By means of Concept 2026159628-004 of September 1, 2026, the Financial Superintendence of Colombia (the “SFC”) ruled on the application of Statutory Law 2573 of 2026 (“Law 2573”) to insurance companies and insurance intermediaries.

This law establishes measures to protect persons affected by identity theft against negative credit reporting and the collection of obligations by telecommunications operators, financial and credit institutions, and “other commercial establishments with this competence”.

The inquiry sought for the SFC to define the scope of this last expression, which Law 2573 does not define, and to clarify whether the obligations to modify the negative report (Article 7) and to suspend collection (Article 8) apply to insurance companies and insurance intermediaries in cases of fraudulent issuance of policies through identity theft.

It also asked whether entities that market voluntary health plans, prepaid medicine and other health services financed through payment agreements or promissory notes fall within said category.

Below, we highlight the main considerations of the SFC:

1. The determining criterion is the status of information source

   • The SFC explained that Article 7 of Law 2573 amended the claim procedure set forth in Article 16 of Law 1266 of 2008 and established that claims for identity theft must be filed with the information source, which is responsible for verifying the documentation provided by the claimant, modifying the reported information and carrying out the corresponding actions before the information operators:

   “For purposes of applying these provisions, it is relevant to emphasize that Article 7 of Law 2573 of 2026 amended the claim procedure set forth in Article 16 of Law 1266 of 2008 and established that claims for identity theft must be filed with the information source, to which it attributed specific obligations, including verifying the documentation provided by the claimant, modifying the reported information and carrying out the corresponding actions before the information operators.

   […]

   Thus, from the perspective of Articles 7 and 8 of Law 2573 of 2026, the legally relevant element for determining the application of the measures provided therein is the status of information source with respect to the obligation whose collection or reporting is challenged by the data subject as a result of an alleged identity theft.” (Emphasis added).

   • Accordingly, for the SFC, the legally relevant element for applying Articles 7 and 8 of Law 2573 is the status of information source with respect to the obligation whose collection or reporting is challenged by the data subject.

2. Insurers may be information sources

   • The SFC concluded that insurance companies may hold the status of information source under Law 1266 of 2008, insofar as they receive, manage and eventually report information arising from the execution and performance of insurance contracts:

   “Under said consideration, insurance companies may hold the status of information source under Law 1266 of 2008, insofar as they receive, manage and eventually report information arising from the execution and performance of insurance contracts.” (Emphasis added).

   • Consequently, when the challenged obligation arises from an insurance contract in respect of which the insurer acts as information source, the obligations and measures of Law 2573 will apply to it.

3. Insurance intermediaries are not information sources with respect to the insurance contract

   • Based on Article 1037 of the Code of Commerce, the SFC recalled that the parties to the insurance contract are the policyholder, the insurer and the insured, and that the role of intermediaries is limited to promoting or facilitating its execution, without assuming rights or obligations arising from the insurance relationship.
   • Therefore, intermediaries are not the parties vis-à-vis whom the payment obligation arising from the contract arises, nor those who report or manage the information related to its performance.

   “On the contrary, in the case of insurance intermediaries, it must be considered that they are not parties to the insurance contract. Indeed, pursuant to Article 1037 of the Code of Commerce, the parties to said contract are the policyholder, the insurer and the insured, as applicable. The role of intermediaries is limited to promoting or facilitating the execution of the contract, which does not imply the assumption of rights or obligations arising from the insurance relationship.

   Consequently, insurance intermediaries are not the parties vis-à-vis whom the payment obligation arising from the contract arises, nor those who report or manage the information related to its performance.” (Emphasis added).

4. Health insurance

   • The SFC clarified that voluntary health plans include health insurance with coverage of healthcare benefits (Article 169 of Law 100 of 1993), and therefore the foregoing considerations apply to insurers operating in the health line of business:

   “With respect to Voluntary Health Plans, it should be noted that this category includes health insurance policies with coverage of healthcare benefits (Article 169 of Law 100 of 1993). Therefore, the foregoing considerations apply to insurance companies that operate such insurance under the health line of business.” (Emphasis added).