1 The Fintech Landscape
1.1 Please describe the types of fintech businesses that are active in your jurisdiction and the state of the development of the market, including in response to the COVID-19 pandemic and ESG (Environmental, Social and Governance) objectives. Are there any notable fintech innovation trends of the past year within particular
sub-sectors (e.g. payments, asset management, peerto-peer lending or investment, insurance and blockchain applications)?
The following list contains the different types of fintech businesses that are currently active in our jurisdiction or that may be deemed as having experienced notable trends in recent years:
■ Crowdfunding.
■ Neobanks.
■ Payment systems and payment gateways.
■ Peer to peer (P2P) lending.
■ Crowdequity.
■ Crypto assets.
■ Distributed ledger technology.
■ Robo-advice technology.
Colombia has recently undergone active development of its fintech regulation, aimed mainly at including new models in the financial system. In addition, since the onset of the COVID-19 pandemic, the use of technologies in financial services has increased due to, inter alia, the avoidance of the use of physical currency. The approach of the Colombian financial regulator has led to accelerated development within the fintech industry.
Colombia is currently a leading country in Latin America with regard to fintech developments, behind only Brazil, Mexico, and Uruguay. The legislator’s focus has not only been on the feasibility of allowing or implementing certain models in Colombia, but also on promoting the implementation of existing models that appear to be beneficial for the financial system.
As regards the latest fintech sector developments, it is important to highlight the following:
■ A new crowdfunding regulation was recently issued, modifying the legal framework first introduced in 2018, and aiming to provide more flexibility in order to make it a
more attractive option for the various involved actors.
■ Regulations are currently being issued with regard to financial markets advice, specifically related to the use of robo-advisors.
■ A decree has been issued allowing some of the financial entities under the supervision of the Colombian regulator to acquire or invest in fintech companies.
■ A decree has been issued creating a Regulatory Sandbox, complementing the Supervision Sandbox which has been in place since 2018.
1.2 Are there any types of fintech business that are at present prohibited or restricted in your jurisdiction (for example cryptocurrency-based businesses)?
Colombian legislation does not set forth any restrictions on businesses or business models in general terms. However, some activities are deemed of public interest and, therefore, may only be performed by authorised companies.
Regarding the fintech industry, collecting money from the public (fundraising) is considered of public interest; hence, to engage in this kind of activity, companies must be authorised by the Financial Superintendence of Colombia (FSC). Therefore, there are restrictions for some types of fintech businesses, such as:
■ Fintechs undertaking unauthorised fundraising activities.
■ P2P platforms, if they engage in unauthorised fundraising in the development of their business model.
■ Companies undertaking equity and debt crowdfunding, as these are regulated activities and must be performed by authorised institutions. Any entity undertaking debt
or equity crowdfunding activities must comply with the requirements and restrictions set forth in the financial regulations.
■ Trading platforms. While these activities are not regulated, authorised by, or under the supervision of the FSC, they are exclusively authorised for financial entities.
■ Financial entities under the supervision of the FSC, which are prohibited from carrying out operations with cryptocurrencies – on their position or on third parties’ positions.
2 Funding For Fintech
2.1 Broadly, what types of funding are available for new and growing businesses in your jurisdiction (covering both equity and debt)?
Both equity and debt are common tools to fund new and growing fintech businesses. It is usual for Colombian start-ups to participate in fundraising rounds in different jurisdictions to finance their initial or ongoing operation. It is also a common practice in our jurisdiction to fund operations or businesses through private investment or venture capital.
Debt is easily accessible through other financial institutions or even through other fintech institutions that are also growing in the market.
In terms of fintech itself, reward-based and donation crowdfunding are neither regulated nor prohibited in Colombia and are alternatives for funding different growing businesses or specific social causes. However, debt and equity crowdfunding are regulated by Decree 1357 of 2018, Decree 1235 of 2020, and External Circular 014 of 2021. Additionally, crowd factoring platforms allow small businesses to access funds for their daily operations.
On the other hand, some governmental entities offer support programmes to small and medium-sized companies aiming to sponsor specific projects with working capital or financial resources. For example, Bancoldex has a programme that finances companies from all economic sectors.
2.2 Are there any special incentive schemes for investment in tech/fintech businesses, or in small/medium-sized businesses more generally, in your jurisdiction, e.g. tax incentive schemes for enterprise investment or venture capital investment?
