Three Latin American regulators wrote the same rule. Only one of them made it happen.
“Open finance” is now a policy label three of Latin America’s larger economies claim. Colombia, Chile and Mexico have all put frameworks on paper that let a customer order their bank to hand transaction data to a competitor. Read the press releases side by side and the language rhymes: consumer control, API standards, a more competitive market. Read the outcomes and they diverge by years.
The variable is not ambition, funding or fintech appetite. It is a single design choice: whether the regulator compelled incumbent banks to open, or merely invited them.
Colombia switched from invitation to obligation
On 7 April 2026, Colombia’s government issued Decreto 0368 de 2026, making participation in the Sistema de Finanzas Abiertas mandatory for every entity supervised by the Superintendencia Financiera de Colombia (SFC): banks, financing companies, cooperatives, electronic payment houses, fiduciaries, brokers, pension administrators and insurers.
That is the whole story, because of what it replaced. Colombia’s first open-finance rule, Decreto 1297 de 2022, was voluntary. Banks could join the data-sharing scheme if they wished. Four years of “if they wished” produced the predictable result: incumbents that own the customer relationship have no commercial reason to hand it to a challenger, so most did not.
Decreto 0368 removes the choice. The SFC now has six months to publish the technical, operational and functional standards, building on the mandatory API standards it had already set out in External Circular 004 of 2024, after which supervised entities face a fixed calendar to expose their data through those APIs. This is compulsion with a clock, not a soft “should participate.” The obligation lands on the data holders, the parties with the least incentive to move, which is exactly where a working open-finance rule has to bite. Non-supervised third parties, the challengers meant to consume the data, can still join voluntarily, but the load-bearing change is that the banks no longer can opt out.
Chile chose obligation too, then bought time
Chile sits between the two poles. Its Ley Fintec (Ley N°21.521) already mandates an open-finance system, so the direction is settled. The fight has been over timing. On 1 June 2026 the Comisión para el Mercado Financiero amended NCG N°514, adding the technical annex that specifies how the Sistema de Finanzas Abiertas actually interoperates, and pushed entry into force to July 2027, with phased implementation running to the end of the decade.
Fintechs read the delay as a loss, and in the near term it is. But the underlying rule is still mandatory, and the amendment does the unglamorous work that decides whether a mandate functions: a 24-month transactional history requirement, a five-minute ceiling on data delivery, a simplified track for entities with fewer than 50,000 clients, and a CMF-run sandbox. A dated obligation with a real technical spec is slow. It is not idle.
Mexico wrote the law first and never finished it
Mexico is the control group, and the result is stark. It was the regional pioneer: the 2018 Ley Fintech was the first dedicated fintech statute in Latin America, and it explicitly required banks, fintechs, money transmitters and credit bureaus to build standardized APIs for open, aggregated and transactional data.
Eight years later, the secondary rules that would make transactional data-sharing binding still have not been issued. Only the least contested slice, open data for ATM locations, was ever published. There are no mandatory consent frameworks and no accreditation standard for third-party providers. The law commands open banking; the machinery to enforce it was never built.
The regulatory sandbox tells the same story in one number. Mexico’s “Modelo Novedoso” was meant to license novel financial models, including data-sharing entrants. In roughly eight years it has authorised zero firms. A sandbox that has never approved anyone is not a cautious gate. It is a closed door with a label on it.
None of this reflects a shortage of demand. Mexico has one of the region’s deepest fintech benches and an active challenger scene that would gladly consume bank data. What has been missing is the second step, the unglamorous regulatory work of writing binding technical and consent rules and then holding incumbents to a date. Absent that, the 2018 law functions as a statement of intent, and the banks that hold the data have been under no obligation to act on it.
The dividing line is enforcement, not intent
Put the three next to each other and the pattern is clean. Colombia and Chile wrote obligations and attached calendars and technical specs; both are moving, one live-imminent and one dated to 2027. Mexico wrote an obligation, left the enforcing rules unwritten, and got eight years of nothing. The distance between a mandate and a working market is entirely in the secondary regulation nobody puts on a launch slide.
This matters beyond Latin America because “we passed an open-banking law” has become a standard line in national fintech strategies, and it is close to meaningless on its own. The question that predicts whether customers can actually move their data is narrower: did the regulator put a dated exposure calendar on the incumbents, and did it publish the API spec, consent rules and accreditation standard that turn the calendar into something a bank can be sanctioned for missing? Colombia now answers yes. Chile answers yes, in 2027. Mexico, the first mover, still answers no.
For anyone tracking the region, the read is to stop scoring open finance by the date a law passed and start scoring it by the date the secondary standards ship. Colombia’s clock started on 7 April. Mexico’s has not started at all. Same policy label, eight years apart in outcome, and the only thing that separated them was whether the rule had teeth.
Discussion
Sign in to join the discussion.
No comments yet. Be the first to share your thoughts.