Colombia made open finance mandatory. The interesting question is what happens to bank market power

On 7 April 2026 Colombia issued Decree 0368 of 2026, which establishes a mandatory open finance system for entities supervised by the Superintendencia Financiera. It replaces the voluntary scheme created by Decree 1297 of 2022, both of them compiled into Decree 2555 of 2010, and it builds on External Circular 004 of 2024, in which the supervisor had already defined the technological and security standards for exchanging information.

The mechanics are not complicated. The Superintendencia has six months to publish a standardization schedule. Supervised entities then have up to twelve months to enable access to data and services through the agreed interfaces, extendable once by a further six months. Participation is compulsory for supervised entities acting as data providers and as data recipients; unsupervised third parties can still join voluntarily.

Most of the commentary so far has been about compliance timelines. I think the more interesting question is a different one.

What actually changes

Under a voluntary regime, an incumbent bank decides whether to share the transaction history of its own customers. It will not, and it does not need a cartel to reach that outcome — the incentive is individual. That history is precisely the asset that lets the bank price a borrower's risk better than any competitor can. A rival lender looking at the same customer sees a thinner signal, prices more conservatively, and loses the good risks while keeping the bad ones. The incumbent's informational advantage is self-reinforcing.

A mandatory regime removes the decision. If the customer consents, the data moves. The asymmetry that sustained the incumbent's screening advantage stops being a property of the market structure and becomes, at least in principle, a policy variable.

Why that is a question and not a conclusion

There are at least three reasons to be careful before predicting more competition in credit.

The first is that access is not the same as capability. Reading a standardized transaction feed and turning it into a credit score are different problems, and the second one has fixed costs. If those costs are high relative to the size of the entrant, mandatory sharing could favour large well-capitalized entrants — including non-financial ones — rather than small lenders.

The second is adverse selection running the other way. If borrowers choose when to authorize sharing, the ones who volunteer their history are disproportionately the ones whose history helps them. A lender receiving a request without shared data learns something from the silence. Consent-based portability does not eliminate selection; it relocates it.

The third is that credit pricing in Colombia is bounded above by the tasa de usura. When a ceiling already prevents lenders from charging the rate that compensates a given borrower's risk, improving the precision of risk measurement does not necessarily expand credit — it may just sort borrowers more sharply into those who receive it and those who do not. Better information under a binding constraint is not obviously the same thing as better access.

What would settle it

None of this is resolvable from the text of the decree. It is an empirical question about how the pass-through from information to lending rates works when the informational structure of the market changes and the price ceiling does not.

The implementation schedule is staggered, which is the useful part: entities will enable access at different moments, and that variation is the closest thing to an identification strategy this reform is likely to offer. It is worth setting up the measurement now, before the schedule is published, rather than reconstructing it afterwards.

---

Sources: Unidad de Regulación Financiera · Superintendencia Financiera de Colombia. The views here are my own.