Bitcoin & Cryptocurrency Regulation in Colombia

• Legal: Legal to use but not formally regulated, not legal tender
• Tax: Taxed as intangible asset; gains reported as income
• Buying: Via exchanges, P2P, fintech apps and ATMs with KYC

Colombia has one of the most active cryptocurrency communities in Latin America, with millions of users buying, holding, and sending digital assets. Yet as of 2026 the country still has no single, comprehensive crypto law. The approach is best summarized as legal to use but not formally regulated: owning and trading Bitcoin is permitted, crypto is not legal tender, and oversight is spread across several authorities applying existing financial, anti-money-laundering, and tax rules. Two developments define the current period: a Virtual Asset Service Provider (VASP) bill (Proyecto de Ley 510 de 2025) advancing through Congress, and DIAN Resolution 000240 of December 2025, which imposes new crypto tax-reporting duties on platforms beginning with the 2026 tax year. This guide explains what is legal today, who the regulators are, how crypto is taxed, and the practical rules around exchanges, AML/KYC, mining, and remittances. For background, see our overview of crypto regulation.

This article is general information as of 2026 and is not legal, tax, or financial advice. Crypto rules in Colombia are changing quickly; always confirm your situation with a qualified Colombian professional and verify against official sources such as the Superintendencia Financiera de Colombia (SFC), DIAN, the Unidad de Información y Análisis Financiero (UIAF), and Banco de la República.

Yes. Buying, holding, selling, and using cryptocurrencies such as Bitcoin is legal for individuals and businesses in Colombia. There is no law prohibiting ownership or peer-to-peer trading, and a large domestic market has developed around exchanges, stablecoins, and remittances.

What crypto is not, however, is official money. Banco de la República (the central bank) and the Superintendencia Financiera de Colombia (SFC) have repeatedly clarified that cryptocurrencies are not legal tender, are not the Colombian peso, and are not securities under Colombian law. The practical consequences:

• No merchant or person is obliged to accept crypto as payment.
• Crypto is generally treated as an intangible asset rather than as currency.
• Holders bear the full risk of price volatility, fraud, and platform failure, with limited consumer-protection recourse compared with regulated bank products.

You can legally use crypto, but you do so largely outside the protections that apply to traditional regulated financial services.

There is no single crypto regulator. Several authorities apply their existing mandates to digital assets:

• Superintendencia Financiera de Colombia (SFC): the financial regulator that supervises banks and securities markets. The SFC has publicly stated that it does not regulate, supervise, monitor, endorse, or authorize operations or business models based on so-called cryptocurrencies, and that crypto trading is not part of the financial system. It warns that any document claiming SFC authorization to trade crypto is fraudulent. Official site: superfinanciera.gov.co.
• Banco de la República (central bank): has stated that crypto is not legal tender and is not part of the national payment system. Official site: banrep.gov.co.
• DIAN (Dirección de Impuestos y Aduanas Nacionales): the national tax authority. It treats crypto as a taxable intangible asset and, through Resolution 000240 of 2025, has introduced platform reporting obligations. Official site: dian.gov.co.
• UIAF (Unidad de Información y Análisis Financiero): the financial intelligence unit, which oversees anti-money-laundering (AML) reporting for virtual asset service providers. Official site: uiaf.gov.co.
• Superintendencia de Sociedades: applies AML/CFT compliance duties (Chapter X of its Basic Legal Circular) to certain companies, including some operating with virtual assets.

Colombia does not yet have a comprehensive, crypto-specific statute. Instead, a patchwork of existing rules forms the de facto framework while dedicated legislation is debated:

• UIAF Resolution 314 of 2021: requires individuals and companies providing virtual asset services to report transactions to the UIAF, including suspicious-operation reports and threshold-based transaction reports, to combat money laundering and terrorist financing.
• Superintendencia de Sociedades, Chapter X of the Basic Legal Circular: sets self-control and AML/CFT risk-management duties for supervised companies.
• DIAN guidance: earlier DIAN concepts established that crypto is an intangible asset subject to income tax, later reinforced by Resolution 000240 of 2025 on platform reporting.

Because there is no single statute, you should treat any specific rule as something to verify against the issuing authority. The clear trend is toward formalizing the sector rather than banning it.

