Crypto-asset regulation and tokenization in Colombia

In Colombia, a business launching a virtual asset platform must build its analysis around rules applying to specific functions. A legislative proposal, a reporting duty and a former banking pilot are not equivalent authorization routes.

For tokenized issuance, what investors receive and how it is offered to the public also matter. Absence of a comprehensive provider framework does not remove securities, fundraising, anti-money-laundering or tax reporting rules.

How to assess a model without confusing reporting and authorization

Colombia retains a fragmented framework for virtual assets. The UIAF's August 2026 assessment describes specific duties without comprehensive sector legislation. This does not remove financial, tax or securities rules applicable to the service. Nor does it establish that all exchange activity is prohibited or that any platform may raise funds from the public.

The Chamber of Representatives records Bill 510/2025 as archived. Its proposed virtual asset provider registration, supervision and protection provisions are not binding requirements merely because they appear in the legislative file. A business assessment must start from applicable rules and established permissions, without anticipating another parliamentary initiative's outcome.

Which authority supervises each activity

The Financial Superintendence of Colombia, SFC, oversees activities and entities within its remit. In its Circular Letters 78 of 2016 and 52 of 2017, which it keeps published, it reminded supervised entities that they are not authorized to hold in custody, invest in, intermediate or operate with crypto-assets, or to allow their platforms to be used for such operations, and stated that crypto-assets are not securities under Law 964/2005. Its banking pilot report distinguishes participating financial institutions from crypto-asset platforms and defines the experiment's scope. Joining an alliance did not make an exchange a supervised financial institution or provide a public guarantee for traded assets.

The Financial Information and Analysis Unit, UIAF, receives preventive reports under Resolution 314/2021. Its Article 11 assigns fines and other penalties for non-compliance to the Superintendence of Companies or the relevant supervisory body. The National Tax and Customs Directorate, DIAN, administers the tax obligations within its remit. Opinion 5146/2026 expressly limits this tax role: interpreting reporting duties does not determine a provider's authorization to conduct other activities.

Which permission the business model requires

The banking operations pilot involving platforms ended on 13 June 2024, according to the SFC's report published on 27 June. It tested peso deposits and withdrawals through deposit products held in platforms' names within specified alliances. It should not be described as a currently open access route or general authorization to hold or intermediate crypto-assets.

A new operator must identify who receives funds, who controls assets and which activity is performed. A reporting obligation does not itself establish financial permission. Where a product constitutes a security, Law 964/2005 requires consideration of issuance, offering and intermediation rules alongside those governing the provider.

The consulted sources do not establish a general VASP license with an ordinary access route comparable to jurisdictions expressly regulating these services. This prevents a complete overall score. It does not establish a general prohibition on software development or extend an earlier experiment's conditions to every overseas company.

How holder rights are documented

Article 2 of Law 964/2005 defines securities by reference to negotiable rights forming part of an issuance whose purpose or effect is to raise funds from the public. A tokenized issuance must be assessed against that legal substance. Describing an instrument as a utility token does not remove obligations where its rights and operation fall within securities law.

Article 12 gives constitutive effect to book entries maintained by a central securities depository. It does not automatically extend those effects to any distributed ledger. The issuer's obligation, legally relevant register and transfer conditions must be documented. A token referencing real estate does not itself establish ownership or replace formalities applicable to the underlying property.

Which obligations continue during operations

UIAF Resolution 314/2021 applies to natural or legal persons who carry out virtual asset activities for or on behalf of another person, including exchange, transfer and custody or administration, regardless of amount. It establishes suspicious transaction reports, transaction and customer reports, and nil reports, each with its own conditions. Resolution 84/2022 postponed mandatory reporting to 1 July 2022. The original April commencement should not be repeated as the applicable date. In addition, the Superintendence of Companies' External Circular 100-000020 of 2 July 2026 brings companies that provide those services in amounts equal to or above 12,323 UVB, and meet its income or asset thresholds, into its anti-money-laundering self-control and risk management system, with enhanced due diligence. Companies already subject to the system must adapt it by 31 May 2027.

For tax purposes, DIAN Resolution 000233/2025, published on 31 October 2025, requires digital asset service providers resident or domiciled in Colombia, operating in the country and with gross income above 1,400 UVT, to report as third-party tax information, from tax year 2026, their users' conversions of legal tender into digital assets or vice versa. DIAN Opinion 3546/2026 distinguishes that third-party information from invoicing obligations. Resolution 000240/2025 additionally implements the Crypto-Asset Reporting Framework, CARF, for covered persons and tax years from 2026. The ordinary deadline is the last business day of May the following year: information for 2026 is reported in May 2027.

That framework requires identification of reportable users, diligence and retention of evidence under its rules. Holland & Knight's analysis explains the operational scope. This tax information exchange must be distinguished from UIAF reports, and providers and users should not be assumed to have identical duties. Structure, territorial connections and transactions determine which provisions apply together.

What to prepare before launching the project

Document peso and asset flows, bank agreements and customer rights. Identify the current basis for each activity without using another entity’s historical pilot participation as evidence of your own permission.

Prepare separate UIAF and DIAN schedules identifying subjects, operations and reporting years. For an investment offering, resolve securities classification and the legally effective register before designing distribution.

Each model still requires verification of reserved activities, operator permissions, concurrent reporting duties and enforceability of tokenized rights. Compliance with tax obligations does not establish a general license, and ordinary book-entry legislation does not establish special recognition of blockchain securities.

To understand how this framework applies to your project, discuss your case with our team.