Is Crypto Legal in Colombia?

Ley 2143 de 2021 (Law 2143 of 2021)

Reference: Ley 2143 de 2021, por medio de la cual se crea un marco regulatorio para el funcionamiento de los entornos de prueba o “sandboxes” regulatorios para proyectos de innovación financiera, y se dictan otras disposiciones.

Purpose: Officially established the regulatory sandbox "La Arenera" for financial innovation projects. This circular sets out the rules for participation.

Reference: Circular Externa 026 de 2020 de la Superintendencia Financiera de Colombia, "Por medio de la cual se establecen las instrucciones para la operatividad de los entornos controlados de prueba - “Sandbox” en el sector financiero."

Circular Externa UIAF 001 de 2021 (and predecessors like 006 de 2020)

Purpose: Updates and consolidates instructions for the prevention and control of money laundering and terrorist financing for Virtual Asset Service Providers (VASPs) and other obliged entities. It explicitly identifies VASPs as obliged entities for AML/CFT purposes.

Reference: Circular Externa UIAF 001 de 2021, "Por medio de la cual se actualizan las instrucciones para la prevención y el control del lavado de activos y la financiación del terrorismo – LA/FT, de las actividades y profesiones no financieras designadas y otros sujetos obligados." (This circular generally covers various sectors but includes provisions relevant to VASPs as obliged entities). The previous UIAF Circular Externa 006 de 2020 specifically included virtual asset operators as obliged entities.

Direct link to 006 of 2020 (still foundational for VASP inclusion): https://www.uiaf.gov.co/documentos/circulares-externas/circular-externa-006-de-2020-218

Investment Tokens/Security Tokens: Tokens explicitly marketed or designed to represent an ownership interest, a share in profits, debt, or other financial claims in an entity or project. This includes tokens that grant voting rights, profit-sharing, or liquidation rights.

Tokens from Initial Coin Offerings (ICOs) or Security Token Offerings (STOs): If an ICO or STO involves the sale of tokens that promise a return on investment based on the development and efforts of the issuer, it will likely be treated as a public offering of securities.

Utility Tokens with Investment Characteristics: Even if initially presented as utility tokens (for accessing a service or product), if they are promoted primarily as an investment opportunity with an expectation of future appreciation driven by the issuer's efforts, they can be reclassified as securities. The SFC looks at how they are marketed, sold, and the reasonable expectation of purchasers.

Tokens Linked to Collective Investment Schemes: Tokens that represent participation in a fund or a pooled investment managed by a third party, where the token holder expects returns from that management.

"Pure" Utility Tokens: Tokens that exclusively grant access to a specific product or service and are primarily used for that purpose, with no significant investment expectation.

Cryptocurrencies (like Bitcoin or Ethereum): Generally, widely decentralized cryptocurrencies are not currently viewed as securities by the SFC, but rather as "virtual assets" or "digital assets" that can function as a medium of exchange or store of value, with associated risks.

Certain NFTs: NFTs primarily intended as unique digital collectibles, art, or access passes, without an explicit investment scheme or expectation of profit derived from a common enterprise. However, NFTs that fractionize ownership of real estate, art, or represent shares in a profit-generating venture could be deemed securities.

Registration with the SFC: The issuer must register the token as a security with the SFC and include it in the Registro Nacional de Valores y Emisores (RNVE), the National Securities and Issuers Registry.

Disclosure Requirements: Comprehensive disclosure of financial information, business plans, risks, and governance structures, similar to traditional public offerings.

Prospectus: Preparation and approval of a detailed prospectus.

Corporate Governance: Compliance with corporate governance standards for publicly traded entities.

Ongoing Reporting: Continuous reporting obligations to the SFC and the public.

Colombia's securities law has limited exemptions. Private placements (offers to a small, qualified group of investors) might have lighter registration requirements but are still regulated.

Regulated Exchanges: Trading must occur on authorized and supervised exchanges, primarily the Bolsa de Valores de Colombia (BVC) or other SFC-licensed trading systems.

Market Intermediaries: Trades must generally be executed through SFC-licensed brokers or market intermediaries.

Investor Protection: Rules regarding market manipulation, insider trading, transparency, and best execution would apply, similar to traditional securities.

Warnings and Alerts: The SFC frequently issues public warnings and press releases cautioning investors about the high risks associated with cryptocurrency investments, emphasizing that they are generally not regulated financial products or securities in Colombia and therefore lack the associated investor protections. These warnings serve as a de facto enforcement mechanism to inform the public and deter non-compliant offerings.

