CFA Móvil API integration services (OpenFinance Colombia)

Login & key management

CFA Móvil uses a 4-digit start key plus a separate transactional key (fixed, SMS-OTP, or e-mail OTP). We wrap that dual-key flow in a session broker, expose a refresh endpoint, and surface key-recovery callbacks so your stack does not have to model each variant.

Statement export & reconciliation

Export movements for savings, CFA Express, “más cupo”, credit and bill-payment journeys to JSON or Excel. Movement metadata includes counterparty alias, channel (PSE, QR, Bre-B), and the fee disclosed at confirmation time, so accountants can match every line.

Bre-B & PSE payment rails

Bre-B (Banco de la República’s instant rail) went live on 6 October 2025 and now interoperates with five SPBVIs. We expose a unified send/receive endpoint plus a PSE button proxy so your checkout can quote both options without duplicating logic.

Debit card & cardless ATM

Block or replace the CFA debit card, generate cardless-withdrawal codes, and stream lifecycle events as webhooks. Useful for fraud-response automations and customer-service portals that need a one-click freeze.

CFA Express onboarding

A documented public-API flow for opening an electronic-money deposit using only the partner’s national-ID document and mobile number, mirroring the in-app “CFA Express” entry point that bypasses the full associate KYC.

Recharges & agreement bill-pay

Top-up cellular minutes and run bill payments against CFA’s agreement catalogue (utilities, education, public services). We surface the catalogue as a queryable list so your UI can show the same agreement codes the app exposes.

Scenario 1 — Accounting sync for SMEs in Antioquia

Local SMEs that hold contributions and a credit line with CFA need monthly bookkeeping to land in Siigo or Alegra. We pull statements via POST /api/v1/cfa/statement, normalize counterparty aliases (Bre-B handle vs. cooperative member), and push journal entries through the accounting partner’s SDK. This maps directly to the OpenFinance “transactional data” phase the SFC sequenced from 2024 onward.

Scenario 2 — Bre-B-aware checkout for fintech merchants

A Colombian PSP needs to quote both Bre-B and PSE at checkout. We brokered a single endpoint that returns a payment intent, the Bre-B QR payload and PSE handoff URL together; the merchant resolves whichever the buyer chooses. Settlement notifications fan out as webhooks signed with HMAC-SHA256, mirroring the OpenBanking event model used in Pix and UPI ecosystems.

Scenario 3 — Multi-cooperative consent dashboard

Wealth-management tools that aggregate balances across CFA and other cooperativas need a consent ledger compatible with SFC Circular 004. We wire CFA Móvil authorizations into a central consent store so each token carries scope, expiry, and revocation hooks, and we expose a /consents endpoint to renew or revoke without forcing the user back into the mobile app.

Scenario 4 — Credit-scoring enrichment

Lenders evaluating thin-file applicants in Medellín can pull 6–24 months of CFA Express movements and savings cadence as a signal layer. Outputs feed a scoring model alongside DataCrédito / TransUnion Colombia bureau data. Because CFA is a regulated cooperative, the OpenFinance contract is legally cleaner than scraping screenshots of statement PDFs.

Scenario 5 — Cross-border remittance reconciliation

Spanish or US-based remittance operators sending money to Colombian beneficiaries can reconcile arrivals into CFA Express by polling the statement endpoint with a reference filter, then auto-confirm the corridor leg. Latency is sub-minute when paired with Bre-B settlement webhooks.

Authentication broker (start key + transactional key)

POST /api/v1/cfa/session
Content-Type: application/json

{
  "document_type": "CC",
  "document_number": "10**********",
  "start_key": "<4-digit numeric>",
  "device_id": "1f0a-...-ab",
  "channel": "cfa-movil"
}

200 OK
{
  "access_token": "eyJhbGciOi...",
  "refresh_token": "rt_5c...",
  "expires_in": 1800,
  "tx_key_required": true,
  "tx_key_mode": "OTP_SMS"
}

Statement query (movements export)

