On 21 November 2025, Colombia’s Communications Regulatory Commission (CRC) released the public consultation draft GAC‑2025‑084 on anti-deepfake voice. It puts forward mandatory requirements on encryption and anti-fraud for A2P services in the financial sector. An interview with CRC commissioners published by Latin American telecom journal Intermedia confirms that this draft ranks among the key regulatory priorities of the year. The document remains open for public consultation and has not yet entered into force as formal legislation.
The consultation draft proposes that all financial (BFSI) A2P verification voice calls and SMS must adopt mandatory end-to-end encryption (E2EE) at operator level. Operators are prohibited from storing plaintext messages and shall rely solely on hash values for routing. For the first time, the draft defines deepfake voice detection as an essential network capability for operators and establishes liability rules: if bank customers suffer fraud caused by AI-generated synthetic voice, the relevant operator shall bear corresponding joint liability if it fails to deploy such detection systems.
An interview with CRC senior executives published in the November 2025 issue of Intermedia shows that strict regulation of short codes, anti-fraud measures against deepfake voice, and traceability encryption for cross-border A2P constitute the three core regulatory strategic priorities of CRC for 2025‑2026. At that time, draft GAC‑2025‑084 was nearing the end of public consultation, and major domestic telecom operators had launched pre-deployment of relevant systems in advance.
Although the draft is merely a consultation document without formal legal force, it provides clear guidance for Colombia’s A2P industrial chain. Service providers engaged in cross-border financial SMS and voice outbound calls shall cooperate with local PCA/IT integrators to plan technical upgrades for encryption and AI synthetic voice recognition in advance, track subsequent legislative progress of the draft, and mitigate compliance risks and joint compensation liabilities once the rules take formal effect.
