Colombia's Identity Theft Law (Law 2573 of 2026): what you need to know

Colombia took a major step in protecting citizens against fraud with Statutory Law 2573 of 2026 (known as the "Identity Theft Law"), signed into law on May 19, 2026 and published in Diario Oficial No. 53.496, Colombia's official gazette¹. Although the law has already been enacted, its core provisions take effect on November 19, 2026, exactly six months after its promulgation.

May 19Law 2573 of 2026 is signed

6 monthsof transition for the industry to prepare

Nov 19Its core provisions take effect

From that date on, banks, mobile carriers and merchants that extend credit will be required to follow strict procedures to protect victims of identity theft. Here's what it's all about.

What kicks in on November 19: key rights and obligations

From that date, the rules of the game change for financial institutions, telecom operators and merchants that offer credit:

“The law requires collections to stop as soon as identity theft is reported”If you report that a loan, mobile line or product was fraudulently obtained using your identity, the institution must immediately suspend collection, interest and collection fees.

"Immediately suspend the provision or supply of the goods and/or services that were obtained through fraudulent conduct, once informed by the persons whose identity was stolen."
— Law 2573 of 2026, Article 5, item 5 (unofficial translation). (See full article)

No need to wait for a criminal complaint to freeze the debtColombia's Financial Superintendence (SFC) has clarified that the measure is immediate.

"The immediate suspension of collection applies from the moment the institution is informed of identity theft and is not conditional on the prior filing of a criminal complaint."
— Superintendencia Financiera de Colombia (SFC), Legal Bulletin No. 123 (unofficial translation).²

Access to documentsYou have every right to request the records and documents the company used to approve the transaction in your name.

Fast response (10 business days)The institution must verify the data and, where applicable, report the case under a special flag.

The “Victim of Identity Fraud” flagIt is not a negative report and cannot affect your credit score with credit bureaus while the case is being resolved.

Step by step: what happens if your identity is stolen

You notify the institutionThe bank, mobile carrier or merchant that granted the loan or product in your name.Day 0
Collection is suspended immediatelyCollection, interest and collection fees are frozen, with no prior criminal complaint required.Immediately
The institution verifies your dataWhere applicable, it reports the case with the “Victim of Identity Fraud” flag, which is not a negative report.10 business days
You file a complaint with the Attorney General's OfficeYou file a criminal complaint for identity fraud and provide the supporting documents to the institution.20 business days
The courts decideJudicial authorities determine whether or not identity theft occurred.

Mind the deadline! The duty to file a complaint

The law is not a blank check; it requires shared responsibility from citizens to prevent abuse:

20business days

Criminal complaint within 20 business days: Once you have notified the institution, you have 20 business days to file a criminal complaint for identity fraud with the Fiscalía General de la Nación (Colombia's Attorney General's Office) and provide the supporting documents.

“The telecommunications operator or financial and/or credit institution and other commercial establishments with this competence shall inform the person whose identity was stolen that, from that moment on, they have twenty (20) business days to file with the Fiscalía General de la Nación the criminal complaint for the offense of identity fraud and related offenses of which they have been a victim, and to provide the telecommunications operator or financial and/or credit institution and other commercial establishments with this competence with the respective supporting records and documents, which shall be taken as summary evidence so that the institution may cancel the collection of the obligation if it so deems appropriate.”
— Article 8, Statutory Law 2573 of 2026 (unofficial translation). (See full article)

What happens to the debt? (Important caveat)

Note: the law does not “automatically erase debts”: the suspension is a provisional, immediate protection measure, but the final decision rests with the courts.

If fraud is provenYou are permanently released from the obligation and removed from negative credit reports.

If it's found that it was you after allThe institution may resume collection, adding the interest and costs accrued during the suspension period.

Who decides?

"The power to determine whether identity theft actually occurred lies with the competent judicial authorities."
— Superintendencia Financiera de Colombia (SFC), Legal Bulletin No. 123 (unofficial translation).²

What applied before, and what changes now?

Since May 19, 2026Identity verification protocolsKeep in mind that paragraphs 1 and 2 of Article 5 have been in force since May 19, 2026. They require companies to implement strict identity verification protocols (both in person and digital) to prevent fraud.

From November 19, 2026A direct shield for consumersWhat truly takes effect and gains teeth on November 19, however, is the direct shield for consumers: the enforceable obligation to stop collections and protect credit history immediately in a case of identity theft.

Bottom line: what you need to know to stay compliant

For businessesThe countdown is over. This is no time to improvise: implementing strict identity verification controls and acting immediately on fraud is no longer optional; it's a legal obligation with hard deadlines.Avoid penalties and protect your users!

For citizensStay informed, act in time and exercise your rights. If you are a victim of identity theft, remember that you have the power to demand the immediate suspension of collections, but also the responsibility to file a complaint within the established deadlines.Don't sit idle: protect your financial peace of mind!

Sources and references

Congress of Colombia. Statutory Law 2573 of 2026 (May 19, 2026). Diario Oficial No. 53.496. Normograma, Ministry of Foreign Affairs (Cancillería). In Spanish.
Superintendencia Financiera de Colombia. Legal Bulletin (Boletín Jurídico) No. 123 on identity theft procedures. In Spanish.
Ministry of Information and Communications Technologies (MinTIC). Digital Identification Guidelines. In Spanish.

Mark your calendar!
Colombia's Identity Theft Law (Law 2573 of 2026) takes effect on November 19, 2026: here's what you need to know

What kicks in on November 19: key rights and obligations

Step by step: what happens if your identity is stolen

Mind the deadline! The duty to file a complaint

What happens to the debt? (Important caveat)

Who decides?

What applied before, and what changes now?

Bottom line: what you need to know to stay compliant

Sources and references

More articles.

Instant payment fraud already moves billions in LatAm, and current systems aren't ready

AI no longer just detects fraud: it anticipates it before it happens

Digital fraud in LatAm no longer exploits systems: it exploits people