Countries › Colombia › Guide › 10. Capital markets and finance › Financial consumer protection and credit bureaus in Colombia: consumer rights, abusive clauses and practices, the consumer ombudsman, SFC court powers, negative reports and how long they stay

Financial consumer protection and credit bureaus in Colombia: consumer rights, abusive clauses and practices, the consumer ombudsman, SFC court powers, negative reports and how long they stay

Last verified: 2026-10-27 · Status: Stable

Ley 1328 de 2009 protects every client, user and prospective client of SFC supervised entities, companies included: it bans abusive clauses in adhesion contracts (which are treated as not written), abusive practices such as tying and unrequested renewals, requires a free and independent consumer ombudsman at the entities the Government designates, and the SFC can decide contractual disputes with consumers as a judge. Under the credit data law, Ley 1266 de 2008 as amended by Ley 2157 de 2021, a negative report needs prior notice and a 20 calendar day wait, and it stays for twice the time in arrears with a maximum of four years from payment, with all negative data deleted after eight years from default.

USD figures use the TRM of COP 3,157.94 per US dollar valid on 27 October 2026, certified by the Superintendencia Financiera and published on the national open data portal (datos.gov.co). Amounts in UVT use the 2026 UVT of COP 52,374 (DIAN Resolución 000238 de 2025) and amounts in minimum wages use the 2026 monthly minimum wage of COP 1,750,905 (Decreto 1469 de 2025). Conversions are for orientation only.

Key facts

Financial consumer protection covers legal entities	Yes, any client, user or prospective client textLey 1328 de 2009 art. 2, as of 2026-10-27 · in force
Financial consumer ombudsman	Required at entities designated by the Government; free for consumers textLey 1328 de 2009 art. 13, as of 2026-10-27 · in force
SFC may decide consumer contractual disputes as a judge	Yes textCódigo General del Proceso art. 24 num. 2, as of 2026-10-27 · in force
Wait after prior notice before a negative credit report	20 calendar daysLey 1266 de 2008 art. 12, as of 2026-10-27 · in force
Maximum stay of negative data after payment	4 yearsLey 1266 de 2008 art. 13 (Ley 2157 de 2021), as of 2026-10-27 · in force
Negative data expires after default in any case	8 yearsLey 1266 de 2008 art. 13 parágrafo 1, as of 2026-10-27 · in force

The rule

1. A financial consumer is any client, user or prospective client of an SFC supervised entity, whether an individual or a legal entity. Clients are persons with whom the entity has a legal or contractual relationship to supply products or services; users use the services without being clients; prospective clients are in preliminary dealings. Adhesion contracts are those drafted by the entity whose terms cannot be freely negotiated by the client.Ley 1328 de 2009 (financial reform and consumer protection), Art. 2, 2009-07-15 official text · verified 2026-10-27

2. Financial consumers have the right, among others, to products and services with safety and quality standards as offered, to transparent, clear, truthful, timely and verifiable advertising and information that allows comparison, to due diligence in the service, to education on products, costs and markets, and to prepay peso credits without penalty up to 880 monthly minimum wages (see the interest rates page).Ley 1328 de 2009, as amended by Ley 1555 de 2012 art. 1, Art. 5, 2009-07-15 official text · verified 2026-10-27

3. Clauses in adhesion contracts are prohibited if they limit or waive consumer rights, shift the burden of proof against the consumer, leave blank spaces not covered by a detailed letter of instructions, or otherwise limit consumer rights or the entity's duties or exclude or reduce its liability in a way that may harm the consumer, plus any others the SFC sets in advance. Any such clause is deemed not written or without effect for the consumer. Abusive practices include tying a product to the purchase of others not needed for it, starting or renewing a service without the consumer's express request or authorization, and shifting the burden of proof in fraud cases.
Example: A clause in a bank's standard account terms saying the client bears all losses from fraudulent transfers unless it proves the bank's fault is ineffective against the client.Ley 1328 de 2009, Art. 11 and art. 12, 2009-07-15 official text · verified 2026-10-27

4. Supervised entities designated by the Government must have a financial consumer ombudsman (Defensor del Consumidor Financiero) who acts autonomously and independently: attends consumers, decides their complaints free of charge, and may act as a certified conciliator, in which case the signed conciliation record is enforceable and has res judicata effect.
Cost to do it: Free for the consumer; the entity pays the ombudsman.Ley 1328 de 2009, Art. 13, 2009-07-15 official text · verified 2026-10-27

