Crypto Exchanges in Colombia Face Strict Compliance Requirements Amid Tax Evasion Crackdown

Colombia’s financial authorities have intensified regulatory pressure on the cryptocurrency sector, mandating that all digital asset platforms operating within the country comply with comprehensive data reporting standards. The move represents a significant shift in how the region approaches crypto oversight.

Under Resolution No. 000240 issued by the Colombian National Tax and Customs Directorate (DIAN), cryptocurrency exchanges and other digital asset intermediaries must now collect and systematically report detailed information about their users and transactions. This requirement encompasses account holder identification, transaction volumes, transfer frequencies, asset valuations, and account balance records.

Scope and Applicability

The regulation casts a wide net, applying not only to domestic cryptocurrency exchanges but also to international platforms and service providers that facilitate transactions for Colombian residents and taxpayers. The DIAN’s primary objective is to enhance transparency across the digital asset market and effectively combat tax evasion schemes that may utilize crypto transactions.

Reporting Timeline and Penalties

Exchange operators face a critical deadline: the initial comprehensive report must be submitted by the final working day of May 2027, covering the 2026 tax year. Non-compliance carries substantial consequences. The DIAN has established penalties reaching up to 1% of the total unreported transaction value for exchanges that either fail to comply or submit inaccurate information.

This penalty structure underscores the seriousness of the compliance mandate and is likely to prompt swift action from cryptocurrency exchanges seeking to avoid significant financial exposure.

Industry Implications

The directive represents a watershed moment for digital asset platforms operating in Colombia, requiring them to invest in enhanced compliance infrastructure and data management systems. Exchanges must now balance user privacy concerns with stringent government reporting requirements, fundamentally changing their operational frameworks in the region.