Chile tightens cyber and fraud rules

Update September 21, 2026: Law 21.663 and the upcoming Law 21.719 are now even more closely linked on the regulatory front, because a single breach could require notices to two different authorities with different deadlines and formats. Proactivanet also noted that the Cybersecurity Framework Law sets fines of up to 40,000 UTM for Vital Importance Operators.

Chile is adding cyber, data and fraud rules for banks, fintechs and payment providers, with faster reporting and stronger security duties. Full enforcement of Law No. 21.719, scheduled for Dec. 1, 2026, together with the obligations already set by Law No. 21.663, CMF NCG 538 and MK4’s fraud reform, is reshaping compliance for banks, fintechs and other players in Chile’s financial system. The new framework combines stronger authentication, faster reporting, tighter controls over personal data and a different split of responsibilities across payment rails.

What changes with Law 21.719?

Law No. 21.719 creates the Personal Data Protection Agency, requires breach notification and sets fines of up to 20,000 UTM or 4% of annual sales, according to the National Congress Library analysis. Kardu says the law includes a transition period and takes full effect on Dec. 1, 2026, when the agency will begin supervising and sanctioning all organizations that process personal data belonging to people in Chile.

That scope includes banks and other financial institutions. Saytec says data encryption, access controls, audit logs and incident management are now legal obligations, not recommendations. G5 Noticias adds that once December enforcement begins, organizations handling personal data must be able to prove high standards for managing, documenting and validating permissions granted by data subjects.

Vanlook Studio also warns that the law includes a 72-hour type of clock for reporting breaches to the authority when there is a risk to data subjects. In practice, that moves Chile’s financial-sector reporting discipline closer to a fast-disclosure standard similar to the European GDPR.

Later analysis adds that the Dec. 1, 2026 start date has been clouded by regulatory uncertainty because the government introduced a bill to push it back to Dec. 1, 2027. At the same time, failing to put in place adequate security measures, such as not deploying multi-factor authentication or keeping vulnerable software in place, could itself be punished under Law 21.719, even if no breach has occurred.

What does Law 21.663 require from financial players?

Law No. 21.663 created the National Cybersecurity Agency and made incident reporting to the National CSIRT mandatory within a maximum of 3 hours, according to the National Congress Library analysis. For Vital Importance Operators, a category that can include critical financial infrastructure, Proactivanet says noncompliance can lead to fines of up to 40,000 UTM.

Saytec says those organizations must also have detection, response and containment capabilities, post-incident forensic analysis and periodic response drills. Corvus reaches the same conclusion, describing a shift away from paper compliance and toward continuous risk management, with prevention, constant monitoring and remediation capacity.

PressLatam focuses on the law’s permanent obligations to prevent, report and resolve incidents, which force financial actors to move from a formal approach to active risk management. At the same time, Proactivanet warns that a single breach in the financial system could trigger simultaneous notices to ANCI and the future data authority, with different deadlines and formats.

The combination of Law 21.719 and Law 21.663 creates a dual reporting regime for financial institutions. Personal data breach notices go to the APDP, while cyber incident reports must reach the National CSIRT within 3 hours, raising operational demands for banks, fintechs and other market players.

How does this overlap with NCG 538?

CMF NCG 538 has required banks, fintechs, regulated card issuers and cooperatives since Aug. 1, 2026 to use at least two independent authentication factors for electronic transfers, digital customer onboarding and changes to sensitive data. The enhanced authentication allowed under the rule can include passwords, devices and biometrics such as fingerprints, facial recognition or voice recognition.

Chilean media and specialist coverage indicate that the requirement is already affecting day-to-day digital operations, because no covered actor can process those critical transactions without validating the user’s identity with two independent factors. The impact is not only regulatory, it also reaches onboarding flows and sensitive information updates.

How does this overlap with MK4 reform?

MK4’s reform to the Fraud Law changes the user liability standard in payment rails when enhanced authentication was used, shifting it from gross negligence to ordinary negligence, according to La Tercera. That change reinforces security demands on financial institutions and payment service providers, and it also introduces a presumption of user lack of care in court in those cases.

Chile’s reform of Law No. 20.009, within the broader capital markets overhaul, also expands security duties to processors, card brands, payment system administrators and Open Finance participants, while keeping financial institutions responsible for safeguarding electronic transactions, according to Garrigues. The same analysis says that if a transaction was authenticated with stronger controls, the user may be liable for ordinary negligence, adjusting the evidentiary standard and the allocation of responsibility in electronic fraud cases.

The same legal analysis cited by La Tercera keeps judicial authorization in place for an issuer to suspend reimbursement of funds. Garrigues adds that an issuer that repays money after a fraudulent transaction may seek recovery from other participants that contributed to the fraud, including processors, card brands, payment system administrators and Open Finance actors.

Economic coverage of MK4 also says the reform will allow the sale of specific fraud insurance for payment rails and add a single sworn-statement form to channel user complaints, standardizing how issuers and other financial-system players process reports of unrecognized transactions, according to La Tercera and MSN.

Holdo says the update to the Fraud Law is part of a broader package aimed at simplifying regulation and positioning Chile as a regional financial center. In that context, payment security changes and the redistribution of operational risk are tied to a competitiveness and market-trust strategy, not just a sector response to incidents.

The roadmap recently presented by the CMF on payment fraud and regulatory modernization is meant to complement the executive bill that amends Law No. 20.009, according to Chócale. That creates a coordination framework between CMF administrative supervision and legislative changes to the liability regime for fraud.