Coljuegos and the Cedula-Based Single-Account Rule: How Colombia Achieves Cross-Operator Self-Exclusion

Colombia’s online gambling regime does not operate a separately branded national self-exclusion register in the manner of Spain’s RGIAJ, Sweden’s Spelpaus, or France’s Interdiction Volontaire. What it operates instead is something structurally more embedded: a cedula-indexed single-account architecture that, as a matter of regulatory design, prevents a person barred by one concesionario from gaining admission through any other. Understanding this mechanism requires understanding the concession-contract model that underlies all Colombian internet gambling, the identity obligations it imposes at account creation, and the centralised reporting infrastructure through which Coljuegos enforces those obligations across the market.

Constitutional Foundations: The Monopolio Rentístico

Colombian online gambling derives its legal basis from Article 336 of the 1991 Political Constitution, which establishes that games of luck and chance (juegos de suerte y azar) constitute a rentistic monopoly of the Colombian state. The exploitation of that monopoly is governed by Ley 643 de 2001, which assigns the administration of nationally-scoped gambling to a specialised state entity. That entity, Coljuegos (Empresa Industrial y Comercial del Estado Administradora del Monopolio Rentístico de los Juegos de Suerte y Azar), was formally created by Decreto-ley 4142 de 2011, modified by Decreto 1451 de 2015. Its statutory object is, in the words of the decree, “la explotación, administración, operación y expedición de reglamentos de los juegos que hagan parte del monopolio rentístico sobre los juegos de suerte y azar que por disposición legal no sean atribuidos a otra entidad.”

The concession-contract model flows directly from this constitutional architecture. Private entities do not hold licences to operate internet gambling independently. They hold contratos de concesión granted by Coljuegos, under which they exploit the monopoly on the state’s behalf and return a percentage of revenues to fund the national health system. As of the 2020 regulatory framework, 16 operators held such concessions and the platform had generated over 2.8 million active accounts, by mid-2026, Coljuegos’s own public data shows at least 17 active concesionarios following the authorisation of new entrants including MrYoker under concession contract C2261 de 2026.

How the Cedula Ties a Player to One Account Across the Market

The cedula de ciudadanía (CC) is Colombia’s national identification document, assigned uniquely to each citizen and to foreign nationals through an equivalent resident identifier. Under the Coljuegos internet gaming framework, account registration is conditional on verified identity, with the cedula number serving as the primary identifier. Each concesionario is permitted to register one active account per cedula. The practical effect is that a single physical person cannot hold parallel active accounts across the same operator’s platform, nor, because the cedula is the universal key against which all accounts are indexed, is it straightforward for that person to hold accounts at multiple concesionarios under different nominal identities.

This is architecturally distinct from models where operators maintain independent identity databases with no cross-operator visibility. In Colombia’s concession model, Coljuegos occupies the apex of the data hierarchy. Concesionarios transmit player account data to Coljuegos’s centralised infrastructure, including through the Portal del Operador and the anti-money-laundering reporting platform known as SIPLAFT. That transmission requirement gives Coljuegos visibility across the entire licensed market against a common cedula index, rather than requiring a separate self-exclusion register to aggregate cross-operator data after the fact.

The cross-operator protection in Colombia is not administered through a post-registration opt-in process. It is built into the account creation step: a person whose cedula is flagged at any point in the Coljuegos-administered system carries that flag into every concesionario’s onboarding check.

Prohibited Persons: Who Is Blocked and on What Basis

The categories of persons whose cedulas should not result in a valid account are established by the concession framework and reinforced by Coljuegos’s reglamentos. They include minors (persons under 18 years of age), persons who have voluntarily self-excluded, and persons designated as legally prohibited from gambling participation. Resolución 19054/2023, Coljuegos’s advertising guidelines for sports betting (Lineamientos de Publicidad en las Apuestas Deportivas), reaffirms the advertising-facing dimension of this prohibition: operators must not direct promotional communications to these persons and must include juego responsable warnings in all marketing materials. The responsible gambling mandate extends across all channels, including digital and physical media, and explicitly prohibits targeting minors or advertising near schools or health centres.

For self-exclusion specifically, the Coljuegos framework provides for voluntary exclusion at the concesionario level. When a player submits a self-exclusion request, the concesionario is required to record and implement the exclusion, and that status forms part of the player’s account record within the Coljuegos data infrastructure. Because concesionarios report against the same Coljuegos-administered cedula registry, a player whose cedula carries a self-exclusion status cannot re-create an account at a different concesionario without that status becoming visible at the point of identity verification. This is the mechanism by which the cedula-based architecture produces what compliance teams elsewhere would recognise as cross-operator self-exclusion, even though Colombia does not maintain a separately administered exclusion register with its own API specification and query protocol.

