AMLR Solutions 
AMLR Consultation
EUDI Wallet
Onboarding
Ongoing Monitoring
FRAML
KYC
KYB
KYI
Age Assurance
Workforce IAM
Candidate Verification
Account Takeover
Bonus/ Promotion Abuse
Chargeback Fraud
Deepfake
Document Fraud
Fraud Networks
Impersonation Fraud
Money Mule Activity
Multi-Accounting
Party Fraud
Regulatory & Compliance Risks
Synthetic Identity Fraud
Adult Content
Banking
Crypto
Fintech
Forex
Compliance
Fraud prevention
Trust & safety
Global expansion
Compliance Officers
Developers
Fraud Analysts
Product Managers
Journey Builder 
Global Trust Platform
Customer Profiles
Vendor Comparison
IDV Case Management
AML Case Management
Regulatory Reporting
Agentic Rule Builder 
AI Compliance Co-Pilot 
Fraud Analytics
Fraud Hub 
OCR
Shufti AI
Bank Account Verification 
Biometric Duplication
Database Checks
Document Intelligence
Government ID
Mobile Driver's License
NFC
Selfie Liveness
Brand Personalisation
Deployment Options
Identity Methods
IDV Modes
Multi-tenancy
On-Premise IDV
Secure Capture
Shufti MCP
- Australia
- Austria
- Bangladesh
- Belgium
- Brazil
- Bulgaria
- Cambodia
- Canada
- Chile
- China
- Colombia
- Croatia
- Cyprus
- Czech Republic
- Denmark
- Egypt
- Estonia
- Eswatini
- Ethiopia
- Finland
- France
- Germany
- Greece
- Haiti
- Hong Kong
- Hungary
- India
- Iraq
- Ireland
- Indonesia
- Italy
- Japan
- Jordan
- Kazakhstan
- Kenya
- Kosovo
- Kuwait
- Latvia
- Lithuania
- Luxembourg
- Malaysia
- Malta
- Mauritius
- Mexico
- Micronesia
- Moldova
- Mongolia
- Montenegro
- Morocco
- Mozambique
- Myanmar
- Namibia
- Nauru
- Nepal
- Nigeria
- Nicaragua
- Niue
- Norway
- Netherlands
- New Zealand
- Oman
- Pakistan
- Palau
- Palestine
- Panama
- Papua New Guinea
- Paraguay
- Peru
- Puerto Rico
- Philippines
- Portugal
- Poland
- Qatar
- Republic of Congo
- Romania
- Russia
- Rwanda
- Samoa
- San Marino
- Senegal
- Serbia
- Seychelles
- Sierra Leone
- Singapore
- Slovakia
- Slovenia
- Somalia
- South Africa
- South Korea
- South Sudan
- Spain
- Sri Lanka
- St Kitts and Nevis
- St Maarten
- St Lucia
- Sweden
- Switzerland `
- Syria
- Taiwan
- Tajikistan
- Tanzania
- Thailand
- Timor Leste
- Togo
- Tonga
- Trinidad and Tobago
- Turkey
- Turks and Caicos
- Turkmenistan
- Tunisia
- Tuvalu
- UAE
- Uganda
- Ukraine
- UK
- USA
- Vietnam
Scale Identity Verification and KYC Operations in Colombia
Verify citizens through Registraduría biometric validation, onboard Venezuelan migrants with the PPT and 10,000+ foreign ID document types, run KYB on companies and beneficial owners, and monitor transactions and sanctions lists. One platform runs compliance and fraud prevention across the full customer lifecycle for SFC-, Supersociedades- and Coljuegos-supervised firms.
Operational Performance for Colombia KYC
Our Numbers Speak Volumes
98.63%
Pass
Rates
Under 5 secs
IDV
Verification
80%
eIDV
Coverage
Colombia IDV/KYC Challenges
Two Cédula Formats and the PPT Widen the Document Mix
Colombian adults carry either the yellow hologram cédula or the newer cédula digital, and 2.8 million Venezuelan nationals live in Colombia, most of them identified by the PPT. Shufti verifies both cédula formats and the PPT in one onboarding flow.
