What laws must you follow when collecting debts in Colombia in 2026?

Summary

Collecting a debt in Colombia in 2026 involves more than sending payment reminders. You need to identify whether the debtor is a consumer, whether you process personal data, whether you report to a credit bureau, whether your company is supervised by the Financial Superintendency, and whether the matter may become a judicial claim. Each scenario creates different obligations.

For many consumer debt-collection activities, the central rule is Law 2300 of 2023. For personal data and credit reporting, the main framework is Law 1266 of 2008, as amended by Law 2157 of 2021, together with Law 1581 of 2012. If the matter requires judicial recovery, the General Code of Procedure defines which documents can support an executive action.

Legal notice: This article is for informational purposes only and is not legal advice. The application of Colombian law depends on the facts, the type of obligation, and the sector involved. Consult a qualified lawyer in Colombia before designing or carrying out a debt-collection strategy.

1. Start by defining the type of collection

There is no single set of rules for every receivable. Before contacting a debtor, classify the case:

• Consumer collection: Does Law 2300 apply, and are authorized contact channels recorded?
• B2B receivable: Are you contacting a natural person whose personal data you process? What does the contract provide?
• Credit-bureau reporting: Are the debt, amount, due date, and prior notice fully supported?
• Financial Superintendency-supervised entity: Do you also comply with financial-consumer protection and SAC requirements?
• Judicial recovery: Do you have an enforceable executive title for an express, clear, due obligation?

Law 2300 protects consumers. The Financial Superintendency has explained that someone who does not fall within the applicable consumer definition is not a consumer for that law. That does not make B2B collection rule-free: contracts, data protection, information quality, and the applicable judicial route still matter. Review the SFC concept before applying consumer rules to a business case.

2. Law 2300: contact channels, frequency, and hours

Law 2300 applies to entities supervised by the Financial Superintendency and to natural or legal persons carrying out direct, outsourced, or assigned-debt collection. For consumers, it requires the collector to disclose its contact channels in advance and let the consumer choose which channels to authorize.

After direct contact has been established, the consumer may not be contacted through multiple channels in the same week or more than once on the same day. Collection activity must be respectful and must not interfere with personal or family privacy.

The statutory contact hours are:

• Monday to Friday: 7:00 a.m. to 7:00 p.m.
• Saturday: 8:00 a.m. to 3:00 p.m.
• Sundays and public holidays: no debt-collection contact.

Contact outside those hours requires the consumer's express request, made after the contract or legal act that created the relationship and in a separate instrument. Do not assume a general contract clause is enough.

3. Practical limits: references, visits, and conversations

Law 2300 prohibits collectors from contacting personal or other references to collect a debt. A guarantor, co-debtor, or jointly liable debtor is not a reference and may be contacted, but under the same channel, frequency, and schedule limits.

As a rule, do not carry out collection visits at a financial or services consumer's home or workplace. The law includes narrow exceptions, including certain microcredit situations with express authorization, or circumstances where no current authorized channels are available and delivery or contact has been demonstrably impossible. Review and document any exception before relying on it.

Collectors must also refrain from asking a financial consumer why the obligation was not paid. You may discuss payment alternatives appropriate to the person's financial situation. In practice, scripts should move from “why did you fail to pay?” to “which payment alternative is workable for you?”.

4. Personal data and collection vendors: Law 1581

A collection platform, agency, or internal team commonly uses phone numbers, email addresses, identity data, balances, payment promises, and interaction records. That is personal-data processing when it identifies or can identify a natural person.

Law 1581 requires, among other measures, a lawful and disclosed purpose, data minimization, security, data-subject request handling, and evidence of authorization where authorization is required. It also requires a clear distinction between the party deciding how data is used and a provider processing it on that party's instructions.

When you outsource collection or use collection software, document:

1. The data the provider receives and the permitted purpose.
2. Required instructions and security measures.
3. How it will handle requests to update, correct, erase, or challenge data.
4. When it must return or delete data.
5. How it will notify you of security incidents.