Yes, the following list contains the tax benefits for companies rendering fintech or tech-related services:
(1) Tax benefit for orange economy companies: the possibility for a company to be exempted from income tax for a sevenyear term, in connection with the income obtained from the development of technological value-added industries, creative and cultural activities. To obtain this benefit, the requirements established in numeral 1 of Article 235-2 of the Colombian Tax Code and the regulatory decree issued by the Colombian Government must be met.
(2) VAT exclusion for cloud computing services: services that fit the definition of “Cloud Computing”, in accordance with legal opinion 17056 of August 25, 2017 issued by
the Tax Authority, are not taxed with VAT. The service provider must fill in the self-diagnostic form of the service, issued by the Ministry of Information Technology
and Telecommunications.
(3) Law 1955 of 2019 established a new tax incentive that allows small and medium-sized businesses to convert 50% of investments into science, technology, and/or innovation projects into a tax credit that can be used to offset national taxes.
2.3 In brief, what conditions need to be satisfied for a business to IPO in your jurisdiction?
In general terms, companies (except for Simplified Stock Companies) may issue securities under an IPO by complying with the regulatory guidelines outlined in the Commercial Code, Law 964 of 2005, and Decree 2555 of 2010. According to those regulations, companies must be registered before the National Securities and Issuers Registry (RNEV) and keep it updated with periodic and relevant information as established in Decree 2555 of 2010. An IPO is carried out through a legal procedure before the FSC, and requires its authorisation.
2.4 Have there been any notable exits (sale of business or IPO) by the founders of fintech businesses in your jurisdiction?
Since fintech companies are mostly start-ups and many of them are incorporated as Simplified Stock Companies, there have not recently been any IPOs in Colombia. However, this does not mean that there have not been significant investment rounds for the most notable fintech businesses. For example, Sempli.co,
which specialises in virtual loans, obtained USD 10 million in September 2021 from the Interamerican Development Bank, Oikocredit, Incofin, among other investment funds and family offices. Addi, a company that offers the possibility of paying for purchases in stores in monthly instalments, obtained USD 80 million in equity from Singapore’s sovereign wealth fund, GIC Private, Softbank Group Corp.’s Latin America Fund and others, and an additional USD 125 million in debt financing, most of which came from Goldman Sachs Group.
3 Fintech Regulation
3.1 Please briefly describe the regulatory framework(s) for fintech businesses operating in your jurisdiction, and the type of fintech activities that are regulated.
Colombia does not have a specific fintech regulation. Fintech companies must observe the different dispositions applicable to them, which may be found in different areas of the Colombian legal system. As explained above, debt and equity crowdfunding platforms must abide by Decree 1357 of 2018, Decree 1235 of 2020, and External Circular 014 of 2021. As mentioned above, Decree 1234 of 2020 created a Regulatory Sandbox, complementing the Supervision Sandbox which has been in place since 2018. Also, it is worth noting that the Superintendence of Finance issued External Circular 029 of 2019 to update the financial system to accommodate new technological trends in payments and biometric security identifiers.
Other legislation that is relevant for fintech businesses is: (i) Decree 661 of 2018 relating to robo-advice technology in financial markets; (ii) Decree 2443 of 2018, which allows credit and other financial entities to invest in companies specialised in developing new technologies in the financial sector; (iii) Resolution 042 of 2020 issued by DIAN (the Tax Authority), which relates to billing systems, technology providers and the registration of electronic sales invoices; and (iv) Decree 222 of 2020, which allows financial correspondents to supply their services not only through physical infrastructure but also through mobile and digital infrastructure.
3.2 Is there any regulation in your jurisdiction specifically directed at cryptocurrencies or cryptoassets?
There is no specific regulation on cryptocurrencies in Colombia. However, the FSC and the Colombian Central Bank have issued communications that state their position in this regard, as briefly explained below:
(1) Colombian Central Bank
The highest monetary authority of Colombia has issued different official statements that establish that cryptocurrencies are not recognised as a currency, since they have no support or participation of a central bank. Furthermore,they have argued that these instruments are not a highly liquid asset.
(2) FSC
The FSC has issued different official statements that establish its position concerning these instruments. External Circular 052 of 2017 established a prohibition on financial entities supervised by the FSC from intermediating with cryptocurrencies, as well as from allowing the use of their platforms to carry out operations with cryptocurrencies.
