Colombia

Superintendencia de Industria y Comercio (SIC) is a regulator in Colombia. The Fiscalía General de la Nación is not supported as a regulator for this context by the provided Colombia-specific evidence.

SIC: Fines in the hundreds of millions of Colombian Pesos (COP) against promoters and entities. For instance, in August 2022, the SIC sanctioned "Smart Business Corp SAS," "Bux Corp SAS," and several individuals involved with OmegaPro, imposing fines totaling over COP $2.400 million (approx. USD $600,000 at the time) and ordering the immediate cessation of activities and restitution to affected consumers. Further fines and orders against other promoters followed.

Fiscalía: Ongoing criminal investigations targeting withholding agents for tax-related failures, not specifically for aggravated fraud, illegal financial intermediation, or money laundering, and investigations into President Petro for narco-terrorism and drug trafficking, not the crimes listed in the original claim.

Date: SIC actions primarily from August 2022 and ongoing through 2023; criminal investigations and arrests have been active throughout this period.

SIC Press Release (August 2022): https://www.sic.gov.co/noticias/la-sic-multa-y-ordena-el-cese-de-actividades-de-promotores-de-esquemas-de-negocio-en-los-que-se-captaban-recursos-del-publico-y-advierte-sobre-los-riesgos-de-omegapro

El Tiempo Article (October 2023, detailing collapse and criminal investigations): https://www.eltiempo.com/unidad-investigativa/omegapro-la-piramide-mas-grande-en-colombia-su-caida-y-los-impactantes-datos-de-su-creador-820876

SIC: Imposed fines of over COP $500 million (approx. USD $125,000 at the time) against the company and its managers, ordered the immediate cessation of its operations, and mandated the return of funds to investors.

Fiscalía: Criminal charges for illegal mass capture of money, aggravated fraud, and money laundering. Arrests and asset seizures.

Date: SIC action in November 2022; criminal investigations and arrests followed into 2023.

SIC Press Release (November 2022): https://www.sic.gov.co/noticias/sic-multa-y-ordena-el-cese-de-actividades-a-daily-cop-s-a-s-por-captacion-no-autorizada-de-recursos-del-publico

El Tiempo Article (August 2023, on arrests): https://www.eltiempo.com/justicia/capturan-a-los-cabecillas-de-la-piramide-daily-cop-que-prometia-ganancias-con-criptomonedas-802526

Regulator(s): Fiscalía General de la Nación (Attorney General's Office). (The primary regulator in Argentina, where Generación Zoe originated, was the Comisión Nacional de Valores (CNV) and judicial authorities).

Date: Arrests and investigations in Colombia began in early 2022, following international alerts and actions in Argentina.

Fiscalía Press Release (March 2022, mentioning international cooperation): https://www.fiscalia.gov.co/colombia/noticias/por-captacion-ilegal-de-dinero-la-fiscalia-imputo-a-cinco-personas-y-logro-medida-de-aseguramiento-contra-dos-de-ellas/ (While not specifically naming Zoe, this reflects the type of coordinated actions against such schemes at the time.)

La República Article (March 2022, detailing Zoe's presence in Colombia): https://www.larepublica.co/especiales/generacion-zoe/generacion-zoe-el-esquema-ponzi-que-tambien-operaba-en-colombia-3323537

Ley 2143 de 2021 (Law 2143 of 2021):

Purpose: Establishes the legal framework for the Regulatory Sandbox (La Arenera) and mandates the Financial Superintendency to propose a comprehensive regulatory framework for crypto assets.

Reference: Ley 2143 de 2021, por medio de la cual se crea un marco regulatorio para el funcionamiento de los entornos de prueba o “sandboxes” regulatorios para proyectos de innovación financiera, y se dictan otras disposiciones.

URL: http://www.suin-juriscol.gov.co/viewDocument.asp?id=30043818 (Diario Oficial, Government of Colombia)

Circular Externa 026 de 2020 (SFC):

Purpose: Officially established the regulatory sandbox "La Arenera" for financial innovation projects. This circular sets out the rules for participation.

Reference: Circular Externa 026 de 2020 de la Superintendencia Financiera de Colombia, "Por medio de la cual se establecen las instrucciones para la operatividad de los entornos controlados de prueba - “Sandbox” en el sector financiero."