The Operator Query Workflow: Account Creation and Ongoing Verification

The practical compliance workflow for concesionarios operates in two phases. At account creation, the concesionario must verify the applicant’s cedula number through the Coljuegos platform infrastructure before the account can be activated. Under the concession framework, this verification serves multiple purposes simultaneously: age confirmation (establishing the person is 18 or older), identity authentication against the national civil registry (Registraduría Nacional del Estado Civil), and cross-referencing against any prohibitions or self-exclusion status held within the Coljuegos system. An account that fails any of these checks cannot proceed to activation under the relevant reglamento.

At transaction level, Acuerdo 04 de 2020 confirms that each bet placed through an internet platform must be traceable to a registered player account, with the player’s geographic location recorded against their registration data for prize payment and regulatory purposes. The geographic registration requirement specifically mandates recording the código DANE of the municipality and department corresponding to the player’s registration, further tethering each account to a verified real-world identity rather than a self-reported one. This per-transaction traceability requirement means the cedula identifier functions as an ongoing anchor for all platform activity, not merely an onboarding credential.

Ongoing monitoring obligations flow through the SIPLAFT system, Coljuegos’s dedicated AML and financial intelligence infrastructure, and through the Portal del Operador, which functions as the primary reporting channel for account-level and transactional data. Concesionarios transmitting data through these channels create the audit trail that Coljuegos uses for both supervisory and enforcement purposes. In practice, the Portal del Operador also serves as the channel through which Coljuegos can communicate updated compliance requirements to operators, completing the supervisory loop that makes the single-CC mechanism operationally effective across the market.

What the Audit Trail Covers

Compliance teams entering the Colombian market need to understand what the Coljuegos data infrastructure requires them to record and transmit, and how that record-keeping obligation intersects with the responsible gambling architecture. Under the concession framework, each bet must be registered in the Sistema Central del Juego with a level of detail equivalent to what is required at physical point-of-sale terminals. For internet channels specifically, Acuerdo 04 de 2020 confirms that the information must include the confirmation mechanism by which the player validated the bet before the ticket was issued, and must record the geographical code of the player’s registered location.

Account-level records must capture the cedula number as the primary identifier, the player’s geographic registration data, and the full transaction history. The concession framework also requires records to reflect account status changes as they occur. This creates a continuous audit trail covering both the financial dimension of player activity and the responsible gambling dimension: whether the operator checked the player’s status at the relevant trigger points, whether self-exclusion was recorded and implemented, and whether marketing was directed to excluded persons in breach of Resolución 19054/2023.

The audit trail obligation in Colombia is best understood as a single continuous record, not as separate compliance tracks for AML, KYC, and responsible gambling. The cedula identifier threads all three tracks into one account-level history that Coljuegos can interrogate through the Portal del Operador.

Comparative Context: How Colombia’s Architecture Differs from Other National Registers

Compliance officers familiar with Europe’s dedicated national self-exclusion registers will notice several structural differences in Colombia’s approach. Spain’s RGIAJ (Registro General de Interdicciones de Acceso al Juego), established under Ley 13/2011, is an independently administered register that operators must query at defined intervals, the DGOJ publishes technical data specifications and operators must build API connectivity into their platforms. Sweden’s Spelpaus operates through a comparable query model, and Spelinspektionen’s SIFS 2026:3, which formalises API query obligations for Swedish licensees at three defined trigger events, illustrates how far prescriptive specification can extend. France’s Interdiction Volontaire, administered by the ANJ, follows the same operator-query approach. Ontario’s BetGuard, which launched in May 2026, is a centrally administered portal with mandatory cross-operator effect.

Colombia’s architecture achieves a comparable cross-operator outcome through a different structural route: rather than maintaining a separate exclusion register that operators query, Coljuegos maintains the master player database against which all concesionarios must verify at account creation. The exclusion effect is therefore upstream of the gambling session rather than a pre-session query against a separate register. In practice, this means the compliance burden on the concesionario at account creation is higher than in a pure query model, because the operator is not simply checking one register but is onboarding the player into a system where all of their data, including any exclusion status, is transmitted to and managed by Coljuegos directly. The ongoing session-level check is less formally specified than in jurisdictions with explicit API query obligations, which is an area where operators applying European-market standards may find Colombia’s framework less prescriptive on technical detail.

