Colombia - Coljuegos: licences

Colombia - Coljuegos: licences

Quick Reference

Colombia is the first major jurisdiction in Latin America with full regulation of online games (casinos, sports, etc.) at the federal level. Supervision, permits and fiscal deductions are administered by Coljuegos (state operator and regulator of "games of chance and excitement"). The basis of the model is concession/permit agreements and the payment of "derechos de explotación" (share of revenue) going to the health care system.

Regulatory Architecture

Coljuegos - issues permits/concessions, approves rules and technical standards, conducts supervision and sanctions, administers fees.
Online games are legal based on a separate permit package and technical regulations for platforms/games.
The ground segment covers casino/EGM, bingo, betting/betting, lottery and specialty products.
Promotional draws (games related to the marketing of goods/services) - a separate, simplified notification/permission procedure with fixed contributions.

Types of permissions (high-level perimeter)

1) Online Gaming (Juegos Online)

Covers casino content (slots/RNG, live tables), sports betting, virtual, crash/instant and other approved games.

• Colombian legal entity, authorized capital and financial stability;
• Platform with RNG/games certified, magazines and anti-tamper controls;
• Integration with the reporting bus of the regulator (transfer of transactions/metrics on time);
• KYC/AML (SARLAFT) policies, log storage, DR/BCP plans;
• Age barrier 18 +, Responsible Gaming tools (limits, self-exclusion, warnings);
• Advertising according to the rules (prohibition of targeting minors/vulnerable, transparent conditions for bonuses).
• Permit period: usually up to 5 years with the right to renew.

2) Casino and EGM (ground)

Permit to operate gaming machine (EGM) halls and tables, including progressive jackpots.
Requirements: hall/personnel/observation, certification of equipment and accounting systems, MICS procedures (cash register, drop/count, access keys, video security).

3) Bingo

Classic and electronic formats with circulation, sales and payment control. Strong "cash" discipline and public regulations of draws.

4) Betting and betting (including offline sports)

Land betting stations/betting shops with separate network infrastructure, terminals and reporting.

5) Sweepstakes/lotteries/promo (Promocionales)

Prize Marketing Promotions - Simplified tolerances, fixed rules, prize limits, and mandatory public terms.

Financial model and payments to the government

"Derechos de explotación" - basic payment to the state as a share of gross income/net revenue, calculated according to the formula fixed in the permit/concession contract (rates vary by vertical).
Admin contributions/supervision - separate payments for control and support from the regulator.
For online operators, there is often a minimum guaranteed payment (monthly/annual), tied to indicators of the economy (for example, the unit of remuneration/minimum wage).
Income/VAT tax regimes apply under general tax law; deductions/registration of prizes and promos are drawn up in a routine manner.

AML/KYC и Responsible Gaming

• KYC before admission to rates/payments, risk profiles, monitoring of transactions, storage of dossiers and reports.
• 18 + and RG mechanics: deposit/time/loss limits, self-exclusion, visible warnings, staff training.
• Cash/payment rails: limits on cache, priority of bestresh channels, clear reconcile with banks/providers.

Technical standards and MICS (canons)

Online platform

Certified RNG/games and version control (signatures, hashes), unchangeable logs.
Geolocation in Colombia, device-hygiene and anti-spoofing.
KYC/AML/sanction filters in on-boarding and on payments, behavioral anti-fraud.
Reporting to Coljuegos: transactions, metrics, security incidents, RG statistics.
Dev→Prod: role-based access, SDLC, SBOM/signed releases, DR/BCP plans, regular pentest and incident log.

Ground (casino/bingo/betting points)

Video surveillance and storage of records; cash register, drop/count; sealing controllers, accounting for progressions; key/access control.
Inventory of EGM/cartridges/jackpot controllers, replacement/patch policy.
Failure/incident logs and timely filing reports.

Advertising and Communications

Prohibition on misleading marketing ("no risk," etc.), on appeals to vulnerable audiences, on missing/hidden conditions.
Mandatory RG disclaimers, operator/permission; control of affiliates lies with the operator (joint responsibility for messages).
Restrictions on media formats and sponsorship, transparency requirements for promotional mechanics.

Go-to-Market Procedure (Reference Roadmap)

1. Pre-filing (0-2 months)

Ownership/financing structure, incorporation in Colombia.
Vertical selection (online/ground/hybrid), draft KYC/AML/RG/MICS policy package.
Technical architecture: platform, games, wallet/payments, logs, geo, SDLC/Dev→Prod.

2. Supply (2-4 months)

Permit/concession application with disclosure of beneficiaries/officers.
RNG/Game/Integration Certificates, PSP/KYC/Geo/Integrite Provider Contracts.
A finmodel with derechos de explotación, a schedule of minimum guarantees and admin contributions.

3. Audit/test (3-6 months)

Lab/platform field tests and reporting; pilots, MICS adjustment, staff training.
Checking advertising/house rules/user agreements.

4. Go-live and supervision (5-7 months)

Signing/activation of the contract, release of production versions, integration of reporting.
Monthly/quarterly forms, share transfers, post-audits and RG/incident controls.

Operational checklists

Online operator

• Platform and games are certified; versioning/signature control; immutable logs.
• Geo inside Colombia, anti-VPN/emulators, device fingerprinting.
• KYC/AML (SARLAFT), RG limits, self-exclusion, reports and incidents.
• Reporting/transfers by derechos de explotación + admin dues.
• Promo/bonus policy: cappings, anti-bonus abuse, transparent conditions.

Casino/EGM

• Video surveillance/storage; cash desk/drop/count; EGM inventory and progressives.
• Maintenance/replacement logs, key control, SDLC/controller patches.
• Timely filing of reports and enumerations.

Marketing/Affiliates

• RG disclaimers, correct offers; audit of affiliate creatives and lands.
• Youth targeting ban, self-excluded blacklists.

Frequent risks and red flags

Opaque beneficiaries/debt constructs → waiver/sanction.
Unauthorized releases/changeable logs, lack of SBOM/signatures.
Undercount of transactions and delinquencies on "derechos de explotación" and admin contributions.
Weak geo-hygiene (VPN/emulators), bonus abuse, violations in advertising/affiliates.
Gaps in SARLAFT: CCM/source of funds, monitoring and storage of dossiers.

Economics and P&L: accents

Fix in the model: the share of "derechos de explotación" by verticals, admin contributions, possible minimum guarantees, certification and supervisory costs.
Online: Margins are sensitive to promotional policies, limits and antifraud; conversion - to local payments and UX.
Ground: CAPEX to surveillance/EGM/controllers, OPEX to store video/logs/service.

Trends 2025

Clarification of technical requirements for online platforms (magazines/telemetry, release stability, software shipments).
Increased control over advertising and affiliates; growth of RG-KPI.
Deeper integration of reporting (operational uploads, unification of metrics), focus on cyber resilience.

What's important to remember

Colombia is a mature and predictable permissive model with an online vertical and understandable "derechos de explotación" payment logic.
Success relies on a transparent ownership structure, impeccable KYC/AML/RG, the discipline of reporting and technical control (signed releases, unchangeable logs, geo/anti-fraud).
In P&L, consider in advance the state share, admin fees, minimum guarantees and fixed costs for certification, cyber and affiliate control.