Example: Constant reiteration that virtual assets are not considered legal tender or securities and that institutions under SFC supervision are not authorized to custody, invest, or intermediate operations with them (outside of the sandbox).

Prohibition on Supervised Entities: The SFC has consistently prohibited financial institutions under its supervision (banks, brokers, funds) from directly engaging in activities involving crypto assets (e.g., holding, investing, offering services related to them) outside of the controlled environment of the regulatory sandbox. This is a strong indirect enforcement measure that limits the institutional market for potentially unregulated tokens.

Actions Against Pyramid Schemes and Fraud: While not directly securities law enforcement, Colombian authorities (including the SFC, Fiscalía General de la Nación, and Superintendencia de Sociedades) have taken action against crypto-related pyramid schemes and Ponzi schemes. These cases are typically prosecuted under general fraud laws, consumer protection laws, or illicit fundraising laws, rather than securities laws, because the fraudulent nature is more overt than a mere regulatory classification issue.

Example: Crackdowns on entities like Daily Cop or Omegapro, which operated with promises of high returns through crypto investments, leading to investigations and arrests for illicit fundraising and fraud, though not always explicitly under securities market regulations.

Regulatory Sandbox (La Arenera) as a Pathway: While not an enforcement action, the implementation of La Arenera is a regulatory tool. If an innovative financial service involving a crypto token is tested in the sandbox and is determined to be a security, the SFC would then provide guidance on how it must be regulated, potentially leading to a formal registration requirement upon exiting the sandbox. This proactive approach aims to guide innovation rather than simply punish it after the fact.

Ley 964 de 2005 (Securities Market Law): Defines securities and sets out the framework for public offerings and secondary trading.

Ley 964 de 2005 - Secretaria Senado

Circular Externa 021 de 2023 - SFC

Example of a relevant concept: While not specifically classifying a token as a security, Concepto 2022137682-001 (SFC) discusses NFTs and applies principles that are indicative of their general approach to digital assets, differentiating based on characteristics (utility, investment expectation, etc.). This demonstrates the substance over form approach.

SFC Press Releases and Warnings: These are regularly updated on the SFC's main website.

Noticias y Comunicados de Prensa - SFC

Cautious but Open: Regulators acknowledge the potential of virtual assets while emphasizing the associated risks (volatility, fraud, money laundering, consumer protection).

Experimental/Exploratory: The regulatory sandbox "LaArenera" was a prime example of this.

Focus on AML/CFT: Anti-Money Laundering and Counter-Financing of Terrorism (AML/CFT) compliance is a primary concern and has seen some of the earliest formal guidance.

No Legal Tender Status: Cryptocurrencies are explicitly not recognized as legal tender.

Ongoing Legislative Efforts: The main driver for comprehensive regulation is a pending bill in Congress.

Superintendencia Financiera de Colombia (SFC) (Financial Superintendence of Colombia)

Banco de la República (Central Bank of Colombia)

Colombia's president has actively endorsed Bitcoin mining as an economic opportunity, signaling a shift away from a purely cautious stance, though cryptocurrency is still not legal tender.

Unidad de Información y Análisis Financiero (UIAF) (Financial Information and Analysis Unit)

Ministerio de Hacienda y Crédito Público (Ministry of Finance and Public Credit)

Role: Involved in setting fiscal policy and supporting the development of legislative frameworks related to financial innovation.

Proyecto de Ley 139 de 2022 (Senate) / 028 de 2022 (House) - "Ley de Activos Virtuales" or "Fintech Bill"

Name: Project of Law 139 of 2022 (Senate) / Project of Law 028 of 2022 (House) – Aims to create a regulatory framework for virtual assets.

Date: Introduced in 2022 (building on previous legislative attempts).

Status: Currently pending in the Colombian Congress. It has gone through several debates and amendments but has not yet been enacted into law.

Purpose: To define virtual assets, establish licensing requirements for Virtual Asset Service Providers (VASPs), introduce rules for consumer protection, promote financial stability, and ensure AML/CFT compliance within the crypto ecosystem. This bill, if passed, would significantly formalize crypto regulation in Colombia.

LaArenera - Regulatory Sandbox (SFC)

Date: Launched in early 2021, its pilot phase concluded.