5. Reporting a default is different from collecting it

If you plan to report negative information to a financial, credit, commercial, or services data operator, Law 1266 creates additional controls. The source must verify data quality and communicate with the holder in advance so they can pay or challenge the amount and due date. The law provides 20 calendar days from sending that communication before the report.

Keep evidence of the obligation, default date, balance calculation, prior notice, and delivery. Negative information must be accurate, current, and handled under the applicable retention and updating rules. Do not use reporting as a threat if your team cannot prove these steps.

Law 2157 also requires negative information to be reported no later than 18 months after default. Low-value obligations and retention rules include further conditions; have counsel assess the specific file before reporting.

6. Additional rules for Financial Superintendency-supervised entities

Entities supervised by Colombia's Financial Superintendency have additional duties toward financial consumers, including their Financial Consumer Attention System and fair-treatment and information principles. The SFC has treated automatic collection charges without real, verifiable collection activity as abusive. See its collection-expense criterion.

Your system should therefore separate principal, agreed and permitted interest, and any collection expense. Each amount should be traceable, contractually or legally supportable, and explainable to the debtor.

7. If the matter moves to court, prepare the right evidence

Out-of-court collection does not authorize attachment of assets and does not replace a judicial proceeding. To bring an executive action, Article 422 of the General Code of Procedure requires an express, clear, and due obligation in a document that qualifies as an executive title.

Before escalating, have Colombian counsel review the invoice, promissory note, contract, acceptance, guarantees, notices, payments, interest, and limitation issues. A well-organized file from the amicable stage reduces disputes over the balance and speeds up legal assessment.

8. 2026 update: identity theft

Law 2573 of 2026 creates protections for people alleging identity theft in relation to collection and negative reporting in covered sectors, including telecommunications, financial or credit entities, and covered commercial establishments. According to the official record, its general effective date is November 20, 2026.

As of July 15, 2026, it is not yet the general operative rule. Nevertheless, prepare a workflow to receive, verify, escalate, and record identity-theft claims. When the law takes effect, covered cases will require immediate suspension of collection, including interest and collection charges, while the claim is resolved.

Checklist before starting a collection activity

• I confirmed the identity, balance, due date, and supporting evidence for the obligation.
• I classified the matter as consumer, B2B, financial, telecommunications, or residential-community collection.
• I recorded authorized channels and contact preferences where Law 2300 applies.
• My strategy respects frequency, schedule, privacy, and the ban on contacting references.
• Collection providers have documented data-protection instructions and obligations.
• If reporting is planned, I retain prior-notice and delivery evidence.
• If judicial recovery is planned, counsel reviewed enforceability and the executive title.

How Certeza can support a more controlled collection operation

Certeza can help turn the policies set by your organization into operational controls: centralizing receivables data, documenting approved contact channels and rules, coordinating follow-up sequences, and retaining traceability for each interaction, payment promise, and payment.

It also helps improve operational execution and apply the compliance controls defined by your organization consistently by automating routine collection activity and escalating only the particular cases that require review or intervention to the responsible team.

Frequently asked questions

Does Law 2300 apply to every business debt?

Not automatically. The law protects consumers and its application depends on the specific relationship. In a B2B receivable, do not assume the law is irrelevant: identify whether you contact a natural person, process personal data, and have contractual or sector-specific duties.

Can I send WhatsApp, email, and call on the same day?

For a consumer covered by Law 2300 after direct contact has been established, no. The rule is no more than one contact per day and no multiple channels in the same week, subject to legal exceptions such as sending information requested by the consumer through a previously authorized channel.

Can I call a family member or reference to locate a debtor?

Not as a collection strategy for consumers covered by Law 2300. The exception is not for references: guarantors, co-debtors, and jointly liable debtors have a different legal status and must be contacted under the same protective rules.

Can I report a debt without prior notice?

No. Before a negative report, Law 1266 requires prior communication to the holder and provides a waiting period. Verify the contact method, evidence, and case data with legal counsel.