If you do business in Colombia, in telecoms, banking, fintech or any business that sells on credit, a new law changes what you must be able to show about your customers.

The numbers explain why. Between 2022 and May 2026, Colombia's Superintendence of Industry and Commerce (SIC), the authority responsible for consumer and personal data protection, recorded 13,983 formal complaints of identity theft. 81% of them involved the telecom sector. Congress responded with Law 2573 of 2026, an unprecedented regulatory change that requires banks and telecom operators to overhaul their digital onboarding and how they manage customer documentation.

The deadline is 19 November 2026, when the law's general regime takes effect. From then on, verifying a customer's identity is not enough. You have to prove it, with documentary and digital evidence that the applicant was properly authenticated.

What is Colombia's Law 2573 of 2026?

Law 2573 of 2026 is a statutory law enacted on 19 May 2026 to protect victims of identity theft and financial fraud: stolen personal data, credit opened fraudulently in someone's name and online scams.

Its core purpose is to stop victims from being chased for payment or reported to Colombia's credit bureaus for debts they never took on.

Does Law 2573 apply to your business in Colombia?

The law is mandatory nationwide. If your company operates in Colombia in any of these three sectors, it is directly affected:

1. Telecom operators, who activate lines and services in a person's name.
2. Financial and credit institutions: banks, financing companies, cooperatives engaged in financial activities, fintechs, and any other entity that grants credit.
3. Businesses that offer credit to their customers: in practice, any company that sells in instalments or finances purchases directly, such as car dealerships, e-commerce stores with in-house financing or even appliance retailers.

What changes: companies now carry the burden of proof

Identity theft is a common form of fraud in Colombia. Victims often only find out when a collection demand arrives, or a credit bureau reports them for a service they never requested. Until now, it was up to them to prove, through long legal proceedings, that they never signed the contract, while companies could take months to investigate and respond.

Law 2573 turns this around. It applies what Colombian law calls the dynamic burden of proof: the party best placed to prove a fact must prove it. In an identity theft case, the company is the one that received the documents and approved the product. That is why the law requires it to give the impersonated person a copy of the approval file, with no right to refuse, and to stop collection as soon as it is notified.

If the company is found to have breached the security protocols issued by the authorities, it must stop collection, correct the credit bureau report and either refund the money or cancel the debt. And if it misses the legal deadline to answer a complaint, positive administrative silence applies: the complaint is automatically resolved in the customer's favour.

What evidence you need under Law 2573, stage by stage

Holding data on your customers is not enough under Law 2573. You must be able to demonstrate how you verified their identity. As we explain in our article on why evidence has become the most valuable asset, a record only counts if it is intact, has a registered date and can be attributed to a specific person. This is what that means across the customer journey:

Customer onboarding and identity verification (KYC)

The law requires sufficient and reasonable digital security measures to establish that people are who they claim to be, and that their documents are genuine. That is the role of document validation, biometric authentication and remote video identification , which verify the person in real time and record the entire process.

A selfie or a photo of the cédula, Colombia's national ID card, is not enough on its own. That capture must be linked to the contract, carry a registered date and time, and be protected against any later alteration.

Contracting: electronic and digital signatures in Colombia

At the contracting stage, what matters is the type of signature and how it is linked to the signer. A registered digital signature with a timestamp, issued by a digital certification entity (ECD) accredited by ONAC, proves what was signed, when, and with what integrity guarantees. ONAC is Colombia's national accreditation body, and ECDs are the certification providers it accredits.

This rests on Colombian law: Law 527 of 1999 and Decree 2364 of 2012 (now compiled in Single Decree 1074 of 2015) recognise electronic signatures as valid when they are reliable and appropriate for the circumstances.

Complaint handling

Once someone reports possible identity theft, the legal deadlines begin to run. Registered SMS, email and WhatsApp notifications let you prove that each communication was sent and delivered, and what it said.

Handing over the approval file

If the person who was allegedly impersonated asks for it, the law requires you to hand over the documents and information used to approve the product or service requested in their name. A registered record of that handover can become strong evidence in criminal proceedings.

