The Critical Path to a Supervised Entity in Colombia (2026)

Two authorisations, not one. Article 53 of the Financial System Statute (EOSF) splits licensing in two: an authorisation to constitute the company and, once it exists and is capitalised, a certificate of authorisation to operate. The second half is where go-live is won or lost.

There is no “fintech licence” in Colombia. There is a path, and most foreign teams underestimate its second half. The Superintendencia Financiera (SFC) has four months to decide on a new entity. On paper. In the two most recent finance-company cases, filing to constitution approval took eight to fourteen months, because the statutory clock stops every time the regulator asks a question. And that is only the first authorisation: the company then has to exist, be capitalised, build its technology, AML framework and bank relationships, and pass an on-site walkthrough before it receives the certificate to operate. In the last public SEDPE case that second half took twenty months.

This briefing lays out the six stages, what the SFC reviews at each one, what you must have ready, which vehicle fits which business, and the three places where foreign applicants lose the months.

The six stages

Stage	Clock	What the SFC looks at	What you must have ready
0 · Design & dossier	2–4 months	Nothing yet. This is your work: which licence, business plan, shareholder structure, capital plan.	Draft bylaws · feasibility study (technology, administration, internal control, risk) · fit-and-proper files for every shareholder ≥10% and every administrator · source of funds.
1 · Filing & public notice	~1 month	Completeness. Within 5 days of a complete file the SFC authorises a notice in a national newspaper, published twice; third parties have 10 days to object.	A file that is complete on day one. Every gap restarts the completeness clock.
2 · SFC review	4 months statutory · 8–12 observed	Governance and ownership: character, responsibility, suitability and solvency of shareholders (net worth at least 1.3× the contribution; at least one third from own funds, not debt). Business model, capital, risk plan. The four-month term is suspended every time the SFC asks for more information.	A single owner answering requests in days, not weeks. Beneficial-owner documentation for foreign parents, apostilled and translated, before you are asked.
3 · Constitute & capitalise	≤2 months	The resolution sets the term to raise the bylaws to public deed and register them (two months in a 2025 case). Capital must be fully paid. Fogafín registration where applicable.	Capital wired and converted; notary and chamber of commerce booked; Fogafín file ready.
4 · Build-out & operating authorisation	8–12 months	That the infrastructure matches the feasibility study: technology, SARLAFT/AML, risk systems, people, processes. The SFC runs a walkthrough test on site (eight days in a 2023 SEDPE case) and issues the certificate within 5 days of a positive check.	Core system live, AML officer appointed, policies approved by the board, bank and settlement accounts open, internal audit function, regulatory reporting tested.
5 · Go-live & year one	12 months	Reporting discipline, first inspections, consumer-protection complaints, any new product that needs prior notice.	Reporting calendar, board cadence, a compliance team that was hired before go-live, not after.

Stages 3 and 4 run in parallel: technology, SARLAFT and bank set-up start the day the constitution is approved, not after.

There is no “fintech licence”: pick the vehicle by what you need to be allowed to do

The same Article 53 path applies to every supervised entity; what changes is scope, capital and how long the dossier takes to assemble. Three routes avoid the path entirely and buy you time while the real one runs.

Route	What it is	Speed	Scope
A · Partner model (no licence)	Operate through a bank, finance company or SEDPE as correspondent or programme partner.	Fastest, cheapest	You own neither the customer account nor the FX. Common first step.
B · Low-value payment system participant	Payment-service providers under Decreto 1692/2020 (acquiring, gateways, aggregation) register with the system operator.	Fast	No Article 53 path, no deposits, no FX.
C · Regulatory sandbox (COT)	Temporary operating certificate for up to two years under Decreto 1234/2020; capital set case by case; exit is a full licence or wind-down.	Medium	Buys evidence and a relationship with the supervisor.
D · SEDPE	Deposit and e-money company (Ley 1735/2014): e-money accounts, payments and, once registered with Banco de la República, FX intermediary status for transfers. Base capital COP 5,846 million, inflation-indexed.	Slow	The natural vehicle for cross-border payments.
E · Finance company (CF)	Full credit and deposit franchise, FX intermediary. Heaviest dossier and capital (COP 46.9 billion and 60 billion in the two 2025 cases).	Slowest	The vehicle when lending is the business.

What the clock said in the last three public cases

Entity	Vehicle	Filed	Constitution approved	Operating certificate	Reading
Cobre Financial	Finance company	Apr 2025	16 Dec 2025 (Res. 2216)	Pending	About 8 months to constitution approval; capital COP 46.9 billion.
Stori Colombia	Finance company	2024	Dec 2025 (Res. 2215)	Pending	12+ months; capital COP 60 billion; announced US$100M country investment.
StoneX Colombia	SEDPE	n/d	Deed Feb 2022	6 Oct 2023 (Res. 1618)	About 20 months from deed to certificate: stage 4 is the long one.

Where foreign applicants lose the months

1. Beneficial owners. Fit-and-proper and source-of-funds files for every ≥10% holder up the chain, apostilled and translated. The most common cause of a suspended clock.
2. The bank account. A supervised entity still needs a settlement bank and, for cross-border, Banco de la República registration. Start in stage 0: bank compliance runs on its own calendar.
3. Build-out before the walkthrough. The certificate is granted on infrastructure that exists, not on a plan. Core, SARLAFT, people and reporting have to be live before the SFC visits.

How Divergint runs the path

Licensing fails on coordination, not on law. We take the dossier, the regulator, the banks and the build-out as one workstream with one accountable person, and hand over a company that is ready to be inspected: vehicle decision and dossier (stage 0), regulator interface (stages 1–2), constitution and capital (stage 3), build-out to inspection standard (stage 4), structures to operate while you wait (routes A–C), and the first year of the supervised entity.

Entering Colombia in 2026? Send us your product and target date. You will get back a one-page licence-route memo and a dated critical path for your case, free, within a week.

Follow the conversation on LinkedIn and X.

---

Sources: EOSF art. 53 (Decreto 663/1993, as amended by Ley 510/1999 and Ley 1328/2009); SFC Resolutions 2215 and 2216 of 16 December 2025 (Stori, Cobre), filing dates per public statements; SFC Resolution 1618 of 6 October 2023 (StoneX Colombia SEDPE), walkthrough test 25 July to 2 August 2023; Decreto 1234/2020 and SFC Circular Externa 016/2021; Banco de la República Resolución Externa 7/2016 and Resolución Externa 1/2018 art. 7. Observed ranges are Divergint estimates from public cases, not SFC commitments. Capital figures are statutory bases or case values, not 2026 indexed minima. This briefing is general information as of October 2026 and is not legal advice.