Cybersecurity Risk Management and Strategy Disclosure	12 Months Ended
Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]	In an increasingly digital and regulated environment, at Grupo Aval and its subsidiaries, cybersecurity risk management is an integral part of our enterprise risk management program. We establish policies, methodologies, and procedures aligned with local regulations, international standards, and industry best practices. In recent years, we have significantly expanded our capabilities to counteract the increasing number of attempts to breach our security barriers, the growing use of the Internet and automated processes, and the diversification of financial transaction channels. Our cybersecurity risk management framework provides a structured approach for handling threats and incidents, including those linked to third-party service providers. It includes steps for assessing the severity of threats, identifying their sources, implementing mitigation strategies, and informing management and the Board of Directors of material cybersecurity risks. We and our financial subsidiaries engage third-party security experts for risk assessment and system enhancements. Additionally, our cybersecurity team provides annual training to all employees. One of the greatest cybersecurity risks in 2025 was the increasing sophistication of AI-based attacks, which are growing exponentially in speed and success rate. Quantum computing also presents a significant risk, as it threatens to render current cryptographic protocols obsolete, posing substantial security challenges for data and communication systems. Grupo Aval actively monitors and mitigates these risks through a robust control environment based on industry best practices, specialized security frameworks, and proactive measures. To mitigate the risks associated with the growing use of digital channels and prevent cyber-fraud, in 2025, we launched initiatives that included strengthening Digital Banking Security Innovation by defining new authentication and authorization models. As part of this effort, more than 25 leading market technologies were reviewed together with the Grupo Aval entities. These advances will enable us to enhance the usability of digital products and improve our customers’ experience. We began the Security Architecture Diagnostic initiative using a Security-by-Design approach to reinforce our assurance strategy for the cloud environments used by Grupo Aval and its subsidiaries. We also conducted the first cyber risk quantification exercises for seven entities within the Grupo Aval, allowing us to prioritize and support decision-making in cybersecurity risk management. Additionally, we initiated strengthening the governance model, methodology, and assessment criteria used to classify more than 230 critical suppliers that form part of our value chain. Furthermore, we continued the process of centralizing the cybersecurity capabilities of the entities into our Security Operations Center (“SOC”), together with the CSIRT (“Computer Security Incident Response Team”) functions. This effort enables us to leverage operational synergies and advance toward a more efficient economic model, generating comprehensive benefits for the Grupo Aval.
Cybersecurity Risk Management Processes Integrated [Flag]	true
Cybersecurity Risk Management Processes Integrated [Text Block]	In an increasingly digital and regulated environment, at Grupo Aval and its subsidiaries, cybersecurity risk management is an integral part of our enterprise risk management program. We establish policies, methodologies, and procedures aligned with local regulations, international standards, and industry best practices. In recent years, we have significantly expanded our capabilities to counteract the increasing number of attempts to breach our security barriers, the growing use of the Internet and automated processes, and the diversification of financial transaction channels. Our cybersecurity risk management framework provides a structured approach for handling threats and incidents, including those linked to third-party service providers. It includes steps for assessing the severity of threats, identifying their sources, implementing mitigation strategies, and informing management and the Board of Directors of material cybersecurity risks.
Cybersecurity Risk Management Third Party Engaged [Flag]	true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag]	true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag]	false
Cybersecurity Risk Board of Directors Oversight [Text Block]	Throughout 2025, the Board of Directors of our financial subsidiaries has overall oversight of cybersecurity risk management. This responsibility is delegated to the Cybersecurity and Information Security Committee and its equivalents at the Board level. These committees ensure that management has processes in place to identify and evaluate cybersecurity risks, implement mitigation strategies, and report material cybersecurity threats to the Board and the Corporate Vice-Presidency of Risk and Compliance. Grupo Aval’s Board of Directors has designated a member to oversee cybersecurity risk management at a corporate level. Management is responsible for continuously assessing material cybersecurity risks, monitoring potential exposures, implementing mitigation measures, and maintaining cybersecurity programs. Our cybersecurity programs are directed by the Corporate Vice-Presidency of Risk and Compliance and the Corporate Vice-Presidency of Cybersecurity. These teams consist of certified and experienced professionals in information systems security and cybersecurity risk management.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block]	Cybersecurity and Information Security Committee
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]	Throughout 2025, the Board of Directors of our financial subsidiaries has overall oversight of cybersecurity risk management. This responsibility is delegated to the Cybersecurity and Information Security Committee and its equivalents at the Board level. These committees ensure that management has processes in place to identify and evaluate cybersecurity risks, implement mitigation strategies, and report material cybersecurity threats to the Board and the Corporate Vice-Presidency of Risk and Compliance. Grupo Aval’s management, including the Vice Presidency of Risk and Compliance and cybersecurity teams, regularly update their Boards of Directors and Cybersecurity and Information Security Committees on the company’s cybersecurity programs, risks, and mitigation strategies. Reports are provided semi-annually or quarterly in some subsidiaries, covering third-party assessments, developments in cybersecurity, and updates to mitigation strategies.
Cybersecurity Risk Role of Management [Text Block]	Management is responsible for continuously assessing material cybersecurity risks, monitoring potential exposures, implementing mitigation measures, and maintaining cybersecurity programs. Our cybersecurity programs are directed by the Corporate Vice-Presidency of Risk and Compliance and the Corporate Vice-Presidency of Cybersecurity. These teams consist of certified and experienced professionals in information systems security and cybersecurity risk management.Grupo Aval’s management, including the Vice Presidency of Risk and Compliance and cybersecurity teams, regularly update their Boards of Directors and Cybersecurity and Information Security Committees on the company’s cybersecurity programs, risks, and mitigation strategies. Reports are provided semi-annually or quarterly in some subsidiaries, covering third-party assessments, developments in cybersecurity, and updates to mitigation strategies
Cybersecurity Risk Management Positions or Committees Responsible [Flag]	true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block]	Corporate Vice-Presidency of Risk and Compliance and the Corporate Vice-Presidency of Cybersecurity
Cybersecurity Risk Management Expertise of Management Responsible [Text Block]	Our cybersecurity programs are directed by the Corporate Vice-Presidency of Risk and Compliance and the Corporate Vice-Presidency of Cybersecurity. These teams consist of certified and experienced professionals in information systems security and cybersecurity risk management.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]	Grupo Aval’s management, including the Vice Presidency of Risk and Compliance and cybersecurity teams, regularly update their Boards of Directors and Cybersecurity and Information Security Committees on the company’s cybersecurity programs, risks, and mitigation strategies. Reports are provided semi-annually or quarterly in some subsidiaries, covering third-party assessments, developments in cybersecurity, and updates to mitigation strategies.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag]	true

