Colombia sets roadmap for open finance

Update October 4, 2026: Decree 0368 of 2026 replaced the voluntary framework in place since 2022 with a mandatory system for entities supervised by Superfinanciera. Unsupervised third parties may participate voluntarily, and access to data will require the holder’s express, prior, and informed authorization.

The Superintendence of Finance of Colombia said it will publish the schedule for issuing information-exchange standards for Open Finance, as part of Decree 0368 of 2026. The rollout will be gradual and coordinated, and each stage will depend on compliance with cybersecurity, data privacy, and financial stability standards.

How is the roadmap being built?

The roadmap was developed through seven technical working groups held between June and July 2026, with more than 157 organizations participating, including traditional supervised institutions and fintech players, Superintendente Financiero Pablo Rivas told La República. The regulator also framed it as a strategic alliance with industry to address obstacles tied to technology architecture, data quality, and regulatory definitions.

The plan goes beyond Open Finance. According to El País, the Superintendence of Finance tied the process to its role in drafting a bill on digital assets and to specialized working groups aimed at tokenizing assets in the stock market and the agricultural sector. In that context, supervised entities and fintech firms operating in those segments will need to adapt both to data exchange and to new tokenization rules.

What tools does the regulator plan to use?

The Superintendence of Finance said it will use the regulatory sandbox and the Innovation Hub so supervised entities and fintech firms can test new business models under supervision before going to market. El Heraldo explicitly linked those testing spaces to the Open Finance roadmap.

The agency also posted a summary of its action plan on X. It included the use of technology and artificial intelligence to strengthen supervision, promote innovation, enable new business models, and advance the gradual implementation of Open Finance.

What pressure is building around digital assets?

Portafolio reported that the regulator has been working on regulatory tools to respond to the rise of digital assets and to consumer exposure caused by the lack of specific regulation. Bloomberg Línea added that the Superintendence acknowledges that financial consumers are already unprotected in this space, and that any regulatory progress will need to uphold financial system security and consumer protection criteria.

That context also connects with UNIR’s academic view, which recalls that as of June 2026 the Superintendence maintained that crypto assets are not currency or legally recognized money and that their trading is, in general terms, neither regulated nor supervised. The announced roadmap points, then, toward a more explicit framework for authorizing and supervising digital asset service providers.

Who will be affected by the change?

The regulatory update will affect a growing universe of digital-native players. La República and Bloomberg Línea both note that between January 2018 and August 2026, the Superintendence authorized 22 new supervised entities with digital vocations, including neobanks, payment institutions, crowdfunding platforms, and fully digital insurers.

Portafolio also noted that regulated fintech firms that take in public savings must hold a license from the Superintendence and that their deposits are covered by Fogafín insurance. That places part of the ecosystem under a prudential umbrella similar to traditional banking, while other unregulated fintech firms remain outside it at the outset.

What signals has the authority sent on supervision and control?

The Superintendence said in its 2026 press release list that on July 6 it updated supervision and control tools against money laundering in the financial system. It also said in its 2026 Resolutions section that its resolutions are general administrative acts that must be complied with by all supervised entities.

At the same time, industry group Colombia Fintech asked the government to speed up decisions in four areas, Bre-B, open finance, credit, and crypto assets, and warned that the current pace of regulation is not keeping up with the innovation rate of the more than 365 companies it represents. That position tempers the official message and reflects the tension between consumer protection and industry expectations.