Customer Data Updates Run on a Fixed Clock
SARLAFT requires yearly updates for high-risk customers and a fresh update within one month of a trigger event, such as a new beneficial owner. Shufti's perpetual KYC rescreens customers continuously and flags registry and ownership changes as they happen.
Each Supervisor Runs Its Own Risk System
Banks follow the SFC's SARLAFT, cooperatives follow Supersolidaria, gaming operators follow Coljuegos, and Supersociedades rewrote its risk chapter in July 2026. Shufti's AI Journey Builder configures checks by supervisor, product and risk tier for each license.
Thin Case Files Slow UIAF Reports
UIAF expects suspicious operations, including attempted ones, to arrive immediately through SIREL, and evidence scattered across systems slows that filing. Shufti's case management gathers identity, screening and transaction evidence in one file ready for submission.
Documents and Languages
Individual Documents Shufti Verifies in Colombia
Shufti verifies 16 Colombian identity documents plus passports and ID cards from other countries. The cards below cover the core documents Colombian onboarding relies on, with the full list on the supported documents page.
View All Supported DocumentsCédula de Ciudadanía Digital
The Registraduría has issued the polycarbonate cédula digital since December 2020, with an encrypted QR code holding the holder's biometric and security data. Shufti decodes that QR code, checks it against the printed card and supports the mobile cédula citizens activate in the Registraduría app.
Cédula de Ciudadanía (Yellow Hologram Format)
Issued since 2000 and still valid, the yellow cédula remains the card many adults carry. Shufti checks its hologram, layout and barcode, matches the photo to a live selfie and validates the holder against Registraduría records before onboarding.
Colombian Passport
The Cancillería issues the Colombian passport as a chip-based ePassport holding the holder's photo and fingerprints. Shufti reads the NFC chip and validates the MRZ checksum against the printed data page, so a cloned or altered passport fails before onboarding.
Permiso por Protección Temporal (PPT)
The PPT identifies Venezuelan migrants under Decreto 216 de 2021, and Resolución 971 de 2021 makes it valid for contracting financial products. Shufti verifies the permit, extracts its data and matches the holder's face, so PPT holders onboard in the same flow as citizens.
Cédula de Extranjería
Migración Colombia issues the Cédula de Extranjería to foreign visa holders aged 7 and over whose visa runs longer than three months. Shufti verifies the card, extracts its data and matches the holder's face, so long-stay residents can open accounts remotely without a branch visit.
Foreign Passports and National ID Cards
Shufti actively processes 10,000+ ID document types from 240+ countries and territories, and its zero-shot AI learns new document formats in minutes. Investors, cross-border workers, students and non-resident account holders onboard with the documents they already carry.
Colombian Driving License
Transit authorities issue the Licencia de Conducción and record it in the RUNT. Shufti checks its authenticity, expiry and facial match and confirms licence status against RUNT data, which helps ride-hailing, delivery and car-rental platforms vet drivers.
Tarjeta de Identidad
The Registraduría issues the Tarjeta de Identidad to minors from age 7 until they turn 18. Shufti verifies it for age-gated services, education platforms and accounts a parent or guardian opens on a minor's behalf.
Proof of Address
Water, power and gas bills, bank statements and municipal residence certificates prove where Colombian customers live. Shufti extracts the address from each document and verifies it in the same step as the identity document.
Entity Identity
Certificado de Existencia y Representación Legal
Issued by the Cámaras de Comercio and recorded in the RUES, the certificate names the company, its legal representative and its status. Shufti makes a live registry call at every check, so a dissolved company or replaced representative is caught before onboarding.
Certificado de Matrícula Mercantil
Natural-person merchants and establishments register with their Cámara de Comercio through a matrícula mercantil. Shufti checks the registration number, status and latest renewal against RUES data and links the merchant to their verified cédula.
Estatutos Sociales
The estatutos sociales set out the company's capital, ownership structure and who can sign on its behalf. Shufti's AI-OCR reads those clauses, compares them with the chamber certificate and flags GAN-generated or edited pages before they reach the case file.