How Lleida.net helps you comply with Law 2573

Lleida.net operates in Colombia as a digital certification entity accredited by ONAC . Its digital trust services cover, with a single provider, every stage where Law 2573 of 2026 requires proof:

• Identity validation (eKYC Video): remote video identification that checks data against the National Identification Archive (ANI), the biographic and biometric database managed by Colombia's National Civil Registry (RNEC).
• Contracting with a registered electronic signature and a digital signature, to prove who signed and what they signed.
• Timestamping to provide a registered date for every piece of evidence during onboarding or when issuing electronic files.
• Registered email and SMS, to prove that deadlines were met and communications sent on time. Registered WhatsApp notifications are also available.
• Evidence issued by a trusted third party, independent of your company, which carries more probative weight before a Superintendence or a judge than an internal record.

Since 2023, the SIC has fined telecom operators more than COP 2.39 billion (COP 2,390,372,596) for failing to properly verify users' identities. With 19 November approaching, getting ahead of these requirements does more than avoid fines: it protects the trust your customers place in you.

This content is for information purposes only and does not constitute legal advice. We recommend reviewing each case with your legal team.

Road freight in Spain is going fully digital, and this time there's a hard deadline. From 5 October 2026, the DeCA Spain's electronic transport document (Documento electrónico de Control Administrativo) becomes mandatory for domestic road freight operations. Other administrative control documents will also need to move to digital formats.

If your company operates in trucking, logistics, or freight forwarding in Spain, whether or not you're based there, this change affects you directly. Here's what's new about DeCA Spain's electronic transport document, what it means in practice, and how to make the transition without adding operational risk.

Why the DeCA Spain's Electronic Transport Document Matters, Even If You're Not a Spanish Company

Spain's transport regulators aren't just asking operators to swap paper for a PDF. The new rules, introduced under Law 9/2025 on Sustainable Mobility and detailed in a Resolution published on 5 June 2026, set specific technical requirements around the availability, integrity, and traceability of transport documentation.

For foreign carriers, freight forwarders, and logistics companies running routes through Spain, this means your existing document workflow, even if it's already digital, may need adjustments to meet DeCA Spain's electronic transport document requirements specifically.

What Exactly Is Changing

Two categories of national transport documentation move to a mandatory digital format:

• Freight transport: operators must hold a valid DeCA Spain's electronic transport document for national road freight services.
• Passenger transport: national passenger services must use a digital version of the service route sheet (hoja de ruta).

What Is the DeCA?

The DeCA Spain's electronic transport document is the digital equivalent of the administrative control document historically required for road freight transport in Spain. It's the document that authorities check to verify a shipment is operating legally, and it forms the core of the country's new digital transport document framework.

Requirements From 5 October 2026

Compliance isn't just about having a PDF on a tablet. The regulation is specific about how DeCA Spain's electronic transport document must be created and maintained:

• Native digital creation only. Scanned paper documents or converted files won't be accepted; the document must be generated digitally from the start.
• File format and access. The PDF must not exceed 5MB and must include a unique URL and a QR code, so inspection authorities can check it instantly without logging in or navigating a website.
• Automatic timestamping. The system must automatically record the date and time the document was created, plus any later modifications.
• Retention period. Documents must be kept on file for at least one year.

Good News: You May Not Need a Separate Document

The regulation allows some flexibility around the DeCA Spain's electronic transport document. If another electronic document already used in your operations, an eCMR (electronic consignment note), ADR documentation, waste transport records, or SANDACH documentation, contains all the information the transport rules require, it can serve as the DeCA. It simply needs to clearly identify the contracting loader and the actual carrier, among other mandatory data points.

In practice, this means companies already running digital transport management systems may be able to adapt their current documents rather than build something entirely new.

Why Traceability Is the Real Challenge

Digitisation brings speed, but it raises a harder question: how do you prove what information existed, and when?

