What the CRC decided and why
CRC Resolution 8308 of July 30, 2026, published that same day in Diario Oficial No. 53,569, amends the framework of Resolution 5050 of 2016 to fight fraud on mobile networks. The goal is to reduce spoofing calls and messages (people posing as banks, government agencies or companies) and to give users back the confidence to answer the phone.
The rule splits obligations between network and service providers (PRST), that is, mobile operators, including mobile virtual network operators, and the companies that call their customers for commercial purposes. According to the CRC, implementation is gradual: some measures at three months, others at six and others at twelve, plus one that depends on a later decision.
What starts now: the three-month measures
The three-month deadline, counted from publication in the Diario Oficial, expires at the end of October 2026. By that date operators must have three measures up and running:
- «Alerta de llamada sospechosa» (suspicious call alert). The originating operator must monitor its voice traffic in real time. If it detects patterns such as unusual volumes, many short back-to-back calls (typical of robocalls), numbers linked to fraud or masking of national numbering, the call reaches the recipient's screen with this label. The flag is temporary and cannot last more than one month after the pattern disappears.
- «Llamada con fines publicitarios» (advertising call). Companies that call customers for commercial purposes had to notify their operator during the first month to be entered in a registry. Operators then had the following two months to configure it. Since the deadline, those calls are displayed with this label.
- Blocking of unauthorized numbers used as caller ID (CLI). Each operator must maintain a Do Not Originate (DNO) list and block calls that display numbers not allocated, not assigned, not granted by the CRC or reserved only for receiving calls. This is the CLI blocking that has been talked about the most.
In addition, operators must submit to the CRC, no later than one month after the deadline, a technical report proving that the systems are operating.
What does not start yet
Some announced measures do not start with this first phase:
- Blocking international calls that pose as Colombian numbers. The resolution orders the blocking of calls coming from abroad that display a number from Colombia's numbering plan, except identified roaming. This measure will only be enforceable three months after a later resolution on roaming parameters takes effect. The CRC says it will come «later».
- Monitoring of bulk messages sent from ordinary 10-digit lines. It arrives at six months, around the end of January 2027, together with an educational microsite.
- Identification and validation of business messages (A2P). It has a twelve-month deadline, but it is counted from the issuance of the act that defines how that system will be paid for.
If your line is flagged as suspicious
The rule provides a review procedure. The line holder has ten business days from notification to ask the operator to review the flag, proving that its use is legitimate. The operator in turn has up to ten business days to decide. If it concludes that the calls are commercial, it changes the label to «Llamada con fines publicitarios».
If the holder does not request a review or cannot justify the behavior, the operator may terminate the voice service contract, giving at least five business days' notice. The label stays active while the review is processed. In addition, every six months operators will send the Superintendence of Industry and Commerce (SIC) the information on calls labeled as advertising, which will be used to monitor compliance with the Registro de Números Excluidos (Colombia's do-not-call registry).
What it means for companies in Colombia and Latin America
For companies that sell or collect payments by phone, the takeaway is practical:
- Only call with assigned numbering. Displaying made-up, unassigned or receive-only numbers will get the call blocked.
- Register your campaign numbers with your operator. That way your calls arrive identified as advertising and not as suspicious.
- Organize your campaigns. Many short back-to-back calls from the same number are exactly the pattern that triggers the alert. Spread out the volume and respect the Registro de Números Excluidos.
- Have your operation's documentation ready in case you need to request a review within the ten business days.
For end users it is good news: fewer spoofing calls and more information to decide whether to answer. At 19 80 TIC Cloud, as a mobile virtual network operator, we provide directly assigned mobile numbering and support our corporate customers in registering and organizing their campaigns. If you want to dig deeper, you can also read our guide on phone fraud on IP PBXs.