Business Address Proof
Utility bills and lease contracts in the company's name prove where it actually operates. Shufti cross-checks them against the address on the chamber certificate and the RUT, so a virtual office or mismatched address is flagged for review.
Tax Identity
RUT and NIT
DIAN's Registro Único Tributario assigns every taxpayer its NIT. Shufti extracts the NIT, economic activity code and registered address from the RUT and cross-checks them against chamber records, plus foreign tax registrations and FATCA/CRS self-certification for non-resident entities.
Ownership and Control
Registro Único de Beneficiarios Finales (RUB)
Under Ley 2155 de 2021, companies declare in DIAN's RUB everyone who holds 5% or more or exercises control, and report changes within a month of each quarterly review. Shufti extracts each beneficial owner from the RUB report and verifies and screens them.
Shareholder Register and Ownership Chart
The libro de registro de accionistas and group charts show who sits behind each layer. Shufti maps ownership through intermediate companies and screens every owner against UN sanctions, PEP and adverse media data.
Legal Representatives, Board Members and Authorised Signatories
Shufti verifies the identity of each legal representative, junta directiva member and authorised signatory, screens them against sanctions and PEP data and alerts your team when the chamber certificate shows a change in representation.
Languages We Cover
Spanish, English and Expat Document Parsing
Colombian documents carry accented Spanish and the ñ, and expatriate customers bring documents in many other scripts. Shufti's OCR reads 150+ languages and scripts at 99.7% accuracy, keeping every accent exactly as printed. It averages 93% accuracy against Google Vision's 78.4% in its published benchmark, and its zero-shot document intelligence reads a cédula layout it has never seen on first sight.
Spanish Name Matching
Colombians carry two surnames, often with particles such as de, del or de la, and accents drop out between systems. Shufti's phonetic models match both surnames in either order, with or without accents, during sanctions and PEP screening.
Cross-Document Consistency Checks
Names, cédula numbers and NITs are reconciled across the cédula, passport, RUT, chamber certificate and RUB report, so a mismatched name or number surfaces before approval instead of during an SFC inspection.
Independent Validation
Shufti's Recognition Across Independent Evaluations
Ranked Exceptional in the Liminal Index 2026 for age estimation
View Report
Differentiated by Gartner on document diversity and country coverage
Read more
Certified at iBeta Level 3 PAD with 0% APCER
Read Blog
Broadest global reach in the 2025 KuppingerCole Extended IDV report
Download Report
Ranked Top 5 in the DHS RIVR 2025 for identity validation
Read Blog
Top Vendor for Product Execution in the Liminal Index for KYC 2026
View Report
Ranked Exceptional for age verification by Liminal Index 2026
View Report
Recognised as a Leader in G2 Fall 2026 reports
Read More
Regulatory Update
Every Verification Route Colombia's Regulators Recognize, in One Platform
SFC rules let KYC run in person or through digital channels and name biometrics validated against Registraduría databases as an identification route. Shufti supports that route, plus chip, database, document and video routes for non-residents and customers without a cédula.
Registraduría Biometric Validation
LiveShufti validates the cédula number and the customer's face against Registraduría records, the check SFC rules point to for biometric identification. Every result is stored with its timestamp in the case file.
Docless Database (eIDV)
LiveCustomers enter their cédula number and Shufti confirms the record against government and permitted commercial data sources, returning a decision in seconds without a document image or selfie upload.
NFC Chip Verification
LiveShufti reads the chip in Colombian ePassports and most foreign biometric passports and compares it with the printed page. It is the high-assurance route for non-residents and for citizens who prefer their passport.
Document and Face Biometric
LiveA document check paired with a certified liveness selfie and face match. It is the route most PPT holders, Cédula de Extranjería holders and non-residents take, and it completes in one mobile session.
Fraud Prevention Across the Colombian Customer Journey
Reduce fraud losses and protect customer trust across onboarding, account access, and payments. Shufti connects identity, behavioral, device, network, and transaction intelligence to help Colombian businesses act on risk while keeping legitimate customers moving.
