Colombia extends mandatory open finance rules

Update November 2, 2026: Decree 0368 of 2026 made Colombia's mandatory Open Finance System official for entities supervised by the Financial Superintendence. Decree 1489 of 2026 then extended several implementation deadlines, including the information standardization schedule, the participant directory, and monitoring indicators.

Decree 0368 of 2026 established a mandatory Open Finance System in Colombia for entities supervised by the Financial Superintendence. The framework was set up with automatic information exchange protocols through application programming interfaces, and data handling subject to Laws 1266 of 2008 and 1581 of 2012.

What changed with Decree 1489 of 2026?

Decree 1489 of 2026 adjusted the system's implementation deadlines, with extensions for information standardization, the participant directory, monitoring indicators, and financial portability. The rule pushed several terms back, with deadlines extending to 2029 for one component.

Enter.co reported that Decree 1489 of 2026 introduced changes to Colombia's open finance framework. The note on the change does not detail the full content of the new standards or the full scope of each adjustment in the material provided, but it does place the rule as a key piece in the regulatory transition.

What deadlines did the extension change?

The extension increased the deadline for the Financial Superintendence to set the information standardization schedule from 6 months to 12 months, with a deadline of April 7, 2027. It also extended the deadline to launch the participant directory and define its access, registration, modification, and removal rules from 12 months to 18 months, due October 7, 2027.

The same decree extended the deadline to define, calculate, and publish the monitoring indicators for the Open Finance System from 12 months to 18 months, also due October 7, 2027. In addition, it increased the time to establish the standards and reporting information for financial portability from 24 months to 30 months, with a deadline of February 4, 2029.

Who does the mandatory framework cover?

According to La República, the new system covers banks, trust companies, pension funds, insurers, and fintech firms, among others. The coverage adds that the exchange may include the last 12 months of transaction history, onboarding information, and the features of financial products, always with the user's authorization.

According to an analysis by Monet, the mandatory framework would cover, among other entities, credit institutions, SEDPEs, trust companies, broker-dealers, pension funds, insurers, and crowdfunding platforms. That reading should be treated cautiously, because the source itself warns that the interpretation should be checked against the official text of the decree and its implementing rules.

The same source draws a distinction between general product information and onboarding or transactional data. In its analysis, general information would not require authorization because it is not personal data, while access to onboarding and transactional data would be subject to authorization.

What new tasks were assigned to the Superintendence?

The Financial Superintendence said Decree 0368 assigns it tasks tied to mitigating technology and cybersecurity risks, preventing misuse of data, setting technology and security standards, and monitoring the system. The agency also linked the framework to competition, innovation, and financial inclusion goals.

What still needs official confirmation?

The official sources from the Financial Superintendence and the Colombian government still need to be checked to confirm the decrees, the deadlines, and the exact way the system will be implemented. The material available for this report does not provide a complete timeline or confirm whether further extensions will follow, so that point remains open in the reviewed coverage.

The editorial recommendation in the research material is to verify those official documents before treating the system's regulatory scope as settled, especially on consent, technical standards, the implementation timeline, the participant directory, and any possible extensions.