URL: https://www.superfinanciera.gov.co/jsp/Publicaciones/publicaciones/loadContent/20428 (Superintendencia Financiera de Colombia)

Circular Externa UIAF 001 de 2021 (and predecessors like 006 de 2020):

Purpose: Updates and consolidates instructions for the prevention and control of money laundering and terrorist financing for Virtual Asset Service Providers (VASPs) and other obliged entities. It explicitly identifies VASPs as obliged entities for AML/CFT purposes.

Reference: Circular Externa UIAF 001 de 2021, "Por medio de la cual se actualizan las instrucciones para la prevención y el control del lavado de activos y la financiación del terrorismo – LA/FT, de las actividades y profesiones no financieras designadas y otros sujetos obligados." (This circular generally covers various sectors but includes provisions relevant to VASPs as obliged entities). The previous UIAF Circular Externa 006 de 2020 specifically included virtual asset operators as obliged entities.

URL: https://www.uiaf.gov.co/noticias-eventos/noticias/uiaf-expide-nueva-circular-externa-para-aumentar-cobertura-del-splaft (UIAF announcement, links to the actual circular)

Direct link to 006 of 2020 (still foundational for VASP inclusion): https://www.uiaf.gov.co/documentos/circulares-externas/circular-externa-006-de-2020-218

Investment Tokens/Security Tokens: Tokens explicitly marketed or designed to represent an ownership interest, a share in profits, debt, or other financial claims in an entity or project. This includes tokens that grant voting rights, profit-sharing, or liquidation rights.

Tokens from Initial Coin Offerings (ICOs) or Security Token Offerings (STOs): If an ICO or STO involves the sale of tokens that promise a return on investment based on the development and efforts of the issuer, it will likely be treated as a public offering of securities.

Utility Tokens with Investment Characteristics: Even if initially presented as utility tokens (for accessing a service or product), if they are promoted primarily as an investment opportunity with an expectation of future appreciation driven by the issuer's efforts, they can be reclassified as securities. The SFC looks at how they are marketed, sold, and the reasonable expectation of purchasers.

Tokens Linked to Collective Investment Schemes: Tokens that represent participation in a fund or a pooled investment managed by a third party, where the token holder expects returns from that management.

"Pure" Utility Tokens: Tokens that exclusively grant access to a specific product or service and are primarily used for that purpose, with no significant investment expectation.

Cryptocurrencies (like Bitcoin or Ethereum): Generally, widely decentralized cryptocurrencies are not currently viewed as securities by the SFC, but rather as "virtual assets" or "digital assets" that can function as a medium of exchange or store of value, with associated risks.

Certain NFTs: NFTs primarily intended as unique digital collectibles, art, or access passes, without an explicit investment scheme or expectation of profit derived from a common enterprise. However, NFTs that fractionize ownership of real estate, art, or represent shares in a profit-generating venture could be deemed securities.

Registration with the SFC: The issuer must register the token as a security with the SFC and include it in the Registro Nacional de Valores y Emisores (RNVE), the National Securities and Issuers Registry.

Disclosure Requirements: Comprehensive disclosure of financial information, business plans, risks, and governance structures, similar to traditional public offerings.

Prospectus: Preparation and approval of a detailed prospectus.

Corporate Governance: Compliance with corporate governance standards for publicly traded entities.

Ongoing Reporting: Continuous reporting obligations to the SFC and the public.

Colombia's securities law has limited exemptions. Private placements (offers to a small, qualified group of investors) might have lighter registration requirements but are still regulated.

Regulatory Sandbox (La Arenera): The closest mechanism for innovation is the SFC's La Arenera, a regulatory sandbox established under Circular Externa 021 de 2023. This allows financial entities (and in certain cases, non-supervised entities in partnership with supervised ones) to test innovative financial services, including those involving crypto assets, under a controlled environment with temporary waivers or specific authorizations. However, participating in La Arenera does not exempt a token from being classified as a security; rather, it allows for a structured dialogue and potential adaptation of regulations if a security token is being tested.

Regulated Exchanges: Trading must occur on authorized and supervised exchanges, primarily the Bolsa de Valores de Colombia (BVC) or other SFC-licensed trading systems.

Market Intermediaries: Trades must generally be executed through SFC-licensed brokers or market intermediaries.

Investor Protection: Rules regarding market manipulation, insider trading, transparency, and best execution would apply, similar to traditional securities.

Warnings and Alerts: The SFC frequently issues public warnings and press releases cautioning investors about the high risks associated with cryptocurrency investments, emphasizing that they are generally not regulated financial products or securities in Colombia and therefore lack the associated investor protections. These warnings serve as a de facto enforcement mechanism to inform the public and deter non-compliant offerings.

