The social and political climate towards identification services is very positive. The know your client (KYC) process has become a standard in the country and an obligation for financial entities supervised by the Colombian Financial Superintendence.
Identification services are regulated by Law 527 of 1999. For the electronic signature, an authorization is required. Such authorization shall be issued by the Organismo Nacional de Acreditación to public or private legal entities. Law 527 of 1999 regulates identification services. Such services can be provided through strong authentication mechanisms such as:
- Digital signature
- One Time Password (together with a second authentication method)
- Cards fulfilling EMV standard (together with a second authentication method)
- Registration of the terminal authorized to effectuate transactions (together with a second authentication method)
There are no official figures as to the size of the market.
The following are the main biggest companies in the market:
For strong authentication services: Gemalto, Vasco, RSA, Visa, Mastercard
For electronic signatures: Citiseg S.A.S., Certicámara S.A., Andes Servicio de Certificación Digital S.A., Gestión de Seguridad Electrónica, EDICOM and for procedures before the Colombian Tax Authority such entity provides its own electronic signature.
For biometric authentication: RNEC, Certicámara, Thomas Gerg & Sons and Carvajal.
Law 527 of 1999 and its decrees regulate identification services. Such services can be provided through strong authentication mechanisms such as: biometry, digital signature, One Time Password (together with a second authentication method), cards fulfilling EMV standard (together with a second authentication method), registration of the terminal authorized to effectuate transactions (together with a second authentication method).
Additionally, know your customer processes have increased the effectiveness in identifying the user and reacting to their needs more accurately.
I. Regulatory Framework
Money laundering is a punishable conduct as per article 323 of the Colombian Criminal Code which states that:
“Whomever acquires, safeguard, invests, transports, transforms, stores, preserves, guard or manage assets that have their mediate or immediate origin in migrant smuggling activities, human trafficking, extortion, illicit enrichment, extortive kidnapping, insurrection, arms trafficking , child trafficking , financing of terrorism and management of resources related to terrorist activities, toxic drugs trafficking, narcotic drugs or psychotropic substances, crimes against the financial system, crimes against public administration, smuggling activities, smuggling of fossil fuels and their derivates, customs fraud or favoring and stimulation of smuggling activities, favoring the smuggling of fossil fuels or their derivates, in any of its forms, or linked to the proceeds of crimes performed under criminal conspiracy , or [whomever] gives [these] assets originated from such activities the appearance of legality or [with the intention of] legalize [them], hide or conceal the true nature, origin, location, destination, placement or rights over such assets, shall be sanction for that single conduct, in prison of ten (10) to thirty (30) years and a fine of one thousand (1,000) to fifty thousand (50,000) times the [Colombian]statutory monthly minimum wage.”.
The Colombian Criminal Code entered into force on 24 July 2000, prior to the criminal code money laundering was regulated by the Law 365 of 1997.
Law 1762 of 2015 introduced new tools to fight money laundering, smuggling and tax evasion.
This Law entered into force on 6 July 2015.
The Basic Legal Circular 029 of 2014 (hereinafter the “Basic Circular”) issued by the Colombian Finance Superintendence entities under its surveillance has the rules and instructions for the management of money laundering risk.
This Legal Circular entered into force on 3 October 2014.
The Basic Circular on its Chapter IV, Title IV, Part I develop the Management System of Money Laundering Risk and Terrorism Financing (known for its initials in Spanish as “SARLAFT”).
This Chapter IV, Title IV, Part I was further amended by External Circular 055 of 2016 issued by the Colombian Finance Superintendence. This External Circular entered into force on 31 March 2017.
National regulator: The Financial Information and Analysis Unit (known for its initials in Spanish as “UIAF”) is the entity charged of collecting, gathering, centralize and analyze data provided by certain entities and from open sources to prevent and find possible operations of money laundering, terrorism funding and their source conduct.
The UIAF is a specialized department of the Ministry of Finance and Public Credit, regulated by Decree 1068 of 2015.
II. Customer Due Diligence (Know your customer identification)
Process: There are two (2) types of KYC identification process. (i)The KYC identification process for entities not under the surveillance of the Colombian Finance Superintendence and (ii) KYC identification process for entities under the surveillance of the Colombian Finance Superintendence.
In Colombia there are no laws whereby the KYC identification process for entities not under the surveillance of the Colombian Finance Superintendence is described. Thus it is free to the parties to establish their own KYC identification process.
For entities under the surveillance of the Colombian Finance Superintendence the minimum standards for KYC identification process, for current and potential customers, are described in article 220.127.116.11.1 of Chapter IV, Title IV, Part I of the Basic Circular, as follows:
- The entity must be certain of the customer identification seeking to establish a relation with them.
The must have reasonable means in place to verify the identification of the people to whom the customer seeks to do transactions with and at least check such customer status in the international lists binding Colombia (i.e. Interpol, OFAC).
If the customer is a company, the KYC identification process includes knowing the identification of its shareholders or associates that hold directly or indirectly the 5% of the companies’ capital. This requirement will not apply when the company is a company listed in capital markets.
- The entity must gather information about the economic activity of the customer.
- The entity must gather information of the customer income and expenses along with its characteristic, amount and origins.
- For current customers the financial entities must have the customer transactions and operations amount and characteristics on file.
Additionally, Chapter IV, Title IV, Part I of the Basic Circular provides, save for some exceptions, that prior to establish a relation with a new customer the entity must conduct an interview, whether face-to-face or by a other means.
