Colombia

Art. 9 of Ley 1581 de 2012 requires the prior and informed authorisation of the data subject for processing, except in the cases the law lists. Art. 8 gives the data subject the right to know, update and rectify data, request proof of authorisation, be told about its use, revoke authorisation or request deletion where provided, access data free of charge and complain to the SIC. Art. 4 sets the processing principles.

Art. 11 of Ley 526 de 1999 amends Art. 102 of Decreto 663 de 1993 so that financial entities report to the UIAF 'de forma inmediata y suficiente' any relevant information on transactions that could suggest funds of criminal origin, and bars them from telling the persons concerned (Art. 105). Arts. 1 and 2 of Ley 1121 de 2006 later amended Arts. 102 and 105 of the same decree. The UIAF's guide to the AML/CFT norms also uses 'de forma inmediata' for suspicious operation reports in the SFC-supervised sector.

Decreto 1692 de 2020 lets acquirers that are not SFC-supervised operate only if entered in the SFC's register of unsupervised acquirers before joining their first low-value payment system (Art. 2.17.3.1.2); the SFC has two months from a complete application to decide. At registration they must be a sociedad anónima with paid-in capital of at least 1,700 monthly minimum wages, and from the first year of operation paid-in capital of at least 2% of settlement funds received in the previous 12 months. They must keep settlement funds separate from their own funds and other persons' funds, with sums owed to merchants held in credit institutions or SEDPEs (Art. 2.17.3.1.5), and must transfer settled funds to users immediately if registration is suspended or cancelled (Art. 2.17.3.1.3).