Colombia Law 2573 of 2026: identity verification against identity theft

If your company sells on credit, provides telecom services or opens financial products in Colombia, Law 2573 of 2026 requires you to verify customers’ identity with “sufficient and reasonable” measures and to respond fast when someone reports identity theft. This guide sums up what the official text says, what is still to be regulated and how to build an API verification flow that leaves evidence.

What Colombia’s Law 2573 of 2026 is and who it applies to

Statutory Law 2573 of 2026 (Ley Estatutaria 2573) was issued on May 19, 2026 and published in Diario Oficial No. 53,496 on May 20, 2026. Its purpose is to protect people whose identity was stolen from negative credit bureau reports and from collection of debts they never took on.

The law targets 3 types of businesses that provide goods or services in person or through electronic channels:

• Telecommunications operators.
• Financial and/or credit institutions.
• Other commercial establishments “with this competence”.

Under Article 13, the law takes effect within 6 months of its promulgation. The exception is paragraphs 1 and 2 of Article 5 (the protocols and the consequences of breaching them), which took effect on promulgation.

What the law requires for identity verification

Article 5 lists 10 duties for businesses. These are the ones with the most impact on onboarding:

1. Item 1: adopt “sufficient and reasonable” digital security measures needed to establish the truthfulness of people’s identity and of the documents they present.
2. Item 3: adopt sufficient and reasonable mechanisms to validate the information customers provide, under the principle of good faith.
3. Item 4: handle complaints within 10 business days, in line with Law 2157 of 2021.
4. Item 5: immediately suspend the goods or services when identity theft is reported.
5. Item 7: give the person copies of the documents used to acquire the product; under the law, this can never be refused.

Other articles complete the picture:

• Dynamic burden of proof (Art. 2, letter d): in identity theft cases, telcos and financial or credit institutions must hand over the information and documents they received to approve the good or service. The official compilation marks this letter as conditionally constitutional.
• Identity validation test (Art. 6, item 5): the person reporting the theft must take the validation test set by the business where they reported it.
• Document check within 10 business days (Art. 7): within 10 business days of the request, the data source must compare the documents used to take on the debt with those the person provides, and request the change of the negative record with the legend “Víctima de Falsedad Personal” (victim of identity fraud). That mark cannot count as negative data and may be used only for an “intensified verification” of the person’s identity.
• Response time (Art. 7, item 8): requests are resolved within 15 business days, extendable by 8 more; if there is no answer, positive administrative silence applies.
• No unilateral decision (Art. 10): the business must check the person’s claim in detail and cannot decide on its own that no identity theft took place.

What comes next: the SIC and Superfinanciera protocol

Paragraph 1 of Article 5 orders the Superintendence of Industry and Commerce (SIC) and the Financial Superintendence, together with MinTIC, to regulate within 6 months the protocols for handling possible identity theft reports. The law says those protocols must include suitable mechanisms, tools and methodologies that allow the full identification of the potential buyer.

Paragraph 2 sets the consequence: if the protocols are breached and the person asks for a correction, collection is suspended, the credit bureau report is changed, and the money must be returned promptly or the debts eliminated.

On September 8, 2026 the SIC opened a public consultation on identity validation (in Spanish). It noted 18,535 identity theft complaints filed through SIC Facilita since 2019 (50% of all complaints there) and 1,316 in 2026 up to May 31. This is the schedule the SIC publishes (updated September 25, 2026):

Stage	Date
Call for participants	September 8 to October 9, 2026
Selection	September 28 to October 10, 2026
Working sessions	Until October 16, 2026
Proposal published for comments	November 2, 2026
Issuance	November 20, 2026

The consultation form asked about the effectiveness, accuracy and reliability of verification technologies, data processing risks, regulatory models, standards and costs. The final content of the protocol is not known yet, so review the proposal once it is published.

“Sufficient and reasonable” verification in practice

The law does not name specific technologies. A common operating approach is to verify in layers, where each layer answers a different question:

1. Does the cédula exist, and who does it belong to? Check the number against official sources and compare the returned name with the one the customer typed.
2. Is the document presented still valid? Item 1 covers the truthfulness of “the documents presented”. The Registraduría validity certificate confirms the cédula’s status using its issue date, an extra data point the customer must know.
3. Is the person in front of the camera the holder? A face comparison with liveness lowers the risk of someone using another person’s photo or document.
4. Can you prove it later? Keep the evidence from each step for the Article 7 document check and for the dynamic burden of proof.

For someone flagged as “Víctima de Falsedad Personal”, the law calls for intensified verification. In practice, that can mean requiring all 3 layers on every new application, even for a known customer.

How Verifik fits: the API flow

You need your Verifik token in the Authorization: Bearer header. These examples come from the official documentation.

Step 1: validate the cédula

The cédula lookup documentation asks for documentType (CC or PPT) and documentNumber (5 to 10 characters, without spaces or periods):

import axios from "axios";

const options = {
  method: "GET",
  url: "https://api.verifik.co/v2/co/cedula",
  params: { documentType: "CC", documentNumber: "123456789" },
  headers: {
    Accept: "application/json",
    Authorization: `Bearer ${process.env.VERIFIK_TOKEN}`,
  },
};

const { data } = await axios.request(options);
console.log(data);

Sample 200 response:

{
  "data": {
    "arrayName": [
      "JULIO",
      "CESAR",
      "CABANA",
      "CONTRERAS"
    ],
    "documentNumber": "1121329662",
    "documentType": "CC",
    "firstName": "JULIO CESAR",
    "fullName": "JULIO CESAR CABANA CONTRERAS",
    "lastName": "CABANA CONTRERAS"
  },
  "signature": {
    "dateTime": "October 8, 2025 8:21 PM",
    "message": "Certified by Verifik.co"
  },
  "id": "I70IL"
}

If the cédula does not exist, the API returns a 404 with "Record not found."; if a parameter is missing, it returns a 409. Compare fullName with the name the customer gave, and store the id and the signature.