Governance & Controls
Audit-Ready Decisions, Lower Operational Drag
Fewer Avoidable Re-submissions
Capture guidance for both cédula formats, the PPT and Spanish-language documents cuts glare, cropping and blur rejections before customers submit.
Cleaner Audit Trails
Shufti's case management records sources, results, timestamps, evidence, analyst notes and decision history, packaged as report-ready bundles for ROS filing through SIREL.
One Workflow, One Back Office
Unify KYC, KYB, AML screening and transaction monitoring in one case file. Perpetual KYC/KYB tracks ownership, director and transaction changes across the full compliance lifecycle.
Registraduría and Cédula-First Flow Design
Citizens verify through the cédula and Registraduría biometric validation first. PPT holders and non-residents move to permit or passport verification in the same flow.
Shufti's IDV/KYC Solutions for Colombia
KYC Solutions
Colombian onboarding mixes citizens with two cédula formats, Venezuelan PPT holders, foreign residents and non-residents. One Shufti flow routes each by risk, so nobody faces checks they don't need.
Explore More
Face Verification
A stolen cédula is useless without the face that matches it. Shufti compares a live selfie with the document photo, backed by iBeta Level 3 liveness and a 99.5% first-try pass rate, so genuine customers pass quickly and impostors do not.
.
Age Verification
Online gaming, alcohol delivery and age-restricted content need proof a customer is 18 or older. Shufti estimates age from a selfie in under five seconds and falls back to the cédula or Tarjeta de Identidad when a result sits near the threshold.
.
Bank Account Verification
Payouts sent to an account in someone else's name are a common fraud exit. Shufti confirms the Colombian bank account exists and matches the holder's name to the verified identity in real time, before the first disbursement or withdrawal.
.
Address Verification
Colombian addresses follow the calle and carrera grid with many spelling variations. Shufti's layout-aware extraction reads bills and statements, fuzzy-matches the address to the application and returns docless results in under three seconds.
.
Document Verification
Forged and edited cédulas are a common way into account fraud. Shufti verifies each document within seconds across nine forensic layers, from screenshot and replay detection to GenAI document checks, so a manipulated card never reaches approval.
.
Identity Verification
Shufti runs document, biometric, NFC, address and database checks in one API session, so each Colombian customer completes every step their risk tier requires without being sent to separate tools.
.KYB Solutions
Colombian companies register with a Cámara de Comercio through RUES, file tax details in the RUT and declare beneficial owners in DIAN's RUB. Shufti checks RUES live and brings the RUT and the company's RUB report into the same review.
Explore More
Business Verification
Onboarding a Colombian company means confirming its chamber certificate, NIT, legal representative and everyone who owns or controls 5% or more. Shufti's live registry call confirms the RUES record, and owners are checked against the RUB report and shareholder register the company provides.
.
Enhanced Due Diligence
Real estate, precious metals and virtual asset businesses face stricter Supersociedades rules. Shufti's due diligence forms branch by risk, collect source-of-funds evidence, send UBO verification links to each owner and score the result for the compliance officer.
.AML Screening
A customer who is clean at onboarding can land on a list next week. Shufti's perpetual KYC screens customers against 4,000+ watchlists, including the UN Security Council lists binding in Colombia, refreshes data every 15 minutes and keeps every alert in one case file.
Explore More
Business AML Screening
Sanctions exposure often sits with a shareholder or legal representative, not the company itself. Shufti screens every owner, director and representative against 215+ sanction regimes, PEP data and 50,000+ adverse media sources, and rescreens the portfolio whenever ownership changes.
.
Transaction Monitoring
Colombian firms must spot unusual operations and report them to UIAF alongside cash transaction reports. Shufti's library of 500+ pre-built rules covers structuring, smurfing and mule activity, cuts false positives by 60% and packages each alert as a report-ready case.
.
