How to Verify Colombian Supplier Bank Accounts: NIT and RUES

Colombia rewards the buyer who checks and punishes the one who does not, in unusually direct terms. Its company registers are among the most open in Latin America — you can confirm a supplier exists, who is authorised to sign for it, and whether its registration is current, all free. But if the tax authority declares your supplier a proveedor ficticio, every invoice it issued you loses its fiscal validity, your costs are disallowed and your VAT credit is denied — and paying in good faith is no defence. This guide covers the account layer, the company layer, and the rule that turns supplier verification into tax protection.

Sources: Estatuto Tributario, Articles 671 and 88; Ley 1727 de 2014 (RUES); Banco de la República, Bre-B.

The account layer

Colombia has no IBAN. A domestic account is identified by the bank and an account number whose length varies by institution, so there is no single structure to validate and no checksum to rely on the way there is with a Mexican CLABE or a European IBAN.

Domestic transfers run through the ACH, and until recently the fast-payment options were fragmented — Transfiya for person-to-person immediate transfers, and separate rails for the cooperative sector. Traditional transfers to another bank by account number could take until the next business day.

Bre-B: the new instant-payment system

In 2025 the Banco de la República launched Bre-B, a unified instant-payment system built to interoperate across every bank and wallet in the country. Like Brazil's Pix, it routes on a llave — a key that can be a mobile number, an identity document, an email or a bank-assigned alphanumeric code — rather than requiring the full account number.

Two things matter for a buyer. First, the account number does not disappear. Bre-B sits on top of the existing account infrastructure; the key is an alias, and the account it points to is still the thing that receives the money. Second, when a supplier registers a key, the system verifies that the person registering owns the account, using identity checks. That protects the supplier's key from being hijacked — but it is not a service that lets you, the payer, confirm that a key belongs to the company you intend to pay.

For an international payment, Colombia uses SWIFT with the receiving bank's BIC and the account number; there is no IBAN to supply. As in much of Latin America, the beneficiary's tax identification number is typically required on the instruction.

The company layer: NIT, and the check digit

Every Colombian taxpayer is identified by a NIT — Número de Identificación Tributaria — assigned by the tax authority, the DIAN, when the entity registers in the RUT (Registro Único Tributario). The NIT is the spine of every check that follows, and it has a feature worth using.

The NIT is a nine-digit base plus a single dígito de verificación (DV), written after a hyphen — for example 900.123.456-7. The DV is derived from the base by a fixed DIAN algorithm, so a transposed digit or a DV that does not match the base fails arithmetically. Electronic invoicing systems reject a NIT whose DV is wrong, which is why the check digit should always be captured and stored, not discarded as punctuation.

RUES: the register you can actually search

Company existence in Colombia is proven through the Chambers of Commerce, and their records are consolidated into the RUES — Registro Único Empresarial y Social — administered by Confecámaras and fed by all of the country's chambers. The basic consultation is free and public by law under Ley 1727 de 2014, searchable by NIT, name or document number.

A RUES search returns the razón social, the NIT, the status of the mercantile registration — active, cancelled or suspended — the chamber where the entity is registered, the registration date and the economic activity by CIIU code. It also lets you check for homonymy: because similar names can legitimately coexist across chambers and cities, the NIT is what disambiguates two companies that look alike.

Reading the RUT for tax responsibilities

The RUT does more than issue the NIT. It records the taxpayer's responsabilidades — the tax regimes and obligations the entity is registered for, including whether it is responsible for VAT (IVA) and whether it acts as a withholding agent. This matters directly to a buyer, because it determines the retención en la fuente — the withholding you may be obliged to apply when you pay. Contracting on the wrong assumption about a supplier's regime creates a withholding error that is yours, not theirs.

Article 671: the fictitious-supplier rule

This is the provision that makes Colombian supplier verification a financial control rather than good housekeeping.

Article 671 of the Estatuto Tributario, read with Article 88, lets the DIAN formally declare a taxpayer in one of two categories. A proveedor ficticio — fictitious supplier — is a taxpayer that invoiced sales or services that were simulated or never existed. A proveedor insolvente is one that transferred its assets to third parties to escape collection of its tax debts. The declaration is made by a formal resolución sanción, after a month for the taxpayer to respond to the charges, and is published once administrative review is exhausted.

The consequence for a buyer is identical in both cases, which is why the insolvent category matters: a supplier stripping its assets to dodge the tax authority is exactly the profile that also tends to route payments through changing accounts.

The timing is more precise than Mexico's, and worth getting right. The disallowance runs from the date the declaration is published in a newspaper of wide national circulation — the wording of both Article 671 and Article 88 is prospective, not retroactive. Purchases made from that date forward lose deductibility and the VAT credit.

