Latin America Compliance and Regulation, Oct 2026

Active Threats and Campaigns

Ransomware and Extortion

The month’s material does not allow a single regional ransomware campaign to be reconstructed with enough precision. It does document six cases with ransomware or extortion as the primary focus, but in five of them the source does not specify whether encryption occurred, and in one case encryption of assets was confirmed. That distinction matters operationally because the impact on continuity, recovery, and notification changes materially.

The cautious read is that extortion risk remained present across the region, but October’s corpus does not document a homogeneous wave or a clearly attributed actor set. For defensive teams, that means keeping encryption prevention, exfiltration management, and response to extortion pressure separate, without assuming that every variant requires the same playbook.

Fraud and Phishing

Fraud and phishing emerged in October as a more concrete and better documented threat. The Banco de La Pampa case followed a classic path of phone deception, credential handoff, and funds transfer without sufficient alerts. Coverage highlighted the lack of mechanisms to verify identity and detect unusual transactions, making the case a useful example for reviewing authentication controls and behavioral monitoring.

The case in Mexico, with the report on CyberCartel and the 43 credentials from a fintech, points to a different problem, exposure of reusable access and the possible enabling of improper operations. The material does not confirm effective exploitation, but it does reveal a risk surface where credential theft, access validation, and financial system segmentation stop being theoretical issues.

Taken together, the 13 documented fraud or phishing cases show that the region continues to face attacks with relatively low technical complexity but high financial yield. The response is not limited to awareness campaigns. It also requires stronger authentication controls, transaction monitoring rules, alternate-channel verification, and auditable logs of alerts and decisions.

APT and Hacktivism

October’s material does not provide solid evidence to support a regional APT campaign or a wave of hacktivism with verifiable attribution in the regulation and compliance space. It does include references to ANPD monitoring, oversight, and sanctions activity, but that reflects regulator action, not an advanced technical threat. It would be inaccurate to inflate that category with speculation.

What the month does provide is an indirect warning. As regulators demand more traceability, early reporting, and security evidence, organizations that cannot demonstrate controls remain exposed to sanctions even if no major public incident has occurred. In this context, compliance becomes a defensive capability against the regulator as much as against the attacker.

Critical vulnerabilities

No critical CVEs were recorded in the analyzed material for the period. That does not mean critical vulnerabilities exploited in the region were absent, only that this October corpus documented none with critical severity or enough attribution to include in the table.

Regulation and compliance

October was, above all, a month of regulatory movement. Most of the verified news in the period fell under regulation, with 185 documented events. That figure should not be read as a simple count of bulletins or press releases, but as a sign of how often Latin America’s ecosystem had to revisit rules, deadlines, obligations, sanctions, or supervisory structures.

Chile, the status of Law No. 21.719 and the clock still ticking

Chile was home to one of the month’s most delicate regulatory debates. The Senate approved a bill amending Law No. 21.719 and proposed moving its effective date to October 15, 2027, although the text still has to complete its passage in the Chamber of Deputies and Deputies. Until that happens, the legal date remains December 1, 2026.

The core issue is that the law is not just a statement of rights. Law No. 21.719 covers access, rectification, deletion, objection, portability, and blocking, along with duties on information, security, and breach notification, plus a regime of offenses and sanctions. The delay, therefore, does not eliminate the adjustment work. It only changes the calendar.

This month’s coverage also revealed an institutional debate. During the legislative process, a proposal was made to increase the future Personal Data Protection Agency’s Governing Council from three members to five, and a staggered-entry alternative kept alive the idea of delaying oversight and sanctioning powers by one year. That combination suggests the Chilean debate is not just about timing, but about governance and real supervisory capacity.

For compliance teams, the lesson is clear. It is not advisable to assume the postponement is already settled, or, on the other hand, to delay all preparation until final approval. The coverage itself warned that while the bill has not completed its legislative process, organizations should not assume the adjustment deadline has automatically been extended to 2027.

Brazil, active enforcement and regulatory language updates

Brazil had a month of high regulatory activity, with a useful contrast between concrete enforcement and structural preparation. ANPD closed the Feira de Santana case with corrective measures, updated its Glossary with terms tied to specific regulations, and published an English version of the LGPD after Law No. 15.352/2026. It is a combination that shows both enforcement and institutional maturation.

The Feira de Santana case is especially important because the authority did not stop at identifying the violation. It imposed concrete actions, from appointing a data officer to drafting privacy policies, an incident response plan, and impact reports. It also said it is monitoring companies and platforms through oversight, enforcement, and sanctions activities, with the goal of pushing regulated entities toward compliance.

At the same time, the Brazilian Senate recorded PL 5.648/2026 as in progress, and the official record for PEC 17/2019 shows it approved by the Plenary and sent to the Chamber of Deputies. That coexistence of initiatives, one more focused on political processes and the other on fundamental rights, indicates that the debate over data and access to information continues to rise across several institutional layers.