Step 2: confirm the document is valid

The Registraduría certificate endpoint takes the cédula number and date, which is the issue date in DD/MM/YYYY format (not the date of birth):

import os, requests

url = "https://api.verifik.co/v2/co/registraduria/certificado"
headers = {"Accept": "application/json", "Authorization": f"Bearer {os.getenv('VERIFIK_TOKEN')}"}
params = {"documentNumber": "123456789", "date": "10/10/2020"}

r = requests.get(url, headers=headers, params=params)
print(r.json())

Sample 200 response (without the pdfBase64 field, which carries the certificate as a PDF):

{
  "data": {
    "codigoVerificacion": "ABC123XYZ",
    "novedad": "VIGENTE",
    "documento": {
      "cedula": "123456789",
      "fechaExpedicion": "10/10/2020",
      "lugarExpedicion": "BOGOTA D.C.",
      "nombre": "JUAN PEREZ"
    }
  },
  "signature": {
    "dateTime": "August 23, 2022 11:42 AM",
    "message": "Certified by Verifik.co"
  }
}

If novedad is not “VIGENTE” or the name does not match, send the case to manual review. The documentation recommends treating pdfBase64 as sensitive data.

Step 3: face comparison with liveness

Compare with liveness takes a selfie (probe) and one or more reference images (gallery), runs the comparison first and then the liveness check:

import os, requests

url = "https://api.verifik.co/v2/face-recognition/compare-with-liveness"
headers = {
    "Content-Type": "application/json",
    "Authorization": f"Bearer {os.getenv('VERIFIK_TOKEN')}"
}
payload = {
    "probe": "<base64>",
    "gallery": ["<base64>"],
    "search_mode": "FAST",
    "liveness_min_score": 0.6,
    "compare_min_score": 0.8
}

r = requests.post(url, json=payload, headers=headers)
print(r.json())

Sample 200 response:

{
  "id": "CWL01",
  "data": {
    "comparison": {
      "score": 0.88
    },
    "liveness": {
      "liveness_score": 0.91,
      "min_score": 0.6,
      "passed": true
    }
  },
  "signature": {
    "message": "Certified by Verifik.co",
    "dateTime": "January 16, 2024 3:44 PM"
  }
}

liveness_min_score defaults to 0.6 and compare_min_score accepts values between 0.67 and 0.95. Set your thresholds to match your risk appetite and record them in your policy.

If, beyond Law 2573, you also need background checks, PEP screening and biometrics in the same onboarding, the Colombia KYC API guide covers all 10 lookups with code.

Evidence for the 10-business-day document check

When a complaint arrives, the Article 7 clock starts. Keeping the evidence organized from onboarding speeds up the check and lets you hand over the documents required by Article 5, item 7. A minimal case file can include:

• The id and signature (with dateTime) of each Verifik response.
• The codigoVerificacion and novedad of the validity certificate.
• The comparison score, the liveness_score and the thresholds you used that day.
• The documents and images the customer provided, with the date they were received.

Article 2 of Law 2573 points to the principles of Law 1266 of 2008 and of Law 1581 of 2012 on personal data protection. Keep only what you need, restrict access to images and PDFs, and set how long you retain them.

For a broader view, see also quick ID verification in Colombia with the cédula de ciudadanía, how to use liveness to prevent identity fraud, and the breakdown of the cost of identity theft for businesses.

How to evaluate a verification provider

If you plan to review your provider before the protocol comes out, these questions help you decide:

• Which official Colombian sources does it query, and which fields does each return?
• Can it confirm the document is valid, not just that the number exists?
• Does it include face comparison and liveness in the same integration?
• Does every response carry an ID or signature you can keep as evidence?
• Is the documentation available in Spanish for local teams, with copy-ready examples?

If you are in that evaluation, this guide on how to choose the best eKYC solution for your business goes deeper into the criteria.

With Verifik, each call is deducted from your smartCHECK plan credits, with plans from $49 a month.

Compliance checklist

A working list to get your operation ready before November 19, 2026:

• List the channels (in person and digital) where products or services are acquired and the verification you apply in each.
• Check the cédula against official sources and compare the returned name with the declared one.
• Confirm the document presented is valid, not just that the number exists.
• Add face comparison with liveness to your highest-risk flows.
• Keep evidence of every step (identifier, signature, scores, thresholds and date) to hand to the person if they ask (Art. 5, item 7).
• Set a procedure to handle identity theft complaints within 10 business days and suspend collection immediately.
• Agree with your credit bureaus on the Article 7 document check and on handling the “Víctima de Falsedad Personal” legend.
• Apply intensified verification to people flagged with that legend.
• Review the SIC and Superfinanciera draft protocol and adjust your flow once it is issued.
• Apply the principles of Law 1581 of 2012 and Law 1266 of 2008: data minimization, restricted access and retention periods.