Argentina BCRA and Chile data law tighten controls

Executive summary

Argentina and Chile accounted for the two most substantive regulatory shifts in the region’s financial sector during the period reviewed. In Argentina, BCRA Communication A 8471/2026 brought fraud risk into the operational risk framework for financial institutions and certain payment service providers, with requirements for identification, assessment, monitoring, mitigation, and periodic reports to the board. In Chile, Law 21.719 finalized a comprehensive personal data protection regime for public and private controllers and processors, with an enforcement agency, breach notification, impact assessments, and mandatory technical controls.

The analytical value of both frameworks lies in their convergence. Both require formal structures, accountable owners, and auditable evidence, but they approach the problem from different angles. The BCRA treats fraud as part of operational risk and staggers adoption deadlines between financial institutions and payment service providers with payment accounts. The Chilean law, by contrast, regulates data processing and incident response, while adding significant penalties, a specialized agency, and obligations that directly affect banks, card issuers, and any data-intensive actor.

The timetable also differs, and that matters for planning. In Argentina, the effective date for financial institutions is set for Dec. 1, 2026, while certain payment service providers will phase in through Sept. 2027. In Chile, the legal start date is also Dec. 1, 2026, although a bill has been introduced in the Senate to push that milestone to Dec. 1, 2027. That delay is proposed, not approved. For now, the obligation stands, and enforcement actions expire after four years.

The rest of the regional picture does not show, in the material reviewed, an equivalent level of verified detail on financial fraud and data protection. Peru maintains a security and cybersecurity framework under its banking supervisor, Colombia is advancing court-backed standards for authentication and validation in digital channels, Uruguay has tightened strong authentication and fraud monitoring, Mexico combines biometrics, CNBV reporting, DMARC, and security governance, Brazil has consolidated regulation for virtual asset service providers, and Paraguay will activate a comprehensive data law in 2027. But none of those sources show a block as detailed as the one observed in Argentina and Chile for 2026 and 2027.

No IOCs, active campaigns, C2 infrastructure, or MITRE-mapped TTPs were identified as directly linked to the entry into force of these rules. The documented pattern is institutional and regulatory, not forensic. For security, risk, and compliance teams, the practical reading is that the center of gravity has moved toward governance, traceability, strong authentication, incident notification, and technical evidence before an event occurs.

Context and background

The consolidated information shows a region with overlapping regulatory layers, not a single uniform pattern. Argentina placed fraud inside the operational risk framework for financial institutions and payment service providers. Chile elevated personal data protection into an autonomous regime with an enforcement and sanctioning agency. In Peru, the SBS had already been requiring a security management system, access controls, cryptography, monitoring, and early incident reporting. In Uruguay, the BCU strengthened authentication and fraud monitoring in digital channels. Mexico, meanwhile, is moving on biometrics, CNBV reporting, DMARC, and information security governance.

That context explains why this report should be read as a comparison between two reference models, not as a threat timeline. The material does not provide technical alerts, infrastructure compromises, or attack sequences published by national CERTs or central banks linking these reforms to specific fraud campaigns. What it does show is a harder regulatory perimeter, with a strong emphasis on prevention, detection, traceability, and the ability to prove controls before an incident.

The difference in focus also matters. The Argentine framework centers on fraud risk management in financial products and operations. The Chilean framework regulates personal data processing, breach response, and the institutional architecture that will supervise and sanction. The two overlap in practice because financial entities handle large volumes of data and operate in high-risk channels, but the legal source of the obligation is not the same.

Key facts table

Operation timeline

<text x="330" y="150" font-size="18" font-weight="700">2026-09-16</text>
<text x="330" y="220" font-size="16" text-anchor="middle"><tspan x="330" dy="0">SBS 02271</tspan><tspan x="330" dy="1.2em">public consultation</tspan></text>

<text x="520" y="150" font-size="18" font-weight="700">2026-09-25</text>
<text x="520" y="220" font-size="16" text-anchor="middle"><tspan x="520" dy="0">BCRA 8471 risk</tspan><tspan x="520" dy="1.2em">fraud</tspan></text>

<text x="710" y="150" font-size="18" font-weight="700">2026-10-01</text>
<text x="710" y="220" font-size="16" text-anchor="middle"><tspan x="710" dy="0">BCU 2497 duplicate</tspan><tspan x="710" dy="1.2em">factor</tspan></text>

<text x="900" y="150" font-size="18" font-weight="700">2026-10-07</text>
<text x="900" y="220" font-size="16" text-anchor="middle"><tspan x="900" dy="0">SOAT Colombia</tspan><tspan x="900" dy="1.2em">channels</tspan><tspan x="900" dy="1.2em">insurance</tspan></text>