Example: Constant reiteration that virtual assets are not considered legal tender or securities and that institutions under SFC supervision are not authorized to custody, invest, or intermediate operations with them (outside of the sandbox).

Prohibition on Supervised Entities: The SFC has consistently prohibited financial institutions under its supervision (banks, brokers, funds) from directly engaging in activities involving crypto assets (e.g., holding, investing, offering services related to them) outside of the controlled environment of the regulatory sandbox. This is a strong indirect enforcement measure that limits the institutional market for potentially unregulated tokens.

Actions Against Pyramid Schemes and Fraud: While not directly securities law enforcement, Colombian authorities (including the SFC, Fiscalía General de la Nación, and Superintendencia de Sociedades) have taken action against crypto-related pyramid schemes and Ponzi schemes. These cases are typically prosecuted under general fraud laws, consumer protection laws, or illicit fundraising laws, rather than securities laws, because the fraudulent nature is more overt than a mere regulatory classification issue.

Example: Crackdowns on entities like Daily Cop or Omegapro, which operated with promises of high returns through crypto investments, leading to investigations and arrests for illicit fundraising and fraud, though not always explicitly under securities market regulations.

Regulatory Sandbox (La Arenera) as a Pathway: While not an enforcement action, the implementation of La Arenera is a regulatory tool. If an innovative financial service involving a crypto token is tested in the sandbox and is determined to be a security, the SFC would then provide guidance on how it must be regulated, potentially leading to a formal registration requirement upon exiting the sandbox. This proactive approach aims to guide innovation rather than simply punish it after the fact.

Ley 964 de 2005 (Securities Market Law): Defines securities and sets out the framework for public offerings and secondary trading.

Ley 964 de 2005 - Secretaria Senado

Circular Externa 021 de 2023 (SFC - Regulatory Sandbox Framework - La Arenera): Establishes the framework for testing financial innovations.

Circular Externa 021 de 2023 - SFC

Example of a relevant concept: While not specifically classifying a token as a security, Concepto 2022137682-001 (SFC) discusses NFTs and applies principles that are indicative of their general approach to digital assets, differentiating based on characteristics (utility, investment expectation, etc.). This demonstrates the substance over form approach. (You would need to search for this specific number on the SFC site).

SFC Press Releases and Warnings: These are regularly updated on the SFC's main website.

Noticias y Comunicados de Prensa - SFC

Cautious but Open: Regulators acknowledge the potential of virtual assets while emphasizing the associated risks (volatility, fraud, money laundering, consumer protection).

Experimental/Exploratory: The regulatory sandbox "LaArenera" was a prime example of this.

Focus on AML/CFT: Anti-Money Laundering and Counter-Financing of Terrorism (AML/CFT) compliance is a primary concern and has seen some of the earliest formal guidance.

No Legal Tender Status: Cryptocurrencies are explicitly not recognized as legal tender.

Ongoing Legislative Efforts: The main driver for comprehensive regulation is a pending bill in Congress.

Superintendencia Financiera de Colombia (SFC) (Financial Superintendence of Colombia)

Banco de la República (Central Bank of Colombia)

Colombia's president has actively endorsed Bitcoin mining as an economic opportunity, signaling a shift away from a purely cautious stance, though cryptocurrency is still not legal tender.

Unidad de Información y Análisis Financiero (UIAF) (Financial Information and Analysis Unit)

Role: The AML/CFT authority. It has issued specific guidelines for virtual asset service providers (VASPs) to report suspicious transactions, even in the absence of a comprehensive regulatory framework.

Ministerio de Hacienda y Crédito Público (Ministry of Finance and Public Credit)

Role: Involved in setting fiscal policy and supporting the development of legislative frameworks related to financial innovation.

Proyecto de Ley 139 de 2022 (Senate) / 028 de 2022 (House) - "Ley de Activos Virtuales" or "Fintech Bill"

Name: Project of Law 139 of 2022 (Senate) / Project of Law 028 of 2022 (House) – Aims to create a regulatory framework for virtual assets.

Date: Introduced in 2022 (building on previous legislative attempts).

Status: Currently pending in the Colombian Congress. It has gone through several debates and amendments but has not yet been enacted into law.

