← Regulations / Colombia / licensing
Grade A AI-Researched

Colombia -- Licensing Requirements Regulatory Overview

Published: 2026-04-22 Updated: 2026-04-22 Author: SearXNG+LLM Version 1 Sources cited in: Spanish (4)
Note: This article cites primary sources in languages other than English. Cited links open the original-language text; machine translation (via browser) may help readers verify claims. See the badge next to each source for its language.

Methodology

AI-generated synthesis from web search results.

Limitations

  • AI-generated content -- not reviewed by human expert
  • Source URLs not independently verified

Colombia's regulatory landscape for virtual assets (VAs) and virtual asset service providers (VASPs) is evolving and currently operates under a framework that is more about supervision and risk management than a comprehensive, standalone licensing regime for all crypto activities. The country is moving towards a more formal licensing system, but it's not fully in place yet.

Here's a breakdown:

Overall Regulatory Regime: Evolving Framework with Sandbox Focus

Colombia does not yet have a specific, general licensing regime for cryptocurrency exchanges, custody providers, or payment processors in the same way it licenses traditional financial institutions. Instead, the approach has been characterized by:

  1. AML/CFT Obligations: All VASPs are subject to Anti-Money Laundering and Counter-Terrorist Financing (AML/CFT) requirements, regardless of whether they are licensed or not.
  2. Regulatory Sandbox ("La Arenera"): The Superintendencia Financiera de Colombia (SFC) established a regulatory sandbox that allows regulated financial institutions to partner with VASP startups to test innovative crypto-related products and services under supervision. This is the closest mechanism to obtaining formal approval for crypto operations that interact with the traditional financial system.
  3. Ongoing Development: Ley 2143 of 2021 mandated the SFC to propose a comprehensive regulatory framework for crypto assets, indicating a future move towards a more formal licensing system.

Required Licenses for Exchanges, Custody Providers, and Payment Processors

Currently, there is no specific "crypto license" issued by the SFC for general operation of these services outside of the regulatory sandbox.

  • Exchanges (Virtual Asset Service Providers - VASPs):
    • General Operation: VASPs operating without direct interaction with the traditional financial system (e.g., direct fiat on/off-ramps via banks) are primarily subject to AML/CFT obligations but are not licensed by the SFC. They operate in a somewhat "grey area" from a licensing perspective, though the UIAF views them as obliged entities for AML purposes.
    • Interaction with Financial System: If an exchange seeks to offer fiat currency on/off-ramps through Colombian banks, it generally needs to participate in the SFC's Regulatory Sandbox ("La Arenera") in partnership with a regulated financial institution. This sandbox allows for supervised pilot programs.
  • Custody Providers:
    • Similar to exchanges, there's no specific license for crypto custody services. If custody is offered in a way that interacts with the traditional financial system or involves managing significant client funds, participation in the La Arenera sandbox would be the route for formal approval and supervision.
  • Payment Processors (using VAs):
    • If a payment processor facilitates payments using virtual assets, and these operations require integration with traditional financial services or involve holding customer fiat funds, they would also look towards the La Arenera sandbox for formal supervision. Standalone crypto payment solutions that don't touch fiat are generally not licensed by the SFC but still fall under AML/CFT obligations.

Registration vs. Licensing Regime

  • Registration Regime (AML/CFT): Colombia primarily operates a registration regime for AML/CFT purposes. All VASPs, regardless of whether they are licensed or participating in the sandbox, are considered "obliged entities" by the Unidad de Información y Análisis Financiero (UIAF) and must:
    • Register with the UIAF.
    • Implement robust AML/CFT policies and procedures.
    • Report suspicious transactions (SARs) to the UIAF.
    • Comply with customer due diligence (CDD/KYC) requirements.
  • Licensing Regime (Emerging/Sandbox-based): Colombia is transitioning towards a licensing regime, with the Regulatory Sandbox acting as a preliminary step. Projects approved within the sandbox are effectively "licensed" or authorized for a specific period to test their services under SFC supervision. The long-term goal, as mandated by Ley 2143/2021, is to establish a comprehensive licensing framework.

