, capital, fees and controller processes with each authority. No authorisation or regulator timetable is promised.

Tell us what you need

Scope the Colombia permission family

Bring the products, payment and asset flows, customers, ownership and Colombia plan. SKY7 will map SFC, Banco de la Republica, UIAF and gaming workstreams.