Identity verification in Colombia
Colombia is a Tier-1 Latin American market of ~52 million people with one of the region's most mature identity infrastructures and, on the iGaming side, the single most advanced online gambling regime in LATAM. The stack that matters: the Cédula de Ciudadanía (physical and Cédula Digital), the Registraduría Nacional del Estado Civil and its ANI (Autenticación Nacional de Identidad) biometric servi
Documents supported
(Government IDs from 220+ countries)
Average verification time
Countries covered
(Government-issued IDs validated)
Market overview
Colombia is LATAM's fourth-largest economy and the region's third-largest fintech hub behind Brazil and Mexico. Population is ~52 million, formal banking inclusion sits above 90% of adults per Banca de las Oportunidades, and smartphone penetration is ~80%. Remittances (~USD $11 billion in 2024 per Banco de la República) and the arrival of more than 2.8 million Venezuelan migrants since 2015 have made identity orchestration a first-order operational problem. Finnovista counts ~400 active fintechs as of 2025, led by Nequi (Bancolombia, 20M+ users), Daviplata (Davivienda, ~18M users), Movii (the country's first SEDPE), Rappi / RappiPay, Nubank Colombia, Lulo Bank, Ualá Colombia, Bold and Sempli. Rappi, Bogotá-headquartered, is Colombia's only private tech unicorn.
Supported documents
Didit templates cover national IDs, passports, residence permits and regional documents — plus 14,000+ documents globally for cross-border flows.
Registraduría Nacional del Estado Civil (RNEC)
Yellow polycarbonate card ("amarilla con hologramas") plus the new Cédula Digital issued from Dec 2020: dual polycarbonate card with contactless chip + companion mobile app
The near-universal national ID. NUIP (Número Único de Identificación Personal) is the unique identifier. The Cédula Digital carries a cryptographic chip, a 2D-barcode, and is linked to RNEC's biomet
RNEC
Polycarbonate card
Required for minors opening youth accounts, gaming-age-gating and school identity flows.
Migración Colombia
Polycarbonate card
Primary foreign-resident ID; carries a NUIP-style identifier.
Migración Colombia
Paper/polycarbonate document
Legacy permit for Venezuelans; being replaced by PPT. Still accepted for certain flows.
Migración Colombia
Polycarbonate card
The primary ID for most of the ~2.8M Venezuelan population. Explicitly accepted by SFC guidance for financial onboarding.
Cancillería / *Oficina de Pasaportes
ICAO-9303 biometric booklet
Chip-read with BAC/PACE; primary fallback for citizens abroad.
Runt / Ministerio de Transporte
Polycarbonate card
Secondary ID; not a primary KYC document.
DIAN
Alphanumeric identifier on the RUT (Registro Único Tributario)
Backbone identifier for KYB and PJ (persona jurídica) onboarding, obtained through the DIAN RUT registration.
Regulators
Empresa Industrial y Comercial del Estado Administradora del Monopolio Rentístico de los Juegos de Suerte y Azar
RNEC (Registraduría Nacional del Estado Civil)
regulated
National citizen ID card. Verified through the RNEC (National Civil Registry). Primary identity document for Colombian nationals.
DIAN (Dirección de Impuestos y Aduanas Nacionales)
open
Unified tax registry. Publicly queryable via DIAN portal.
Confecámaras (Confederation of Chambers of Commerce)
open
Unified business and social registry. Publicly accessible for business verification.
Government & regulated databases
Compliance framework
AML framework
Supervised by Coljuegos
Primary AML laws. Colombia's AML architecture is built on three statutes: Ley 526 de 1999 (creating the UIAF as the country's financial intelligence unit under the Ministerio de Hacienda), Ley 1121 de 2006 (CFT obligations and terrorist-financing criminalisation) and Ley 1708 de 2014 (Código de Extinción de Dominio, asset forfeiture). The AML criminal type is Art. 323 del Código Penal (lavado de activos).
Data protection
Supervised by National DPA
Ley Estatutaria 1581 de 2012 and Decreto 1377 de 2013 govern personal-data processing, with biometric data classified as dato sensible. The regime allows international transfers only to (a) countries deemed to offer an adequate level of protection by the SIC (via declaración de conformidad), (b) whe
Penalties for non-compliance
- 2020-2023: The SFC levied repeated SARLAFT sanctions on mid-sized banks, cooperatives and broker-dealers for segmentation failures, PEP-screening gaps and weak ongoing monitoring (Relación de Sanciones, quarterly).
