The Superintendence of Industry and Commerce (SIC) released for public comment a draft External Directive setting out guidelines and mechanisms to prevent identity theft, implementing paragraph 1 of article 5 of Statutory Law 2573 of 2026, which directed the SIC and the Financial Superintendence (SFC), in coordination with the Ministry of ICT, to regulate protocols including “suitable mechanisms, tools and methodologies that allow the full identification of the potential acquirer”. According to the draft, “full identification” does not require absolute certainty, but rather a sufficient and reasonable level of confidence, based on verifiable and risk-proportionate evidence, that the declared identity belongs to the person acquiring the good or service.

Verification will be mandatory, at a minimum, in: (i) customer onboarding and the acquisition of products that create financial obligations, such as loans, financing, installment sales and postpaid plans; (ii) high-risk transactions, such as SIM replacement, change of holder or contact details, credential recovery, device linking and credit limit increases, and (iii) any others identified by the risk analysis.

These new obligations are addressed to “telecommunications operators, credit or financial entities and other legal entities or individuals that, within their commercial activity and the ordinary course of their business, create monetary obligations or enter into loan, credit facility, financing or similar agreements with individuals, that are not subject to SFC supervision, in processes for the acquisition or opening of goods or services by individuals, whether in person or through electronic means, or in transactions that, due to their inherent risks, require verifying the identity of the person carrying them out”.

Under the principle of technological neutrality, obligated parties may choose their mechanisms and providers, provided they ensure an adequate level of confidence and rely on at least one of three factors: something you know (passwords or PINs), something you have (ID document, mobile phone, token or registered device) and something you are (face, fingerprints, voice or behavioral patterns). Accepted mechanisms include biometric matching, OTP codes, document verification, chip reading, queries to official sources, the digital ID card and digital signatures. On their own, an unverified copy of the ID document, static data, OTPs sent to unverified channels and facial matching without liveness detection are not sufficient.

At onboarding, combining at least two independent mechanisms will be mandatory; for other transactions, it is a good practice. A documented risk analysis is also required, with minimum variables, at least three risk levels and remote verification at least as rigorous as in-person verification. Acquisitions may not be conditioned on providing biometric data, and a real, effective and accessible alternative must be offered, unless the risk analysis demonstrates that no less intrusive measure exists, which the SIC will assess strictly. Processing biometric data requires prior, express and informed authorization, is limited to verification and fraud prevention and, where possible, should favor encrypted templates.

In addition, hiring providers does not shift the obligated party’s responsibility, mechanism performance must be assessed periodically (including false acceptance and false rejection rates) and, following an unfavorable automated result, the applicant is entitled to know the reasons and to a human review or an alternative mechanism.

The directive will take effect upon publication but will be enforceable from July 1, 2027, for transactions initiated on or after that date. Interested parties may submit their comments regarding the Circular between November 7 and November 21 to the email address delegaturadatos@sic.gov.co.