Key Requirements (for Sandbox or General Operation)

For Sandbox Participation (in partnership with a regulated entity):

  • AML/KYC: Crucial. Both the partnering financial institution and the VASP must demonstrate robust AML/KYC policies, procedures, and systems that comply with Colombian regulations and international standards (FATF).
  • Capital: The primary capital requirements would rest with the partnering regulated financial institution. The VASP itself would need to demonstrate financial soundness and operational capacity.
  • Local Presence: The VASP should have a legal entity registered in Colombia and a physical presence or clear operational base. The partnering financial institution must, of course, be a regulated entity in Colombia.
  • Technological Infrastructure & Security: Robust cybersecurity measures, data protection protocols, and technical reliability are essential.
  • Consumer Protection: Clear mechanisms for user dispute resolution, transparent terms of service, and risk disclosures are required.
  • Project Innovation & Viability: The proposed project must demonstrate innovation and have a clear business case and operational plan.

For all VASPs (AML/CFT obligations by UIAF):

  • AML/KYC Programs: Implement a comprehensive risk-based approach to AML/KYC, including:
    • Customer Due Diligence (CDD) for all clients, including beneficial ownership.
    • Ongoing monitoring of transactions.
    • Reporting of suspicious transactions (SARs).
    • Record-keeping.
    • Appointing an AML Compliance Officer.
    • Training for staff.
  • Registration with UIAF: Mandatory for all obliged entities.
  • Information Sharing: Cooperation with authorities.

Application Process (for Regulatory Sandbox - La Arenera)

The process for participating in "La Arenera" involves several steps, emphasizing a partnership between an innovative project (often a FinTech/VASP startup) and a regulated financial entity (e.g., a bank, trust company) supervised by the SFC.

  1. Project Identification & Partnership: An innovative project (e.g., a crypto exchange concept) identifies a regulated financial institution willing to partner and sponsor the initiative.
  2. Preliminary Engagement with SFC: The partners engage with the SFC to present their idea, discuss potential regulatory hurdles, and receive initial guidance.
  3. Formal Application Submission: The regulated financial institution, together with the VASP, submits a detailed application to the SFC. This application typically includes:
    • A comprehensive description of the innovative project or service.
    • Detailed business plan, financial projections, and operational model.
    • Risk assessment (operational, technological, financial, AML/CFT, legal).
    • Proposed regulatory flexibility or exemptions requested.
    • Consumer protection measures.
    • Technology infrastructure details and cybersecurity protocols.
    • Proof of compliance with AML/CFT regulations by both parties.
    • Timeline for the pilot project.
  4. SFC Evaluation: The SFC evaluates the application based on its innovation, potential benefits, risks, consumer protection measures, and compliance with existing regulations.
  5. Authorization & Monitoring: If approved, the SFC issues an authorization for a specific pilot project, typically for a defined period (e.g., 1-2 years). The SFC closely monitors the project's development and compliance during this period.
  6. Scaling or Exit: Upon completion of the pilot, the project may seek to transition to permanent authorization (if a formal framework exists), scale up operations, or cease activities if unsuccessful.

Specific Regulatory References with URLs

  1. Ley 2143 de 2021 (Law 2143 of 2021):

    • Purpose: Establishes the legal framework for the Regulatory Sandbox (La Arenera) and mandates the Financial Superintendency to propose a comprehensive regulatory framework for crypto assets.
    • Reference: Ley 2143 de 2021, por medio de la cual se crea un marco regulatorio para el funcionamiento de los entornos de prueba o “sandboxes” regulatorios para proyectos de innovación financiera, y se dictan otras disposiciones.
    • URL: http://www.suin-juriscol.gov.co/viewDocument.asp?id=30043818 (Diario Oficial, Government of Colombia)
  2. Circular Externa 026 de 2020 (SFC):

