Chile, Mexico and Brazil tighten PLD rules

Attack chain and TTPs

Casbaneiro remains the clearest example of how a regional banking campaign adapts to defenses and to regulatory environments that demand finer monitoring. According to the research reports, the payload stays dormant until it detects that the user has accessed banking sites, at which point it intercepts credentials and manipulates financial sessions. That makes it especially relevant for banks and fintechs that rely only on hash blocking or domain blocking, because the operational trigger happens during real browsing.

The infrastructure architecture also changed. SocPrime described distributed data reception servers for C2, with multiple exfiltration endpoints. RST Cloud, for its part, documented MITRE ATT&CK techniques that include obfuscation, system discovery, execution through the web and process manipulation, which fits an operation designed to persist, hide and exfiltrate data in layers. The practical result is that detection cannot depend on a single signature or a single blocklist.

The campaign observed in August 2026 affected banking users in Mexico, Peru, Argentina and Colombia, with invoice or legal notice lures and malicious PDFs. That was joined by job-themed phishing campaigns in Brazil, and by BREEZE COMET, a financially motivated actor also active in that country. The research also mentions LLM-assisted intrusions, DuckDNS domains and multiple binaries, suggesting an operational surface where automation, exfiltration and post-exploitation are no longer unusual exceptions.

Observed flow in the Casbaneiro campaign

The technical sequence described in the reports suggests a fairly classic but still effective path: delivery through phishing, activation when the victim visits a financial site, dormant loading, credential theft, session manipulation and exfiltration toward distributed servers. The relevant point is not the novelty of each step, but how they fit together. When the outbound infrastructure shifts to a distributed model, reputation controls and static blocking lose effectiveness quickly.

That pattern also helps explain why several of the new regulatory frameworks in the report are pushing toward automated monitoring, deviation alerts and historical evidence retention. Regulatory defense and technical defense are starting to look alike. The supervisor demands traceability, and the attacker forces organizations to produce it for every incident, transaction or suspicious access.

Regional impact

The regional picture shows a converging movement: regulators are no longer limiting themselves to asking for reports or consent, but are demanding operational capability to classify risk, preserve evidence, notify incidents, audit processes and justify automated decisions. That affects banks, fintechs, PSAVs, telecom operators, credit entities and, in several countries, any organization that handles personal data or sensitive financial information flows. The pressure is not uniform, but it is synchronized: the hardest deadlines fall between November 2026 and January 2028.

Regional overview

Chile, Paraguay, Mexico and Brazil concentrate the most structural changes in personal data, virtual assets and AML. Peru and Colombia are advancing in cybersecurity, operational incidents and identity verification. Argentina is introducing a formal fraud management framework in the financial system. Uruguay is ordering PSAV authorization and adding a new anti-fraud layer in payment methods. Bolivia, for now, sits in an intermediate position, with a reform commitment that still has no closed calendar.

Chile

Chile has Law No. 21,719, which according to the National Congress Library takes effect on December 1, 2026 and replaces the old Law No. 19,628. The Ministry of Economy, however, said the government proposed pushing that date to December 1, 2027 to give time for the Personal Data Protection Agency to be installed and for application standards to be defined. The change is not minor, because the bill also expands the agency's board from three to five members and adjusts the first appointments of its authorities.

For the private sector, the result is twofold. If the original date holds, the agency will receive sanctioning powers over controllers, including private companies. If the delay moves forward, organizations gain time, but not a full pause, because the institutional design will be more detailed and adaptation will need to start early. The Anguita & Osorio report makes clear that the debate is not whether compliance will happen, but when and under what architecture.

Paraguay

Paraguay has one of the densest frameworks in the report. Law No. 7593/2025 creates the National Personal Data Protection Agency within MITIC, sets a 24-month transition, orders incident notification within 72 hours and regulates international transfers under adequacy or contractual safeguard criteria. The law applies to any public or private organization that handles personal data and provides for fines of up to 10,000 minimum wage units.

At the same time, the DNIT issued General Resolution No. 47/2026 to declare annual cryptoasset transactions above US$5,000. The process requires a tax ID, obligation 959-DJI, filing in Marangatu and an informational sworn statement before Internal Revenue. In addition, banking and tax information is moving faster between DNIT and ASOBAN through a web service, which strengthens oversight and financial traceability. For banks, fintechs and exchanges, the pressure is happening on three layers: privacy, taxation and access to financial information.

Peru

Peru is showing a mix of data protection, cybersecurity and new financial distribution models. Supreme Decree 016-2024-JUS modernized the regulations for Law 29733 and established a size-based timeline for appointing the Personal Data Officer. According to the material reviewed, mid-sized firms with annual sales between 1,700 and 2,300 UIT must appoint the officer by November 30, 2026. The regulation also requires notification of incidents to the National Personal Data Protection Authority within 48 hours and adoption of standards such as ISO/IEC 27001.

