This country-specific Q&A provides an overview of the legal framework and key issues surrounding fintech law in Colombia.
This Q&A is part of the global guide to Fintech.
For a full list of jurisdictional Q&As visit http://www.inhouselawyer.co.uk/index.php/practice-areas/fintech-2nd-edition
What are the sources of payments law in your jurisdiction?
Payment systems are defined and governed by Decree 2555 of 2010, External Resolution 5 of 2009 by the Central Bank and by rules in the Basic Legal Letter (CBJ) of the Colombian Financial Superintendence (SFC). Payment systems are separated into low-value (client oriented) and high-value (financial institution oriented) systems depending on the average transactions processed during a 6-month period and require a license depending on whether participants are financial institutions and other conditions are fulfilled.
Can payment services be provided by non-banks, and if so on what conditions?
Payment services can be provided by non-banks, either by an electronic money institution or payment institution, see the Danish Payments Act § 9.
An electronic money institution is defined as a legal entity authorized to issue electronic money. A payment institution is defined as a legal entity authorized to offer payment services. Both are hereafter referred to as payment service providers.
A payment service provider must apply for a license at the Danish Financial Supervisory Authority. The payment service provider must fulfil the conditions set out in the Danish Payments Acts chapter 2 in order to be granted such license. When applying, the applicant must provide all information necessary for the Danish Financial Supervisory Authority to assess whether the applicant fulfils the criteria.
For a payment service provider to be granted a license, it will have to comply with the criteria set out in § 10 in the Danish Payments Act:
- The applicant must be a limited liability company, and the management must consist of both an executive committee and a board of directors.
- The applicant must be situated and have its head office located in Denmark, and at least perform some its activities in Denmark.
- The applicant must have an initial capital of at least:
- 350,000 Euro for electronic money institutes
- 125,000 Euro for payment institutes, applying in accordance with annex 1, no. 1-5, to the Danish Payments Act.
- 20,000 Euro for payment institutes, applying in accordance with annex 1, no. 6, to the Danish Payments Act.
- 50.000 Euro for payment institutes, applying in accordance with annex 1, no. 7, to the Danish Payments Act.
- Members of the executive committee, board of directors, the anti-money laundry (AML) responsible person and members of the actual management responsible for compliance and AML, must comply with the fit and proper requirements in § 30 of the Danish Payments Act.
- Direct or indirect owners of at least 10 % of the shares, voting rights or other powers with a decisive influence on the applicant, must be approved by the Danish Financial Supervisory Authority in accordance with § 23 in the Danish Payments Act.
- The applicant must not have close links between the payment institution and other natural/legal person’s that will prevent the Danish Financial Supervisory Authority in exercising their supervisory functions.
- The applicant must have proper and effective organisational structures, procedures and codes of practice.
- The applicant must have the resources to comply with the Danish Anti-Money Laundry Act (In Danish: Lov nr. 930 af 6. september 2019, hvidvaskloven) (The Danish Anti-Money Laundry Act).
- The applicant must secure the funds related to the user of the payment service by ring fencing the funds, in accordance with § 35 in the Danish Payments Act.
- The applicant must ensure proper organization of its activities.
- If the activities effects or are deemed to effect the solidity of the applicant, or
- the activities otherwise effect the Danish Financial Supervisory Authority in exercising their supervisory function.
In addition to the criteria set out above, applicants applying in accordance with annex 1, no. 7, to the Danish Payments Act, must have a liability insurance or otherwise provide a guarantee that the applicant will reimburse potential claims against the applicant.
If the applicant provides other services than payment services (for which the applicant applies), the Danish Financial Supervisory Authority can decide that the payment services must be carried out by a separate legal entity from the applicant under the following criteria:
As payment systems are considered as a set of organized policies, rules, agreements, instruments and technology that allow for the transfer of funds among participants and allow for membership only for financial or cooperative institutions, regulated payment services may only be provided by a specific-purpose financial institution. However, certain payment services may be provided by non-banks, including payment gateways that either serve as a technology provider that connects merchants to the payment system, payment aggregators or similar technology enabling companies. However, all non-banking providers must have an agreement with a bank to provide payments services.
What are the most popular payment methods and payment instruments in your jurisdiction?
Central Bank surveys show that 92% of transactions carried out by private persons are cash-based, showing its prevalence as a preferred payment method. Hence, during 2018 debit cards were used for cash withdrawals in 83% of uses. In contrast, credit cards were used during the same year 73% for purchases.
Corporates prefer other payment methods. Cheques continue to be actively used, as 11.5 million cheques were settled in 2018 (GDP value of 19%) down from 40.6 million cheques in 2009. Electronic transfers had a daily average of COP 16.79 Bn in 2018, with 97% being carried out by companies and representing 85% of total payment operations carried out by companies.
Even though 45% of transactions are carried out via internet, an ample base of payment providers exists in the country including 435.836 POS terminals and 134.318 banking correspondents, mostly comprised of retailers or convenience stores. Postal couriers also provide payment methods within the country as immediate cash payment services nationwide are common in every town.