However, even though this Circular has not been modified, FSC has moderated its position with the launch and entry into operation of a pilot project in the sandbox
(LaArenera) for carrying out deposits and withdrawal operations of pesos for the purchase and sale of crypto assets, in which alliances made up of financial entities and trading platforms are participating.
The completion of the pilot project is expected at the end of 2022. Based on the project’s conclusions, it is expected that the Colombian Government shall issue a regulation concerning cryptocurrencies for the first time.
3.3 Are financial regulators and policy-makers in your jurisdiction receptive to fintech innovation and technology-driven new entrants to regulated financial services markets, and if so how is this manifested? Are there any regulatory ‘sandbox’ options for fintechs in your jurisdiction?
The FSC has created a working group dedicated to fintech issues. The group has been working closely with the actors close to the fintech ecosystem and the financial regulator to ensure a smooth implementation of the regulations that have been, and will be, issued to address fintech issues. The group oversees all matters related to the projects that are submitted before the Supervision Sandbox, as well as those that will be presented to the newly created Regulatory Sandbox. Likewise, the National
Development Plan has focused on proposing new policies in the fintech industry, covering the different legal aspects that may affect the industry.
3.4 What, if any, regulatory hurdles must fintech businesses (or financial services businesses offering fintech products and services) which are established outside your jurisdiction overcome in order to access new customers in your jurisdiction?
Decree 2555 of 2010 sets forth that foreign financial institutions seeking to promote or market financial services or products in Colombia are required to either: (i) open a representative office in Colombia; or (ii) enter into a referral agreement with a local stockbroker or a local investment bank authorised and under the surveillance of FSC; in both cases authorisation from the FSC is required. However, not all fintech businesses are considered, as per Colombian regulations, as foreign financial entities that promote financial services in Colombia. Entities that are not considered foreign financial entities and do not provide financial services are allowed to promote their services without requiring specific authorisation by the FSC.
4 Other Regulatory Regimes / Non-Financial Regulation
4.1 Does your jurisdiction regulate the collection/use/transmission of personal data, and if yes, what is the legal basis for such regulation and how does this apply to fintech businesses operating in your jurisdiction?
All matters related to the collection, use, transmission, and, in general, the handling of personal data are regulated by specific laws in Colombia. Also, personal information is protected through a constitutional right, known as habeas data. Law 1581 of 2012 regulates the General Data Protection Regime, establishing general standards and requirements regarding data processors’ and controllers’ duties as well as the subjects’ data rights. However, the handling of personal data in financial, credit, and commercial services is regulated under Law 1266 of 2008.
The abovementioned regulation will apply to fintech businesses only if they handle personal information (Law 1581 of 2012) or personal information related to financial, credit, or commercial aspects (Law 1266 of 2008). From our experience, businesses similar to fintech businesses would have to apply both regulations depending on the purposes of the handling of personal information.
4.2 Do your data privacy laws apply to organisations established outside of your jurisdiction? Do your data privacy laws restrict international transfers of data?
The regulations mentioned in the answer above are applicable whenever the organization is established outside of Colombia. Please note that, as per Colombian regulation, there is a difference between transfers and transmissions of personal data. Transfers are the exchange of data from one controller to another, while transmissions refer to the exchange of data from a controller to a data processor.
Regarding international transfers, these may not be performed in countries that do not have adequate levels of data protection similar to those granted by Colombian regulation. However, international data transfers are allowed in the following cases: (i) when the transfer is expressly authorized by the data subject; (ii) when it is required for public health reasons; (iii) when transfers are required on a bank or stock exchange operation following the corresponding applicable regulation; (iv) when it is an agreed transfer within the international treaties framework to which Colombia is a party; (v) when the transfer is necessary for the execution or performance of a contract between the data subject and the controller, or for the execution of pre-contractual measures where the data subject has authorized it; and (vi) when it is a transfer legally required for safeguarding the public interest or for rights recognition, exercise, or defense in a judicial process.
On the other hand, international transmissions may be performed without the data subject’s consent whenever there is a transmission agreement between the controller and the processor in terms of Article 25 of Decree 1377 of 2013.
4.3 Please briefly describe the sanctions that apply for failing to comply with your data privacy laws.
Sanctions applicable for failing to comply with data privacy laws are outlined in two different regulations: Law 1266 of 2008; and Law 1581 of 2012. Failing to comply with either or both laws may result in the following sanctions:
Under Law 1266 of 2008:
■ For financial entities: suspension of the financial entity’s activities for a maximum term of six months when such entity is in serious violation of the abovementioned law.