Cybersecurity Risk Management and Strategy Disclosure

12 Months Ended

Dec. 31, 2025

Cybersecurity Risk Management, Strategy, and Governance [Line Items]

Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

In an increasingly digital and regulated environment, at Grupo Aval and its subsidiaries, cybersecurity risk management is an integral part of our enterprise risk management program. We establish policies, methodologies, and procedures aligned with local regulations, international standards, and industry best practices. In recent years, we have significantly expanded our capabilities to counteract the increasing number of attempts to breach our security barriers, the growing use of the Internet and automated processes, and the diversification of financial transaction channels. Our cybersecurity risk management framework provides a structured approach for handling threats and incidents, including those linked to third-party service providers. It includes steps for assessing the severity of threats, identifying their sources, implementing mitigation strategies, and informing management and the Board of Directors of material cybersecurity risks. We and our financial subsidiaries engage third-party security experts for risk assessment and system enhancements. Additionally, our cybersecurity team provides annual training to all employees. One of the greatest cybersecurity risks in 2025 was the increasing sophistication of AI-based attacks, which are growing exponentially in speed and success rate. Quantum computing also presents a significant risk, as it threatens to render current cryptographic protocols obsolete, posing substantial security challenges for data and communication systems. Grupo Aval actively monitors and mitigates these risks through a robust control environment based on industry best practices, specialized security frameworks, and proactive measures.

To mitigate the risks associated with the growing use of digital channels and prevent cyber-fraud, in 2025, we launched initiatives that included strengthening Digital Banking Security Innovation by defining new authentication and authorization models. As part of this effort, more than 25 leading market technologies were reviewed together with the Grupo Aval entities. These advances will enable us to enhance

the usability of digital products and improve our customers’ experience. We began the Security Architecture Diagnostic initiative using a Security-by-Design approach to reinforce our assurance strategy for the cloud environments used by Grupo Aval and its subsidiaries. We also conducted the first cyber risk quantification exercises for seven entities within the Grupo Aval, allowing us to prioritize and support decision-making in cybersecurity risk management. Additionally, we initiated strengthening the governance model, methodology, and assessment criteria used to classify more than 230 critical suppliers that form part of our value chain. Furthermore, we continued the process of centralizing the cybersecurity capabilities of the entities into our Security Operations Center (“SOC”), together with the CSIRT (“Computer Security Incident Response Team”) functions. This effort enables us to leverage operational synergies and advance toward a more efficient economic model, generating comprehensive benefits for the Grupo Aval.

