The Draft Regulation regulates, among other matters:

• The types of data to be shared among system participants, and identifies both mandatory and non-mandatory participants, their duties and obligations.
• Establishes that reciprocity in data sharing will be required.
• Access to data within the scope of the system must be free of charge, in order to prevent fees from data providers that could create entry barriers.
• A framework of obligations for data providers and recipients to obtain the express consent of data subjects for the processing of personal data within the system.
• Financial Superintendence of Colombia (SFC) is designated as the administrator of the system's participant registry and is granted with authority to define the specific characteristics of the data to be shared, as well as to establish common standards for the operation of the system.

Upon the formal issuance of the Decree, it will take effect immediately; its implementation will follow a phased approach: the SFC will have a period of six (6) to nine (9) months to issue the instructions for the functioning of the Open Finance system, and a twelve (12)-month period for the implementation of payment initiation services which is also regulated by this Draft Regulation in a more less way.

Other Relevant Aspects

Personal Data Protection

The Draft Regulation incorporates a robust regulatory framework for personal data protection, aligned with Laws 1581 of 2012 and 1266 of 2008. Key aspects include:

• Prior, express, and informed consent: The processing of personal data within the Open Finance system will require specific authorization from the data subject, clearly indicating the purpose, authorized processing, and duration of use. General or open authorizations are prohibited.
• Confirmation and authentication: Data providers must confirm with the data subject that the receiving third party has their authorization before sharing information. Additionally, strong authentication of the data subject is required to grant, modify, or revoke authorizations.
• Demonstrated responsibility: Participants must adopt appropriate, effective, and demonstrable measures to ensure the security, confidentiality, quality, and proper use of data, in accordance with Decree 1074 of 2015.
• Data subject rights: The exercise of rights such as consultation, revocation, updating, or refusal of data processing within the system is guaranteed.
• Inclusion of non-supervised entities: Participation of entities not supervised by the SFC is enabled through the figure of trusted third parties, who must operate under principles of transparency, non-discrimination, and absence of conflicts of interest.

Current status

• Pursuant to Decree 1297 of 2022, Law 2294 of 2023, and External Circular No. 004 of 2024 issued by the SFC, Colombia currently has a voluntary Open Finance model applicable to financial institutions. This framework enables such entities to exchange and access customer-permitted data with third parties for the purpose of offering financial products and services.
• In December 2024, the URF released an initial Draft Regulation proposal, which was subject to extensive stakeholder feedback. As a result, the URF has now issued the current Draft Regulation for public consultation.

Click here to read the Spanish version.