AI Compliance Co-Pilot
One common name can return 140+ screening hits, and frequent surnames such as Rodríguez or Gómez make that worse. Shufti's AI Compliance Co-Pilot reviews every hit with a confidence score and written reason, while the compliance officer keeps the final call.
.Built To Fit Colombia's Compliance Landscape
Colombia's AML statutes and the UIAF apply to every obligated entity, and each supervisor adds its own risk management system on top. Shufti maps its KYC, KYB, AML screening and transaction monitoring controls to every regime below, so one platform covers each license your group holds.
Estatuto Orgánico del Sistema Financiero (Decreto 663 de 1993)
Articles 102 to 107 require supervised financial institutions to adopt controls against money laundering and terrorist financing, know their customers and report suspicious operations. Article 96 requires records to be kept for at least five years, and Ley 526 de 1999 updated the reporting duty.
Superintendencia Financiera de Colombia (SFC)
SARLAFT, in Parte I, Título IV, Capítulo IV of the Circular Básica Jurídica, governs banks, insurers, pension funds, SEDPEs and securities intermediaries. It treats anyone holding more than 5% as a beneficial owner and caps customer data updates at three years, or one year for high-risk customers.
Unidad de Información y Análisis Financiero (UIAF)
Created by Ley 526 de 1999, the UIAF receives suspicious operation reports, which must be filed immediately through its SIREL system, along with cash transaction reports. Under Resolución 314 de 2021, virtual asset service providers also report through SIREL, including monthly reports on transactions of USD 150 or more.
Superintendencia de Sociedades (Supersociedades)
Circular Externa 100-000020 of July 2026 replaced SAGRILAFT and the PTEE with Capítulo IX, a single self-control and risk management system. It covers companies above income or asset thresholds and sectors such as real estate, precious metals, construction and virtual assets, with existing companies adjusting by 31 May 2027.
Dirección de Impuestos y Aduanas Nacionales (DIAN)
DIAN runs the Registro Único de Beneficiarios Finales under Ley 2155 de 2021 and Resolución 164 de 2021, now compiled in Resolución 227 de 2025. Entities declare everyone holding 5% or more or exercising control, review the register each quarter and report changes within the following month.
Superintendencia de la Economía Solidaria (Supersolidaria)
Savings and credit cooperatives and other solidarity-economy entities follow their own SARLAFT under Título V of the Supersolidaria Circular Básica Jurídica, introduced by Circular Externa 20 de 2020. It requires customer due diligence, risk segmentation and reporting to UIAF, with records kept for at least five years.
Coljuegos
Coljuegos licenses national games of chance, including online gaming, and sets their SIPLAFT under Resolución 20195100044514 of 2019, amended in 2021. Operators must apply customer due diligence, monitor transactions for unusual activity, report suspicious operations to UIAF and keep the supporting records for at least five years.
Registraduría Nacional del Estado Civil
The Registraduría issues the cédula de ciudadanía, including the polycarbonate cédula digital introduced in December 2020, and the Tarjeta de Identidad. Resolución 27145 de 2023 sets how authorised private entities access its biometric database, including ISO 27001 security documentation and a risk analysis before access is granted.
Migración Colombia
Migración Colombia issues the Cédula de Extranjería to visa holders staying longer than three months and the Permiso por Protección Temporal created by Decreto 216 de 2021. Article 14 of Resolución 971 de 2021 confirms the PPT as a valid identity document for contracting financial products.
Ley 1121 de 2006 (UN Sanctions Lists)
Article 20 makes UN Security Council sanctions lists binding in Colombia, with the Cancillería transmitting them to the authorities. Any match must be reported to the UIAF, and SFC rules require screening against these binding lists before onboarding and throughout the customer relationship, including after each list update.
Código Penal, Artículo 323 (Ley 599 de 2000)
Article 323 defines money laundering, with prison terms of 10 to 30 years and fines of up to 50,000 monthly minimum wages. It applies even when the predicate offence took place abroad, and the Fiscalía General de la Nación investigates and prosecutes these cases before the criminal courts.