Article 18.104.22.168.1.2.3. Chapter IV, Title IV, Part I of the Basic Circular states that for the KYC identification process the financial entities must have a generic form that will have to be filled by the potential customer, a form that must contain at least the following information [ to the right of the table “I” stands for individual and “C” for company and whereas marked with an “X” means that it is applicable ]:
It is not possible to meet customer due diligence requirements by relying on third parties who are obliged by law themselves to comply with AML regulations.
It is legally permitted to outsource customer due diligence by contract to other third parties who are not obliged by law to meet AML regulations and rely on these.
License or registration requirement: In Colombia, there are no laws that prohibit the outsourcing of customer due diligence with third parties who are not obliged by law to meet AML regulations.
There are no regulations about license or registrations of the third party conducting the customer due diligence. Thus, no special requirement exits.
I. Specific Form Requirements
There are no regulations under Colombian law regarding a binding declaration of intention.
A declaration of intention under Colombian law can be understood as a verbal or a written offer.
Whether if it is a verbal or a written offer, the offer is binding for the issuer. In a written offer the issuer could withdraw its offer if the receiver has not accepted within the term described here below.
The verbal offer does not have a specific formal requirement to make it binding, save for when the law mandates for a specific formal requirement to the underlying agreement being offered. As per article 850 of the Colombian Commerce Code the acceptance to this offer must be made when the offer is heard.
The written offer does not have a specific formal requirement to make it binding, save for when the law mandates for a specific formal requirement to the underlying agreement being offered. As per article 851 of the Colombian Commerce Code the acceptance to this offer must be informed to the offeror in the six (6) days following the receipt of the offer.
Colombian law establish that certain agreements have to comply with some formal requirements, yet this is not the general rule and the acceptance of a declaration of intention does not necessarily have to be by written to be binding for the parties.
On the other hand, if the law provides that the agreement construed by the parties needs to be a written agreement it is not legally possible/effective for the parties to replace such requirement.
Conclusion of loan agreement: There are no specific formal requirements under Colombia law to effectively conclude a loan agreement.
Yet, financial entities granting loans must bear in mind that interests accrued by the loan can not exceed the interest limits set by the law or the competent authority, failure to comply is punishable by law.
Conclusion of contracts by electronic signature: In Colombia there are three (3) types of electronic signatures:
- The digital signature, as defined in article 2 (c) of Law 527 of 1999, is a numeric value added to an electronic file, that through a mathematical operation tied to the entity of the signatory and the numeric value of the signature will provide certainty to the electronic file and must be issued by an entity approved by the Colombian Commerce and Industry Superintendence.
The digital signature as per article 28 of the Law 527 of 1999 have the same validity and force as the handwritten signature if :
- It is unique to the individual who uses it.
- It can be verified.
- It is under the exclusive control of the individual who uses it.
- It is bind to the electronic message whereby it is affixed.
- It is in accordance with the Law.
Yet, the digital signature is not commonly used in Colombia, save for some procedures before certain governmental entities.
If the digital signature is used in the manner described above it is binding to the user.
- The electronic signature agreed by the parties, as defined in article 1(1) of Decree 2364 of 2012, as the electronic signature privately agreed by the parties to be used in their agreements and which has the same validity, between such parties, as an electronic signature issued by an entity approved by the National Organization of Accreditation of Colombia (known for its initials in Spanish as “ONAC”).
The entering into an agreement using an electronic signature agreed by the parties is binding to the parties of such agreement, as per article 7 of Decree 2364 of 2012.
- The electronic signature issued by an entity approved by the ONAC, as defined in article 1(3) of Decree 2364 of 2012, as any such method as codes, passwords, biometric data or cryptographic data that will allow for the identification of an individual, issued by an entity approved by the ONAC.
The electronic signature issued by an entity approved by the ONAC is binding to the user of such electronic signature and will create the same rights and liabilities on a contract as the handwritten signature, as per article 3 of Decree 2364 of 2012.
In practice the electronic signature is not commonly used, and until very recently, its access was expensive and limited.
As mentioned hereabove the vendors/entities issuers of electronic or digital signatures must be approved/licensed by the ONAC, the list of the approved/licensed vendors/entities can be searched in the following link https://onac.org.co/directorio-de-acreditados/buscador-por-palabra-clave .Using the key word “Firma electónica”.
Conclusion of an electronic contract that has to match with specific formal requirements is convenient in the country.
Legal consequences if formal requirements are not fulfilled: If a contract does not fulfill the formal requirement as set by the law such contract will be unenforceable.
II. Procedure of Signing in Practice
Contractual agreements in B2B sector: The e-commerce and other related activities are regulated in Law 527 of 1999.
This Law does not provide any indications as to how contractual agreements must be signed.
In practice, B2B contractual agreements are usually signed by the companies’ legal representatives or by whomever has the authority to sign on behalf of the company, by the means (i.e. electronic, physical copies) agreed by the parties to sign .
Contractual agreements in B2C sector: The e-commerce and other related activities are regulated in Law 527 of 1999.
This Law does not provide any indications as to how contractual agreements must be signed.
Usually the contractual agreements in the B2C sector in Colombia are not physically signed as the agreement is completed once the customer agrees to pay the business and the business commits to deliver the service/good paid.
In the B2C sector not many contracts are concluded with a handwritten signature.
Is usual in different business sectors in Colombia that contracts are concluded with a handwritten signature.
Alvaro Parra Gómez
Bernardo Rodríguez Ossa