If you do business in Colombia, in telecoms, banking, fintech or any business that sells on credit, a new law changes what you must be able to show about your customers.
The numbers explain why. Between 2022 and May 2026, Colombia’s Superintendence of Industry and Commerce (SIC), the authority responsible for consumer and personal data protection, recorded 13,983 formal complaints of identity theft. 81% of them involved the telecom sector. Congress responded with Law 2573 of 2026, an unprecedented regulatory change that requires banks and telecom operators to overhaul their digital onboarding and how they manage customer documentation.
The deadline is 19 November 2026, when the law’s general regime takes effect. From then on, verifying a customer’s identity is not enough. You have to prove it, with documentary and digital evidence that the applicant was properly authenticated.
Table of contents
What is Colombia’s Law 2573 of 2026?
Law 2573 of 2026 is a statutory law enacted on 19 May 2026 to protect victims of identity theft and financial fraud: stolen personal data, credit opened fraudulently in someone’s name and online scams.
Its core purpose is to stop victims from being chased for payment or reported to Colombia’s credit bureaus for debts they never took on.
Does Law 2573 apply to your business in Colombia?
The law is mandatory nationwide. If your company operates in Colombia in any of these three sectors, it is directly affected:
- Telecom operators, who activate lines and services in a person’s name.
- Financial and credit institutions: banks, financing companies, cooperatives engaged in financial activities, fintechs, and any other entity that grants credit.
- Businesses that offer credit to their customers: in practice, any company that sells in instalments or finances purchases directly, such as car dealerships, e-commerce stores with in-house financing or even appliance retailers.
What changes: companies now carry the burden of proof
Identity theft is a common form of fraud in Colombia. Victims often only find out when a collection demand arrives, or a credit bureau reports them for a service they never requested. Until now, it was up to them to prove, through long legal proceedings, that they never signed the contract, while companies could take months to investigate and respond.
Law 2573 turns this around. It applies what Colombian law calls the dynamic burden of proof: the party best placed to prove a fact must prove it. In an identity theft case, the company is the one that received the documents and approved the product. That is why the law requires it to give the impersonated person a copy of the approval file, with no right to refuse, and to stop collection as soon as it is notified.
If the company is found to have breached the security protocols issued by the authorities, it must stop collection, correct the credit bureau report and either refund the money or cancel the debt. And if it misses the legal deadline to answer a complaint, positive administrative silence applies: the complaint is automatically resolved in the customer’s favour.
What evidence you need under Law 2573, stage by stage
Holding data on your customers is not enough under Law 2573. You must be able to demonstrate how you verified their identity. As we explain in our article on why evidence has become the most valuable asset, a record only counts if it is intact, has a registered date and can be attributed to a specific person. This is what that means across the customer journey:
Customer onboarding and identity verification (KYC)
The law requires sufficient and reasonable digital security measures to establish that people are who they claim to be, and that their documents are genuine. That is the role of document validation, biometric authentication and remote video identification , which verify the person in real time and record the entire process.
A selfie or a photo of the cédula, Colombia’s national ID card, is not enough on its own. That capture must be linked to the contract, carry a registered date and time, and be protected against any later alteration.
Contracting: electronic and digital signatures in Colombia
At the contracting stage, what matters is the type of signature and how it is linked to the signer. A registered digital signature with a timestamp, issued by a digital certification entity (ECD) accredited by ONAC, proves what was signed, when, and with what integrity guarantees. ONAC is Colombia’s national accreditation body, and ECDs are the certification providers it accredits.
This rests on Colombian law: Law 527 of 1999 and Decree 2364 of 2012 (now compiled in Single Decree 1074 of 2015) recognise electronic signatures as valid when they are reliable and appropriate for the circumstances.
Complaint handling
Once someone reports possible identity theft, the legal deadlines begin to run. Registered SMS, email and WhatsApp notifications let you prove that each communication was sent and delivered, and what it said.
Handing over the approval file
If the person who was allegedly impersonated asks for it, the law requires you to hand over the documents and information used to approve the product or service requested in their name. A registered record of that handover can become strong evidence in criminal proceedings.
How Lleida.net helps you comply with Law 2573
Lleida.net operates in Colombia as a digital certification entity accredited by ONAC . Its digital trust services cover, with a single provider, every stage where Law 2573 of 2026 requires proof:
- Identity validation (eKYC Video): remote video identification that checks data against the National Identification Archive (ANI), the biographic and biometric database managed by Colombia’s National Civil Registry (RNEC).
- Contracting with a registered electronic signature and a digital signature, to prove who signed and what they signed.
- Timestamping to provide a registered date for every piece of evidence during onboarding or when issuing electronic files.
- Registered email and SMS, to prove that deadlines were met and communications sent on time. Registered WhatsApp notifications are also available.
- Evidence issued by a trusted third party, independent of your company, which carries more probative weight before a Superintendence or a judge than an internal record.
Since 2023, the SIC has fined telecom operators more than COP 2.39 billion (COP 2,390,372,596) for failing to properly verify users’ identities. With 19 November approaching, getting ahead of these requirements does more than avoid fines: it protects the trust your customers place in you.
This content is for information purposes only and does not constitute legal advice. We recommend reviewing each case with your legal team.