    • Purpose: Officially established the regulatory sandbox "La Arenera" for financial innovation projects. This circular sets out the rules for participation.
    • Reference: Circular Externa 026 de 2020 de la Superintendencia Financiera de Colombia, "Por medio de la cual se establecen las instrucciones para la operatividad de los entornos controlados de prueba - “Sandbox” en el sector financiero."
    • URL: https://www.superfinanciera.gov.co/jsp/Publicaciones/publicaciones/loadContent/20428 (Superintendencia Financiera de Colombia)
  3. Circular Externa UIAF 001 de 2021 (and predecessors like 006 de 2020):

    • Purpose: Updates and consolidates instructions for the prevention and control of money laundering and terrorist financing for Virtual Asset Service Providers (VASPs) and other obliged entities. It explicitly identifies VASPs as obliged entities for AML/CFT purposes.
    • Reference: Circular Externa UIAF 001 de 2021, "Por medio de la cual se actualizan las instrucciones para la prevención y el control del lavado de activos y la financiación del terrorismo – LA/FT, de las actividades y profesiones no financieras designadas y otros sujetos obligados." (This circular generally covers various sectors but includes provisions relevant to VASPs as obliged entities). The previous UIAF Circular Externa 006 de 2020 specifically included virtual asset operators as obliged entities.
    • URL: https://www.uiaf.gov.co/noticias-eventos/noticias/uiaf-expide-nueva-circular-externa-para-aumentar-cobertura-del-splaft (UIAF announcement, links to the actual circular)
    • Direct link to 006 of 2020 (still foundational for VASP inclusion): https://www.uiaf.gov.co/documentos/circulares-externas/circular-externa-006-de-2020-218

Colombia is actively working towards a more robust and explicit regulatory framework for virtual assets. Companies looking to operate in this space should stay updated on developments from the SFC and UIAF, and seriously consider the sandbox for any operations that require interaction with the traditional financial system.

Source Data

90%

**Purpose:** Updates and consolidates instructions for the prevention and control of money laundering and terrorist financing for Virtual Asset Service Providers (VASPs) and other obliged entities. It explicitly identifies VASPs as obliged entities for AML/CFT purposes.

95%

**Reference:** *Circular Externa UIAF 001 de 2021, "Por medio de la cual se actualizan las instrucciones para la prevención y el control del lavado de activos y la financiación del terrorismo – LA/FT, de las actividades y profesiones no financieras designadas y otros sujetos obligados."* (This circular generally covers various sectors but includes provisions relevant to VASPs as obliged entities). The previous UIAF Circular Externa 006 de 2020 specifically included virtual asset operators as obliged entities.

95%

**Investment Tokens/Security Tokens:** Tokens explicitly marketed or designed to represent an ownership interest, a share in profits, debt, or other financial claims in an entity or project. This includes tokens that grant voting rights, profit-sharing, or liquidation rights.

95%

**Tokens from Initial Coin Offerings (ICOs) or Security Token Offerings (STOs):** If an ICO or STO involves the sale of tokens that promise a return on investment based on the development and efforts of the issuer, it will likely be treated as a public offering of securities.

95%

**Utility Tokens with Investment Characteristics:** Even if initially presented as utility tokens (for accessing a service or product), if they are promoted primarily as an investment opportunity with an expectation of future appreciation driven by the issuer's efforts, they can be reclassified as securities. The SFC looks at how they are marketed, sold, and the reasonable expectation of purchasers.

95%

**Tokens Linked to Collective Investment Schemes:** Tokens that represent participation in a fund or a pooled investment managed by a third party, where the token holder expects returns from that management.

95%

**"Pure" Utility Tokens:** Tokens that exclusively grant access to a specific product or service and are primarily used for that purpose, with no significant investment expectation.

95%

**Cryptocurrencies (like Bitcoin or Ethereum):** Generally, widely decentralized cryptocurrencies are not currently viewed as securities by the SFC, but rather as "virtual assets" or "digital assets" that can function as a medium of exchange or store of value, with associated risks.

