- Law 2573 of 2026 is a statutory law, enacted on May 19, 2026 and published in Official Gazette 53,496 of May 20 (Senate Secretariat).
- It takes effect six months after its publication, except for two paragraphs of article 5 that have been in effect since May (art. 13). According to its timetable, the SIC expects to issue the identity validation protocol on November 20, 2026.
- It requires telecommunications operators and financial and credit institutions to adopt "sufficient and reasonable" measures to establish the truthfulness of identity and documents (art. 5).
- In the face of alleged impersonation, the entity has to provide the documents with which it approved the product, and the source must compare them within ten business days (arts. 5 and 7).
Law 2573 of 2026 is a statutory law that Colombia enacted on May 19, 2026 and published in Official Gazette 53,496 of May 20. It protects victims of identity impersonation from negative reporting and the collection of debts they did not incur, and for that purpose it imposes verification duties on the entities that sell the product or service.
The official text is in the Senate laws database and in the Public Function Regulatory Manager.
November 20, 2026 brings together two facts with different degrees of certainty. The Superintendence of Industry and Commerce (SIC) published a timetable that expects to issue the identity validation protocols on that day. And if six months are counted from publication in the Official Gazette, it is also the day on which most of the law enters into force, although that date comes from a calculation and no authority set it through its own act.
What the law asks of a bank or a telecommunications operator is to verify identity and document with reasonable measures, and to be able to provide, when someone says they have been impersonated, the documents with which it approved the product.
What Law 2573 is and whom it binds
Law 2573 is a financial habeas data rule that requires telecommunications operators, financial and credit institutions, and "other commercial establishments with this competence" to protect the impersonated person from negative reporting and collection. That formula is repeated throughout the articles.
The law does not define what a commercial establishment "with this competence" is, and Judgment C-413 of 2025 of the Constitutional Court does not either.
The only thing the Court records is the origin of the phrase: in the third debate, the bill was adjusted so that it would also apply to establishments with competencies in telecommunications, financial, and credit matters. Which companies are included is not stated by either the law or the Court; the protocol or a statement from the SIC or the Financial Superintendence may clarify it.
The law covers physical and digital identity impersonation. It should not be confused with Law 2502 of 2025, which amended article 296 of the Criminal Code to increase the fine when personal falsehood is committed with artificial intelligence.
What has been in effect since May and what takes effect on November 20
Paragraphs 1 and 2 of article 5 have been in effect since publication; the rest of the law takes effect six months later. Article 13 says so: "This law shall enter into force within six (6) months following its promulgation, with the exception of the first and second paragraphs of article five (5), which shall enter into force upon promulgation of the law."
| What | Since when it applies |
|---|---|
| Paragraph 1 of art. 5: mandate to regulate the protocols | Since promulgation |
| Paragraph 2 of art. 5: consequences of failing to comply with the protocols | Since promulgation |
| Duties of art. 5 and procedure of arts. 6 to 10 | Six months after promulgation |
The exact date depends on when the law is considered promulgated. According to Law 4 of 1913, promulgation is completed on the date of the issue of the official newspaper that inserts it, and months are counted according to the calendar.
With the Official Gazette of May 20, the count reaches Friday, November 20, 2026. No authority set that day through its own act, and the interactive edition of the Judicial Branch takes the enactment date, May 19, as the promulgation date, and dates effectiveness to November 19.
The period to regulate runs from issuance. Paragraph 1 gives the SIC and the Financial Superintendence, in coordination with the ICT Ministry, six months to regulate protocols that include "suitable mechanisms, tools, and methodologies that allow full identification of the potential acquirer".
As of October 2026, the SIC is the only one of the three authorities with a public process. Its September 8 statement sets these stages:
| Stage | Announced date |
|---|---|
| Call for consultation | Until October 9, 2026 |
| Proposal published for comments | November 2, 2026 |
| Issuance | November 20, 2026 |
The SIC announced it, but it has not yet issued any act. No draft from the Financial Superintendence or the ICT Ministry linked to the law was found, and because the paragraph divides the task "within the framework of each of their competencies", it is still not clear whether the SIC protocol will cover the entities supervised by the Financial Superintendence.
The law requires verifying identity and document with reasonable measures and does not name technologies
Article 5 requires "Adopting the sufficient and reasonable digital security measures necessary to establish the truthfulness of the identity of persons and the documents submitted to acquire their products and/or services". There are two objects, the person and the document, and identity verification has to cover both. Numeral 3 adds validation of the data declared by the customer, "under the principle of good faith".
The Court read those two numerals as an application of the principle of demonstrated accountability: the duty to demonstrate before the data authority "that they have an adequate institutional structure and internal procedures to ensure the effective enjoyment of the right to habeas data". That is why the practical question for the entity is what it can show, in addition to what measures it has.
The law does not mention biometrics, liveness, document verification, or any technical standard. Biometrics appears in the SIC consultation, which asks about available technologies, their accuracy, "alternatives to biometrics" and their risks for personal data, so the choice remains open.