Purpose: To define virtual assets, establish licensing requirements for Virtual Asset Service Providers (VASPs), introduce rules for consumer protection, promote financial stability, and ensure AML/CFT compliance within the crypto ecosystem. This bill, if passed, would significantly formalize crypto regulation in Colombia.

LaArenera - Regulatory Sandbox (SFC)

Date: Launched in early 2021, its pilot phase concluded.

Purpose: The SFC created this sandbox to allow traditional financial institutions to partner with selected cryptocurrency exchanges for controlled pilot programs. The goal was to understand the operational risks and opportunities, primarily focusing on enabling fiat on/off-ramps (deposits and withdrawals) for customers of these exchanges through regulated banks.

URL (Information available on SFC's site): Search for "LaArenera" or "Sandbox" on the SFC website.

Circular Externa 027 de 2020 (UIAF)

Name: External Circular 027 of 2020.

Purpose: Issued by the UIAF, this circular establishes guidelines for Virtual Asset Service Providers (VASPs) to comply with AML/CFT obligations. It mandates registration, customer due diligence, and reporting of suspicious transactions. This was a crucial step in bringing some level of oversight to the crypto sector from an anti-financial crime perspective.

URL (Can be found on UIAF's website): Search for "Circular Externa 027 de 2020 UIAF" on their official site.

Legality: Owning and trading cryptocurrencies is not prohibited in Colombia. Citizens are free to buy, sell, and hold virtual assets.

Unregulated Market: However, the trading environment is largely unregulated from a financial services perspective (pending the "Ley de Activos Virtuales"). This means:

No specific licensing regime for exchanges: Crypto exchanges currently operate under general commercial law, not as regulated financial institutions supervised by the SFC (except for those that participated in the LaArenera sandbox pilots).

Consumer Protection Gaps: There is no specific legal framework for consumer protection in crypto transactions, leaving users exposed to risks like platform failure, hacks, and scams without clear recourse to financial regulators.

Banking Relations: While the sandbox aimed to improve this, many traditional banks remain cautious or refuse to directly service crypto exchanges or businesses due to regulatory uncertainty and AML/CFT risks, making banking access challenging for the industry.

AML/CFT Obligations: Despite the lack of comprehensive financial regulation, VASPs are expected to comply with UIAF's Circular 027 of 2020, meaning they must implement robust AML/CFT controls.

Taxation: For tax purposes, cryptocurrencies are generally considered intangible assets. Capital gains derived from their sale are subject to income tax. The DIAN (Dirección de Impuestos y Aduanas Nacionales – National Tax and Customs Directorate) has provided some guidance, but comprehensive tax regulations specifically for crypto are still developing.

Identify, measure, control, and monitor the risks of money laundering and terrorist financing (ML/TF).

Report suspicious transactions (SARs) to the UIAF.

Conduct comprehensive customer due diligence (CDD), including identifying ultimate beneficial owners (UBOs) and politically exposed persons (PEPs).

Implement policies, procedures, and internal controls to prevent ML/TF.

Train personnel on AML/CFT obligations.

Resolución 314 de 2021 de la UIAF: Por la cual se imparten instrucciones relacionadas con el SARLAFT a los proveedores de servicios de activos virtuales.

[Link to official UIAF Resolution 314/2021 (often found via UIAF's regulations section or official gazettes)] - Note: Official direct link may vary as government sites update. Search "Resolución UIAF 314 de 2021" for the most current access. A common source for these regulations is the "Diario Oficial" (Official Gazette) or the UIAF's own regulatory publications page. As an example, a legal portal reference: Resolución 314 de 2021 - Legis Xperta (subscription required, but shows its existence)

UN Sanctions: As a member state of the United Nations, Colombia is legally obligated to implement sanctions imposed by the UN Security Council. UIAF Resolution 314/2021 directly references adherence to UN Security Council resolutions as a core component of ML/TF risk management. This includes asset freezes and other restrictions against listed individuals and entities.

How Colombia implements: UN sanctions are generally incorporated into Colombia's domestic legal system through presidential decrees or ministerial resolutions, requiring financial institutions (now including VASPs) to monitor and comply.

Legal Reference: While a single overarching decree for all UN sanctions isn't typical, specific resolutions are adopted. The UIAF's mandate inherently covers adherence.

OFAC (U.S. Office of Foreign Assets Control) Sanctions: While OFAC sanctions are extraterritorial and primarily apply to U.S. persons, Colombian VASPs (and any entity operating in Colombia) are effectively compelled to comply for several reasons:

Access to the U.S. financial system: Many international transactions involve U.S. dollars or U.S. correspondent banking relationships. Non-compliance can lead to "de-risking" by banks, refusal to process transactions, and difficulties accessing global financial services.