■ Personal or institutional fines from an amount of up to 1,000 monthly legal minimum Colombian wages at the time of the sanction (for 2021, approx. USD 252,752).
■ Suspension of data bank activities for a maximum term of six months.
■ Definitive closure of data banks, whenever the handling of data is performed with unauthorised data.
Under Law 1581 of 2012:
■ Personal or institutional fines from an amount of up to 2,000 monthly legal minimum Colombian wages at the time of the sanction (for 2021, approx. USD 505,504).
■ Temporary closure of the operations of data processing, whenever the processor did not apply the measures ordered by the authority along with the suspension.
■ Definitive and immediate closure of the operations of sensitive data processing.
Every failure to comply should be assessed on a case-by-case basis, as it is possible only one of both the foregoing laws could be applicable.
4.4 Does your jurisdiction have cyber security laws or regulations that may apply to fintech businesses operating in your jurisdiction?
According to Decree 663 of 1993 and Decree 2555 of 2010, there are specific regulations applicable to financial entities and therefore to some fintech businesses. Accordingly, the FSC has recently issued the following regulations:
■ External Circular 005 of 2019 sets forth rules related to the use of cloud computing services;
■ External Circular 006 of 2019 establishes instructions, standards, and requirements related to transactions with
QR codes;
■ External Circular 029 of 2019 establishes instructions related to the use and implementation of biometric identifiers on financial services; and
■ External Circular 033 of 2020 establishes instructions regarding the Single Taxonomy of Cyber Incidents (TUIC), the format for reporting information security and cybersecurity metrics, and the labelling protocol for the exchange of information Traffic Light Protocol (TLP).
4.5 Please describe any AML and other financial crime requirements that may apply to fintech businesses in your jurisdiction.
AML requirements for financial entities are outlined in Articles 102 to 105 of the Organic Statute of the Financial System (Decree 663 of 1993) and Chapter IV of Title IV of Part I of the Basic Legal Regulation issued by the FSC. AML requirements for all other companies (including companies exempted from such requirements) are outlined in Circular 100-000016 of 2020 issued by the Superintendence of Companies.
Additionally, it must be borne in mind that unauthorised fundraising is considered a crime under the Colombian Criminal Code. To carry out this activity, it is necessary to be authorised by the FSC.
4.6 Are there any other regulatory regimes that may apply to fintech businesses operating in your jurisdiction?
Depending on the type of fintech business and if the activity being carried out is considered a financial operation, the financial entities regime may apply and the fintech business may be subject to the control and surveillance of the FSC. Otherwise, the regular commercial regime will be applicable.
5 Accessing Talent
5.1 In broad terms, what is the legal framework around the hiring and dismissal of staff in your jurisdiction? Are there any particularly onerous requirements or restrictions that are frequently encountered by businesses?
The general legal framework for hiring and dismissing staff in Colombia is outlined in the Colombian Labour Code, but it is important to always bear in mind the rulings issued by the Supreme Court of Justice and Constitutional Court, as both entities establish how laws are understood and applied. There are no requirements or restrictions for hiring staff in Colombia. Thus, foreign staff require a visa or a permit that would allow them to perform certain activities in Colombia.
However, regarding the dismissal of staff, there are certain occasions where this faculty is limited because of special protection that provides labour stability in favour of certain groups of employees, in respect of which it is not possible to carry out the termination of their labour agreements without the authorisation of the Ministry of Labour.
If the employment agreements are terminated without having the mentioned authorisation, the employee wrongfully dismissed may file a Constitutional Action to claim his/her reinstatement, in which case the salaries and social security contributions must be paid retroactively from the date of dismissal plus an indemnity equivalent to 180 days of salary.
Employees who have labour stability protection are:
■ Individuals suffering health issues (by a common or labour cause).
■ Pregnant women.
■ Women on maternity leave.
■ Men whose wives are pregnant or on maternity leave and are thus economically dependent on their husbands.
■ Employees who have filed a labour harassment claim in the past six months.
■ Employees who are within three years of obtaining their pensions.
Additionally, considering that when an employer needs toexceed the limit established by law on labour agreement terminations, it is necessary to request a special authorisation before the Ministry of Labour, which may take up to two years, and authorisation is not always granted. If the employer exceeds such a limit
without due authorisation, the terminations will not have any legal effects and the employees shall be reinstated. The limit established by law starts with a headcount of 10 or more employees.
