The Colombian Financial Supervisor (SFC) issued External Circular 028/2016, later amended by External Circular 053 of the same year, setting forth instructions for financial institutions regarding i) the information that must be reported to financial consumers and to the supervisor when events occur that interrupt servicing and truncate transactions and ii) the establishment of alternative financial touchpoints for consumers in such situations and mechanisms to ensure that their rights are enforced.

Its instructions on security mechanisms and touchpoints oblige financial institutions to adopt measures to guarantee a minimum level of service even when their usual channels are temporary offline.

They also state that the institutions must send SFC a quarterly report on the monthly availability of their channels (up-time). The report must include details on the methodology applied by each institution to calculate this up-time.

The SFC also establishes an obligation to report to it on events with a significant impact on confidentiality, availability or integrity of information in the systems used to operate the different channels.

The instructions state that when lines may be down for foreseeable reasons, eg, for scheduled maintenance, financial institutions must provide consumers with 8 working-days’ notice on which touchpoints and which services are going to be impacted, how transactionality may be limited, giving them information on alternative channels and downtime in services.

When it is not possible to inform consumers so far in advance, due to more urgent requirements to make changes or update systems, the financial institution must send out the information in the shortest time possible without it affecting such changes and/or updates in the hardware or software systems.

Additionally, when a line is going to be down for more than one hour, the financial institutions must inform financial customers of which touchpoints will be affected, which transactions they will be unable to carry out, which alternative touchpoints they can use, and the estimate time and date on which the service will be resumed, along with any other relevant information.

Finally, the SFC instructs financial institutions to establish mechanisms to compensate customers for the inconvenience caused by such down-time. These should take into account at least the following aspects: i) payment of the management fee and other services, ii) payment of transactions conducted on alternative channels; iii) payment of arrears interest and reporting to information centres, iv) measures to avoid customers being adversely affected by the impossibility of making their payments on time; v) channels through which to present requests, complaints and claims.