<text x="1060" y="150" font-size="18" font-weight="700">2026-12-01</text>
<text x="1060" y="220" font-size="16" text-anchor="middle"><tspan x="1060" dy="0">Chile and</tspan><tspan x="1060" dy="1.2em">Argentina</tspan><tspan x="1060" dy="1.2em">active</tspan></text>

Attack chain and TTPs

The material does not document a single attack campaign or a malicious chain with public IOCs. What it does show is a set of observable tactics in regional financial fraud, especially impersonation, identity abuse, non-face-to-face digital channels, deepfakes, voice cloning, phishing, compromised devices, and the use of domains or platforms that appear legitimate. In Bolivia, for example, ASFI warned about a fraudulent platform using its name and institutional image, with AI-generated videos and voices. In Colombia, virtual SOAT and instant loans through digital wallets show impersonation, social engineering, and weak validation as recurring vectors.

At the regulatory level, the response converges on three layers. The first is strong authentication and biometrics. The second is behavior monitoring, geolocation, alerts for unknown devices, and validation of the transaction before allowing sensitive changes. The third is traceability and evidence, which in Chile takes the form of internal breach logs, proof that controls existed before the incident, and notice to the authority, while in Argentina it translates into board reporting, self-assessments, and mitigation plans.

In other words, the report does not support naming a concrete offensive TTP attributable to a specific actor. It does allow a map of the defensive perimeter that authorities are demanding to blunt attacks that, by nature, exploit identity, trust, and the low friction of digital channels.

<rect x="300" y="140" width="170" height="90" rx="14" fill="#ffffff" stroke="#2563eb"/>
<text x="385" y="175" font-size="18" font-weight="700">Monitoring</text>
<text x="385" y="200" font-size="16">Behavior, geolocation</text>

<rect x="530" y="140" width="170" height="90" rx="14" fill="#ffffff" stroke="#2563eb"/>
<text x="615" y="175" font-size="18" font-weight="700">Mitigation</text>
<text x="615" y="200" font-size="16">Blocking, reversal</text>

<rect x="760" y="140" width="170" height="90" rx="14" fill="#ffffff" stroke="#2563eb"/>
<text x="845" y="175" font-size="18" font-weight="700">Reporting</text>
<text x="845" y="200" font-size="16">Directory, authority</text>

<rect x="990" y="140" width="140" height="90" rx="14" fill="#ffffff" stroke="#2563eb"/>
<text x="1060" y="175" font-size="18" font-weight="700">Evidence</text>
<text x="1060" y="200" font-size="16">Auditable</text>

Regional impact

Regional outlook

The clearest regional impact does not come from a wave of technical compromise, but from the accelerated formalization of antifraud and privacy controls. Argentina and Chile set the highest verified bar. Argentina regulates fraud as operational risk and separates adoption stages for financial institutions and PSPs. Chile establishes a full privacy regime with an agency, sanctions, breach notification, and technical obligations that reach the financial system.

The comparison exposes asymmetries. Uruguay and Mexico are tightening authentication and monitoring controls, but with a more operational focus. Colombia is reacting to specific fraud cases in SOAT and digital wallets, with court orders and user warnings. Peru is maintaining its security and reporting layer in the SBS ecosystem. Brazil’s material is concentrated on virtual asset service providers rather than traditional banking fraud. Paraguay is moving toward a comprehensive data law that takes effect in 2027. For Peru, Paraguay, and Brazil, the sources reviewed do not show a 2026 to 2027 block that combines financial fraud and data protection with the same level of detail seen in Argentina and Chile.

Argentina

BCRA Communication A 8471/2026 placed fraud inside operational risk and required banks and PSPs to work with structures, policies, responsible owners, risk appetite and tolerance, risk identification, self-assessments, monitoring, and mitigation. The material also indicates that for PSPCPs there is a phased framework that starts in September 2026 and is completed in September 2027, while financial institutions begin on Dec. 1, 2026.

The strongest point for internal teams is the governance requirement. The BCRA report speaks of governance, antifraud policies, responsible officers, monitoring, mitigation, and reporting. El Cronista adds periodic reports to the board with indicators, relevant incidents, metrics, corrective measures, and new fraud methodologies. Marval also notes the obligation to use fraud risk scoring in customer onboarding and account opening.

Chile

Law 21.719 takes effect on Dec. 1, 2026, although there is a legislative proposal to push it back one year. Unless the law changes, the obligation applies, and any postponement depends on congressional approval. The rule creates the Personal Data Protection Agency, with powers to investigate, fine, order corrective measures, and even temporarily suspend processing.

