Name
Global FinTech Guide
Country _ Name
Colombia
SectionTitle
Identification
Body
FinTechs belonging to this category provide identification services, which are required for most banking services.

Introduction

Attitude of the country towards identification services

Colombia has made significant progress in strengthening its digital identity infrastructure, especially with the introduction of the electronic ID card (cédula digital) since 2020. By the end of 2022, over one million digital IDs had already been issued, and the adoption continues to grow as the country works toward a fully digital civil registry system.

Additionally, under Concept 2020295459 of January 28, 2021, the Colombian Financial Superintendency confirmed that supervised financial institutions may implement digital identification tools such as biometrics, facial recognition, voice, or fingerprint systems, provided they comply with the relevant security and data protection standards.

Private sector actors like digital onboarding and identity verification providers have developed robust biometric authentication and e-signature solutions that help strengthen KYC processes across banks, digital wallets, and FinTech platforms. These tools are now critical as financial institutions must meet strict standards under Colombia’s financial regulations, including multi-factor authentication and secure data handling.

Overall, Colombia’s regulatory and market environment actively supports modern digital identification services, which have become a key enabler for the expansion of secure online banking and broader FinTech adoption in the country.


Legal affairs

Obligations and requirements to provide identification services

In Colombia, the legal framework for identification services, especially in the context of digital transactions and financial services, is based on several interrelated regulations that define how electronic signatures, digital authentication, and biometric mechanisms can be used lawfully and securely.

At the core, Law 527 of 1999 established the legal equivalence between data messages and physical documents, giving full legal validity to electronic signatures and digital certification mechanisms. This law laid the groundwork for the recognition of digital identification processes in commercial and financial operations.

Article 160 of Decree 19 of 2012 further reinforced this by simplifying administrative procedures and expressly regulating the use of electronic signatures as valid identification mechanisms for contracting with public and private entities. It clarified that digital documents and signatures have the same evidentiary value as handwritten ones, provided they meet the integrity and authenticity requirements set out by the law.
To ensure trust in digital signatures, Decree 333 of 2014 implemented detailed rules for the accreditation of certification service providers. Under this regime, any public or private legal entity wishing to issue valid digital certificates used to support advanced electronic signatures must obtain formal accreditation from the Colombian National Accreditation Body  - Organismo Nacional de Acreditación de Colombia (ONAC). ONAC is responsible for verifying that the certifying entity complies with international standards of security, technological infrastructure, identity verification, data encryption, and operational continuity.

Additionally, the Superintendency of Finance, through Concept 2020295459 (Jan. 28, 2021), confirmed that supervised entities may use advanced identification mechanisms including biometrics, facial recognition, fingerprints, and voice patterns, as long as these comply with general data protection principles under Law 1581 of 2012 and specific standards for handling sensitive data.

Financial institutions and FinTechs that implement such identification services must also align with the Basic Legal Circular issued by the Superintendency of Finance, which details the minimum security, KYC, and AML standards for onboarding processes. This includes robust authentication procedures, two-factor mechanisms, encryption of data at rest and in transit, and secure data storage compliant with both local and international cybersecurity frameworks.

Finally, the Habeas Data regime (Law 1266 of 2008) complements this framework by imposing strict obligations to protect financial and credit information when processed for identity verification purposes.

Taken together, these norms ensure that digital identification services operate under a high level of trust, data security, and institutional oversight. Companies seeking to provide or integrate identification solutions, whether offering electronic signatures, digital certificates or biometric verification, must obtain the relevant authorizations, ensure compliance with strict privacy and technological standards, and be prepared for periodic audits by the ONAC and the Superintendency of Finance.

Additional comments regarding the legal situation for identification services or what FinTech’s must be aware of in this business area

Law 527 of 1999 and its decrees regulate identification services. Such services can be provided through strong authentication mechanisms such as:

  • Biometry;
  • Digital signature;
  • One Time Password (together with a second authentication method);
  • Cards fulfilling EMV standard (together with a second authentication method); and
  • Registration of the terminal authorized to effectuate transactions (together with a second authentication method).
For entities under the surveillance of the Colombian Superintendency of Finance, the minimum standards for KYC identification process, for current and potential customers, are described in article 4.2.2.2.1 of Chapter IV, Title IV, Part I of the Basic Legal Circular 029 of 2014.


Economic conditions

Market size for identification services and biggest companies in this business area
There are no official consolidated figures for the total market size of identification services in Colombia, but the sector has shown steady growth driven by the expansion of digital banking, e-government and FinTech solutions. The main companies operating in this market include global and local players offering specialized solutions for strong authentication, digital signatures and biometric verification.

For strong authentication services, key providers include Gemalto (now part of Thales), Vasco (OneSpan), RSA Security, Visa and Mastercard, which supply tokenization, multi-factor authentication and secure identity management technologies for banks and large corporations.

In the field of electronic signatures and digital certification, relevant actors are ETEK, Avanxo, DocuSign, Microsoft, Deceval, Papel Cero, DoyFe, Andes and Certicámara, as well as the Colombian Tax Authority - DIAN (Dirección de Impuestos y Aduanas Nacionales), which acts as the main certifying authority for tax and invoicing compliance.

For biometric authentication, the main players are the National Civil Registry - RNEC (Registraduría Nacional del Estado Civil), which manages Colombia’s national ID database; Certicámara, which offers biometric validation services for private sector transactions; Thomas Greg & Sons, a key supplier of secure printing and biometric systems; and Carvajal Tecnología y Servicios, which develops identity and authentication solutions for both government and private clients.

Additional comments regarding the economic situation for identification services or what FinTech’s must be aware of in this business area

N/A

Authors

Close

Choose country