The SBS is also pushing the operational front. Resolution SBS No. 01741-2026, according to Apaxi, requires reporting cybersecurity incidents and channel outages within 24 hours and notifying affected users within 10 business days. Resolution SBS No. 01747-2026 sets the BaaS framework with board policies, risk assessment, continuous monitoring, minimum contracts and biannual publication of active recipients. And the draft single operational incident reporting procedure, still under consultation, could unify outages and cybersecurity events under one channel.

Colombia

Colombia is tackling identity impersonation. Law 2573 protects victims from negative reports and debt collection, imposes sufficient and reasonable digital security measures to verify identity and document authenticity, and requires the person to be marked as a victim of personal falsity when there is a complaint. According to the Superintendence of Finance, the law was published on May 19, 2026 and takes effect six months later, except for parts of Article 5 that apply from promulgation.

The effect for banks, telecoms and merchants is operational. They must retain evidence of the onboarding process, including biometrics, IP and document validation, and respond to claims under a framework in which the burden of proof shifts. The public consultation opened by the SIC in September 2026 is aimed precisely at strengthening identity validation and personal data processing, so the Colombian ecosystem is moving toward more technical and auditable controls. The proposed reform of Law 1581 adds another layer, although it remains only a proposal.

Argentina

Argentina focused on internal and external fraud. BCRA Communication A 8471 created Section 6.5, Fraud Risk Management, within the risk management guidelines. The rule requires a specific organizational structure, assignment of responsibilities, self-assessment of risk, a mitigation plan and coordination with technology and information security risk management. In addition, the phased schedule pushes full effectiveness to September 2027.

The practical burden is not abstract. Entities must define risk appetite, document processes, report indicators to the board and adjust controls to new fraud patterns. LM Neuquén added that, starting in September 2026, immediate transfer administrators will receive public information from the BCRA to build person-level fraud risk profiles. That places the Argentine system into a more granular prevention model, with transfers and personal fraud as the main focus.

Brazil

Brazil already had a robust framework for PSAVs and kept refining it. Central Bank Resolutions 519, 520 and 521 build the authorization, operation and regulated perimeter architecture for virtual assets. PSAVs must show financial capacity, lawful source of capital, business viability, compatible technology infrastructure, proper governance and the technical reputation of administrators and controllers. In addition, certain virtual asset transactions were brought under the foreign exchange market and require counterparty identification.

The next layer came with Resolution BCB 584, which expands anti-fraud rules and enables a preventive hold of up to 24 hours for certain transfers above US$10,000 per client per day when they are sent abroad or to self-custody wallets. The jump is significant because supervision is no longer limited to authorizing entities, but can intervene in the transaction flow when the risk warrants it. In practical terms, Brazil is pushing PSAVs and banks toward preventive control, not only reactive control.

Mexico

Mexico is the largest case in the report. Agreement 115/2026 rewrote the General Rules under the LFPIORPI, added 11 new chapters and put the risk-based approach at the center of compliance. The change covers vulnerable activities and PSAVs, with a requirement for documented methodology, customer classification into three levels, enhanced due diligence, beneficial owner identification with a 25% threshold, annual training and periodic audits.

Implementation is phased. General effectiveness begins on November 30, 2026, but several operational components activate on March 1, 2027 and the annual audit period begins on January 1, 2028. Automated monitoring mechanisms must keep files, group transactions, feed the risk assessment, generate alerts and store histories for at least 10 years. For sectors such as casinos, gaming, sweepstakes and other vulnerable activities, this means reworking platforms, alert rules and internal manuals from end to end.

Bolivia

Bolivia does not yet have a closed regime, but it does have a clear direction. The Economic and Financial Policy Memorandum dated September 10, 2026 commits the country, under the IMF program, to develop a robust virtual asset framework. The goal is to prevent illicit capital outflows and protect financial resilience. The available material makes clear that there is still no defined timeline, no single main authority and no detailed legislative approach.

The cautious reading is that Bolivia is entering a design phase. Some reports speak of tripartite oversight between the Central Bank, ASFI and the UIF, while others mention possible stricter AML rules for VASPs, but those pieces are not confirmed at the same level as the memorandum. For this report, the verifiable point is the intention to create a robust framework and the absence of a closed calendar.

Uruguay

Uruguay consolidated its PSAV regime and added another layer on payment fraud. The Central Bank said it had prepared a regulatory project for PSAVs and, according to iProUP, activated a mandatory register formally effective as of September 1, 2026. The country already has a digital channel for authorization and registration, and the rules require fund segregation, transparency, cybersecurity and internal controls.

At the same time, the BCU introduced a proposal to reinforce fraud protection in payment methods. The initiative calls for stronger authentication when electronic instruments are linked to digital wallets and allows a tokenized instrument to function as a possession factor if it has a unique and secure link to the customer's device. It is a clear sign of convergence between payments, identity and fraud management.

