CiberLATAMbywhalemate

Chile tightens banking, data and fraud rules

Chile’s CMF kept ARC in force, data law 21.719 took effect, and authorities launched a national anti-fraud board.

Whalemate Labs · AI-assisted researchPublished:2 min read

Chile moved in August 2026 with a package of measures that directly affects the financial sector and personal data handling. The CMF kept Reforced Customer Authentication in force, Law 21.719 took effect on Dec. 1, 2026, an agreement was signed to create a National Financial Fraud Board, and the Central Bank announced a consultation on a new stablecoin framework. Added to that are mandatory registration for prepaid mobile lines and the public consultation on stablecoins.

Chile moved in August 2026 on a package of measures that directly affects the financial sector and the handling of personal data. The CMF kept Reforced Customer Authentication in force, Law 21.719 took effect on Dec. 1, 2026, an agreement was signed to create a National Financial Fraud Board, and the Central Bank announced a consultation on a new framework for stablecoins.

What changed in Chilean banking with ARC?

The Reforced Customer Authentication rule requires at least two independent factors to authorize transfers to new recipients or for high-value amounts, according to El Mostrador. Those factors must combine elements of knowledge, possession, and biometrics, such as a password or PIN, a trusted device, soft token, dynamic key, facial recognition, fingerprint, or voice.

A report from the same outlet also said ARC remained fully in force from July 1, 2026, and that the update allowed coordinate cards to remain in use only for certain vulnerable segments, such as older adults or people without a trusted device. 24 Horas added that the future of those cards was formalized and that, since Aug. 1, only a group defined by each financial institution can keep using them.

What does Law 21.719 require for data protection?

Chilean Law No. 21.719, which amends Law No. 19.628, took effect on Dec. 1, 2026 and sets new security and compliance obligations for all organizations that process personal data, including financial entities, according to GDPRI and DataProtection.gi.

Hackmetrix said the law modernizes the data protection framework and requires organizations to adopt technical and organizational measures appropriate to risk, strengthen security in third-party management, and take on greater responsibility for data processing, in line with Article 14 quinquies. In practice, the change raises the bar for oversight of vendors, internal processes, and the protection of sensitive information.

How is Chile organizing against financial fraud?

In August 2026, an interagency agreement was signed to establish a National Financial Fraud Board, with the participation of bodies such as SERNAC and financial authorities, according to the service itself. The goal is to create a strategic framework for cooperation and cross-sector coordination to prevent, detect, and prosecute financial fraud more effectively.

País Lobo reported that the anti-transnational fraud board includes the National Cybersecurity Agency as the body responsible for regulation, oversight, and coordination of state and private cybersecurity in the country. Chócale, meanwhile, said the platform run by the Public Prosecutor's Office will share statistics, trends, criminal patterns, and aggregated data on financial fraud.

What other changes affect payments and telecom?

Chile's Central Bank announced a public consultation on a new regulatory framework for stablecoins, which will set conditions for issuance in Chile when they can be used as a means of payment, with potential impact on payment systems and the financial sector.

Added to that, Cooperativa reported that since Aug. 20, 2026, all prepaid lines in Chile must be linked to an identity. According to that outlet, verification can be done with a fingerprint, facial recognition, security questions, two-factor authentication, or an advanced electronic signature, and for already active lines the validation is required when making operations that need operator intervention, with a 10-day window to complete it.

Sources

View all