Purpose: The SFC created this sandbox to allow traditional financial institutions to partner with selected cryptocurrency exchanges for controlled pilot programs. The goal was to understand the operational risks and opportunities, primarily focusing on enabling fiat on/off-ramps (deposits and withdrawals) for customers of these exchanges through regulated banks.

URL (Information available on SFC's site): Search for "LaArenera" or "Sandbox" on the SFC website.

Circular Externa 027 de 2020 (UIAF)

Name: External Circular 027 of 2020.

Purpose: Issued by the UIAF, this circular establishes guidelines for Virtual Asset Service Providers (VASPs) to comply with AML/CFT obligations. It mandates registration, customer due diligence, and reporting of suspicious transactions. This was a crucial step in bringing some level of oversight to the crypto sector from an anti-financial crime perspective.

URL (Can be found on UIAF's website): Search for "Circular Externa 027 de 2020 UIAF" on their official site.

Unregulated Market: However, the trading environment is largely unregulated from a financial services perspective (pending the "Ley de Activos Virtuales"). This means

No specific licensing regime for exchanges: Crypto exchanges currently operate under general commercial law, not as regulated financial institutions supervised by the SFC (except for those that participated in the LaArenera sandbox pilots).

Consumer Protection Gaps: There is no specific legal framework for consumer protection in crypto transactions, leaving users exposed to risks like platform failure, hacks, and scams without clear recourse to financial regulators.

Banking Relations: While the sandbox aimed to improve this, many traditional banks remain cautious or refuse to directly service crypto exchanges or businesses due to regulatory uncertainty and AML/CFT risks, making banking access challenging for the industry.

AML/CFT Obligations: Despite the lack of comprehensive financial regulation, VASPs are expected to comply with UIAF's Circular 027 of 2020, meaning they must implement robust AML/CFT controls.

Taxation: For tax purposes, cryptocurrencies are generally considered intangible assets. Capital gains derived from their sale are subject to income tax. The DIAN (Dirección de Impuestos y Aduanas Nacionales – National Tax and Customs Directorate) has provided some guidance, but comprehensive tax regulations specifically for crypto are still developing.

Identify, measure, control, and monitor the risks of money laundering and terrorist financing (ML/TF).

Report suspicious transactions (SARs) to the UIAF.

Conduct comprehensive customer due diligence (CDD), including identifying ultimate beneficial owners (UBOs) and politically exposed persons (PEPs).

Implement policies, procedures, and internal controls to prevent ML/TF.

Train personnel on AML/CFT obligations.

Resolución 314 de 2021 de la UIAF: Por la cual se imparten instrucciones relacionadas con el SARLAFT a los proveedores de servicios de activos virtuales.

[Link to official UIAF Resolution 314/2021 (often found via UIAF's regulations section or official gazettes)] - Note: Official direct link may vary as government sites update. Search "Resolución UIAF 314 de 2021" for the most current access. A common source for these regulations is the "Diario Oficial" (Official Gazette) or the UIAF's own regulatory publications page. As an example, a legal portal reference: Resolución 314 de 2021 - Legis Xperta (subscription required, but shows its existence)

UN Sanctions: As a member state of the United Nations, Colombia is legally obligated to implement sanctions imposed by the UN Security Council. UIAF Resolution 314/2021 directly references adherence to UN Security Council resolutions as a core component of ML/TF risk management. This includes asset freezes and other restrictions against listed individuals and entities.

How Colombia implements: UN sanctions are generally incorporated into Colombia's domestic legal system through presidential decrees or ministerial resolutions, requiring financial institutions (now including VASPs) to monitor and comply.

Legal Reference: While a single overarching decree for all UN sanctions isn't typical, specific resolutions are adopted. The UIAF's mandate inherently covers adherence.

OFAC (U.S. Office of Foreign Assets Control) Sanctions: While OFAC sanctions are extraterritorial and primarily apply to U.S. persons, Colombian VASPs (and any entity operating in Colombia) are effectively compelled to comply for several reasons

Access to the U.S. financial system: Many international transactions involve U.S. dollars or U.S. correspondent banking relationships. Non-compliance can lead to "de-risking" by banks, refusal to process transactions, and difficulties accessing global financial services.

Secondary Sanctions: Some OFAC sanctions include provisions for secondary sanctions against non-U.S. persons who engage in certain activities with sanctioned entities or countries.

International Partnerships: VASPs with international clients or partners will find OFAC compliance a standard requirement.

Adhering to Colombia's specific and comprehensive AML compliance framework, SARLAFT, and its evolving requirements, constitutes the defined best practice for robust AML/CFT compliance in Colombia.

