How open standards are reshaping Colombia’s digital identity stack

Colombia’s five-day verifiable credentials bootcamp in Bogotá may have looked like a small technical exercise. In reality, it represented the latest step in the country’s effort to transform an existing digital identity system into a broader digital public infrastructure built on open standards.

More than 40 developers from across the Colombian public sector built functional pilots, including a rural digital ID and migrant permit credentials, in less than 48 hours. Developed with open standards and open-source tools rather than proprietary platforms, the projects reflect a broader shift underway in Colombia’s digital identity strategy.

Rather than replacing its existing identity infrastructure, Colombia is using open source software and standards such as X-Road, OpenID Connect (OIDC) and verifiable credentials to turn a legacy biometric registry into a modern digital public infrastructure. The strategy offers an alternative path for countries seeking DPI without rebuilding identity systems from scratch.

The country’s identity modernization process began in 2017 when the National Civil Registry (RNEC) engaged Idemia to digitize 74 million civil registration records and integrate face biometrics. Rather than replacing that foundation, Colombia has spent the past several years building interoperability layers and open standards around it, allowing decentralized services and reusable credentials to interact with the national identity system.

The X-Road selection

The shift continued in 2020, as Colombia faced a crossroads. To resolve the bottleneck of data silos across separate state registries, Colombia moved to establish a secure data transmission highway. Governed by the Agencia Nacional Digital (AND) under Decree 620 of 2020, Colombia launched X-Road as its national data exchange platform (Servicios Ciudadanos Digitales Interoperabilidad).

By deploying X-Road, Colombia rejected a centralized “master database” design. It instead opted for a decentralized network of secure peer-to-peer proxy servers, which connected isolated public databases (land registries, academic records and ministries). X-Road solved data exchange but it didn’t affect portable citizen-controlled identity and credentials.

In 2024, Colombia signed a bilateral agreement with India in a sign of the country’s growing interest in open, interoperable DPI approaches. The MOU focused on promoting digital transformation “through capacity-building programs, the exchange of best practices, the exchange of public officials and experts, the development of pilot or demo solutions and the facilitation of private sector contacts,” according to the announcement.

Colombia adopted India’s blueprint of low-cost, interoperable APIs. However, Colombia’s data-sharing architecture more closely resembles Estonia’s X-Road model, which relies on decentralized data exchange rather than a single centralized database. The final piece of the architecture emerged in 2023, when Colombia introduced Digital Identity 2.0 and adopted OpenID Connect as the bridge between its biometric registry and a growing ecosystem of digital services.

OIDC and regulatory pivot

As it introduced Digital Identity 2.0., Colombia made it easier for developers to integrate identity services by adopting OIDC. By utilizing an open web standard rather than custom vendor code, Colombia turned the identity registry into an open, secure API layer.

This gave developers familiar tools. It reduced dependence on proprietary integration approaches and allowed services to connect through standardized authentication protocols. OpenID Connect (OIDC) is the same authentication framework used by major internet platforms such as Google’s APIs, Gmail, Microsoft Office 365 and Microsoft Azure.

MinTIC and RNEC used OIDC to turn the national biometric database into an open, secure identity provider. Authorized public and private services can integrate with Colombia’s digital identity ecosystem through standard authentication protocols using off-the-shelf web development tools.

But scaling safely needed more robust legislation. As the data exchange platform expanded and identity APIs went live, the ecosystem required regulatory boundaries to protect citizen data privacy from predatory data practices.

In 2025, the Superintendency of Industry and Commerce (SIC) began issuing directives aligning Colombia’s open finance ecosystems and digital identity layers with national personal data privacy laws. The mandates enforced strict, explicit user consent mechanisms for handling biometric validation and automated processing, cementing the legal foundation required for safe, decentralized DPI.

The Colombia DPI Stack architecture

Colombia’s identity layer is the Cédula Digital, which forms the foundational layer, backed by the RNEC and its 74 million digitized civil records. The digital ID app is developed by Gestión de Seguridad Electrónica S.A. (GSE), while the ID has received technical support from Idemia.

The identity layer provides biometric facial authentication and OIDC protocols to confirm the user’s identity. X-Road is the interoperability layer, moving data securely across ministries.

The data sharing layer is the focus of current implementations, like VC and reusable credential pilots. This will mean that instead of an agency requesting an individual’s full file from a central registry, the system issues a tamper-proof digital credential (like a digital seal) directly to the user’s smartphone. They present only what is required, such as proof they are over 18 without revealing their exact birthdate or other personal details like address.

Another DPI component is payments. Launched by the Central Bank (Banco de la República), Bre-B is Colombia’s instant interoperable payments system. When connected to the digital ID, it forms a key part of DPI, paving the way for seamless digital commerce and the distribution of state social subsidies.

Adoption remains low

Colombia’s challenge now is less technical than behavioral. The country has assembled many of the core components of DPI, but infrastructure only becomes public infrastructure when citizens, businesses and government agencies use it at scale. As countries such as Malaysia and the Philippines have found, adoption and usage are the hardest parts.

Five million digital IDs were issued by 2024 but the adult population of Colombia is around 30 million. The longer-term challenge the South American country faces is in encouraging widespread use of digital credentials across public services and commercial transactions.

The launch of Bre-B was intended to create an interoperable instant payments rail similar to systems deployed elsewhere in Latin America. But cash remains dominant in Colombia, accounting for nearly 80 percent of transactions.

Cash will stay king if connectivity issues persist. Rural fixed broadband speeds lag 43 percent below OECD baselines, creating a risk that the benefits of digital identity, credentials and online public services are spread unevenly.

Building around existing assets

Colombia offers a different path from countries pursuing new foundational identity systems. It is attempting to modernize existing registries through interoperability layers, open standards and reusable credentials.

The approach contrasts with both India’s greenfield DPI development and MOSIP-based deployments that begin with a new open-source identity foundation. Colombia offers an emerging model of digital public infrastructure built around existing national assets, not wholesale replacement.

Colombia is assembling the components of a sovereign DPI stack while retaining control of core public infrastructure. The country’s participation in initiatives such as 50-in-5 reflects a broader shift toward interoperability, user consent and digital sovereignty.

The next challenge is in scaling past pilots and infrastructure build-out to widespread adoption in a country where cash remains dominant and digital inclusion gaps persist. Whether Colombia becomes a model for DPI modernization will ultimately depend on the institutions, businesses and citizens taking up the infrastructure it has built over years.

Article Topics

50-in-5  |  Colombia  |  data protection  |  digital ID infrastructure  |  digital identity  |  digital public infrastructure  |  OpenID Connect  |  verifiable credentials  |  X-Road