The regulation requires systems to log the creation date and time of each DeCA Spain's electronic transport document, along with any subsequent changes. If a new version of a document is created, the original must be preserved as well, so the full history of changes remains traceable.

That covers the internal record. But in disputes, audits, or inspections, companies often need something more: independent, verifiable evidence that specific data existed at a specific moment, evidence a court, auditor, or authority can trust without relying solely on your internal system logs.

That's precisely the gap a Registered timestamp is built to close.

Adding a Layer of Trust: Electronic Timestamping

A timestamp cryptographically links a set of electronic data to a specific date and time, creating verifiable proof of when that information existed and allowing you to detect if it's been altered afterwards.

Lleida.net's Time Stamping service does exactly this for DeCA Spain's electronic transport document and other transport records, giving you:

• Time-based proof that a document or dataset existed at a given moment.
• Data integrity checks to confirm whether sealed information has been modified since.
• Traceability across the lifecycle of a document or process.
• eIDAS grade trust, since a Registered timestamp carries reinforced legal guarantees under the EU's eIDAS framework, relevant well beyond Spain's borders.

Does It Need to Be Signed?

Not always. The Resolution clarifies that an electronic signature isn't a general requirement for the administrative validity of DeCA Spain's electronic transport document.

However, if the document also serves a contractual purpose and needs signatures, those signatures must meet at least the standard of an advanced electronic signature (AdES) under eIDAS, or a Registered electronic signature (QES), which is also valid.

Handling Contractual Signatures: Click & Sign

When a DeCA doubles as a contractual or commercial document requiring a signature, Lleida.net's Click & Sign platform manages the full signing process digitally, securely, and with built-in traceability:

• Advanced and Registered signatures, AdES and QES options, matched to what each document needs.
• Fully online signing, send, review, and sign from any device, no printing or scanning.
• Tamper evidence, the signing process confirms the document hasn't been altered afterwards.
• Electronic evidence, every signature is backed by evidence showing how, when, and by whom it was completed.

The Bigger Picture

The DeCA Spain electronic transport document mandate is another step in Spain's push to digitise road transport, and it's a preview of where documentation standards across the EU are heading. Going digital isn't just about dropping paper; it's about proving that information can be preserved, verified, and, when needed, traced back to an exact moment.

For companies operating in Spain, getting ahead of the 5 October 2026 deadline means reviewing your current document workflow now, checking whether your existing systems (eCMR, TMS platforms, etc.) already meet the requirements, and adding independent verification, such as timestamping and compliant e-signatures, wherever there is contractual exposure.

Related reading:

• Legal validity of signatures on PDF documents

• WhatsApp electronic signatures: Legal validity, risks and compliance under EU law

Law firms increasingly face a high-stakes scenario where a reliable esignature validator makes all the difference: a client receives a digitally signed contract or notice binding their company to a multi-million-euro transaction. The document appears entirely authentic, complete with a digital signature and a secure timestamp, yet subtle timeline discrepancies or irregularities raise red flags.

Faced with this challenge, utilising a reliable esignature validator is essential before taking action, as challenging a signature without solid technical backing can result in severe financial exposure. Under procedural rules inspired by EU civil litigation standards and the eIDAS framework, if a document is proven valid, the challenging party typically bears the legal costs and potential financial penalties for procedural bad faith.

Counsel is inevitably left asking how to verify whether a signed document is genuine or forged with sufficient certainty to litigate or advise with confidence.

The Universal eSigned Verifier from Lleida.net, known as USVC, acts as the ultimate esignature validator for legal practices. It enables legal teams to complete verification in minutes, completely removing the need for prior technical setup.

Document Fraud Makes an eSignature Validator Essential

Global regulatory bodies and legal authorities report a continuous rise in document fraud. Traditional manual forgeries of paper records have been largely replaced by sophisticated digital alterations of contracts, corporate certificates, identification documents, and electronic receipts, fuelled by advanced editing software and artificial intelligence.

