SFC Circular 007: Cybersecurity Requirements for Colombia's Financial Sector

No Colombian bank signs a contract with a technology vendor without first asking about Circular 007. In the day-to-day reality of the financial sector, it's the exam any vendor has to pass before getting near sensitive data. If your business is an entity supervised by the Superintendencia Financiera (SFC) — a bank, fintech, financial cooperative, investment fund, or insurer — this circular isn't a suggestion. It's a regulatory instruction with concrete technical requirements and real consequences for non-compliance.

Circular Externa 007 is part of the set of instructions the SFC issues to entities under its supervision regarding cybersecurity risk management. Unlike Law 1581, which applies broadly to any business handling personal data, Circular 007 is sector-specific and considerably more demanding in technical detail. Having a written policy isn't enough; you need to demonstrate the controls actually work.

The list includes banks, financing companies, financial cooperatives, pension and severance funds, trust companies, brokerage firms, insurers, and fintechs that fall under the SFC's supervisory perimeter. If your business provides technology or cybersecurity services to any of these entities, sooner or later you'll be asked to prove you can support their compliance — it's not negotiable in the sales process.

Beyond the regulatory text, here's what a supervised entity needs to have working:

Cyber risk governance at the board level, not just within the IT department — the circular doesn't accept cybersecurity as an IT-only concern.

A real inventory of information assets: what's handled, where it lives, how critical it is. Many entities underestimate this task until an auditor formally requests it and they discover nobody has the full map.

Verifiable technical controls: access management, encryption, network segmentation, continuous monitoring, real capability to detect an incident when it happens.

Tested continuity plans, not just documented ones — the entity must be able to show that, during an incident, it maintains or quickly restores critical operations.

Third-party management: if you outsource technology, the circular requires you to demand the same standards from your vendors. It's exactly why certifications get requested from the cybersecurity companies entities work with.

Reporting of significant incidents to the SFC within defined timeframes.

Periodic testing — vulnerability audits and pentesting — that validates controls actually work, not just look good on paper.

It's no accident this circular is so detailed. The sector absorbs a large share of the country's most sophisticated attacks: card fraud, social engineering aimed at employees with access to critical systems, phishing that impersonates banks to steal credentials. Colombia's Supreme Court has also ruled that financial entities carry strict liability for electronic fraud — they must compensate victims unless they can prove the user was solely at fault. With that legal exposure hanging over them, technically complying with Circular 007 stops being an image issue and becomes a matter of real financial exposure.

For a supervised entity, this is almost never a one-time project. It's a cycle: