Open Finance in Colombia: Understanding Decree 0368 and the New Rules

Although Colombia features a rapidly expanding Fintech ecosystem, where 96% of adults possess digital accounts, a significant segment of the population still depends on the informal market due to a lack of formal credit options.

In an effort to enhance competitiveness, financial inclusion, and innovation, the Colombian Government established a mandatory Open Finance framework by issuing Decree 0368 of 2026 on April 7, 2026, making Colombia the third country in the region to implement a compulsory model.

This regulatory framework offers advantages to financial institutions by delivering consumer data insights necessary for developing customer-centric business models. Concurrently, it provides consumers with a broader selection of customized, more affordable services while fostering financial inclusion by allowing institutions to review shared financial histories.

Objectives and core principles

Decree 0368 was born with clear targets to transform the country's financial health. Its central objectives include:

• Promoting the financial and credit inclusion of the population through facilitated access to new products.
• Stimulating competition and innovation within the financial ecosystem.
• Guaranteeing collective financial well-being and the secure interoperability of the system.
• Ensuring transparency, security, and user trust while fully respecting the rights of account holders.

To bring these objectives to life, the model is shielded by six fundamental pillars:

1. Access to Personal Data: The data holder retains the exclusive right to authorize (or deny) the processing of their information.
2. Transparency: The user must have access to clear information to identify who is participating in the flow, what data is shared, and its quality.
3. Security: Robust mechanisms that prevent any type of unauthorized access or use.
4. Information Quality: Formally circulating data must be precise, complete, updated, and pertinent to the defined goals.
5. Inclusion: Data provision and access must be carried out under equal conditions for all participants, fundamentally based on the client's prior, express, and informed consent.
6. Interoperability: Automatic exchange protocols that enable an efficient, secure, and invisible interaction for the user.

What does this regulation mean for financial institutions?

Decree 0368 transforms regulatory discussions into binding legal mandates, establishing concrete deadlines and enforcement measures for non-compliance. Under these new rules, financial institutions are obligated to:

• Expose customer financial data to authorized third parties via secure, standardized APIs.
• Implement a double-consent mechanism: customers must explicitly authorize data sharing, and the bank must confirm that authorization before any data moves.
• Share at least 12 months of transaction history when a customer requests portability.
• Meet strict technical and security standards: FAPI 2.0, OAuth 2.0, mTLS, ISO 20022, and maintain 5-year immutable audit logs.
• Operate Open Finance systems in a logically segregated network, encrypted at rest and in transit.

The regulation applies to a broad set of supervised entities:

• Banks and Credit Institutions: Commercial, state-owned, and special lenders.
• Payment Institutions and Digital Wallets (SEDPEs): Electronic deposits and payment processors.
• Pension Fund Administrators (AFPs): Mandatory pension, severance, and individual savings funds.
• Insurance Companies: Life, general, and reinsurance entities.
• Asset Managers and Fiduciary (Trust) Companies: Trust firms and investment managers.
• Broker-Dealers and Commodity Brokers: Stock exchange and commodity brokers.
• Crowdfunding Platforms: Authorized collaborative financing platforms.

What do financial institutions have to do to comply?

Compliance with Decree 0368 is a multi-layer technical and operational undertaking. Below are the steps Financial Institutions need to execute:

1. Assess your current architecture

Conduct a gap analysis against the mandatory technical requirements. Identify which systems hold regulated data (transactional, KYC, product characteristics), whether they can expose APIs, and what security controls are missing. Most entities will find significant gaps in legacy core banking systems that were never designed for external data sharing.

2. Build or adopt a compliant API layer

All data exchanges must use RESTful APIs in JSON format and these APIs must be published and exposed for data consumption from approved third-party providers (TTPs). The regulation divides the data transacted into three well-defined categories:

• Transactional and Product Data: Detailed information regarding financial products and services registered under the holder's name, which obligatorily includes a 12-month transaction history.
• KYC (Know Your Customer) Analysis Data: Verified registration details of the client and data collected during the account opening (onboarding) process, smoothing the portability of relationships between institutions.
• General Product Characteristics: Purely public data about rates, interest fees, and service packages offered by institutions, allowing the creation of automated market comparators.

3. Implement the double-consent mechanism:

The regulation textually dictates that the citizens are the absolute owners of their financial information, and before sending data with the requesting third-party the entity must have the explicit authorization of the owner. This means that, when a third party requests the data access, the financial institution must:

• Receive the access request from the third party.
• Contact the customer directly to confirm they authorized the access.
• Present clearly: the identity of the requesting party, the specific data being shared, the purpose, and the duration.
• Allow the customer to review, approve or deny.
• Even after the customer has given authorization to a third-party, the financial institution must contact the customer to confirm they truly authorized the access before.
• Customers can review, modify and revoke their authorization any time.
• Log the entire consent lifecycle, such as creation, validation, modification, and revocation and have it for 5 years.