This evolving threat has pushed forward-thinking law firms to adopt an automated esignature validator, embedding document authentication directly into their intake and review workflows to neutralise risks before a dispute ever reaches court.

USVC: The Forensic Methodology Behind This eSignature Validator

The process is frictionless: legal teams simply email the file or run the check through the secure online portal. Within minutes, the platform returns a full verification result, along with documentary evidence of full probative value, to send to auditors, regulators, or judicial bodies.

USVC Ensures Complete Integrity, Authenticity, and Legal Validity

As an advanced esignature validator, the Universal Signed Document Verifier overcomes several technical hurdles that traditional checks cannot:

• Confirms absolute document integrity by validating the underlying cryptographic hash and detecting any unauthorised alteration, regardless of visual seals.

• Determines whether the uploaded file is the pristine original signed document or a degraded secondary reproduction.

• Evaluates certificate validity as of the exact moment of signing, even if the certificate has since expired, by leveraging advanced LTV/LTA mechanisms compliant with European eIDAS standards (Regulation (EU) No 910/2014).

• Validates whether the signature carries an official timestamp and confirms strict temporal consistency.

• Audits the issuing digital certificate against recognised Trusted Service Lists across the EU (EU TSL) or approved international certification authorities and repositories.

• Operates entirely zero-touch, with no complex API integration or IT setup required.

• Generates a litigation-ready report that can be filed directly in court proceedings as objective expert evidence.

Real Cases: Verifying Electronic Signatures in Legal Practice

For practising attorneys, using USVC as a trusted esignature validator transforms decision-making, whether evaluating a settlement, drafting a motion, or advising corporate clients, shifting the process from subjective visual judgment to an objective, data-driven strategy.

Below are three case studies from firms that use USVC in their workflows.

Case 1: Verifying the Cryptographic Signature, Not the Visual Seal

A commercial law firm handles a multipage lease agreement signed electronically, where the visible signature block appears only on the final page. The opposing party moves to challenge the contract, arguing it is legally incomplete because it lacks a signature on every page.

Counsel runs the file through USVC as an esignature validator to verify the cryptographic hash. The report confirms the file is unaltered, and the signature is legally binding under digital signature frameworks. The court dismisses the challenge and orders the opposing party to cover the verification costs.

The Takeaway: Visual signature stamps are cosmetic placeholders. True electronic validity depends on cryptographic integrity across the entire file hash, not on how many pages display a graphic signature.

Case 2: Copying, Reprinting, or Rescanning Destroys Digital Evidence

A corporate client hands their attorney a printed copy of a contract that was originally executed digitally. The printout looks visually identical to the original agreement, but when a dispute arises, running a flat scan through an esignature validator fails: a scanned or reprinted copy strips out the embedded digital certificate and cryptographic payload, reducing the document to ordinary documentary evidence and weakening the client's position.

Lawyers should always request the native digital file from clients rather than a printout or scan. If only a reproduction is available, running it through the esignature validator early reveals its limitations immediately, allowing counsel to adjust their evidentiary strategy before filing.

The Takeaway: Always secure the native digital file to preserve embedded metadata; a reproduction loses its legal force.

Case 3: Unfounded Challenges Carry Financial Consequences

A firm initiates a debt recovery action supported by an electronically signed loan agreement. The debtor challenges the signature purely as a delaying tactic to force a settlement discount. Plaintiff's counsel relies on the esignature validator before responding, confirming the file's integrity.

Backed by solid technical proof, the lawyer stands firm and files the verification report directly in opposition. The judge dismisses the challenge, orders the debtor to cover all verification costs, and penalises them for procedural bad faith.

The Takeaway: Objective technical validation through a reliable esignature validator lets legal counsel confront unfounded procedural challenges with confidence, shifting the financial penalty onto the bad-faith party.

USVC gives legal professionals the technical backing they need to act as confident, informed users of an esignature validator, protecting clients from costly procedural missteps and aggressive opposing tactics.

YOU MIGHT ALSO LIKE:

Legal validity of PDF signatures: how to secure it with qualified time stamping