← Regulations / Colombia / Operating Models / Self-custodial wallet

Self-custodial wallet / non-custodial software in Colombia

Publisher of software where users hold their own private keys. The publisher never holds, controls, or has access to user funds.

Permitted AI-Generated · Unreviewed

Self-custodial wallet is permitted in Colombia with no licensing burden.

Verdict Details

Permitted
yes
Local entity required
No
Licensing burden
None
Last updated
2026-07-13

AML Obligations

  • No AML obligations – the publisher never holds, controls, or has access to user funds, so it does not constitute a VASP under Colombian law and is not an 'obliged entity' before the UIAF.
  • The AML/CFT framework (Law 526 of 1999, Decree 1068/2015 as modified by Decree 169/2020, UIAF Resolution 314/2021) applies to VASPs that provide services involving the custody, exchange, or transfer of virtual assets. A non-custodial software publisher does not perform these activities.
  • No customer due diligence (CDD), suspicious transaction reporting (SAR), or registration with the UIAF is required for non-custodial wallet publishers.

Key Restrictions

  • The software must be truly non-custodial: the publisher must never hold, control, or have access to user private keys or funds. Any feature that transitions toward custody (e.g., a hosted wallet, key recovery service controlled by the publisher) would trigger VASP classification and full AML/CFT obligations.
  • No specific license exists for non-custodial wallet software, but if the publisher offers any value-added services (e.g., fiat on/off-ramps, staking-as-a-service, swap aggregation that involves handling user assets), it may fall under SFC sandbox requirements (La Arenera) or VASP obligations.
  • Cryptocurrencies are not legal tender in Colombia (co.custody.cryptocurrencies-are-not-legal-tender). The product must not present itself as a financial instrument or security.

Key Risks

  • Regulatory ambiguity: Colombia has no specific crypto custody license (co.custody.no-specific-crypto-custody-license). The line between 'software publisher' and 'VASP' is not statutorily defined, creating gray-area risk.
  • Enforcement precedent: SIC has aggressively pursued unregistered financial intermediation and pyramid schemes (OmegaPro, Daily Cop), fining entities hundreds of millions of COP (co.licensing.sic-fines-in-the-hundreds). While these involved custody of funds, aggressive enforcement could extend to borderline cases.
  • Consumer-protection liability: Under SIC's consumer protection authority, a wallet publisher could face claims if software defects cause user losses, even without custody (co.licensing.regulators-superintendencia-de-industria-y).
  • Tax reporting uncertainty: If Colombian tax authorities (DIAN) later require wallet publishers to report user transactions, non-compliance could arise even without AML obligations.

Evidence

This verdict synthesizes the following facts. Each fact links to its primary source(s).

custody 96% confidence

Cryptocurrencies are not legal tender in Colombia.

[primary] funcionpublica.gov.co — Norma [primary] superfinanciera.gov.co — La Arenera Sandbox Regulatorio Fintech 10078049 [primary] funcionpublica.gov.co — Norma
custody 95% confidence

They are not regulated by the SFC as financial products or securities, unless they exhibit characteristics that make them fall under existing definitions (e.g., a security token).

[primary] funcionpublica.gov.co — Norma [primary] superfinanciera.gov.co — La Arenera Sandbox Regulatorio Fintech 10078049 [primary] funcionpublica.gov.co — Norma
custody 70% confidence

In Colombia, standalone virtual asset service providers (VASPs) offering services related to virtual assets are not supervised by the Superintendencia Financiera de Colombia (SFC) as traditional financial market institutions, but they are now directly subject to specific AML/CTF and reporting obligations (notably UIAF Resolution 314‑2021) and to an emerging, VASP‑focused regulatory framework that goes beyond the earlier situation where only already‑regulated financial entities were within SFC‑linked oversight when their traditional services touched crypto.

[primary] funcionpublica.gov.co — Norma [primary] superfinanciera.gov.co — La Arenera Sandbox Regulatorio Fintech 10078049 [primary] funcionpublica.gov.co — Norma
custody 60% confidence

No specific "crypto custody license" currently exists in Colombia.