Cybersecurity Risk Management Processes Integrated [Flag]

true

Cybersecurity Risk Management Processes Integrated [Text Block]

Cybersecurity Risk Management Third Party Engaged [Flag]

true

Cybersecurity Risk Third Party Oversight and Identification Processes [Flag]

true

Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag]

false

Cybersecurity Risk Board of Directors Oversight [Text Block]

Throughout 2025, the Board of Directors of our financial subsidiaries has overall oversight of cybersecurity risk management. This responsibility is delegated to the Cybersecurity and Information Security Committee and its equivalents at the Board level. These committees ensure that management has processes in place to identify and evaluate cybersecurity risks, implement mitigation strategies, and report material cybersecurity threats to the Board and the Corporate Vice-Presidency of Risk and Compliance. Grupo Aval’s Board of Directors has designated a member to oversee cybersecurity risk management at a corporate level. Management is responsible for continuously assessing material cybersecurity risks, monitoring potential exposures, implementing mitigation measures, and maintaining cybersecurity programs. Our cybersecurity programs are directed by the Corporate Vice-Presidency of Risk and Compliance and the Corporate Vice-Presidency of Cybersecurity. These teams consist of certified and experienced professionals in information systems security and cybersecurity risk management.

Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block]

Cybersecurity and Information Security Committee

Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]

Throughout 2025, the Board of Directors of our financial subsidiaries has overall oversight of cybersecurity risk management. This responsibility is delegated to the Cybersecurity and Information Security Committee and its equivalents at the Board level. These committees ensure that management has processes in place to identify and evaluate cybersecurity risks, implement mitigation strategies, and report material cybersecurity threats to the Board and the Corporate Vice-Presidency of Risk and Compliance. Grupo Aval’s management, including the Vice Presidency of Risk and Compliance and cybersecurity teams, regularly update their Boards of Directors and Cybersecurity and Information Security Committees on the company’s cybersecurity programs, risks, and mitigation strategies. Reports are provided semi-annually or quarterly in some subsidiaries, covering third-party assessments, developments in cybersecurity, and updates to mitigation strategies.

Cybersecurity Risk Role of Management [Text Block]

Management is responsible for continuously assessing material cybersecurity risks, monitoring potential exposures, implementing mitigation measures, and maintaining cybersecurity programs. Our cybersecurity programs are directed by the Corporate Vice-Presidency of Risk and Compliance and the Corporate Vice-Presidency of Cybersecurity. These teams consist of certified and experienced professionals in information systems security and cybersecurity risk management.Grupo Aval’s management, including the Vice Presidency of Risk and Compliance and cybersecurity teams, regularly update their Boards of Directors and Cybersecurity and Information Security Committees on the company’s cybersecurity programs, risks, and mitigation strategies. Reports are provided semi-annually or quarterly in some subsidiaries, covering third-party assessments, developments in cybersecurity, and updates to mitigation strategies

Cybersecurity Risk Management Positions or Committees Responsible [Flag]

true

Cybersecurity Risk Management Positions or Committees Responsible [Text Block]

Corporate Vice-Presidency of Risk and Compliance and the Corporate Vice-Presidency of Cybersecurity

Cybersecurity Risk Management Expertise of Management Responsible [Text Block]

Our cybersecurity programs are directed by the Corporate Vice-Presidency of Risk and Compliance and the Corporate Vice-Presidency of Cybersecurity. These teams consist of certified and experienced professionals in information systems security and cybersecurity risk management.

Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]

Grupo Aval’s management, including the Vice Presidency of Risk and Compliance and cybersecurity teams, regularly update their Boards of Directors and Cybersecurity and Information Security Committees on the company’s cybersecurity programs, risks, and mitigation strategies. Reports are provided semi-annually or quarterly in some subsidiaries, covering third-party assessments, developments in cybersecurity, and updates to mitigation strategies.

Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag]

true