4. Deploy financial-grade security

The regulation mandates a rigorous architecture and highest international security standards to maintain the ecosphere integrity:

• Strong Authentication and Advanced Security Protocols
• FAPI 2.0 Profile: Mandatory alignment with the Financial-grade API framework by the OpenID Foundation.
• OAuth 2.0 + JWT: Employed for authorizations via secure Access Tokens signed with PS256 algorithms or stronger, using private_key_jwt authentication.
• Mutual Authentication (mTLS): Reciprocal certificate-based authentication for all data exchanges.
• Network Segregation: Open Finance systems must operate within a logically separated internal network distinct from the institution's other networks.
• Encryption: Data encrypted at rest and in transit using at minimum AES or RSA-level standards.
• Availability: Systems must implement redundancy, fault tolerance, and load balancing mechanisms to guarantee continuous operations.

5. Register and verify third-party providers (TPPs)

Financial institutions must implement a Dynamic Client Registration (DCR) process to onboard, verify and manage third parties that will access their APIs. Only entities that meet the regulatory conditions, including data protection compliance, cybersecurity frameworks, and valid user authorization, may be granted access.

6. Build observability and audit infrastructure

Every API request must be logged with origin, timestamp, user, transacted data, and status. Logs must be retained for 5 years, with critical data encrypted or masked. The SFC will monitor compliance through quarterly indicators and the institutions must be able to produce evidence on demand.

7. Be prepared for the rollout

Financial data has evolved from an isolated asset into the core fuel of a collaborative ecosystem. The government laid down an official 24-month timeline for full transition:

What are the benefits to financial institutions?

Embracing Open Finance as a strategic platform, financial institutions will capture significant competitive advantages:

Revenue Generation

• Infrastructure Monetization and Cost Recovery: The Colombian model allows banks to charge fees based on the volume of API queries executed by third parties. Banks running efficient IT architectures can transform data into an entirely new technology revenue stream.

• Banking-as-a-Service (BaaS): Package core banking capabilities such as payments, accounts, credit, etc. as API products and offer them to fintechs, retailers, and non-financial companies, creating new B2B revenue streams without building new distribution channels.

• Embedded Finance: Extend financial services, such as credit, insurance, payments, etc., directly into third-party apps and platforms, reaching customers at the point of need rather than waiting for them to visit a bank channel.

• Corporate API Integrations: Offer corporate clients direct, secure API access to their financial data, automating treasury, reconciliation, and cash management which will help for deepening relationships and significantly increasing switching costs.

Better Risk and Credit Decisions

• Ultra-Precise Credit and Risk Models: By tapping into a 12-month transaction history of incoming clients from competitors, risk units can build vastly more assertive credit scoring models, lowering default rates and expanding the addressable credit market to previously unscored segments.

Increase Customer Loyalty

• Hyper-Personalization: Consolidated multi-financial profiles enable institutions to offer products that match each client's real financial behavior, not generic offers, but precisely timed, precisely sized propositions that increase conversion and retention.

• Smart Cross-Selling: Given the nation's broad scope spanning insurance and pensions, banks can cross-reference data to roll out highly attractive, customized products, delivering the right product, to the right client, at the right moment in their financial lifecycle.

• Reduced Churn: Institutions that use Open Finance to deliver superior personalized experiences will retain clients that would otherwise migrate to fintechs or challenger banks.

What challenges will financial institutions face?

Navigating the transition toward Open Finance compliance is technically demanding and operationally complex. For this reason, institutions should plan for the major challenges areas:

How WSO2 resolves these challenges

To assist Colombian financial institutions in effortlessly adopting Decree 0368 of 2026, WSO2 provides a comprehensive solution that mitigates technical complexity and significantly accelerates time to market. By delivering pre-built components designed for strict regulatory compliance, WSO2 enables banks to transform regulatory requirements into long-term strategic advantages.

Drawing on extensive global experience from successful open banking implementations across Europe, the Middle East, and Asia-Pacific, WSO2 delivers out-of-the-box infrastructure that addresses every layer of the Open Finance framework. Rather than assemble and integrate products from multiple vendors, WSO2 offers a single, unified platform that lowers deployment efforts and simplifies ongoing governance.

The platform streamlines consent management by supporting the entire lifecycle of creation, validation, authorization, administration, and real-time revocation of user authorizations. Built-in security features implement financial-grade controls out-of-the-box, enforcing strict protocols including FAPI 2.0, OAuth 2.0, JWT, and Mutual SSL with TLS 1.3 to secure every API endpoint without custom development.

To defend against cyber threats, WSO2 incorporates advanced API security measures such as granular authorization policies, incoming message validation, rate limiting, and throttling. These capabilities ensure that only accredited third parties consume financial data, shielding institutions from unauthorized access and denial-of-service attempts.

Seamless integration with legacy core banking systems is achieved through WSO2 Integrator, which utilizes pre-packaged connectors and AI-assisted tooling to automatically map proprietary data formats to standard ISO 20022 and JSON formats. This approach reduces core system integration effort by 40 to 60 percent, allowing banks to modernize data flows without rewriting legacy infrastructure.

Additionally, WSO2 supplies full end-to-end observability and five-year immutable audit logging to meet the regulatory monitoring standards set by the Superfinanciera (SFC).

In summary, WSO2 provides the technology, the accelerators, and the global expertise to help Colombian financial institutions move from compliance to leadership faster, more securely, and with less risk.