Siberson and Duemint describe a high-impact scheme for banks and other data-intensive entities. Each processing activity must be justified, controls must be proportional to the volume and sensitivity of the data, auditable evidence must be kept, breaches must be reported without undue delay, and incidents must be logged internally. If a breach affects sensitive data, children under 14, or economic, financial, banking, or commercial data, the data subjects must also be notified.

Peru

Peru does not have in the material a new fraud regime comparable to Argentina’s or Chile’s, but it does have a consolidated security and cybersecurity framework. The SBS keeps the SGSI-C in place, requires least-privilege access controls, an inventory of information assets, cryptography, network monitoring, and reporting of significant cyber incidents. SBS Resolution 02326-2026 adds specific obligations when EAFs use digital wallets or apps for pension contributions.

The SBS proposal on single operational incident reporting is still under consultation. That means it does not yet replace the existing continuity and cybersecurity reporting regime. For Peru’s financial sector, the 2026 to 2027 picture is one of regulatory continuity and channel refinement, not a new antifraud architecture with its own name.

Colombia

Colombia appears in the material with targeted responses to digital fraud, not with a single framework law. The Cundinamarca court ordered the Financial Superintendence to design secure digital SOAT channels and early fraud detection, and MinTIC to build an interagency protocol to identify, report, and dismantle fraudulent pages, profiles, links, and applications. The Financial Superintendence reported 2,870 complaints tied to possible fraud or impersonation in that digital purchase.

At the same time, the Superintendence warned about instant loans through digital wallets and says phishing remains one of the main fraud methods. Noticias RCN adds that, under an existing security rule, banks may end up absorbing card fraud if they cannot prove compliance with their security obligations. The dominant signal is clear, authentication, channel validation, and the ability to demonstrate controls.

Brazil

Brazil consolidated the perimeter for virtual assets and VASPs. Central Bank resolutions 519, 520, and 521 created the SPSAV figure, require local incorporation, minimum capital, governance, internal controls, asset segregation, responsible officers for risk, AML, and cybersecurity, and set rules for exchange operations involving cryptoassets, including transfers to and from self-custodied wallets.

The material reviewed does not show, for 2026 to 2027, a traditional banking antifraud reform comparable to Argentina’s or Uruguay’s. It does show much stricter oversight of virtual assets and cross-border flows. That expands the supervisory perimeter, but it does not support the claim of a new sector-wide antifraud policy with the same granularity observed elsewhere.

Mexico

Mexico combines biometrics, regulatory reporting, continuous monitoring, and email controls. Nu Mexico says the Banking Circular requires an information security officer, obliges incident reporting to the CNBV, and demands a detailed report within five business days. ITSitio adds technical requirements for fingerprint and facial biometrics, while iWorld and Expansión describe broad adoption of DMARC for institutional banking email.

Fast Company and Forbes reinforce the market reading: fraud prevention relies on behavior, identity, and digital trust signals, with analytics and risk models. The Mexican system does not appear as a single 2026 reform, but as a set of controls pushing toward stronger authentication, traceability, and data governance.

Uruguay

Uruguay is the other clear case of tightening. BCU Circular 2.497 expanded strong authentication for access, transfers, non-face-to-face purchases, and changes to sensitive data. It also set requirements to detect unusual transactions, geolocation, unknown devices, and suspicious patterns, and requires electronic notice of any attempt to change credentials or contact details.

The scope is broad and covers banks, credit cooperatives, lending companies, financial service firms, exchange houses, funds transfer entities, and P2P platforms. The obligation to periodically assess the effectiveness of monitoring systems and fix failures gives the rule a continuous-control dimension that brings it close to the standard already seen in other regional markets.

Paraguay

Paraguay appears with a comprehensive data protection law that, according to Última Hora and Ceibo.digital, will fully take effect in November 2027. The material says it will apply to all public and private organizations that process personal data, with a national agency and fines of up to ten thousand minimum wages at the highest tier.

The verified information does not yet develop, in the sources reviewed, a specific bridge to financial fraud or technical requirements on the same level as those observed in Argentina and Chile. The key point for the financial system is that the privacy framework now has a clear horizon and requires early preparation.

United States

In the material available, the United States appears only as an indirect technical reference. El Cronista cites an official CISA recommendation on multi-factor authentication to protect accounts and applications, used as technical support when discussing BCRA Communication A 8471. There is no comparable local reform or event in this corpus that requires separate development.