95%

**Certain NFTs:** NFTs primarily intended as unique digital collectibles, art, or access passes, without an explicit investment scheme or expectation of profit derived from a common enterprise. However, NFTs that fractionize ownership of real estate, art, or represent shares in a profit-generating venture *could* be deemed securities.

95%

**Registration with the SFC:** The issuer must register the token as a security with the SFC and include it in the **Registro Nacional de Valores y Emisores (RNVE)**, the National Securities and Issuers Registry.

95%

**Disclosure Requirements:** Comprehensive disclosure of financial information, business plans, risks, and governance structures, similar to traditional public offerings.

95%

Colombia's securities law has limited exemptions. Private placements (offers to a small, qualified group of investors) might have lighter registration requirements but are still regulated.

60%

**Regulatory Sandbox (La Arenera):** The closest mechanism for innovation is the SFC's **La Arenera**, a regulatory sandbox established under **Circular Externa 021 de 2023**. This allows financial entities (and in certain cases, non-supervised entities in partnership with supervised ones) to test innovative financial services, including those involving crypto assets, under a controlled environment with temporary waivers or specific authorizations. However, participating in La Arenera does not *exempt* a token from being classified as a security; rather, it allows for a structured dialogue and potential adaptation of regulations if a security token is being tested.

100%

**Regulated Exchanges:** Trading must occur on authorized and supervised exchanges, primarily the **Bolsa de Valores de Colombia (BVC)** or other SFC-licensed trading systems.

90%

**Investor Protection:** Rules regarding market manipulation, insider trading, transparency, and best execution would apply, similar to traditional securities.

60%

**Warnings and Alerts:** The SFC frequently issues **public warnings and press releases** cautioning investors about the high risks associated with cryptocurrency investments, emphasizing that they are generally not regulated financial products or securities in Colombia and therefore lack the associated investor protections. These warnings serve as a de facto enforcement mechanism to inform the public and deter non-compliant offerings.

60%

**Example:** Constant reiteration that virtual assets are not considered legal tender or securities and that institutions under SFC supervision are not authorized to custody, invest, or intermediate operations with them (outside of the sandbox).

80%

**Prohibition on Supervised Entities:** The SFC has consistently **prohibited financial institutions under its supervision** (banks, brokers, funds) from directly engaging in activities involving crypto assets (e.g., holding, investing, offering services related to them) outside of the controlled environment of the regulatory sandbox. This is a strong indirect enforcement measure that limits the institutional market for potentially unregulated tokens.

90%

**Actions Against Pyramid Schemes and Fraud:** While not directly securities law enforcement, Colombian authorities (including the SFC, Fiscalía General de la Nación, and Superintendencia de Sociedades) have taken action against **crypto-related pyramid schemes and Ponzi schemes**. These cases are typically prosecuted under general fraud laws, consumer protection laws, or illicit fundraising laws, rather than securities laws, because the *fraudulent nature* is more overt than a mere regulatory classification issue.

85%

**Example:** Crackdowns on entities like **Daily Cop** or **Omegapro**, which operated with promises of high returns through crypto investments, leading to investigations and arrests for illicit fundraising and fraud, though not always explicitly under securities market regulations.

100%

**Regulatory Sandbox (La Arenera) as a Pathway:** While not an enforcement action, the implementation of **La Arenera** is a regulatory tool. If an innovative financial service involving a crypto token is tested in the sandbox and is determined to be a security, the SFC would then provide guidance on how it must be regulated, potentially leading to a formal registration requirement upon exiting the sandbox. This proactive approach aims to guide innovation rather than simply punish it after the fact.

100%

**Ley 964 de 2005 (Securities Market Law):** Defines securities and sets out the framework for public offerings and secondary trading.

100%

**Circular Externa 021 de 2023 (SFC - Regulatory Sandbox Framework - La Arenera):** Establishes the framework for testing financial innovations.

