COLOMBIA Trends and Developments Contributed by: Rebeca Herrera, Rebeca Herrera Abogados
A New Regulatory Cycle for the Insurance Market On 26 June 2025, the Colombian Financial Superin- tendency (SFC) launched one of the most significant regulatory milestones of the last decade: the reissu- ance of the Basic Legal Circular through External Cir- cular 006 of 2025. The CBJ synthesises more than 50 years of regulatory and supervisory experience and is the backbone of the conduct framework, corporate governance, and the operation of supervised entities, including insurers, reinsurers, and insurance and rein- surance intermediaries. The update is part of the strategic “Regulatory Optimi- sation” project, which seeks to make regulation more accessible to consumers and the non-specialist pub- lic, without compromising technical rigour. The SFC applied explicit criteria for regulatory streamlining: eliminating unnecessary burdens, removing duplica- tions with other regulations, withdrawing obsolete instructions, and rewriting unclear or ambiguous texts. A new display format also accompanies the CBJ on the SFC website, which facilitates navigation and tracking of the regulatory history of each instruction. This redesign is linked to a second regulatory initiative currently underway: the reorganisation of the Basic Accounting and Financial Circular (CBCF), which sets out prudential standards, the implementation of IFRS 17, and new solvency criteria. Together, the CBJ and CBCF form the “economic constitution” of the Colom- bian insurance sector for the coming years. Corporate governance, internal control, and technological transformation A first area of impact for the insurance sector is Title I of Part I, which relates to organisation, corporate governance, the equity regime, internal control, cloud computing, sandboxing, and open finance. Although these are general rules for all supervised entities, in practice, they redefine the governance architecture of insurance companies. The CBJ strengthens the responsibilities of boards of directors by expanding the documentation require- ments for the internal control system, mandating that internal manuals explicitly include SFC guidelines as part of document management, and integrating con- flict of interest management as a key element of inter-
nal control, which involves mandatory policies, whis- tle-blower protection, and secure, traceable channels. In terms of internal auditing, the annual plan must include a specific review of emerging risks, with an emphasis on cybersecurity and data protection, and requires the audit department to submit at least one annual report to the board on the effectiveness of the internal control system. The statutory auditor, for its part, is subject to rules on staff “rotation”, good hiring practices, and greater scrutiny of the quality of financial information. In this regard, the new Circular imposes obligations on all financial institutions that apply to securities issuers. Regarding technological governance, cloud comput- ing instructions require supervised entities to thor- oughly document their contracts, ensure providers’ operational resilience, avoid dependence on a single provider, and guarantee the SFC’s access to cloud- hosted information. This is especially relevant for insurers that migrate their policy and claims cores to cloud environments and run data-heavy models, such as mass insurance, embedded insurance, and parametric coverage. Finally, the chapter on controlled testing environments and open finance specifically broadens the scope to include emerging technologies (AI, blockchain, open finance), imposes due diligence obligations on pro- viders, enhances consumer protection during testing, and mandates immediate reporting to the SFC, with authority to adjust conditions or revoke access in real time if security incidents occur. Digital channels, cybersecurity, and cross-border provision Title II of Part I updates the rules for financial services and security channels in electronic media. The glos- sary now includes biometrics, multi-factor authenti- cation, and digital fraud. It adds technical standards like end-to-end encryption, regular penetration test- ing, and real-time incident monitoring. Organisations must have an incident response plan that is tested at least once annually and promptly report relevant incidents to the SFC.
126 CHAMBERS.COM
Powered by FlippingBook