Colombia Data Residency and Deployment
Shufti can host Colombian customer data in Oracle Cloud's Bogotá region (sa-bogota-1) or deploy on-premises, including air-gapped installations. Hosting locations, sub-processors and any transfer arrangements are fixed in the service agreement, so your data map matches what your board approves.
Ley 1581 de 2012 (Habeas Data)
Ley 1581, upheld by the Constitutional Court in C-748 de 2011 and enforced by the SIC, treats biometric data as sensitive and requires explicit authorisation. Shufti captures consent in the flow and protects identity and biometric data with encryption, role-based access and configurable retention.
International Transfers and SFC Cloud Rules
Article 26 of Ley 1581 limits transfers to countries with adequate protection, and SFC cloud computing rules expect ISO 27001-certified providers and advance notice to the SFC. In-country hosting keeps data in Colombia, and Shufti's certified controls support your cloud filing.
Retention Controls
SARLAFT records must be kept for at least five years, or ten under Ley 962 de 2005 for entities outside the financial statute. Shufti sets retention by client and license. Statutory minimums are not automatic deletion dates, and legal holds pause deletion for open cases.
Encryption and Security
Shufti encrypts data in transit with TLS 1.2+ and at rest with AES-256, limits access by role and logs every action. ISO 27001:2022 certification and SOC 2 Type 2 reports are available for your vendor risk assessment and outsourcing review.
Automated Decisions and Biometric Data
The SIC's Circular Externa 002 de 2024 asks for proportionality and impact studies when AI processes personal data. Shufti returns verification results and supporting details through the API and back office, so support teams can explain outcomes and escalate disputed results.
Scope of Our Role
Shufti processes personal data as an Encargado on your instructions, while your firm remains the Responsable under Ley 1581 and keeps responsibility for its compliance decisions. Shufti's privacy notice identifies any activity where it acts as an independent controller.
Data Residency and Privacy Controls in Colombia
Colombia AML Sources That Strengthen Decisions
Unidad de Información y Análisis Financiero (UIAF)
Superintendencia Financiera de Colombia (SFC)
Superintendencia de Sociedades (Supersociedades)
Superintendencia de Vigilancia y Seguridad Privada (Supervigilancia)
Superintendencia Nacional de Salud (Supersalud)
Superintendencia de Transporte
Coljuegos
Dirección de Impuestos y Aduanas Nacionales (DIAN)
Fiscalía General de la Nación
Ministerio de Justicia y del Derecho
Grupo de Acción Financiera de Latinoamérica (GAFILAT)
Financial Action Task Force (FATF-GAFI)
Egmont Group of Financial Intelligence Units
World Bank Group
United Nations Office on Drugs and Crime (UNODC) Colombia
Turn Colombia Verification Requirements into a Smoother Customer Journey
Share your customer types, risk rules and current onboarding process. A Shufti specialist will show you how to connect identity verification, KYB and ongoing monitoring, reducing operational hand-offs while keeping decision evidence organised for compliance review.
INDEPENDENTLY AUDITED. GLOBALLY CERTIFIED.
Certified to Global Standards
PROVEN WORKFLOWS
Identity Verification Built Around Your Industry in Colombia
Faster Account Opening Under SARLAFT
Banks must collect, verify and approve customer information before any relationship starts, whether onboarding happens in a branch or online. Shufti combines Registraduría biometric validation, document checks and screening in one digital flow, then keeps each profile current on the SARLAFT update cycle with perpetual KYC.
Frequently Asked Questions
Does Shufti support Registraduría biometric validation, and what happens when customers cannot use it?
Yes. Shufti validates the cédula number and the customer's face against Registraduría records, the route SFC rules name for biometric identification. When a customer holds a PPT, a foreign passport or no cédula at all, the same flow switches to document, chip or video verification.
Is scanning a cédula enough, or should verification include more checks?
A scan alone proves little, since a good printed copy can pass a visual check. Shufti decodes the cédula digital's QR code, runs forensic checks on both card formats, matches the photo to a live selfie and validates the holder against Registraduría records.
Can Shufti verify foreign documents or identity formats it has not encountered before?