That is not the same as saying earlier invoices are safe. The DIAN keeps its general powers to audit prior periods under Article 684, and the general anti-abuse rule remains available, so if the authority concluded a supplier's operations were simulated it can still challenge past transactions — but through those routes, not through Article 671 reaching backwards. And good faith is not a shield in either direction: Colombian doctrine is explicit that trusting the counterparty does not relieve you of responsibility before the DIAN. What protects you is documentary evidence that each operation was real.

How to use the DIAN information

The DIAN publishes acts relating to fictitious-supplier declarations and their removal, which lets you check whether a counterparty has been linked to this conduct. The practical posture that Colombian accountants recommend is a verification routine rather than a one-off:

• Confirm the supplier's RUT is active and its RUES registration current before the first payment.
• Check the supplier against the DIAN's fictitious-supplier information.
• Keep the materiality file — contracts, purchase orders, transport documents, delivery records, and traceable electronic payment — as the operation happens, not afterwards.
• Re-review critical suppliers periodically, because a declaration can land after onboarding.

SAGRILAFT: when checking suppliers is the law, not a choice

For a large class of Colombian companies, supplier due diligence is not a prudent habit — it is a supervised legal obligation, and one that reaches foreign parent groups whose Colombian subsidiaries qualify.

SAGRILAFT — Sistema de Autocontrol y Gestión del Riesgo Integral de Lavado de Activos, Financiación del Terrorismo y de la Proliferación de Armas de Destrucción Masiva — is the anti-money-laundering regime the Superintendencia de Sociedades imposes on real-sector companies through Chapter X of its Circular Básica Jurídica. Companies that cross defined income or asset thresholds must implement it; a set below those thresholds must implement a lighter Régimen de Medidas Mínimas.

The practical consequence is that if your Colombian entity is an empresa obligada, verifying a supplier's identity, ownership and status is a documented control you must be able to evidence to a supervisor — not an internal preference. And because the standard is risk-based and continuous, a supplier cleared at onboarding has to be kept under review. This is the same monitoring logic the fictitious-supplier rule creates for tax, arriving from a second direction: two independent Colombian regimes both point at knowing, and re-checking, who your suppliers really are.

Verifying the invoice: the CUFE

Colombia has mandatory electronic invoicing, and every valid factura electrónica carries a CUFE — Código Único de Factura Electrónica — a unique code generated and validated against the DIAN. A related code, the CUDE, identifies supporting electronic documents.

The CUFE lets you confirm an invoice was genuinely authorised by the DIAN rather than fabricated, and Colombia's RADIAN system records the events in an invoice's life — issuance, receipt, acceptance — which adds traceability where it applies. For a first invoice from a new supplier, verifying the CUFE closes the loop between the invoice, the NIT and the entity.

What an account check will not catch

Confirming a Colombian account number, or seeing a Bre-B key resolve, tells you the money will arrive somewhere. With no national payee-name check, it does not confirm the account belongs to the company you intend to pay.

And it tells you nothing about the exposure that actually costs money in Colombia. The account can be valid while the supplier's RUES registration is cancelled, its legal representative is not the person signing your contract, its RUT is suspended, or the DIAN has declared it a fictitious supplier and your deductions are about to be disallowed. There are several company red flags a bank account match alone will not catch, and Colombia gives several of them a direct fiscal price — and, for obligated companies, a supervisory one.

A practical verification workflow

For a new Colombian supplier, or a change to an existing one, a defensible sequence looks like this:

1. Validate the NIT and its check digit. Confirm the DV matches the base. A mismatch is a data error to resolve before anything else.
2. Search the RUES. Confirm the company exists, the mercantile registration is active, and the razón social matches the invoice. Free.
3. Check the RUT at the DIAN. Confirm the tax registration is active and read the responsabilidades to establish your withholding position.
4. Request the certificado de existencia y representación legal. Confirm who is authorised to sign and any limits on that authority.
5. Screen against the DIAN's fictitious-supplier information. Before the first payment, and periodically thereafter.
6. Verify the CUFE. Confirm the electronic invoice was authorised by the DIAN, at least for the first invoice.
7. Identify the beneficial owners where your entity is subject to SAGRILAFT or the Régimen de Medidas Mínimas, applying intensified diligence to higher-risk counterparties.
8. Build the materiality file as you go. Contracts, purchase orders, transport and delivery evidence, and traceable electronic payment.
9. Confirm the account and re-verify on change. With no payee-name check, a request to change bank details is the highest-risk moment; re-confirm through a channel you already hold.

Frequently asked questions