What is the status of open banking in your jurisdiction (i.e. access to banks’ transaction data and push-payment functionality by third party service providers)? Is it mandated by law, if so to which entities, and what is state of implementation in practice?
Colombian banks are sceptical to opening their interfaces to provide open banking services and client data due to commercial and security concerns. There are some limited initiatives by a few banks to open an API for access to client data. Financial Regulatory Unit (URF) is currently preparing a technical assessment with the purpose of reviewing regulatory tendencies in digital identity and open banking in order to identify obstacles and set a roadmap for an open banking initiative.
How does the regulation of data in your jurisdiction impact on the provision of financial services to consumers and businesses?
Privacy (Law 1581 of 2009) and habeas data regulation (Law 1266 of 2008) are the main regulatory limitations on the collection, transfer and processing of personal and financial data. General authorization on behalf of the consumer is required for each activity but widespread and commonly accepted. However, negative reports on financial behaviour is limited to 4 years after payment which limits lender’s ability to establish long term behavioural credit risk models.
What are regulators in your jurisdiction doing to encourage innovation in the financial sector? Are there any initiatives such as sandboxes, or special regulatory conditions for fintechs?
Law 1955 of 2019 created a sandbox for accelerated licensing for fintech companies. Also, in December 2018 financial institutions were authorized to invest in fintech companies which has triggered M&A activity in the sector. SFC, financial supervisor, created a 3-tier program in 2017 in order to foster innovation in the financial sector which has already bore fruits in encouraging technology adoption and regulation flexibilization. The 3 tiers are (a) an innovation hub with the purpose of establishing an on-going conversation between SFC and innovators, (b) a regulatory sandbox for rules issued by the SFC and that only applies to licensed institutions that may or not partner with fintech companies, and (c) regtech developments.
Do you foresee any imminent risks to the growth of the fintech market in your jurisdiction?
Motivated by legal grey-area business models and believing that government oversight may ease difficulty of doing business, fintech entrepreneurs are pushing for more regulation. If successful, fintech companies may have set up a regulatory landscape that hinders innovation since licensing comes along with burdensome compliance requirements that startups find difficult and costly to implement. Also, financial and innovation policies in fintech and payments industry modernization have yet to be issued as secondary regulation in the form of government decrees which shows a degree of improvisation in some of these initiatives and may be subject to repeal from future administrations or regulatory stagnation if policies change.
What tax incentives exist in your jurisdiction to encourage fintech investment?
Until 2021, fintech companies may be eligible for a 7 year income tax exemption if they qualify with certain criteria including, amongst others: (a) exclusive corporate purpose must be the development of value added technology industries, (b) main activity must be software planning, analysis, design, programming or testing or IT consulting and administration, (c) minimum investment (aprox. USD 50.000 and job creation commitment, (d) income of less than COP 2.741 mm. Also, tech companies may also be eligible for tax credit and accelerated deduction on investments carried out in IT.
Which areas of fintech are attracting investment in your jurisdiction, and at what level (Series A, Series B etc)?
Most investment is still being carried out at early stage companies by either seed or angel rounds. However, there are several Series A rounds that have been successful in digital lending and payments industry, which seem to be the most attractive subsectors in the past years. Increased interest in money transfer and BPO/Enterprise financial services is also a recent trend. Venezuelan migration to the country has become a driver for money remittances alternatives to traditional banking, mostly based in crypto-currency solutions.
If a fintech entrepreneur was looking for a jurisdiction in which to begin operations, why would it choose yours?
According to Finnovista, Colombia is the third largest fintech ecosystem in the LatAm region, after Mexico and Brazil. An active community exists which supports newcomers and market trend-setters alike. Current government policy is betting on digital economy growth and innovation to promote financial inclusion. Finally, Bogotá’s institutions are set on promoting the city as a the most important financial services hub for the Andean and Caribbean region by 2026.
Access to talent is often cited as a key issue for fintechs – are there any immigration rules in your jurisdiction which would help or hinder that access, whether in force now or imminently? For instance, are quotas systems/immigration caps in place in your jurisdiction and how are they determined?
Persons taking up employment in Colombia need a work visa prior to their employment. However, hiring immigrants in Colombia has become increasingly easy for companies over the past few years since after a century of conservative migration policies, regulations were relaxed, and managerial quotas were repealed. Moreover, common opinion is that access to talent is not an issue and a high demand from foreign companies exists for Colombian developers.
If there are gaps in access to talent, are regulators looking to fill these and if so how? How much impact does the fintech industry have on influencing immigration policy in your jurisdiction?
Gaps in talent was the key element of pre-reform visa approval so it still is a valid and legitimate consideration in migration policy. Yet, however momentous, fintech industry is still and incipient industry with limited influence in policy and regulation.
What protections can a fintech use in your jurisdiction to protect its intellectual property?