Technical indicators

Analysis for security teams

The first operational takeaway from the report is that the risk surface can no longer be managed by business function alone. Fraud, data, cybersecurity, compliance and operational risk teams now have to work from the same process map. The reason is simple: in the region, several regulators are asking for the same thing under different names, whether that is risk-based assessment, evidence retention, stronger authentication, automated monitoring or incident reporting.

On detection, the priority pattern is to combine identity, behavior and transaction monitoring. Mexico requires keeping risk histories for at least 10 years and generating alerts for high-risk customers, PEPs and restrictive lists. Colombia pushes identity control into onboarding and requires evidence retention. Uruguay and Brazil are pushing stronger authentication and anti-fraud controls in payments and virtual assets. That suggests effective detection now extends beyond SIEM or SOC operations and must include business rules, customer profiling and correlation with regulatory events.

On mitigation, priorities change by country, but not the logic. Where deadlines are short, as in Peru and Argentina, the urgency is governance, appointments and internal manuals. Where the change is structural, as in Mexico and Brazil, the urgency is redesigning monitoring engines, classifying risk by level, formalizing methodology and making sure evidence is exportable and auditable. Where the law is still in transition, as in Chile or Bolivia, it makes sense to prepare architecture and contracts before the political window closes.

In threat intelligence terms, the material on Casbaneiro, CL-CRI-1163, BREEZE COMET and LLM-assisted campaigns points to a particular focus on email, banking navigation, endpoint devices and distributed C2. The fact that Casbaneiro's payload activates when a user accesses banking sites means browser protection, behavioral analysis and session-manipulation detection need to be strengthened. In Brazil, campaigns aimed at HR show that the entry point can be a corporate email, not a digital banking portal.

Based on the research, the recommended prioritization would be the following. First, close compliance gaps with hard deadlines, especially in Mexico, Peru, Argentina and Paraguay. Second, consolidate evidence and logs, because several rules already require proving that validation or assessment actually took place. Third, review third parties, PSPs and cloud or BaaS providers, since third-party risk responsibility appears in Peru, New York and Mexico. Fourth, integrate fraud and cybersecurity into a single dashboard, because attacks that hit banks now exploit identity, email, web and automation at the same time.

Frequently asked questions

Which countries in the report have the most urgent changes between 2026 and 2027?

Mexico, Brazil, Peru, Colombia, Paraguay and Argentina concentrate the nearest milestones because they combine phased effective dates, adaptation deadlines and new monitoring or reporting requirements. Chile is also relevant because of its data law, although its timeline depends on the possible legislative delay. Uruguay and Bolivia are in different stages, more focused on registration or regulatory design.

Which frameworks require automated monitoring rather than only manual controls?

Mexico explicitly requires it under the amended LFPIORPI, with six minimum functions and historical retention. Brazil links it to anti-fraud controls for virtual assets, and Peru incorporates it through different incident reporting and supervision schemes in cybersecurity and digital banking. At the same time, the technical pressure from Casbaneiro reinforces the need for automated detection.

Which countries already require or anticipate short incident-reporting deadlines?

Paraguay sets a 72-hour deadline for security incidents, Peru calls for 24-hour reporting of cybersecurity incidents and 10 business days to notify affected users, and Colombia is moving identity validation into a regime that protects victims of impersonation. In the United States, the research also mentions 36-hour and four-business-day clocks for banks and issuers.

Where is the convergence between fraud, personal data and operational risk clearest?

Argentina, Mexico and Colombia show that convergence most clearly. Argentina created a specific fraud risk section within operational risk. Mexico turned AML, customer classification, beneficial ownership and auditing into a formal program. Colombia tied its identity impersonation law to identity verification, documentary proof and personal data protection.

Which jurisdictions in the report already affect crypto and virtual assets directly?

Brazil, Uruguay, Paraguay and, at an earlier stage, Bolivia. Brazil already has authorization, a foreign exchange perimeter and anti-fraud controls. Uruguay activated registration and authorization for PSAVs. Paraguay added an annual reporting duty for cryptoassets and banking cross-checks with the DNIT. Bolivia has only committed to a robust framework before the IMF so far, without a closed calendar.

Material limitations

The material provided allows for a fairly precise reconstruction of regulatory calendars, main obligations and part of the regional operating context, but it does not include the full text of some rules or their technical annexes. In Chile, for example, the postponement bill has already been reported, but the final status of the legislative process cannot be confirmed from this research alone. In Bolivia, the available information is programmatic and does not allow a final authority or timeline to be fixed.

It was also not possible to directly verify some details published by secondary sources when they themselves mark them as uncertain, such as the exact 270-day period for the transitional PSAV authorization process in Brazil or the operational start of the DNIT-ASOBAN platform in Paraguay. In those cases, the report keeps the attribution to the source and does not elevate the claim to the same level as the confirmed facts.