5. The SFC exercises judicial powers over disputes between financial consumers and supervised entities relating exclusively to the performance of contractual obligations assumed in financial, securities, insurance and any other activity involving funds taken from the public.
Example: A company whose bank refused to honour a term deposit can sue the bank before the SFC's delegated judicial function instead of a civil court.Código General del Proceso (Ley 1564 de 2012), Art. 24 num. 2, 2012-07-12 official text · verified 2026-10-27

6. Data sources must update the information given to credit bureaus monthly. A negative report on any unpaid obligation may only be made after prior notice to the data subject, so it can pay or dispute the amount or due date; the notice may go in periodic statements, and the report may be made 20 calendar days after the notice was sent to the last registered address. For obligations of 15 percent of a monthly minimum wage or less, at least two notices on different days are needed, with 20 calendar days between the last notice and the report. Reporting without the prior notice requires immediate removal of the report.
Cost to do it: The small debt threshold of 15 percent of a minimum wage is COP 262,636 (about US$83) in 2026.Ley 1266 de 2008 art. 12 and art. 13 parágrafo 2, as amended by Ley 2157 de 2021 art. 3 and art. 6, Art. 12 and art. 13, 2021-10-29 official text · verified 2026-10-27 · changed: Ley 2157 de 2021 (29 October 2021) added the duty to remove reports made without prior notice and the double notice rule for small debts.

7. Positive information stays indefinitely. Negative data (time in arrears, type of collection, portfolio status and other default data) stays for twice the time in arrears, up to a maximum of four years from the date the overdue instalments are paid or the obligation is extinguished. In any case, negative data expires eight years after the obligation went into default and must then be deleted. Scores and ratings must be updated at the same time as negative data is removed.
Example: A borrower who was six months late and paid in March 2026 has the negative data removed in March 2027 (twice six months). / The rule turns on time in arrears, not on amount: a US$100 debt and a US$100,000 debt paid after the same delay stay the same time.Ley 1266 de 2008 art. 13, as amended by Ley 2157 de 2021 art. 3, Art. 13 and parágrafos 1 and 3, 2021-10-29 official text · verified 2026-10-27

Time in arrears	Stay after payment	Rule
3 months	6 months	Twice the arrears
12 months	24 months	Twice the arrears
30 months	48 months	Capped at 4 years
Never paid	Deleted 8 years after default	Parágrafo 1

How long negative credit data stays (Ley 1266 de 2008 art. 13 as amended by Ley 2157 de 2021)

Worked example

A US group's Colombian subsidiary disputes a bank's refusal to release a guarantee. It can file a complaint with the bank's consumer ombudsman for free, ask for conciliation before the ombudsman, or sue the bank before the SFC exercising judicial functions, because protection covers companies as well as individuals (Ley 1328 de 2009 art. 2 and 13; Código General del Proceso art. 24 num. 2).
A Colombian lender wanting to report a defaulting consumer must send prior notice and wait 20 calendar days; for a debt of COP 262,636 or less it needs two notices on different days (Ley 1266 de 2008 art. 12 and 13).

Step by step

1. If you run a supervised entity, review standard contracts against the art. 11 abusive clause list and the SFC's published list.
2. Appoint the consumer ombudsman if your entity type is designated, and publish how to reach it.
3. Build credit reporting workflows that send prior notice, wait 20 calendar days and keep proof of sending.
4. Remove negative data at twice the arrears, at most four years after payment, and delete it after eight years from default.
5. As a corporate client, consider the ombudsman and SFC judicial route for contractual disputes with banks, insurers or brokers.

Common traps

Assuming consumer protection only covers individuals: corporate clients are financial consumers too (Ley 1328 de 2009 art. 2).
Auto renewing insurance or services without express authorization, an abusive practice (art. 12 lit. b).
Reporting a debtor without prior notice: the report must be removed immediately (Ley 1266 de 2008 art. 12 parágrafo).
Keeping negative data beyond eight years from default even if the debt was never paid (art. 13 parágrafo 1).

Sources

← Fintech in Colombia: crowdfunding platforms and caps, the SFC regulatory sandbox, payment initiation, the Bre-B instant payments rules and electronic deposit companiesThe tax on financial movements (GMF, 4 per 1,000) in Colombia: what triggers it, who withholds it, key exemptions for treasury, credit, factoring and portfolio repatriation, and the 50 percent deduction →