In 2026, Colombia activated the most ambitious regulatory change to its financial system in a decade. Decree 0368 turned Open Finance Colombia into an obligation for all entities supervised by the Superintendencia Financiera (Financial Superintendence), no longer an option adopted by a few innovative banks.
In parallel, Bre-B already moves millions of transactions daily and shows that instant payments can change deeply rooted payment habits. Shared data and instant payments are two distinct pillars of financial inclusion, and both are starting to fit together, although official data show gaps that deserve a closer look.
This article reviews what the decree requires, what figures support (and challenge) the inclusion narrative, how Colombia positions itself against Brazil, Mexico and Chile, and what compliance teams need to resolve before the deadlines expire.
What Is Open Finance Colombia and Why Is It Now Mandatory
On April 7, 2026, President Gustavo Petro signed Decree 0368, which turns the open finance system into an obligation for all entities supervised by Colombia’s Superintendencia Financiera. The list includes banks, financial corporations, financing companies, financial cooperatives, SEDPEs, trust companies, brokerage firms, pension and severance fund managers, investment managers, crowdfunding platforms, and insurance companies.
The decree sets out a key principle: data belongs to the user, not to the entity that holds it. That is why it establishes a double consent mechanism. First, the customer authorizes the sharing of their information. Then, the receiving entity must confirm that authorization before accessing the data.
“Mandatory open finance will drive the development of the system and financial inclusion in the country.”
Superintendencia Financiera de Colombia, official communiqué on Decree 0368.
The Superintendencia explains the full scope of the change in its official communiqué.
Decree 0368 Implementation Timeline
| Milestone | Deadline | Responsible Party |
| Publication of technical standards | Up to 6 months from the decree | Superintendencia Financiera |
| Launch of the participant directory | Up to 12 months from the decree | Superintendencia Financiera |
| Enabling data access | Up to an additional 12 months after the standards | Supervised entities |
| Operational double consent across all flows | Before enabling access | Supervised entities |
Source: Decree 0368 of 2026 and communiqué from the Superintendencia Financiera de Colombia.
For legal and compliance teams, Facephi brings together the full regulatory detail, including the obligated entities, deadlines and implications of the decree, in its regulatory compliance analysis for Colombia.
The change has clear precedents. Since 2022, Colombia already had a voluntary open finance scheme, adopted by a limited group of banks and fintechs. Decree 0368 takes the missing step: turning that voluntary participation into an obligation for the entire supervised system, with deadlines and standards defined by the regulator instead of private agreements between entities.
Bre-B and Instant Payments: The Piece That Is Already Working in Today’s Economy
While Open Finance organizes the exchange of data, instant payments solve the other side of the problem: moving money without friction. Bre-B, the Banco de la República’s interoperable instant payment system, began operating in July 2025 and reached full operation in October of the same year.
The system allows money to be transferred in seconds, at any time and between accounts at different entities, using keys that identify a savings account, a checking account or a low-value deposit account. That interoperability responds to a figure that explains much of the country’s financial lag: more than 70% of transactions in Colombia are still made in cash.
Bre-B by the Numbers (May 2026)
| Indicator | Figure |
| Registered keys | More than 105 million |
| Linked users | 34.9 million |
| Daily operations | Up to 5 million (compared to 1.5 million at launch) |
| Peak amount transacted in one day | Close to $1.2 trillion pesos |
| Cost to the user (first 3 years) | $0 |
Source: official Bre-B indicators, Banco de la República.
The impact is not limited to individuals. Small businesses that currently depend on cash gain a digital collection channel without the fees that usually hold back adoption. That formalization of retail commerce is, along with access to credit, one of the effects that the Banco de la República expects to measure in the coming years.
Financial Inclusion in Colombia: What the Data Says (and What It Doesn’t Show)
Open Finance and Bre-B share a goal stated by the Government itself: the financial and credit inclusion of the population that has historically been left out of the system. The most repeated figure sounds like a solved problem: 96.3% of Colombian adults had at least one deposit or credit product at the close of 2024, compared to 94.6% in 2023.
That figure measures formal access, not current use. The same report shows that access in rural areas reaches 65.6%, compared to practically universal coverage in urban areas. The gap widens when looking at effective use of the products: 53.4% in rural areas versus 89.3% in urban areas. A gender gap of 6.9 points in access and 4.4 points in use also persists.