Lawmakers have tried for several years to pass dedicated crypto legislation; earlier attempts stalled. The most recent effort, Proyecto de Ley 510 de 2025 (also cited as PL 510C), was filed by Representative Julián López and Senator Gustavo Moreno and passed its first debate in the Chamber of Representatives on May 20, 2025. It aims to bring Colombia's crypto ecosystem out of its current grey area.

As reported, the proposal would establish a framework for Virtual Asset Service Providers (in Spanish, Proveedores de Servicios de Activos Virtuales, or PSAV) with a division of oversight: a mandatory public PSAV registry administered by the Superintendencia de Sociedades, which would supervise the providers; the Superintendencia Financiera de Colombia (SFC) supervising the activities and specialized entities; and Banco de la República keeping a role over stablecoins because of their impact on monetary policy. Domestic and foreign platforms serving Colombia would have to register, with a transition period reported at up to 12 months once the registry becomes operational. The bill draws on Financial Action Task Force (FATF) Recommendation 15 on virtual assets and would set consumer-protection, registration, and AML standards while leaving existing finance, data-protection, and competition rules in place. Stablecoins would be treated for tax purposes in the same way as the asset that backs them.

Important: as of this update the bill is proposed, not enacted. Its provisions, scope, and timing can change during congressional debate or fail to pass. Do not rely on its specifics until it is signed into law and published. Track its status through Congress and the named regulators.

Crypto is taxable in Colombia. DIAN regards digital assets as intangible property, which generally means:

• Income or profit on disposal: gains from selling or trading crypto are generally treated as taxable income and reported in your annual return.
• Asset declaration: holdings are generally declared at their value as assets (net worth) in the income-tax return where filing thresholds are met.
• Mining and crypto received as payment: typically treated as income at the time received.

Colombia uses progressive personal income-tax rates, and the exact rate, brackets, filing thresholds, and any deductions depend on your total income and circumstances and change with each tax reform. This guide deliberately does not quote a specific percentage or peso threshold; verify current numbers directly with DIAN or a Colombian tax adviser. For general context, see our explainer on crypto taxes.

None of the above is tax advice. Confirm filing obligations and rates with DIAN or a licensed accountant.

The most consequential recent change is DIAN Resolution 000240, signed on December 24, 2025. It aligns Colombia with the OECD's Crypto-Asset Reporting Framework (CARF) and shifts crypto reporting from voluntary self-disclosure toward automatic platform reporting.

Key points as reported:

• Who must report: Crypto-Asset Service Providers (PSCAs / VASPs) operating with Colombian users, including foreign platforms that serve Colombian taxpayers.
• What is reported: transactions exceeding USD 50,000, plus general user information such as tax residence and net crypto balances (which may be reported even below the threshold).
• Deadline: the first full annual reports covering 2026 activity are due by the last business day of May 2027.
• Penalties: fines reported at up to 1% of the value of unreported transactions for inaccurate or incomplete reporting.

The practical effect for users is that crypto activity is becoming far more visible to the tax authority. Keep your own records, including dates, amounts, counterparties, and peso values, for every transaction. Confirm thresholds and obligations on the DIAN website, since figures can be updated.

Two changes stand out in the current period:

• DIAN Resolution 000240 (December 24, 2025): Colombia adopted the OECD Crypto-Asset Reporting Framework (CARF) and moved from voluntary disclosure toward automatic platform reporting. Crypto-asset service providers serving Colombian users, including foreign platforms, must report reportable users and transfers above USD 50,000, with the first reports covering 2026 activity due by the last business day of May 2027. See the section above for detail.
• Bill 510 of 2025 (PL 510C): a dedicated VASP framework passed its first debate in the Chamber of Representatives on May 20, 2025. It would create a mandatory PSAV registry under the Superintendencia de Sociedades and align Colombia with FATF Recommendation 15. As of this update it is still moving through Congress and is not law.

The direction of travel is toward formalizing and reporting rather than banning. Both items above are drawn from Colombian tax, legal, and news sources; confirm current status directly with DIAN and Congress before relying on any specific figure or date.

