Bill 575.

Summary.

The bill establishes a programmatic framework to prevent, detect, deter, and pursue digital fraud. It calls for a people centered approach involving public cooperation, technical assistance, public awareness, and coordination among institutions. Special rules and regulations issued by public bodies in this area must conform to that framework and to the laws governing their powers. Responsibility extends to the public and private sectors. The Ministry of Education (Ministerio de Educación), Superintendency of Banks (Superintendencia de Bancos), National Public Services Authority (Autoridad Nacional de los Servicios Públicos), Consumer Protection and Competition Defense Authority (Autoridad de Protección al Consumidor y Defensa de la Competencia), Ministry of Security (Ministerio de Seguridad), Public Prosecutor's Office (Ministerio Público), and Financial Analysis Unit (Unidad de Análisis Financiero) must develop coordinated, funded policies within their respective powers. Municipalities and community boards must implement and publicize preventive policies in their jurisdictions. Banks and telecommunications companies must maintain internal controls, cybersecurity, complaint channels, and cooperation policies, updating them periodically.

The public sector must maintain international cooperation mechanisms to exchange information, investigate, gather evidence, locate and arrest persons, pursue illicit proceeds, and recover losses. It must also support technology development for banks and telecommunications operators, coordinate technical countermeasures, share data, and cross check information on suspected users. When handling cases, public and private entities must strengthen efforts to recover property and return it promptly to victims. Banks and telecommunications companies must offer free, accessible, current mechanisms for risk assessment, monitoring, alerts, and complaints; communicate responses to anomalies immediately; and correct errors promptly. Both sectors must conduct awareness campaigns beginning in secondary education, tailored to audiences including young people, older adults, and rural communities. Operators and banks must inform staff and users about new fraud methods and warn them of the legal responsibility associated with unlawful use of their own cards and accounts.

In telecommunications, operators must identify, block, intercept, trace, and verify the origin of communications using spoofed or fraudulent numbers, and provide results to affected customers and authorities. The use or sale of mass SIM card insertion devices, GOIP gateways, and analogous systems without authorization from the National Public Services Authority is prohibited. Operators, that authority, the Ministry of Security, and the Public Prosecutor's Office must identify and report equipment and software used for these practices; operators must prevent their connection to networks. They must also reverify suspicious accounts and, according to risk and requests from competent authorities, restrict functions, suspend service, close accounts, or bar new registration. Failures involving controls, monitoring, technical measures, or cooperation constitute violations punishable under Law 31 of 1996 (Ley 31 de 1996).

In the financial sector, banks must conduct customer due diligence when opening accounts, providing payment or settlement services, and throughout the business relationship. They must verify or deny anomalous requests and inform customers and authorities. Real time transaction monitoring must identify unusual patterns and enable verification of transactions and identities, postponement of payments, retention or freezing of funds, restrictions on services, and timely release or return of funds. Banks must collect and report transaction and device data associated with anomalous accounts. Failures involving controls, due diligence, monitoring, or cooperation would be sanctioned under the Banking Law. Competent public bodies and police forces must strengthen their joint work; the Ministry of Economy and Finance (Ministerio de Economía y Finanzas) must facilitate the budget. The bill would take effect six months after promulgation. Its provisions concern users of banking and telecommunications services, internet providers, educational institutions, and local administrations.