POST /api/v1/cfa/statement
Authorization: Bearer <ACCESS_TOKEN>

{
  "product_id": "savings:1234",
  "from_date": "2026-03-01",
  "to_date":   "2026-03-31",
  "channels":  ["BRE_B","PSE","ATM","APP"],
  "page_size": 100
}

200 OK
{
  "items": [
    {
      "id": "mov_9f...",
      "posted_at": "2026-03-04T18:21:09-05:00",
      "amount_cop": 250000,
      "channel": "BRE_B",
      "counterparty_alias": "carlos@bancolombia",
      "fee_cop": 0,
      "balance_after_cop": 1842300
    }
  ],
  "next_cursor": "cur_..."
}

Bre-B transfer webhook

POST {your_webhook}
X-Cfa-Signature: t=1715300000,v1=hmac-sha256(payload, secret)

{
  "event": "bre_b.transfer.settled",
  "data": {
    "ref": "bb_2026_05_04_001",
    "amount_cop": 120000,
    "from_key": "3001234567",       // mobile
    "to_key":   "andres@correo.co", // email
    "settled_at": "2026-05-04T13:11:02-05:00"
  }
}

Colombian regulatory anchor points

Integrations follow the framework set by the Superintendencia Financiera de Colombia (SFC): External Circular 004 of 2024 on Open Finance architecture, Decree 0368 of 2025 making the regime mandatory for SFC-supervised entities, and External Circular 001 of 2026 which extends the transition timeline from 18 to 30 months. Habeas Data Law 1581 of 2012 governs personal-data handling end-to-end.

Bre-B alignment

Bre-B is operated by Banco de la República and went live on 6 October 2025. Our wrapper preserves the canonical four key types (document, mobile, e-mail, alphanumeric) so consent records remain portable across the 218+ participating entities and the five fully interoperated SPBVIs.

Nequi

Bancolombia’s digital spin-off, around 24 million users; processes tens of millions of daily Bre-B transactions and is usually paired with CFA in cross-wallet remittance flows.

Daviplata

Davivienda’s wallet, focused on financial inclusion; useful as a counterparty source in CFA Móvil statement-export reconciliation.

Bancolombia App

The flagship Bancolombia retail-banking app; integrators typically aggregate CFA savings balances next to Bancolombia checking for unified treasury dashboards.

MOVii

One of the three leading neobanking platforms in Colombia; widely used in P2P and recharge flows that also appear in CFA Móvil bill-payment data.

Lulo Bank

A digital-native bank offering savings and personal loans; commonly integrated alongside CFA for credit-comparison and rate-shopping tools.

Nu Colombia

Nubank’s Colombian operation, currently a top-three finance app on Google Play and iOS; cross-platform statement export is a typical extension request.

RappiPay

Rappi’s payment app, available across Latin America; appears as counterparty on QR-person and merchant flows that feed into CFA Móvil movements.

Mercado Pago Colombia

MercadoLibre’s wallet; e-commerce reconciliations frequently need a joined view of CFA cooperative payouts and Mercado Pago settlements.

Wompi

A Bancolombia-affiliated payment gateway; merchants taking Bre-B through Wompi often reconcile against CFA Móvil statements on the buyer side.

Deliverables checklist

• OpenAPI 3.1 specification for every endpoint above
• Protocol analysis report (start-key + transactional-key flow, refresh, key-recovery)
• Runnable Python and Node.js clients (login, statement, Bre-B send/receive)
• Postman / Bruno collection plus a Bre-B sandbox harness
• Habeas Data & SFC Circular 004 compliance notes

About us

OpenFinance Lab is an independent studio focused on Latin American fintech and open-data API integration. The team blends payments, protocol analysis, and platform-engineering experience from banks, PSPs, and cloud providers. We know SFC, Banco de la República, NPCI UPI, Pix, and CBPR contracts, and we ship financial APIs under security and compliance constraints.

• Source-code delivery from $300 — runnable API source and full documentation, paid after delivery upon satisfaction
• Pay-per-call API billing — call our hosted endpoints, pay only for what you use, no upfront fee
• Full pipeline: protocol analysis → build → validation → compliance review