There is currently no dedicated licensing regime that exchanges must hold to operate in Colombia. The SFC does not authorize or supervise crypto platforms, and there is no SFC license for crypto trading. However, providers are subject to existing obligations:

• AML reporting: under UIAF Resolution 314 of 2021, virtual asset service providers must register with and report to the UIAF.
• Tax reporting: under DIAN Resolution 000240 of 2025, platforms serving Colombian users face the new CARF-aligned reporting duties described above.
• Proposed registration: Bill 510 of 2025 would, if enacted, create a formal VASP registry and licensing-style framework, but this is not yet law.

Banking access can be uneven. Because the SFC keeps crypto outside the regulated perimeter, some banks have historically restricted or closed accounts linked to crypto activity, and users often rely on fintech rails for peso deposits and withdrawals. When choosing a platform, prioritize transparent fees, clear KYC, peso on and off ramps, a solid security track record, and compliance with UIAF and DIAN reporting.

Anti-money-laundering and counter-terrorist-financing rules are the most developed part of Colombia's crypto framework. The core obligations come from the UIAF:

• UIAF Resolution 314 of 2021 requires virtual asset service providers to file Suspicious Operation Reports (ROS) and threshold-based transaction reports through the UIAF's reporting system, so that authorities can detect possible money laundering or terrorist financing.
• Covered activities include exchange between crypto and fiat, exchange between different cryptoassets, custody or administration of virtual assets, and related financial services.
• The Superintendencia de Sociedades (Chapter X) imposes AML/CFT self-control duties on certain supervised companies.

For users, the practical result is identity verification (KYC). Reputable platforms will ask for your national ID (cédula) and may request proof of address, particularly for larger transactions. Be wary of any service that lets you transact significant sums with no verification at all.

Colombians can buy crypto through global and regional exchanges, peer-to-peer marketplaces, fintech apps, and Bitcoin ATMs. A typical, compliant path looks like this:

• 1. Choose a reputable platform that supports Colombian pesos, applies proper KYC, and reports to the UIAF and DIAN.
• 2. Verify your identity with your cédula and, where required, proof of address.
• 3. Fund your account via bank transfer or supported fintech rails. Be aware some banks restrict crypto-linked transfers.
• 4. Place your order and review the spread and fees before confirming.
• 5. Secure your holdings; for larger amounts consider a self-custody hardware wallet and safeguard your recovery phrase.
• 6. Keep records of every transaction for tax reporting.

Colombia has historically hosted one of the largest fleets of Bitcoin ATMs in Latin America, concentrated in Bogotá and Medellín. ATMs are convenient but typically charge fees well above online-exchange rates, and AML rules still apply. Dollar-pegged stablecoins are widely used for remittances and as a hedge, because they avoid Bitcoin's short-term volatility; recipients should remember that converting and holding crypto can carry tax-reporting implications.

Bitcoin mining is legal in Colombia, and there is no dedicated mining ban or special mining licence. Miners operate under the same general business, electricity, tax, and environmental rules that apply to any energy-intensive activity.

Key considerations:

• Electricity cost and supply: profitability depends heavily on power prices, which vary by region and tariff. Colombia has a substantial share of hydropower, which appeals to operators seeking lower-carbon energy, though hydrology and grid conditions affect availability and price.
• Tax treatment: mined coins are generally treated as income when received, and equipment and operations carry the usual business-tax obligations.
• Compliance: larger operations should consider corporate registration, environmental permitting where relevant, and AML obligations if they also exchange the proceeds.

Claims that Colombia offers special crypto-specific mining subsidies should be treated cautiously; there is no broad, crypto-specific mining incentive. Confirm any incentive with official energy and tax authorities before relying on it.

Because crypto sits outside the regulated financial perimeter, consumer protection is limited. The SFC explicitly does not supervise or guarantee crypto platforms, so deposit-insurance and the recourse mechanisms that apply to banks generally do not apply to crypto holdings.

Main risks to keep in mind:

• Fraud and fake authorizations: the SFC warns that documents claiming SFC permission to trade crypto are fraudulent, and that promises of high guaranteed returns are a classic scam pattern. Verify any entity against the SFC's official list of authorized firms before investing.
• Platform and custody risk: losses from hacks, insolvency, or fraud may have little recourse. Consider self-custody for significant sums.
• Volatility: crypto prices can swing sharply; never invest funds you cannot afford to lose.
• Regulatory and tax change: a VASP law could reshape which platforms operate, and the new DIAN reporting rules make under-reporting riskier.

