Colombia SMS Fraud Prevention (CRC 181)

For businesses sending SMS in Colombia

In September 2026, Colombia’s Communications Regulation Commission (CRC) issued Circular 181 of 2026. It sets out how companies in the A2P messaging ecosystem must comply with the fraud prevention and education measures in CRC Resolution 8308 of 2026.

Does this apply to you?

It does if your company has an identification resource for A2P messaging in Colombia assigned in its name, such as a Sender ID or a short code. It also applies to telecom network and service providers (PRST).

• If your company holds a Sender ID, the obligation is yours. That’s true whether or not you deal directly with end users.
• You can’t delegate it. A provider, integrator, or contractor can help you, but your company stays responsible.

What you need to do

First deadlines

• First campaign: Q4 2026 (October 1 – December 31, 2026). Report it within 15 business days after December 31, 2026.
• First training: first half of 2027 (January 1 – June 30, 2027).

Quarterly campaigns: two ways to comply

Option 1: Create your own campaign. This is for companies that deal directly with end users. Each campaign must:

• Focus on one fraud risk, with a clear main message and a recommended action.
• Cover the minimum topics: users’ rights over their personal data, types of fraud by text message and phone call, social engineering, and warning signs and how to prevent fraud.
• Use the CRC’s model in Annex 1 of the circular, or your own content mapped to the checklist in Annex 2.
• Not recommend brands or commercial solutions, and never ask users for passwords, codes, or financial data.

Option 2: Share official CRC content. This is for companies with no direct relationship with end users. Each quarter you must:

• Pick current, official content published by the CRC.
• Share it on your available channels (social media and website) during the quarter.
• Keep the CRC as the credited source and don’t change the message.
• Use the official hashtag on social media.
• Keep evidence and report it using Annex 3.

Both options

• Keep campaign content available on your website for the whole quarter.
• Publish at least 4 posts or reminders in different weeks. The same piece posted on several channels on the same day counts as one.
• Use the official hashtag #LaClaveEsVerificar on social media, spelled exactly like this.
• Make content accessible: plain language, good contrast, subtitles on videos, and alt text on images.

Internal training

At least one structured session per half-year. In person, online, or a mix are all fine. It must cover:

• Common types of fraud (smishing, vishing, spoofing, wangiri) and social engineering.
• The regulatory framework and the consequences of not complying.
• Internal procedures to detect, report, and manage fraud.
• Escalation channels.
• How to support users, especially vulnerable users.
• Personal data protection in A2P messaging.

Minimum teams to train: customer service, corporate account management, network operations, regulatory compliance, and sales. New hires must be trained within 30 business days of joining.

How to report to the CRC

• Email: [email protected]
• Forms: Annex 3 for campaigns (quarterly) and Annex 5 for training (half-yearly).
• File name: NIT_TYPE_PERIOD_YEAR, for example 900000000_CAMP_T1_2027.
• Evidence: dated URLs and screenshots, message samples with proof of sending, and a content calendar. Metrics are optional and there’s no minimum reach.
• Don’t attach user or employee databases, passwords, codes, or unnecessary personal data.
• Keep the submitted version, your evidence, and the CRC’s acknowledgment of receipt.

How indigitall can help

• Direct channel to your users. Send your campaign pieces by SMS, email, push, or in-app from the indigitall platform.
• 4 reminders in different weeks. Schedule your sends in advance across the quarter.
• Evidence. Use your campaign sending statistics as proof of sending for Annex 3.