The Superintendency of Industry and Commerce issued External Circular No. 001 of 2025, addressed to actors in the fintech ecosystem that offer loans, low-amount deposits, digital wallets, and other digital services that promote financial inclusion.
This regulation reaffirms the application of Laws 1266 of 2008 and 1581 of 2012, establishing that data processing must respond to legitimate purposes, with criteria of necessity and proportionality.
Among the most relevant aspects, the circular requires that authorizations be clear and differentiated, between necessary and ancillary purposes, strictly regulates the handling of biometric data, and mandates the agile exercise of data subjects’ rights. It also addresses the use of automated decisions and artificial intelligence, in addition to reinforcing rules on collection, security, and international data transfers, strengthening confidence in digital financial services.