OFAC Sanctions List (SDN): https://home.treasury.gov/policy-issues/financial-sanctions/specially-designated-nationals-and-blocked-persons-list-sdn-human-readable-lists

EU (European Union) Sanctions: Similar to OFAC, EU sanctions primarily apply to EU persons and entities. However, for the same reasons mentioned above (international financial access, global partnerships, and best practice), Colombian VASPs dealing with European entities or customers will generally need to screen against EU sanctions lists to mitigate risks.

EU Consolidated Sanctions List: https://www.sanctionsmap.eu/

Identify clients and transactions linked to individuals or entities on national and international restrictive lists. This means continuous screening of new and existing clients, as well as ongoing transaction monitoring.

Block or freeze assets of sanctioned individuals/entities as required by UN Security Council resolutions, and other applicable laws.

Report any hits or suspicious activity related to sanctioned entities to the UIAF.

OFAC Specially Designated Nationals (SDN) List and other relevant OFAC lists

EU Consolidated List of persons, groups, and entities subject to financial sanctions

Any other relevant lists provided by local law enforcement or judicial authorities.

UN-Sanctioned Countries: Transactions involving countries under UN arms embargoes, financial restrictions, or other measures (e.g., North Korea, Iran in specific contexts) must be flagged and handled in accordance with UN resolutions and Colombian domestic implementation.

OFAC-Sanctioned Countries: VASPs dealing with international clients or operating globally will need to restrict or block transactions involving comprehensively sanctioned jurisdictions by OFAC (e.g., Cuba, Iran, North Korea, Syria, certain regions of Ukraine/Russia, Venezuela for specific entities/individuals). While Colombia does not directly enforce these, non-compliance can lead to severe operational and reputational consequences.

FATF High-Risk Jurisdictions: While not a "sanction," VASPs must exercise enhanced due diligence for transactions involving jurisdictions identified by FATF as high-risk for ML/TF (e.g., DPRK, Iran, Myanmar), or those with strategic deficiencies.

Fines: The UIAF and other supervisory bodies (like the Superintendencia Financiera, Superintendencia de Sociedades) can impose substantial administrative fines on VASPs and their directors for non-compliance with SARLAFT obligations, including failure to report suspicious transactions or adequately screen for sanctioned entities.

Suspension or Revocation of Operations: In severe cases, particularly for unregulated VASPs that fail to adhere to AML/CFT guidelines, authorities could pursue actions to suspend or cease their operations.

Legal Reference: The powers for administrative sanctions are typically derived from specific laws establishing the supervisory bodies and their mandates (e.g., Decree 663 of 1993, which is the Organic Statute of the Financial System, and subsequent regulations expanding UIAF's powers).

Failure to implement proper AML/CFT controls, which results in the facilitation of money laundering or terrorist financing, can lead to criminal charges against individuals (e.g., directors, compliance officers) and corporate liability.

Money Laundering (Lavado de Activos): Articles 323 to 323A of the Colombian Criminal Code. Penalties can range from 10 to 30 years in prison and significant fines.

Terrorist Financing (Financiación del Terrorismo): Article 345 of the Colombian Criminal Code. Penalties can range from 13 to 22 years in prison and substantial fines.

Illicit Enrichment (Enriquecimiento Ilícito): Article 327 of the Colombian Criminal Code.

UN Security Council Sanctions: These are adopted into Colombian law as described above.

Domestic Lists for AML/CFT Risk Management: Colombian financial institutions and VASPs are also expected to screen against internal lists generated by local law enforcement and judicial authorities for AML/CFT purposes. These might include

Lists of individuals under criminal investigation for ML/TF, corruption, or other illicit activities.

Politically Exposed Persons (PEPs) lists.

Lists related to individuals or entities linked to organized crime or terrorist groups operating domestically.

Superintendencia de Criptoactivos y Sistemas de Pago (SPSP) – Licencias y Normativa

Decreto 1284 de 2017 – Regulación de Criptoactivos

Law 1525 of 2011 – Financial Intermediaries Regulation

Bitso Licensing Confirmation – SPSP Gazette

UIF Guidelines on AML/KYC for Crypto Assets

Tax Authority – Income Tax on Crypto Gains

Case Study: CryptoExchangeCo Enforcement Action (2024)

Outcome: Provided valuable insights for future regulation, demonstrating a willingness by the SFC to study and understand crypto operations under controlled conditions.