In Colombia, the theft of an identity has long carried consequences that outlast the crime itself — fraudulent debts, ruined credit, and years of financial exclusion for people who were victims, not borrowers. Responding to this quiet epidemic, the country's Superintendence of Industry and Commerce has opened a public consultation to translate Law 2573 into concrete standards, asking banks, telecoms, and technologists alike what genuine identity verification should look like. The process is a rare institutional acknowledgment that the rules governing who we are — and who can claim to be us — m
Colombia's SIC Opens Public Consultation on Identity Verification Standards
Identity theft victims face adverse credit ratings and fraudulent financial obligations with telecommunications operators and financial institutions.
Victims carry the financial wreckage of crimes committed against them
Mark
So the SIC is basically saying they need help writing the rulebook. What's the actual problem they're trying to solve?
Mimi
Identity theft victims end up with bad credit marks for debts they never took on. Someone steals your ID, opens a phone contract or gets a loan in your name, and suddenly you're the one with the damaged credit rating.
Mark
And Congress decided that wasn't fair?
Mimi
Right. Law 2573 says those fraudulent marks shouldn't count against you. But to make that work, banks and telecom companies have to actually verify who you are before they hand out credit or services.
Luke
Which sounds simple until you ask: how? What technology? How accurate does it need to be? That's what the SIC is trying to figure out.
Mark
So they're asking the industry what's possible?
Mimi
They're asking everyone—technology companies, financial institutions, data protection experts. They want to know what verification systems exist, how well they work, what they cost, and what risks they create.
Luke
The data protection angle is important. You can verify identity perfectly but destroy privacy in the process. The SIC is trying to balance both.
Mark
How long do they have to figure this out?
Mimi
About ten weeks. Consultation ends September 25th, working sessions in October, proposed rules in early November, final regulations by November 20th.
Luke
That's fast. Which means either they're confident about the direction, or they're under political pressure to move quickly.
Mark
And if the rules aren't right?
Mimi
Either legitimate customers get blocked by overly strict verification, or fraudsters keep finding ways in because the standards are too loose.
Luke
Exactly. The SIC is asking the right questions, but the answers will determine whether this actually protects people or just creates new problems.
Der Puls
- Identity theft in Colombia leaves victims holding fraudulent debts and damaged credit scores they had no hand in creating, sometimes for years.
- Law 2573 now compels financial institutions and telecom operators to implement real digital verification — but the law's demands outpace any existing rulebook for how to meet them.
- The SIC has opened a narrow, ten-week consultation window, racing to gather expert input on verification technologies, their accuracy, their failure modes, and the data risks they introduce.
- Working sessions, a draft protocol, and final regulations are all scheduled in rapid succession, signaling that regulators view the status quo as an active harm that cannot wait.
- The stakes cut both ways: standards set too loosely leave fraudsters with room to maneuver, while standards set too rigidly risk burdening legitimate customers with friction and delay.
In Colombia, the theft of an identity has long carried consequences that outlast the crime itself — fraudulent debts, ruined credit, and years of financial exclusion for people who were victims, not borrowers. Responding to this quiet epidemic, the country's Superintendence of Industry and Commerce has opened a public consultation to translate Law 2573 into concrete standards, asking banks, telecoms, and technologists alike what genuine identity verification should look like. The process is a rare institutional acknowledgment that the rules governing who we are — and who can claim to be us — must be built with both technical rigor and human consequence in mind.
Colombia's Superintendence of Industry and Commerce has launched a public consultation to build the regulatory framework that Law 2573 demands — one designed to protect citizens from the financial wreckage that follows identity theft. The problem the law addresses is concrete: when someone's identity is stolen, fraudulent loans and phone contracts appear in their name, dragging down credit scores and locking them out of legitimate financial life for years. Congress passed Law 2573 in 2026 specifically to shield victims from these consequences, particularly when the fraud involves banks and telecommunications operators.
The law sets a clear expectation — any institution offering credit or financial services must deploy robust digital security capable of confirming that applicants are who they claim to be, and that their documents are genuine. The SIC, working alongside the Financial Superintendence and the Ministry of Information and Communications Technologies, must now turn that expectation into enforceable protocols.
To do so, the SIC is consulting the market itself. The questionnaire it has circulated asks which verification technologies exist, how accurate and reliable they are, what conditions cause them to fail, and what risks they pose to the personal data flowing through them. Regulators also want to hear about international models that have worked elsewhere and the real costs of implementation.
The timeline is deliberately compressed: consultation closes September 25th, working sessions run through mid-October, a draft protocol circulates November 2nd, and final regulations arrive November 20th. Roughly ten weeks from announcement to implementation — fast enough to signal urgency, deliberate enough to allow genuine input. What emerges will determine whether millions of Colombians can access credit and telecommunications services without their identities becoming instruments of fraud used against them.
Colombia's financial regulator has opened the door to public input on how banks, telecom companies, and credit institutions should verify who their customers actually are. On September 8th, the Superintendence of Industry and Commerce—known as the SIC—announced a consultation period to gather technical and legal guidance for building new rules around identity verification systems and personal data handling across the country.
The move stems from a real problem. When someone's identity gets stolen, the damage often shows up in credit reports—fraudulent loans taken out in a victim's name, phone contracts they never signed, financial obligations they never incurred. These false entries can tank a person's credit rating and lock them out of legitimate borrowing for years. Congress recognized the scope of this harm and passed Law 2573 in 2026 specifically to shield people from these kinds of negative credit marks when they result from identity theft, particularly involving telecommunications operators and financial institutions.
The law itself is straightforward in its demand: any entity offering financial products, credit services, or similar arrangements must put in place robust digital security measures capable of actually verifying that the person applying is who they claim to be, and that the documents they submit are genuine. The SIC, working alongside the Financial Superintendence of Colombia and the Ministry of Information and Communications Technologies, now has the job of turning that requirement into workable protocols and standards.
To do that job well, the SIC is asking the market itself. The consultation invites anyone with relevant expertise—technology vendors, financial institutions, data protection specialists, civil society groups—to weigh in on what's actually available and what actually works. The questionnaire digs into the specifics: Which identity verification technologies exist? How accurate are they? How reliable? What factors might make them fail? What happens to personal data when these systems process it? What risks do they create for the people whose information flows through them? The SIC also wants to hear about regulatory models that have worked elsewhere, international best practices, and the real costs of implementing these tools.
The timeline is compressed but deliberate. The consultation window runs from September 8th through September 25th at 4 p.m. The SIC will then select participants for working sessions that run from October 5th through October 16th. A proposed protocol goes out for comment on November 2nd. Final regulations are due November 20th. That's roughly ten weeks from announcement to implementation—fast enough to signal urgency, slow enough to allow genuine input.
What's at stake is both technical and human. Get the standards right, and victims of identity theft stop carrying the financial wreckage of crimes committed against them. Get them wrong, and either the rules become so burdensome that legitimate customers face friction and delay, or they remain so loose that fraudsters keep finding ways through. The SIC is essentially asking: what does reasonable security actually look like in a Colombian context, with Colombian technology, serving Colombian customers and institutions? The answer will shape how millions of people access credit, open phone accounts, and protect themselves from having their identities weaponized against them.
Bemerkenswerte Zitate
Entities subject to these requirements must implement sufficient and reasonable digital security measures to verify customer identity and document authenticity— Article 5, Law 2573 of 2026
Möchten Sie die ganze Geschichte?
Das Original lesen bei Baker McKenzie ↗
Politics & Governance