Secondary Sanctions: Some OFAC sanctions include provisions for secondary sanctions against non-U.S. persons who engage in certain activities with sanctioned entities or countries.

International Partnerships: VASPs with international clients or partners will find OFAC compliance a standard requirement.

Adhering to Colombia's specific and comprehensive AML compliance framework, SARLAFT, and its evolving requirements, constitutes the defined best practice for robust AML/CFT compliance in Colombia.

OFAC Sanctions List (SDN): https://home.treasury.gov/policy-issues/financial-sanctions/specially-designated-nationals-and-blocked-persons-list-sdn-human-readable-lists

EU (European Union) Sanctions: Similar to OFAC, EU sanctions primarily apply to EU persons and entities. However, for the same reasons mentioned above (international financial access, global partnerships, and best practice), Colombian VASPs dealing with European entities or customers will generally need to screen against EU sanctions lists to mitigate risks.

EU Consolidated Sanctions List: https://www.sanctionsmap.eu/

Identify clients and transactions linked to individuals or entities on national and international restrictive lists. This means continuous screening of new and existing clients, as well as ongoing transaction monitoring.

Block or freeze assets of sanctioned individuals/entities as required by UN Security Council resolutions, and other applicable laws.

Report any hits or suspicious activity related to sanctioned entities to the UIAF.

OFAC Specially Designated Nationals (SDN) List and other relevant OFAC lists

EU Consolidated List of persons, groups, and entities subject to financial sanctions

Any other relevant lists provided by local law enforcement or judicial authorities.

UN-Sanctioned Countries: Transactions involving countries under UN arms embargoes, financial restrictions, or other measures (e.g., North Korea, Iran in specific contexts) must be flagged and handled in accordance with UN resolutions and Colombian domestic implementation.

OFAC-Sanctioned Countries: VASPs dealing with international clients or operating globally will need to restrict or block transactions involving comprehensively sanctioned jurisdictions by OFAC (e.g., Cuba, Iran, North Korea, Syria, certain regions of Ukraine/Russia, Venezuela for specific entities/individuals). While Colombia does not directly enforce these, non-compliance can lead to severe operational and reputational consequences.

FATF High-Risk Jurisdictions: While not a "sanction," VASPs must exercise enhanced due diligence for transactions involving jurisdictions identified by FATF as high-risk for ML/TF (e.g., DPRK, Iran, Myanmar), or those with strategic deficiencies.

Fines: The UIAF and other supervisory bodies (like the Superintendencia Financiera, Superintendencia de Sociedades) can impose substantial administrative fines on VASPs and their directors for non-compliance with SARLAFT obligations, including failure to report suspicious transactions or adequately screen for sanctioned entities.

Suspension or Revocation of Operations: In severe cases, particularly for unregulated VASPs that fail to adhere to AML/CFT guidelines, authorities could pursue actions to suspend or cease their operations.

Legal Reference: The powers for administrative sanctions are typically derived from specific laws establishing the supervisory bodies and their mandates (e.g., Decree 663 of 1993, which is the Organic Statute of the Financial System, and subsequent regulations expanding UIAF's powers).

Criminal Penalties (Money Laundering and Terrorist Financing):

Failure to implement proper AML/CFT controls, which results in the facilitation of money laundering or terrorist financing, can lead to criminal charges against individuals (e.g., directors, compliance officers) and corporate liability.

Money Laundering (Lavado de Activos): Articles 323 to 323A of the Colombian Criminal Code. Penalties can range from 10 to 30 years in prison and significant fines.

Terrorist Financing (Financiación del Terrorismo): Article 345 of the Colombian Criminal Code. Penalties can range from 13 to 22 years in prison and substantial fines.

Illicit Enrichment (Enriquecimiento Ilícito): Article 327 of the Colombian Criminal Code.

Ley 599 de 2000 (Código Penal Colombiano):

UN Security Council Sanctions: These are adopted into Colombian law as described above.

Domestic Lists for AML/CFT Risk Management: Colombian financial institutions and VASPs are also expected to screen against internal lists generated by local law enforcement and judicial authorities for AML/CFT purposes. These might include:

Lists of individuals under criminal investigation for ML/TF, corruption, or other illicit activities.