Use cases
Neobanks, EMIs, payment institutions, lenders, brokerages.
Canonical remote flow for an SFC-supervised entity under SARLAFT 4.0:
Exchanges, custodians, wallets, on/off-ramps.
Colombia has no dedicated VASP licence. Virtual-asset service providers operate under one of three structures:
Sports betting, online casinos, age-gated platforms.
Coljuegos runs the most mature online gambling regulator in Latin America. Under Acuerdo 04 de 2016 and successors, every operador de juegos de suerte y azar por internet must:
Gig platforms, delivery, creator economy, e-commerce.
Colombian marketplaces — Mercado Libre / Mercado Pago, Rappi, Linio, Falabella, Tpaga and gig/delivery platforms — fall under two regimes simultaneously. Mercado Pago and RappiPay (via their EMI/SEDPE structures or banking partnerships) are SFC-supervised and apply full SARLAFT. Non-financial market
Biometric liveness
Colombia treats biometric data as dato sensible under Ley 1581 Art. 5, requiring express, prior and informed consent and a strict necessity/proportionality test. Inside this constraint, biometric liveness is effectively mandatory for SFC-supervised remote onboarding: - Facial biometrics with passive liveness (ISO/IEC 30107-3 PAD) is the dominant modality, reflecting smartphone ubiquity and universal facial enrolment at RNEC. - Fingerprint remains common for in-branch, notarial and Coljuegos-adja
CERTIFICATIONS
Our platform meets the highest international standards for information security, data privacy, and biometric accuracy.
Full EU data protection compliance
Information security management
PAD (liveness + face match)
TRUSTED WORLDWIDE
Join thousands of companies that trust Didit for their verification needs
Didit’s NFC + active biometrics technology blocks the most advanced fraud scenarios, offering a level of security equivalent to or superior to in-person verification.
Spanish Financial Sandbox
CNMV, SEPBLAC & Spanish Treasury — Conclusions Report
Didit is an exceptionally valuable partner, delivering a stable and highly adaptable solution”.
Vuk Adžić
Head of the E-Business Department at Crnogorski Telekom
Didit offered us a robust technology with a simple implementation and adaptability to different markets”.
Fernando Pinto
CEO & CoFounder at TucanPay
Thanks to Didit we have been able to reduce manual processes and improve data extraction accuracy”.
Diana Garcia
Trust & Safety Executive at Shiply
Didit’s integration slashed verification times and costs, freeing resources for other projects”.
Guillem Medina
COO at GBTC Finance
Didit removed KYC costs, enabling faster scaling with high verification standards and less fraud.”
Paul Martin
VP Marketing & Growth at Bondex
Didit’s secure, user-friendly verification boosts customer trust and optimizes our process.”
Cristofer Montenegro
Executive assistant to the CEO at Adelantos
Didit ensures a precise, secure digital onboarding without slowing negotiations or client time.”
Ernesto Betancourth
Gerente de riesgos at CrediDemo
FAQ
Yes. Colombia permits remote KYC onboarding under its national AML framework, including document verification, biometric liveness and video identification where required by regulation.
Didit verifies all major national IDs, passports and residence permits issued in Colombia, plus 14,000+ document types globally for cross-border flows.
Didit charges $0.30 per verification with 500 free checks per month. No contracts, no minimums. Competitors typically charge $1.00–$2.50+ per verification.
Yes. Didit screens against 1,000+ global watchlists including PEP databases, sanctions lists (EU, UN, OFAC, OFSI), and adverse media — covering all AML obligations in Colombia.
Most regulated sectors in Colombia require or strongly recommend biometric liveness detection for remote onboarding. Didit provides ISO 30107-3 PAD Level 2 certified liveness.
Yes. Didit supports document verification, liveness, AML screening and ongoing monitoring aligned with Colombia’s crypto regulatory framework, including EU Travel Rule compliance where applicable.
Yes. Didit provides document-based age verification and identity confirmation suitable for Colombia’s iGaming regulatory requirements.
500 free verifications per month. No contracts, no minimums. $0.30 per verification after the free tier.
