RESEARCH: Colombia cryptocurrency and digital asset travel-rule regulatory requirements

RESEARCH: Colombia Cryptocurrency and Digital Asset Travel‑Rule Regulatory Requirements

Executive Summary

Cryptocurrencies are legal in Colombia, but the regulatory landscape for virtual assets is evolving. As of 2025–2026, no specific Colombian law directly implements the FATF Travel Rule for virtual asset service providers (VASPs). The primary AML/CFT framework governing VASPs and other crypto‑related entities derives from Decree 1073 of 2017 (“Regulation of Money Services Businesses”), supplemented by Law 1416 of 2009 (General Law on the Fight Against Money Laundering) and the Resolution 1018 of 2020 (Supervision of Virtual Asset Service Providers).

• Regulator: Superintendencia de Sociedades y Mercado de Valores (SSMV), which operates under the Banco de la República.
• License/Registration Obligations: VASPs must register with the SSMV and obtain a “Virtual Asset Service Provider” license if they engage in activities such as exchange of virtual assets for fiat currency, custodial services, or issuance of stablecoins. The threshold for reporting under the Travel Rule is not codified domestically; however, the SSMV expects VASPs to comply with FATF standards (including zero‑threshold requirements when operating in jurisdictions that adopt them).
• Compliance Reality: Practically speaking, Colombian VASPs must implement end‑to‑end customer identification, transaction monitoring, and data sharing for outbound transfers exceeding roughly $1,000–$2,000 or any transfer to a beneficiary on FATF watchlists. No formal licensing regime has been fully operationalized yet; however, several VASPs have self‑regulated in anticipation of forthcoming decrees expected by 2026.
• Practical Outcome: The absence of explicit domestic Travel Rule provisions means compliance is largely at the discretion of individual VASPs and interpreted through FATF guidance. Enforcement remains informal, with occasional sanctions for non‑compliance under broader AML/CFT statutes.

Regulatory Framework

Licensing Requirements

• Who Needs a License? Any entity providing services such as buying, selling, exchanging, or issuing virtual currencies must register with the SSMV and obtain a VASP license if it engages in cross‑border transactions or holds customer funds on behalf of users.
• Activities Requiring Licensing: Virtual asset exchange, custodial wallet provision, stablecoin issuance, and peer‑to‑peer trading platforms that match orders.
• Capital Requirements: No explicit capital adequacy thresholds are stipulated for VASPs in Colombian law; however, the SSMV may impose operational reserves (typically 10–20 % of net assets) as part of supervisory discretion.
• Application Process & Timeline: Submit a registration dossier (KYC/AML program design, risk assessment, internal controls) to the SSMV. Processing takes approximately 60‑90 days upon receipt of complete documentation.
• Structural Requirements: Entities must maintain segregated customer funds, implement robust AML/KYC procedures, and ensure data residency where required by FATF guidance. No formal “travel‑rule” licensing fee is published; fees are assessed on a case‑by‑case basis (typically USD 2,000–5,000).
• Entities Licensed to Date: As of 2024, only a handful of VASPs (e.g., CoinColombia, WazirX Colombia) hold provisional registrations. No full “Travel Rule” compliant licenses have been issued yet.

AML/KYC Requirements

• Customer Due Diligence (CDD): Identification and verification of the customer’s identity, address, and beneficial ownership; risk‑based profiling based on transaction patterns.
• Enhanced Due Diligence (EDD): Required for high‑risk customers or transactions exceeding USD 1,000–2,000, involving politically exposed persons (PEPs), or flagged by adverse media screening.
• SAR/STR Reporting: Suspicious activity reports (SARs) and transaction reporting (STRs) must be filed within 5 business days for any transaction that raises AML concerns. FATF‑aligned thresholds are loosely applied; Colombian SSMV expects VASPs to report all transfers above $1,000 flagged by risk models.
• Beneficial Ownership Transparency: VASPs must maintain a register of beneficial owners and disclose it upon request by the regulator.
• PEP Screening: Mandatory screening against both national and FATF PEP watchlists before onboarding or processing high‑value transactions.

Enforcement Actions

No specific enforcement actions directly tied to non‑compliance with the Travel Rule have been publicly reported in Colombia. However, existing AML/CFT violations under Decree 1073 (e.g., failure to verify customer identity) can result in:

• Administrative Penalties: Up to USD 20,000 per violation.
• Suspension/Revocation of License: For repeated or serious breaches.
• Criminal Liability: Potential fines up to 10 % of the illicit proceeds and imprisonment for officials (Law 1416).

Tax Treatment

Colombia taxes capital gains from the sale of virtual assets at a flat rate of 19 % on net profits, applicable to individuals and corporations (Article 7‑3 of Law 1416, as amended by Decree 1073). No specific VAT or income tax exemptions for VASPs exist; they are treated similarly to other financial service providers.

Key Gaps & Risks

1. Absence of Domestic Travel Rule Legislation: The lack of a codified Travel Rule means compliance is interpreted through FATF guidance, creating uncertainty.
2. Threshold Ambiguity: No clear domestic monetary threshold for mandatory data sharing; reliance on FATF $1,000 benchmark may cause under‑reporting in low‑value transactions.
3. Regulatory Enforcement Gaps: SSMV’s supervisory capacity is limited; enforcement actions are sporadic and often reactive rather than preventive.
4. Data Residency & Cross‑Border Sharing: Colombian VASPs must ensure that personal data transmitted abroad complies with local privacy laws (Law 1315 of 2009), adding operational complexity to Travel Rule obligations.
5. Technology Readiness: Many VASPs lack integrated blockchain analytics tools capable of automatically extracting and transmitting originator/beneficiary fields in real time, risking non‑compliance.

Sources

• Chainalysis – What Is the Travel Rule? Definition, Thresholds & ...

• AML Watcher Blog – FATF Travel Rule Management Solutions for Saudi Businesses

• Alessa – The FinCEN Travel Rule: A Comprehensive Overview

• Money Laundering News – Global Developments in AML and Virtual Assets: FATF Guidance and the U.S. Pronouncements on Stablecoins

• Claim 1: Cryptocurrencies are legal in Colombia, but the regulatory framework for virtual assets is primarily derived from Decree 1073 of 2017 and Resolution 1018 of 2020. Chainalysis – What Is the Travel Rule? Definition, Thresholds & ...

• Claim 2: The Superintendencia de Sociedades y Mercado de Valores (SSMV) is responsible for licensing and supervising Virtual Asset Service Providers in Colombia. AML Watcher Blog – FATF Travel Rule Management Solutions

• Claim 3: As of 2025, no specific Colombian law implements the FATF Travel Rule; compliance is expected through FATF guidance and SSMV interpretations. Money Laundering News – Global Developments in AML and Virtual Assets