Politically Exposed Persons (PEPs) lists.

Lists related to individuals or entities linked to organized crime or terrorist groups operating domestically.

Adopted: Yes, Colombia has formally adopted requirements aligned with the FATF Travel Rule. This aligns with its commitment as a member of GAFILAT (Financial Action Task Force of Latin America), which enforces FATF standards in the region.

Key Legislation/Guidance: The primary regulation is the UIAF Circular Externa 001 of 2023, which modifies and updates the "Sistema de Administración del Riesgo de Lavado de Activos y Financiación del Terrorismo para el sector de Activos Virtuales" (SARCIM - AML/CFT Risk Management System for the Virtual Assets Sector). This circular explicitly requires Virtual Asset Service Providers (VASPs) to implement measures to identify and transmit information on originators and beneficiaries of virtual asset transfers.

UIAF Circular Externa 001 of 2021 (the predecessor to the 2023 circular) initially established the SARCIM and its obligations, becoming effective shortly after its publication in 2021.

The UIAF Circular Externa 001 of 2023 modified the SARCIM, entering into force upon its publication on March 10, 2023. VASPs were given specific deadlines to comply with the updated requirements, generally within 6 months to a year, depending on the specific obligation.

The UIAF Circular Externa 001 of 2023 mandates the collection of originator and beneficiary information as part of the VASP's overall AML/CFT risk management for all virtual asset transfers involving their customers.

While the circular does not explicitly state a threshold for data transmission between VASPs for the Travel Rule (like the FATF's recommended $1,000/€1,000 equivalent), the general AML/CFT framework, and the spirit of the Travel Rule, implies that for inter-VASP transfers, this threshold applies for the full set of Travel Rule data transmission. VASPs are generally required to identify customers and collect basic transaction information for all amounts. For transfers equal to or greater than the equivalent of USD 1,000 (or local currency equivalent), enhanced due diligence and the full set of Travel Rule data (originator and beneficiary information) should be collected and transmitted.

The UIAF Circular Externa 001 of 2023 covers "Providers of Virtual Asset Services" (Proveedores de Servicios de Activos Virtuales - PSAV), which includes:

Entities that exchange virtual assets for fiat currency.

Entities that exchange one or more forms of virtual assets.

Entities that transfer virtual assets.

Entities that safeguard and/or administer virtual assets or instruments enabling control over virtual assets.

Entities that participate in and provide financial services related to an issuer's offer and/or sale of a virtual asset.

This broad definition aligns with FATF Recommendation 15 on virtual assets and VASPs.

Data to be Collected and Transmitted: The Circular requires VASPs to obtain and retain information about the originator and beneficiary of virtual asset transfers. This typically includes:

Name (natural person) or legal name (legal person).

Account number or identifier used for the transaction.

Physical address (if available) or unique national identification number (e.g., passport, national ID) or customer identification number (e.g., RUT).

Unique national identification number (e.g., passport, national ID) or customer identification number (e.g., RUT).

Transmission Method: While the Circular mandates the collection and retention of this information, it does not specify a particular technical standard or protocol (e.g., TRISA, OpenVASP) for transmitting this data between VASPs. It expects VASPs to establish secure and reliable means for such transmission, consistent with data privacy and security regulations. VASPs must have robust internal systems to manage and securely store this information.

Non-compliance with UIAF regulations, including those related to SARCIM and the Travel Rule, can result in significant penalties under Colombia's broader AML/CFT framework.

Regulatory Body: The UIAF, in conjunction with other supervisory bodies like the Superintendencia Financiera de Colombia (SFC) for entities under its direct supervision, is responsible for enforcing these rules.

Types of Penalties: Penalties can include:

Fines: Substantial monetary fines, which can be tiered based on the severity of the violation, the VASP's size, and the amount of money involved.

Reputational Damage: Public sanctions and regulatory enforcement actions can severely damage a VASP's reputation and trust among users.

Operational Restrictions: In severe cases, regulatory authorities may impose operational restrictions, suspend licenses, or even order the closure of the VASP.

Criminal Charges: In instances where non-compliance is linked to money laundering or terrorist financing activities, individuals (e.g., VASP management) can face criminal prosecution and imprisonment.

The specific penalty regime is outlined in Colombian Law 526 of 1999 (which created the UIAF) and other related AML/CFT statutes, which generally apply to all obligated entities, including VASPs.

Cryptocurrencies are not legal tender in Colombia.