80%

*Example of a relevant concept:* While not specifically classifying a token as a security, **Concepto 2022137682-001 (SFC)** discusses NFTs and applies principles that are indicative of their general approach to digital assets, differentiating based on characteristics (utility, investment expectation, etc.). This demonstrates the *substance over form* approach. (You would need to search for this specific number on the SFC site).

70%

**Cautious but Open:** Regulators acknowledge the potential of virtual assets while emphasizing the associated risks (volatility, fraud, money laundering, consumer protection).

85%

**Focus on AML/CFT:** Anti-Money Laundering and Counter-Financing of Terrorism (AML/CFT) compliance is a primary concern and has seen some of the earliest formal guidance.

85%

Colombia's president has actively endorsed Bitcoin mining as an economic opportunity, signaling a shift away from a purely cautious stance, though cryptocurrency is still not legal tender.

100%

**Role:** The AML/CFT authority. It has issued specific guidelines for virtual asset service providers (VASPs) to report suspicious transactions, even in the absence of a comprehensive regulatory framework.

100%
100%

**Name:** Project of Law 139 of 2022 (Senate) / Project of Law 028 of 2022 (House) – Aims to create a regulatory framework for virtual assets.

78%

**Status:** **Currently pending in the Colombian Congress.** It has gone through several debates and amendments but has not yet been enacted into law.

100%

**Purpose:** To define virtual assets, establish licensing requirements for Virtual Asset Service Providers (VASPs), introduce rules for consumer protection, promote financial stability, and ensure AML/CFT compliance within the crypto ecosystem. This bill, if passed, would significantly formalize crypto regulation in Colombia.

90%

**Purpose:** The SFC created this sandbox to allow traditional financial institutions to partner with selected cryptocurrency exchanges for controlled pilot programs. The goal was to understand the operational risks and opportunities, primarily focusing on enabling fiat on/off-ramps (deposits and withdrawals) for customers of these exchanges through regulated banks.

85%

**Outcome:** Provided valuable insights for future regulation, demonstrating a willingness by the SFC to study and understand crypto operations under controlled conditions.

100%

**Purpose:** Issued by the UIAF, this circular establishes guidelines for Virtual Asset Service Providers (VASPs) to comply with AML/CFT obligations. It mandates registration, customer due diligence, and reporting of suspicious transactions. This was a crucial step in bringing some level of oversight to the crypto sector from an anti-financial crime perspective.

90%

**Legality:** Owning and trading cryptocurrencies is **not prohibited** in Colombia. Citizens are free to buy, sell, and hold virtual assets.

80%

**Unregulated Market:** However, the trading environment is largely **unregulated** from a financial services perspective (pending the "Ley de Activos Virtuales"). This means:

80%

**No specific licensing regime for exchanges:** Crypto exchanges currently operate under general commercial law, not as regulated financial institutions supervised by the SFC (except for those that participated in the LaArenera sandbox pilots).

70%

**Consumer Protection Gaps:** There is no specific legal framework for consumer protection in crypto transactions, leaving users exposed to risks like platform failure, hacks, and scams without clear recourse to financial regulators.

100%

**Banking Relations:** While the sandbox aimed to improve this, many traditional banks remain cautious or refuse to directly service crypto exchanges or businesses due to regulatory uncertainty and AML/CFT risks, making banking access challenging for the industry.

100%

**AML/CFT Obligations:** Despite the lack of comprehensive financial regulation, VASPs are expected to comply with UIAF's Circular 027 of 2020, meaning they must implement robust AML/CFT controls.

70%

**Taxation:** For tax purposes, cryptocurrencies are generally considered **intangible assets**. Capital gains derived from their sale are subject to income tax. The DIAN (Dirección de Impuestos y Aduanas Nacionales – National Tax and Customs Directorate) has provided some guidance, but comprehensive tax regulations specifically for crypto are still developing.

36 fact(s) collected but awaiting source verification. View in explorer →

Sources & Attribution

This article was generated by SearXNG+LLM .

Edit History

2026-04-22 — auto-publish-pipeline: published — Auto-published: grade A

This article is maintained by AI research workers and reviewed by human editors. Learn about our methodology →