Yes. Shufti's zero-shot AI learns new document formats in minutes, so a newly issued permit or an unfamiliar foreign ID does not stall onboarding. That matters in Colombia, where PPT holders, expatriates and visiting investors bring documents from many issuing countries.
How does Shufti OCR handle Spanish accents and compound surnames on Colombian documents?
Shufti's OCR reads every accent and the ñ exactly as printed, so Muñoz never becomes Munoz in your records. Both surnames and particles such as de la are captured as separate fields and reconciled across the cédula, passport and business records.
How does Shufti verify ownership when a Colombian company has several corporate layers?
Shufti pulls the chamber certificate from RUES, reads the shareholder register and bylaws, and follows each corporate shareholder through its own registry records. Everyone who reaches the 5% threshold in DIAN's RUB rules or exercises control is identified, verified and screened.
Does Shufti's ongoing monitoring cover more than sanctions screening?
Yes. SARLAFT numeral 4.2.2.2.1.6 requires customer updates on a risk-based cycle and after trigger events. Shufti's perpetual KYC watches sanctions, PEP and adverse media data, registry and ownership records and transaction behavior, and opens a review when any of them changes.
How does Shufti keep screening current and handle Spanish name variations?
Watchlist data refreshes every 15 minutes, including the UN Security Council lists made binding by Ley 1121 de 2006. Native phonetic models handle accents, double surnames and particles, so Rodríguez Peña and Rodriguez Pena resolve to the same person rather than two separate alerts.
Can we choose Colombian hosting or run verification inside our own infrastructure?
Yes. Shufti can host Colombian data in Oracle Cloud's Bogotá region, deploy on-premises or run fully air-gapped. The hosting location is written into your agreement, which supports your SFC cloud computing filing and the international transfer limits in Ley 1581.
What controls help us protect identity and biometric data?
Encryption in transit and at rest, role-based access, audit logging and configurable retention protect every record. Consent capture is built into the flow because Ley 1581 treats biometrics as sensitive data, and ISO 27001:2022 and SOC 2 Type 2 reports support vendor reviews.
Can we configure different retention periods for different Colombian licenses?
Yes. Retention is set per client, product and license, so SFC-supervised records can follow the five-year minimum while other entities apply ten years under Ley 962 de 2005. Legal holds keep records in place for open investigations or UIAF requests.
What does Shufti provide when our compliance team needs to prepare a UIAF report?
Each case file holds the identity results, screening hits, transaction alerts, analyst notes and decision history behind a suspicious operation. The compliance officer exports it as a report-ready bundle and files the ROS through SIREL without rebuilding evidence from separate systems.
Can we add verification checks without rebuilding our onboarding journey?
Yes. Shufti's AI Journey Builder adds or reorders checks such as Registraduría validation, PPT verification or business screening through configuration. When the SFC or Supersociedades changes a requirement, you update the flow without touching your app or rewriting your integration.
How does Shufti make verification queries easier for our customer support team?
Agents see each result with the reason behind it, such as a blurred cédula, a failed liveness check or a name mismatch. They can explain the outcome, request a resubmission or escalate a disputed result without opening a ticket with the compliance team.
Let’s Build Trust Into Your Business
1B+Verifications Processed
240+Regions Actively Processed
99.7%Accuracy Rate
Samer Al Tamimi
CEO of Safwa Bank
“We take our client’s privacy very seriously and always look for new innovative solutions to ensure a safe banking experience. Working with Shufti feels like a breath of fresh air, as their 100% in-house tech keeps our customer’s data free from vulnerabilities and fully safe and protected.”
Trusted. Compliant. Certified
Explore Shufti For Your Business
Get a personalised demo from our experts.
PROVEN PLAYBOOKS
Explore Practical KYC & AML Resources
11 September, 2026
Enterprise Guide to Docless Identity Verification in Latin America
A practitioner's guide to docless onboarding across Brazil, Mexico, Argentina, Chile, Colombia and Peru, covering the registry and the remote onboarding rule in each.
Product Guide