They are not regulated by the SFC as financial products or securities, unless they exhibit characteristics that make them fall under existing definitions (e.g., a security token).

In Colombia, standalone virtual asset service providers (VASPs) offering services related to virtual assets are not supervised by the Superintendencia Financiera de Colombia (SFC) as traditional financial market institutions, but they are now directly subject to specific AML/CTF and reporting obligations (notably UIAF Resolution 314‑2021) and to an emerging, VASP‑focused regulatory framework that goes beyond the earlier situation where only already‑regulated financial entities were within SFC‑linked oversight when their traditional services touched crypto.

No specific "crypto custody license" currently exists in Colombia.

However, if a firm engaged in crypto custody also conducts activities that fall under existing financial services laws (e.g., operating as a payment service provider, managing collective investment schemes, or issuing securities), then it would be subject to the SFC's licensing and supervision requirements for those specific activities.

The "La Arenera" Regulatory Sandbox: This is the closest Colombia has to a structured approach for crypto firms.

Decree 1234 of 2020 established the framework for innovative projects in financial technologies (FinTech) within a regulatory sandbox (known as "La Arenera").

Purpose: It allows regulated entities (banks, trusts) and new FinTech firms (including those dealing with crypto assets) to test innovative products and services under the SFC's supervision for a limited period, with certain regulatory waivers.

Custody Aspect: While not a "custody license," participating crypto platforms in the sandbox, especially those handling client funds/assets, are subject to heightened scrutiny regarding risk management, cybersecurity, and consumer protection. Some projects involving the intermediation of crypto assets have been approved, which inherently involves some form of custody.

Decreto 1234 de 2020 (Ministerio de Hacienda y Crédito Público): https://www.funcionpublica.gov.co/eva/gestornormativo/norma.php?i=141870

Superintendencia Financiera de Colombia - La Arenera: https://www.superfinanciera.gov.co/inicio/la-arenera-sandbox-regulatorio-fintech-10078049

No specific regulations for segregation of client crypto assets.

Entities operating within the traditional financial system or the sandbox in Colombia are subject to the general principles of financial law and trust law, but these are now supplemented and modified by specific regulatory mandates including External Circular No. 015 of 2025 (environmental, social, and climate risk obligations) and the Open Finance draft decree (data sharing and consent rules), meaning the framework is no longer limited to traditional general principles.

Separation: Client assets must be clearly segregated from the firm's own assets to protect clients in case of firm insolvency.

Fiduciary Duty: Entities holding client assets (e.g., fiduciaries, custodians) have a fiduciary duty to act in the best interest of their clients.

These principles are deeply embedded in Colombian financial law (e.g., Estatuto Orgánico del Sistema Financiero (Decree 663 of 1993)) and would likely be extended to crypto custody if a firm operates under SFC oversight.

Decreto 663 de 1993 (Estatuto Orgánico del Sistema Financiero): https://www.funcionpublica.gov.co/eva/gestornormativo/norma.php?i=2450 (Search for articles related to fiduciary duties and client asset protection within financial intermediaries).

No specific insurance or bonding requirements for crypto custody.

General Principles: Regulated financial institutions in Colombia are subject to various insurance requirements (e.g., deposit insurance for banks via Fogafín, professional indemnity insurance for fiduciaries). If a crypto custody service were to be performed by a regulated entity, then these existing requirements would apply to the regulated entity as a whole.

For unregulated crypto service providers, there are no mandatory insurance requirements.

No specific legal mandates for cold storage of crypto assets.

Best Practices: While not legally mandated, cold storage is widely recognized as a critical security best practice within the crypto industry. Any reputable custodian, especially those aiming for regulatory approval or operating within the sandbox, would be expected to implement robust cybersecurity measures, which typically include a significant use of cold storage for the majority of client assets.

General Cybersecurity & Data Protection: Colombia has general data protection laws (Ley 1581 de 2012) that require entities handling personal data to implement appropriate security measures. While not directly about asset storage, it sets a precedent for strong cybersecurity.

Ley 1581 de 2012 (Protección de Datos Personales): https://www.funcionpublica.gov.co/eva/gestornormativo/norma.php?i=49981

No specific legal definition for "qualified custodian" in the context of crypto assets.

In traditional Colombian financial law, a "custodian" or "fiduciary" is a regulated entity (e.g., banks, trust companies – sociedades fiduciarias) subject to SFC oversight.