Typical IP protection figures apply in Colombian jurisdiction, including patents, source code, industrial design, circuits design, and trademarks. This provides protection for algorithms and business flows/processes which may be protected by criminal procedures that are the responsibility of both tax and criminal authorities. IP owners are also entitled to file for private enforced litigation forcing violators to open their books and technology to a civil judge to determine whether IP is being used in violation of valid licencing. Databases may also be subject to protection in most cases, if they are constructed by the owner. Several trade agreements are in effect with the US, EU, UK, Canada, and several others, that provide additional protection and procedures for IP.
How are cryptocurrencies treated under the regulatory framework in your jurisdiction?
Cryptocurrencies are not subject to specific regulation in Colombia nor its legal status has been clearly defined, except for tax purposes, although several attempts to regulate them are undergoing legislative process. SFC has instead issued warning directed at consumers and financial institutions regarding fraud and AML risks. Even more, SFC has instructed financial institutions since 2017 that they are not allowed to trade cryptocurrencies, that they are not considered to be a security under any circumstances, and persuaded them in limiting banking access to individuals and companies that trade or provide trading services for cryptocurrencies.
How are initial coin offerings treated in your jurisdiction? Do you foresee any change in this over the next 12-24 months?
Law 964 of 2005 regulates securities and states that any negotiable right issued with the purpose or effect of raising money from the public may be deemed a security and, as such, require registration with market authorities and authorization for public offering. Whereas utility tokens or coins clearly do not fall under this category, some ICOs may be classified as securities requiring a detailed analysis in each case. However, SFC has issued several non-binding opinions that cryptocurrencies are not considered to be securities leading to no action being taken against any ICO issuer so far.
Are you aware of any live blockchain projects (beyond proof of concept) in your jurisdiction and if so in what areas?
No live blockchain projects operate in the jurisdiction providing successful use cases except for private networks supporting payment remittances. Central bank is working alongside R3 to use DLT to support payments and centralized depository for securities trading. The Colombian commodities exchange is also developing a plan to support warehousing bond trading on blockchain technology.
To what extent are you aware of artificial intelligence already being used in the financial sector in your jurisdiction, and do you think regulation will impede or encourage its further use?
AI is not heavily used in the Colombian financial sector and is limited to chatbots for bank-client relations. There has been for some years now limited use of trading algorithms in government bond trading which is the most liquid in the country. Regulation may impede the use of AI in several industries as an astringent interpretation of professional responsibility delegation has been in place for a long time. Some advances in securities markets advisory have been adopted allowing for tech-based advisory but are yet to be a common place in the industry.
Insurtech is generally thought to be developing but some way behind other areas of fintech such as payments. Is there much insurtech business in your jurisdiction and if so what form does it generally take?
Insurance industry in Colombia represents 10-15% of innovation opportunities and sandbox applicators within the SFC in 2019. Insurtech startups are mostly focused on price comparison and microinsurance development. There are several early stage newcomers working on IoT based agricultural insurance and health insurance. No other relevant or clearly identified market champion or tendency is evident.
Are there any areas of fintech that are particularly strong in your jurisdiction?
Nasper’s owned PayU LatAm branch was mostly grown for a Colombian startup which aided in the development of a strong payments fintech community. Also, Venezuelan migration coupled with international sanctions against Venezuela have provided a fruitful environment for crypto-currency based payment remittances startups. Finally, due to financial institutions failure to provide credit products in a large scale, online lending is also very strong with an ample room for additional growth.
What is the status of collaboration vs disruption in your jurisdiction as between fintechs and incumbent financial institutions?
Up until December 2018, financial institutions relationship with fintechs was limited to software vending services and, even though, incumbents were members of the main fintech association in the country, a high level of suspicion existed. In December 2018, banks were allowed to invest in fintech startups which drastically changed the relationship, allowing startups to become acquisition or investment targets and helping to develop more collaborative relationships due to alignment of interests.
To what extent are the banks and other incumbent financial institutions in your jurisdiction carrying out their own fintech development / innovation programmes?
Until December 2018, banks were not allowed to invest in fintech companies which forced them to develop their own fintech programmes. Banking market leaders have already been working for some years in becoming fully digital banks and increasing their savings offers to digital wallets, which is a success business case for incumbents. This same segment was so appealing that even money market fund managers decided to indirectly fund fintechs to provide similar services.
Additional developments exist in parents accompanies but due to regulation restrictions these programmes were carried out or funded at a higher or parallel company level. A very successful example of this is Colombian securities exchange owned Sophos, a separate company that provides trading technology for banks and other participants which grew from a side-business to representing a quarter of corporate earnings.
Are there any strong examples of disruption through fintech in your jurisdiction?
PagosOnline (acquired by PayU) started in 2002 to work in payment solutions for e-commerce and introduced payments gateways which changed the ecosystem so much that (i) regulation was revised in order to introduce rules for the newcomers, (ii) market supervisor decided to turn a blind eye into some of the gateways activities as not to hinder innovation. Rappi, initially set up as a delivery company, is growing fast by distributing digital wallet services to retail consumers but moving rapidly into any type of good or service.