Colombia's SIC Opens Consultation on Identity Verification Rules Under Law 2573
On September 8, 2026, Colombia's SIC opened a public consultation on identity verification mechanisms, implementing Law 2573 of 2026 to curb identity theft in credit and telecom onboarding.
What Changed
On September 8, 2026, Colombia's Superintendencia de Industria y Comercio (SIC) opened a public consultation seeking technical and legal input to build guidelines, recommendations, and protocols on identity verification mechanisms and the processing of personal data. The consultation, open until September 25, 2026, implements Law 2573 of 2026, the statutory law that targets identity theft producing wrongful negative credit reports. It addresses the digital-security measures firms use to verify individuals and authenticate documents when customers acquire financial products, credit, or telecom services. The SIC has outlined a five-phase process, with working sessions expected in October, a proposal published for comment, and final regulation anticipated in November 2026.
Who It Affects
Financial and credit institutions, telecommunications operators, and commercial establishments extending credit in Colombia, all of which process personal data during onboarding. Data controllers and identity-verification vendors serving these sectors should engage. Supervision is shared: the Financial Superintendence (SFC) oversees regulated financial entities, the SIC covers habeas data and commercial establishments, and MinTIC covers telecom operators. The SIC's forthcoming protocol will nonetheless shape the reference standard for identity verification across Colombian onboarding flows.
What to Do
Submit comments before the September 25, 2026 deadline through the SIC's questionnaire, addressing verification-technology effectiveness, data-processing risk, and implementation cost. Inventory your current identity and document-authentication methods against likely protocol expectations, and confirm your personal-data processing has a lawful basis and a clear audit trail. Firms that pair document authentication with liveness and multi-method checks will be best positioned when the November rules land.
What is deepidv?
Not everyone loves compliance — but we do. deepidv is the AI-native verification engine and agentic compliance suite built from scratch. No third-party APIs, no legacy stack. We verify users across 211+ countries in under 150 milliseconds.
Learn More