By contrast, markets such as Curaçao and most US state frameworks maintain operator-level self-exclusion programs without a structural cross-operator mechanism. Colombia’s concession architecture, by virtue of the single cedula index, is structurally closer to the European national register model than to the operator-level model, despite not maintaining a separately branded register. For the broader LATAM licensing context, including how Brazil’s federal-permit model and Peru’s local-presence operating licence compare on player protection design and entry costs, the Brazil Bets Act compliance reference covers the federal licensing obligations operators face in the region’s largest regulated market.

Juego Responsable Obligations for Concesionarios

Beyond the account-creation and exclusion architecture, concesionarios carry a suite of affirmative responsible gambling obligations under the Coljuegos framework. Resolución 19054/2023 is the primary instrument for advertising compliance, and its requirements have direct responsible gambling implications. Concesionarios must include a mensaje de juego responsable in all advertising materials and must ensure that all promotional communications are limited to audiences of legal age. Segmentation strategies are specifically recommended to prevent advertising from reaching minors across digital platforms.

The prohibition on false perceptions of gratuitous play (falsas percepciones de gratuidad en el juego) and on misleading communications about game characteristics reinforces the responsible gambling framing: operators must not represent promotional mechanics in ways that distort the player’s understanding of the product. This includes bonus and free-play structures that might create unrealistic expectations about winning probability. Advertising near schools or health centres is expressly prohibited under the relevant provision of Resolución 19054/2023. These obligations apply to all channels, including digital, broadcast, and physical point-of-sale, and apply during major sporting events that might otherwise drive promotional intensity, as the resolution was issued specifically in the context of the Copa América, UEFA European Championship, and Paris 2024 Olympics.

Coljuegos has also maintained cross-sector coordination on responsible gambling, including a first Mesa de Juego Responsable (Responsible Gambling Roundtable) and ongoing cooperation with the UIAF (Unidad de Información y Análisis Financiero), Colombia’s financial intelligence unit, under a formal convenio. These cooperation mechanisms reinforce the audit trail requirements by aligning the AML and responsible gambling reporting frameworks under a common supervisory umbrella.

Operational Risks and Compliance Gaps

The cedula-based architecture is structurally robust, but compliance teams should be clear-eyed about its practical limitations. The effectiveness of the cross-operator exclusion mechanism depends on the quality and timeliness of data transmission through the Portal del Operador. If a concesionario delays reporting a self-exclusion status, there is a window during which the affected player’s cedula does not yet carry the exclusion flag in the Coljuegos system, creating a gap that a different concesionario’s onboarding check would not detect. The Colombian framework does not publicly specify latency requirements for exclusion propagation, which is a point compliance officers should raise with Coljuegos through the formal correspondence process when entering the market.

A second operational risk concerns identity substitution. The cedula-based model assumes that the person presenting the identity document at account creation is the genuine document holder. Coljuegos requires verification against the Registraduría Nacional del Estado Civil database, but the robustness of that verification in practice depends on the technical integration each concesionario maintains. Operators applying European-market KYC standards should ensure their Colombian operation meets at minimum the same identity verification depth, even where the Coljuegos specification may be less prescriptive in technical terms.

The VAT volatility that has affected the Colombian market since 2025 has added a further compliance dimension. A 19% VAT on deposits introduced in 2025 caused a reported 30% decline in online GGR before the Constitutional Court suspended the measure, the government subsequently imposed a 16% VAT on GGR through emergency Decree 0240, according to reporting by iGaming Business in May 2026. While tax architecture sits outside the responsible gambling framework directly, significant shifts in player economics can alter problem gambling risk profiles, and compliance teams should factor tax-driven market disruptions into their responsible gambling monitoring and reporting obligations under the concession contract terms.

Key Resources

Ley 643 de 2001 (Régimen propio del monopolio rentístico de los juegos de suerte y azar), Congreso de Colombia. Available via Función Pública: www.funcionpublica.gov.co.

Decreto-ley 4142 de 2011 (Creación de Coljuegos), Presidencia de la República de Colombia. Available via Función Pública.

Acuerdo 04 de 2020 (Comercialización de juegos operados por internet, adición a Acuerdos 08/2014 y 03/2019), Junta Directiva de Coljuegos. Diario Oficial No. 51.293, 22 April 2020. Available via www.coljuegos.gov.co.

Resolución 19054/2023 (Lineamientos de Publicidad en las Apuestas Deportivas), Coljuegos. Available via www.coljuegos.gov.co.

Compliance teams entering the Colombian market should obtain current versions of all active concession reglamentos directly from Coljuegos and engage qualified Colombian legal counsel for jurisdiction-specific application of the framework described in this article. For a detailed review of portal integration requirements and operator onboarding timelines, contact Coljuegos through the formal correspondence channel listed on its website, or consult our companion article on Portal del Operador integration and reporting protocols.