Financial Inclusion in Colombia: The Gap Behind the Headline
| Indicator | Urban Area | Rural Area |
| Access (at least one product) | Practically universal | 65.6% |
| Effective product use | 89.3% | 53.4% |
Source: 2024 Financial Inclusion Report, Superintendencia Financiera de Colombia and Banca de las Oportunidades.
The practical conclusion is that having an account does not equal being included. An account that is opened and never used generates no credit history or access to formal credit. That is exactly the problem that Open Finance, by enabling new scoring models based on shared data and not only on traditional banking history, seeks to tackle.
Colombia Compared to the Region: How It Stacks Up Against Brazil, Mexico and Chile
Colombia is today Latin America’s third-largest fintech ecosystem, with more than 380 active startups and annual growth of close to 18%. The country is advancing, but it does not yet lead the region in the regulatory depth of open finance.
Open Finance and Instant Payments: Colombia Compared to Its Regional Peers
| Country | Open Data Framework | Instant Payments | 2026 Status |
| Brazil | Central Bank’s Open Finance, in force since 2021 | Pix, operating since 2020 | Consolidated, regional benchmark |
| Mexico | Fintech Law (2018), open finance still partial | CoDi, limited adoption | Under review, not fully mandatory |
| Chile | Fintec Law (2023), gradual implementation | Instant payments in development | In transition |
| Colombia | Decree 0368 (2026), mandatory open finance | Bre-B, fully operational since October 2025 | Newly mandatory, deadlines underway |
Own elaboration based on the public regulatory frameworks of each country.
The difference compared to Brazil is due more to the model’s maturity than to regulatory approach. Brazil has more than four years of operational open finance, while Colombia is just starting the countdown on the decree’s deadlines. The full analysis of that regional comparison is available in Facephi’s observatory on Colombia’s fintech agenda.
Compliance Pain Points: What Banks and Fintechs Must Resolve Before the Deadlines
The double consent required by Decree 0368 only works if the identity of the person authorizing it is reliably verified. An authorization signed by an impostor protects no one, and multiplies the very risk the decree seeks to control.
Compliance Pain Points Facing Mandatory Open Finance
| Pain Point | Why It Matters | What the Regulator Requires |
| Verifying that the customer is who they claim to be at every consent | A false identity invalidates the entire double consent mechanism | Reliable identity verification, not just a password |
| Connecting legacy systems with standardized APIs | Technical interoperability between different entities is mandatory | Meeting the standards timeline within less than 12 months of its publication |
| Managing consent in an auditable way | Every authorization must be demonstrable to the regulator | Full traceability, not just an acceptance click |
| Containing fraud risk in a more open ecosystem | More data shared among more players widens the attack surface | Reinforced security at each customer’s first data exchange |
This is where digital identity verification comes in as a compliance component, not just a user experience feature. Biometric and liveness detection technologies, like those developed by Facephi, make it possible to confirm within seconds that the person authorizing the data exchange is who they claim to be, without adding friction for the customer.
Compliance teams already reviewing their onboarding and consent flows before the regulatory deadlines expire can find a starting point in Facephi’s digital onboarding solution.
Postponing this review carries a double cost. The regulatory cost: arriving late to a deadline set by decree exposes the entity to observations from the Superintendencia. And the reputational cost: a security failure in a customer’s first data exchange can damage trust in the entire Open Finance system, precisely when that trust is the asset the regulator most needs to protect.
Frequently Asked Questions About Open Finance in Colombia
Open Banking is limited to traditional banking products, such as accounts and cards. Open Finance extends that data exchange to insurance, pensions, investments and crowdfunding, which is why Colombia opted for this broader model.
All entities supervised by the Superintendencia Financiera: banks, financial corporations, financing companies, financial cooperatives, SEDPEs, trust companies, brokerage firms, pension and severance funds, investment managers, crowdfunding platforms and insurance companies.
No. Bre-B is the Banco de la República’s instant payment system. Open Finance is the framework that regulates the exchange of financial data between entities. They are complementary, but they are governed by different rules.
The Superintendencia Financiera has up to six months to publish the technical standards. From the date of publication, entities have a maximum of an additional twelve months to enable access.
The double consent required by the decree depends on confirming that the person authorizing the data exchange is truly the account holder. Biometrics and liveness detection are the technologies that make this confirmation possible without friction for the user.
Not entirely. That figure measures access to financial products, not use. Significant gaps persist between urban and rural areas (89.3% versus 53.4% in effective use) and between genders, according to the Superintendencia Financiera and Banca de las Oportunidades’ 2024 Financial Inclusion Report.