If something looks too good to be true, check the regulator first. See also the broader regulation hub for other countries.

Crypto rules in Colombia are evolving, so always confirm current details with the responsible authority rather than relying on summaries. The primary official sources are:

• Superintendencia Financiera de Colombia (SFC): superfinanciera.gov.co for its public statements on crypto and its list of authorized entities. See its notice that it does not regulate or endorse crypto operations.
• DIAN (tax authority): dian.gov.co for income-tax rules and Resolution 000240 of 2025 on crypto-platform reporting.
• UIAF (financial intelligence unit): Resolution 314 of 2021 on virtual-asset reporting.
• Banco de la República (central bank): banrep.gov.co on legal-tender status.

Reminder: this page is general information as of 2026 and is not legal, tax, or financial advice. Verify your situation with the named official regulators (especially the SFC and DIAN) or a qualified Colombian professional before acting.

Yes. Owning, buying, selling, and trading crypto is legal for individuals and businesses. However, crypto is not legal tender and is not classed as currency or a security, so no one is obliged to accept it, and it sits largely outside regulated financial protections. The SFC has confirmed it does not regulate or endorse crypto operations.

There is no single regulator. The SFC supervises the financial system but states it does not regulate crypto; Banco de la República addresses legal-tender status; DIAN handles taxation and platform reporting (Resolution 000240 of 2025); and the UIAF oversees AML reporting (Resolution 314 of 2021). A dedicated VASP bill (Proyecto de Ley 510 de 2025) is advancing through Congress but is not yet enacted.

Generally yes. DIAN treats crypto as a taxable intangible asset, so profits are typically reported as income and holdings may need to be declared as assets. Rates and thresholds depend on your overall situation and change with tax reforms. From the 2026 tax year, DIAN Resolution 000240 also requires platforms to report user and transaction data. Confirm specifics with DIAN or a tax professional.

Signed in December 2025 and aligned with the OECD's Crypto-Asset Reporting Framework (CARF), it requires crypto platforms serving Colombian users (including foreign ones) to report transactions over USD 50,000 plus general user information such as tax residence and net balances. The first reports covering 2026 activity are due by the last business day of May 2027. In practice, your crypto activity is now far more visible to the tax authority, so keep accurate records.

Not currently. There is no SFC licence for crypto trading, and the SFC does not supervise exchanges. Providers must, however, register and report to the UIAF for AML purposes (Resolution 314 of 2021) and comply with DIAN reporting (Resolution 000240 of 2025). The proposed Bill 510 of 2025 would create a formal VASP registry if it becomes law.

Under the bill as reported, the mandatory registry for Virtual Asset Service Providers (PSAV) would be administered by the Superintendencia de Sociedades, which would supervise the providers, while the SFC would supervise activities and specialized entities and Banco de la República would keep a role over stablecoins. Domestic and foreign platforms serving Colombia would have to register, with a transition reported at up to 12 months once the registry is operational. This is a proposal that passed only its first debate on May 20, 2025, so the details can change and are not yet law.

Yes, if they serve Colombian users. DIAN Resolution 000240 of 2025 applies to crypto-asset service providers with Colombian users, including foreign platforms. They must report reportable users and transfers above USD 50,000, and general user data such as tax residence and net balances can be reported even below that threshold. The first reports cover 2026 activity and are due by the last business day of May 2027. Keep your own records regardless.

Crypto is legal but high-risk and largely outside regulated consumer protections. The SFC does not guarantee crypto platforms and warns that any document claiming SFC authorization to trade crypto is fraudulent. Before investing, verify entities against the SFC's official list, never trust promises of high guaranteed returns, consider self-custody for large sums, and only invest what you can afford to lose. This is not investment advice.

Last updated: 2026-06-30.

• Crypto regulation in Argentina
• Crypto regulation in Bolivia
• Crypto regulation in Brazil
• Crypto regulation in Chile
• Crypto regulation in Ecuador
• Crypto regulation in United States
• Crypto Taxes Explained
• How to Buy & Sell Crypto