Finally, and in response to the pandemic, the Ministry of Labour established that companies must obtain previous authorisation to temporarily suspend activities for up to 120 days.
5.2 What, if any, mandatory employment benefits must be provided to staff?
Aside from salary, employees who earn an ordinary salary are entitled to receive other mandatory benefits, such as the following:
■ Severance payment: the payment of one monthly salary for each year of service and proportionally per fraction. The deposit must be made no later than February 14 of the next calendar year. The severance fund must be elected by the worker.
■ Interest on the severance payments: interest is liquidated on accrued severance payments as of December 31 of each calendar year.
■ Legal bonus: corresponds to one month’s salary per year of service and is payable half in June and half in December of each year.
■ Legal transportation allowance: consists of the monthly payment of a fixed sum to employees who earn up to two monthly minimum wages, (for 2022, COP 2,000,000). In response to COVID-19, the Ministry of Labour established that the legal transportation allowance will cover the internet connectivity expense of employees who work
from home due to the pandemic.
■ Footwear and clothing: footwear and clothing are given every four months to employees who earn up to two monthly minimum wages (for 2022, COP 2,000,000). This benefit must be given on April 30, August 30, and December 30.
In addition to fringe benefits, employees are entitled to a 15-business-day period of paid rest for every year of service and proportionally for any fraction thereof. Employees shall enjoy at least six continuous days of vacation for every year of service. For this reason, the accumulation of vacations is limited to nine
days per year. Such leave may be accumulated only for up to two periods.
However, in special cases (technicians, employees who specialise in certain forms of work, management, senior staff, or foreigners who render their services in places different from those where their families live), such leave may be accumulated for up to four years.
5.3 What, if any, hurdles must businesses overcome to bring employees from outside your jurisdiction into your jurisdiction? Is there a special route for obtaining
permission for individuals who wish to work for fintech businesses?
To bring foreign staff into Colombia, it is important to determine the activities that are going to be performed in Colombia by each foreigner, his/her duration in the country, if any kind of payment is going to be made to them, among any other relevant information to determine the type of visa or permit that will allow them to render services in Colombia. The most common visas granted to foreigners who are going to render services in Colombia are the Migrant Visa and the Visitors’ Visa.
6 Technology
6.1 Please briefly describe how innovations and inventions are protected in your jurisdiction.
Innovation and inventions can be protected through patents, utility models, and industrial designs. It is important to highlight that Colombia is a member of different treaties that protect intellectual property such as TRIPS, the Paris Convention, and the Patent Cooperation Treaty.
Furthermore, under the local legislation, Decision 486/2000 of the Andean Community establishes that inventions from all fields of technology are subjected to patentability examination; this allows the possibility to seek protection for innovations that exist in products and procedures from different industries.
However, there are specific subject matters that are considered non-patentable subject matter, such as living beings, scientific theories, therapeutics, financial or business methods, uses, and second uses. Regarding software, this is not patentable subject matter but is protected by copyright laws.
6.2 Please briefly describe how ownership of IP operates in your jurisdiction.
The ownership of IP in Colombia works through a registration process before the Superintendence of Industry and Commerce. Inventions and innovations are protected through patents which are granted for 20 years, and utility models and industrial designs patents are granted for 10 years. They give the patent holder the exclusive right to exploit and commercialise the invention, and the right to prevent the use, manufacture or commercialization of the invention by third parties.
The patent holder has the faculty to grant licences to third parties interested in the exploitation and commercialisation of the invention.
6.3 In order to protect or enforce IP rights in your jurisdiction, do you need to own local/national rights or are you able to enforce other rights (for example, do any
treaties or multi-jurisdictional rights apply)?
IP rights are subjected to a territorial factor, which asserts that they are only enforceable within the territory in which they were granted by the corresponding authority. In this sense, in IP matters, there are no multi-jurisdictional rights to be enforced as every jurisdiction has its legal requirements and guidelines regarding what is or is not considered an invention to seek protection.
6.4 How do you exploit/monetise IP in your jurisdiction and are there any particular rules or restrictions regarding such exploitation/monetization?
The ownership of IP rights grants the possibility to exploit, commercialise, assign or license the protected invention or innovation. In this sense, IP rights holders may exploit their invention by themselves, sell/assign, or grant a licence to the IP right to a third party to monetise their right.
Autor: Carlos Carvajal / Santiago Gutiérrez