Should crypto custody become specifically regulated, it is highly probable that a "qualified custodian" would be defined as an entity that is:

Properly licensed and supervised by the SFC.

Meets stringent capital, governance, technology, and risk management requirements.

Demonstrates expertise and robust systems for safeguarding digital assets.

Draft Law on Crypto Asset Regulation: There have been several attempts to introduce comprehensive legislation for crypto assets in Colombia. The most significant recent one is Proyecto de Ley 139 de 2023 Cámara (and its predecessors), which seeks to regulate activities related to virtual assets.

Colombia has finalized a draft law to define virtual assets, establish a framework for Virtual Asset Service Providers (VASPs), and create a registry under the SFC, which would include custody rules.

Operational standards, including security protocols, in Colombia are evolving as businesses adopt updated international frameworks like ISO 27001 and as the security environment shifts following the FARC peace agreement.

Colombia's consumer protection measures are currently undergoing active legislative reform, including Senate Bill 173 of 2024 and Chamber Bill 490 of 2025, as well as proposed changes to data protection under Law 1581 of 2012.

Anti-Money Laundering (AML) and Counter-Terrorist Financing (CTF) obligations.

Status: These legislative efforts have faced delays and significant debate. They represent the current direction of legislative intent to bring clarity and regulation to the crypto space, but no law has been enacted yet.

Reference: You would typically find information on the legislative progress via the Congress of the Republic's website. A search for "Proyecto de Ley 139 de 2023 cripto" or similar terms on the Congreso de la República website (http://www.camara.gov.co/ or http://www.senado.gov.co/) would yield the most current legislative text and status.

Entity Targeted: OmegaPro Group (an international alleged Ponzi scheme), its local promoters, influencers, and related entities operating in Colombia (e.g., Bux Corp, Smart Business Corp). Violation Type: Unregistered and unauthorized financial intermediation, operating a multi-level marketing scheme that promised high returns without proper backing, misleading advertising, consumer fraud, and alleged pyramid scheme. Outcome: SIC ordered the cessation of all promotion and operations of OmegaPro-related schemes in Colombia, imposed significant fines, and mandated restitution to affected consumers. The Fiscalía has pursued criminal charges, leading to arrests of key promoters and the freezing of assets. Many victims have lost significant sums, and the full extent of recovery is uncertain.

Entity Targeted: Daily Cop S.A.S. and its founders/promoters (e.g., Camilo Andrés Suárez Aldana, David Mateo Suárez Aldana). Violation Type: Alleged pyramid scheme, unauthorized and illegal financial intermediation using cryptocurrencies as a front, offering unrealistic returns, consumer fraud. Outcome: SIC issued a definitive resolution ordering the immediate cessation of Daily Cop's activities, imposing fines, and requiring restitution. The Fiscalía subsequently arrested key figures behind the scheme and initiated criminal proceedings, uncovering millions of dollars in alleged fraud.

Entity Targeted: Local promoters and affiliates of the international Generación Zoe scheme operating in Colombia. Violation Type: Alleged illegal financial intermediation, fraud, and operating a Ponzi/pyramid scheme under the guise of coaching and crypto investments. Penalty Amount: Arrests and criminal charges against Colombian operators. Assets linked to the scheme were seized. Outcome: Colombian authorities, working with international counterparts, arrested individuals linked to Generación Zoe's operations in the country. Criminal proceedings are ongoing for charges related to aggravated fraud and illegal financial intermediation. Outcome: Provided valuable insights for future regulation, demonstrating a willingness by the SFC to study and understand crypto operations under controlled conditions.

Outcome: SIC ordered the cessation of all promotion and operations of OmegaPro-related schemes in Colombia, imposed significant fines, and mandated restitution to affected consumers. The Fiscalía has pursued criminal charges, leading to arrests of key promoters and the freezing of assets. Many victims have lost significant sums, and the full extent of recovery is uncertain.

Outcome: SIC issued a definitive resolution ordering the immediate cessation of Daily Cop's activities, imposing fines, and requiring restitution. The Fiscalía subsequently arrested key figures behind the scheme and initiated criminal proceedings, uncovering millions of dollars in alleged fraud.

Outcome: Colombian authorities, working with international counterparts, arrested individuals linked to Generación Zoe's operations in the country. Criminal proceedings are ongoing for charges related to aggravated fraud and illegal financial intermediation.

Outcome: Provided valuable insights for future regulation, demonstrating a willingness by the SFC to study and understand crypto operations under controlled conditions.