[primary] funcionpublica.gov.co — Norma [primary] superfinanciera.gov.co — La Arenera Sandbox Regulatorio Fintech 10078049 [primary] funcionpublica.gov.co — Norma
licensing 20% confidence

AML/CFT Obligations: All VASPs are subject to Anti-Money Laundering and Counter-Terrorist Financing (AML/CFT) requirements, regardless of whether they are licensed or not.

licensing 20% confidence

Exchanges (Virtual Asset Service Providers - VASPs):

licensing 20% confidence

General Operation: VASPs operating without direct interaction with the traditional financial system (e.g., direct fiat on/off-ramps via banks) are primarily subject to AML/CFT obligations but are not licensed by the SFC. They operate in a somewhat "grey area" from a licensing perspective, though the UIAF views them as obliged entities for AML purposes.

aml 20% confidence

Law 526 of 1999: This law created the Financial Information and Analysis Unit (UIAF) and established its functions as Colombia's Financial Intelligence Unit (FIU). It is the foundational law for AML/CFT in the country.

aml 20% confidence

Decree 1068 of 2015 (as modified by Decree 169 of 2020): This crucial decree explicitly incorporates "virtual assets" into the scope of assets and operations that the UIAF must analyze to prevent money laundering and terrorism financing. It empowers the UIAF to establish reporting requirements for entities involved in operations with virtual assets.

aml 100% confidence

Resolución 314 de 2021 de la UIAF: Por la cual se imparten instrucciones relacionadas con el SARLAFT a los proveedores de servicios de activos virtuales.

[secondary] Resolución 314 de 2021 - Legis Xperta (subscription required, but shows its existence) [secondary] un.org — Information [primary] home.treasury.gov — Specially Designated Nationals And Blocked Persons List Sdn Human Readable Lists
licensing 86% confidence

Superintendencia de Industria y Comercio (SIC) is a regulator in Colombia. The Fiscalía General de la Nación is not supported as a regulator for this context by the provided Colombia-specific evidence.

[primary] sic.gov.co — La Sic Multa Y Ordena El Cese De Actividades De Promotores De Esquemas De Negocio En Los Que Se Captaban Recursos Del Publico Y Advierte Sobre Los Riesgos De Omegapro [secondary] eltiempo.com — Omegapro La Piramide Mas Grande En Colombia Su Caida Y Los Impactantes Datos De Su Creador 820876 [primary] sic.gov.co — Sic Multa Y Ordena El Cese De Actividades A Daily Cop S A S Por Captacion No Autorizada De Recursos Del Publico
licensing 60% confidence

SIC: Fines in the hundreds of millions of Colombian Pesos (COP) against promoters and entities. For instance, in August 2022, the SIC sanctioned "Smart Business Corp SAS," "Bux Corp SAS," and several individuals involved with OmegaPro, imposing fines totaling over COP $2.400 million (approx. USD $600,000 at the time) and ordering the immediate cessation of activities and restitution to affected consumers. Further fines and orders against other promoters followed.

[primary] sic.gov.co — La Sic Multa Y Ordena El Cese De Actividades De Promotores De Esquemas De Negocio En Los Que Se Captaban Recursos Del Publico Y Advierte Sobre Los Riesgos De Omegapro [secondary] eltiempo.com — Omegapro La Piramide Mas Grande En Colombia Su Caida Y Los Impactantes Datos De Su Creador 820876 [primary] sic.gov.co — Sic Multa Y Ordena El Cese De Actividades A Daily Cop S A S Por Captacion No Autorizada De Recursos Del Publico

Verdict Attribution

Source:
AI-Generated · Unreviewed
AI synthesized:
2026-07-13 (deepseek-chat)
Last updated:
2026-07-13
Confidence:
high

This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.

Permitted — a publisher of non-custodial wallet software who never holds, controls, or has access to user private keys or funds is not classified as a VASP in Colombia, faces no AML/CFT obligations, and does not require a license; however, any move toward custody or financial intermediation would trigger full regulatory requirements.

Questions this verdict aims to answer

  • Does software publishing trigger VASP / MSB classification?
  • Do AML obligations attach when no custody exists?
  • What disclosure or consumer-protection rules apply?