Validation is also needed in the claim: article 6 asks whoever reports impersonation to "Carry out the identity validation test established by" the entity. There, too, the law does not say which one.
The evidence that must be available to show is the onboarding file
The evidence that the law makes enforceable is the set of documents and data with which the entity approved the product. Numeral 7 of article 5 requires that a copy be provided to the person allegedly impersonated: "Under no circumstances may delivery of this information to the person be refused." The bill required the request to come with a copy of the complaint; the Court declared that requirement unconstitutional, so the request is sufficient.
Article 7, which amends Law 1266 of 2008, requires the source to "compare, within the following ten (10) business days, the documents used to acquire the obligation being disputed, with the documents provided by the holder".
Then the legend "Victim of Personal Falsehood" is included, which does not count as a negative report and serves "for the sole purpose of carrying out intensified verification of the holder’s identity". This is the only time the law grades verification.
An entity that did not keep the documents with which it onboarded the customer has nothing against which to compare. The file must exist, be retrievable, and be deliverable: what document was submitted, what data was validated, and how.
In the reasoning of the judgment, the Court accepted that the principle of dynamic burden must cover "all types of interaction with the good or service" and the data on the time, manner, and place in which it was used. That is not in the operative part and operates only in non-criminal judicial proceedings, by decision of the judge. Neither the law nor the judgment sets a retention period.
The burden of proof is dynamic and is decided by the judge
The law adopts the dynamic burden of proof: "The party in the best position to do so shall have the obligation to prove" (art. 2, literal d). The same literal adds that entities "must provide the information and documents they received to approve the good or service".
Because it is statutory, the law underwent prior review. Judgment C-413 of 2025, dated October 2, 2025, with Justice Juan Carlos Cortés González as reporting judge, declared that literal constitutional under three conditions:
- When sending the information, the entity "must comply with the burden of truthfulness regarding the full identity of the customer".
- The dynamic burden "shall apply in judicial proceedings, other than criminal proceedings, in which the occurrence of personal impersonation is discussed".
- "the judge hearing the case shall determine the operation of the reversal of the burden of proof".
It does not apply in criminal matters because the Prosecutor’s Office investigates, according to article 250 of the Constitution. Where the Court sees it as meaningful is in a potential civil liability proceeding against the financial institution, because without this rule all the proof would fall on the holder alleging the fraud. What is unconditional is providing the documents truthfully regarding the customer’s identity; proving anything else depends on the proceeding and the judge.
If the protocol is not complied with, the entity assumes the loss
According to paragraph 2 of article 5, in effect since May, if it is verified that the entity failed to comply with the security protocols issued by the authorities and the holder requested correction alleging impersonation, the entity has to return the monies to the impersonated person and/or eliminate the receivables.
In addition, collection is suspended and the report in the credit bureaus is modified. The rule refers to "the guidelines, recommendations, and security protocols issued by the competent authorities" and to the "timely return of the monies and/or the elimination of the receivables that were the subject of fraud".
Nor may it freeze those monies or wait for authorization from the holder of the account to which they were transferred in order to reverse the transaction.
The protocols of Law 2573 do not yet exist. One possible reading, which no official source confirms, is that in the meantime the paragraph operates only against guidelines that already exist through another channel.
The law does not create its own sanctioning regime: article 11 refers to each authority within its competence, only in habeas data, and Law 1266 divides oversight between the SIC and the Financial Superintendence. No authority has yet said how noncompliance with numeral 1 of article 5 will be sanctioned. And the entity does not decide alone: according to article 10, it cannot determine that there was no impersonation, because that is reserved for judges.
| Deadline | What runs | Basis |
|---|---|---|
| Immediate | Suspend the service acquired through fraud, once the entity has been informed | Art. 5, num. 5 |
| Immediate | Suspend collection, interest, and collection expenses | Art. 8 |
| 10 business days | Process requests and complaints from impersonated persons | Art. 5, num. 4 |
| 10 business days | Compare documents and request modification of the negative data | Art. 7 |
| 15 business days, extendable by eight | Resolve petitions or claims; otherwise, positive silence | Art. 7 |
| 20 business days | The impersonated person reports and provides supporting documents; the entity must also report | Art. 8 and Judgment C-413 of 2025 |
| Until judicial ruling | The suspension of collection lasts | Art. 9 and Judgment C-413 of 2025 |
The two response deadlines coexist in the text, and how they are articulated in practice is not defined.
What VU does
Verify, VU’s identity verification, checks the document and the person presenting it. Facial liveness evaluated against ISO/IEC 30107-3 is part of that verification.
ISO/IEC 30107-3 defines the method, the metrics, and how a presentation attack detection test is reported. The degrees of sophistication of the attack are not defined by the standard: they are defined by the iBeta testing program, which applies that methodology and orders them by what it costs to build the instrument, in time, expertise, and equipment. There are three. What VU has evaluated is facial liveness, at Level 2 of that program.
Keeping the file is a duty of the entity, which defines its retention policy; VU provides technical evidence of the identity process according to the configuration that is implemented. What measures the SIC protocol will require will be known when it is issued.
let’s review your identity verification.