Brazil’s regulatory signal is not limited to privacy. It also shows ANPD adjusting definitions and tools for an environment where security incidents, international transfers, and data processors require precise terminology. That language work matters because, in practice, it defines obligations and reduces compliance gray areas.

Argentina, the CNV moves fully into cybersecurity for PSAVs

Argentina took one of the clearest regulatory steps of the month by approving CNV General Resolution 1172/2026. The rule amends the CNV Regulations and adds cybersecurity obligations for virtual asset service providers, with requirements for risk-based policies, procedures, and controls, governance, periodic assessments, cybersecurity audits, and protection of user information.

The change matters because it does not treat cybersecurity as an external or loosely sector-specific duty, but as part of the market supervisory regime. The resolution also consolidates the chapter applicable to PSAVs and integrates the regime previously regulated by RG 1058/2025 and earlier interpretive criteria. That makes the legal text easier to read, while also raising the implementation bar for regulated entities.

The rule also requires PSAVs to immediately report relevant events such as losses above 15% of net worth, cybersecurity incidents, system outages, or the decision to cease operations. And for Category 4 PSAVs, it clearly separates their own assets from customer assets, while prohibiting custodians from using customer assets or funds on their own behalf.

The compliance takeaway here is twofold. On one hand, the CNV is aligning its rules with real technological risks. On the other, it is pushing providers to document security in a way that can be audited. Controls are not enough. They have to be provable.

Mexico, financial supervision and control of minors in digital environments

Mexico added several regulatory moves that do not belong to the same case file, but do share a common tightening of oversight. CNBV carried out the second 2026 evaluation for certification in anti-money laundering and counter-terrorist financing, with 977 people, while specialized coverage attributed to Mexican financial security rules requirements such as immediate incident notification, independent penetration tests, and remediation plans with concrete deadlines.

In addition, the Supreme Court confirmed, according to the available coverage, CONDUSEF’s authority to sanction financial entities for breaches tied to the Collection Agency Registry and monthly complaint reports. That combination points to an ecosystem where supervision is no longer limited to solvency or commercial conduct, but extends to incident traceability and reporting duties.

On the digital and child protection front, the month also left a separate regulatory package, with the decree on safe digital environments for girls, boys, and adolescents and several reports on its implications. Although that area is not the main focus of this report, it does confirm that Mexico’s regulatory agenda is combining user protection, platform oversight, and operational requirements for financial and digital intermediaries.

Guatemala, cybersecurity as a legislative priority

Guatemala sent a clear legislative signal with Bill 6347 on cybersecurity. The proposal was added to the congressional agenda for its first debate, after receiving a favorable opinion with amendments from a committee and being sent back in April 2026 for further review by the National Security and Economy committees.

Congress also plans to set up a technical working group with representatives from the banking sector and the sponsors so observations can be incorporated before the bill advances. That decision matters because it shows the text is not being discussed in the abstract, but with input from the actors that would be affected by the future regulatory obligation. The proposal seeks to strengthen the state’s ability to prevent, detect, and respond to digital threats.

The available material also mentions the possible creation of the National Cybersecurity Council, the National Cybersecurity Directorate, and the Guatemala Cybersecurity Incident Response Center, although always as part of the proposal and not as institutions already in operation. For that reason, this content should be read as legislative design, not as completed implementation.

Peru, the financial sector and open payments rules

Peru contributed a regulatory front focused on open finance and digital payments. SBS published the first block of rules for the Open Finance System and opened a public consultation on the draft regulation. At the same time, the BCRP approved the regulation for payment acceptance services to strengthen digital payments and protect merchant funds.

Although this report focuses on regulation and compliance in cybersecurity and data, the point is clear. A well-designed open finance system requires controls over APIs, permissions, consent, and traceability, even if the corpus does not detail a technical development this month comparable to those in other countries. Peru’s signal is one of regulatory architecture under construction, still in the definition and comment phase.

Paraguay, and the debates over personal data

The available material on Paraguay is thinner in verifiable volume for this month, but it shows a growing public conversation about personal data regulation and improper use. The reports listed indicate that the personal data law is already being invoked in debates over access to information, fraudulent affiliation, and shielding officials, although in several cases the detail provided does not allow those notes to be turned into closed regulatory facts for the period.

That does not mean there was no agenda, only that the source material provided was not sufficient for this report to confirm it. In compliance terms, it should be treated as a sign of ongoing political and social debate, but not as a consolidated regulatory change within the October corpus analyzed.

Latin America’s Most Affected Countries

Argentina

Argentina was among the countries with the highest density of verifiable events, driven by regulation, sanctions, and documented fraud. The CNV took its most concrete step by adding cybersecurity obligations for PSAV under RG 1172/2026, with a focus on governance, risk-based controls, audits, and reporting of material incidents. That move is structural, and it changes the supervisory standard for the virtual assets sector.

At the same time, the Banco de La Pampa case confirmed that the judicial and consumer protection front is active as well. The phishing fine did not just punish an individual incident, it also suggests that the system expects institutions to detect unusual activity and alert on anomalous patterns. For local teams, that turns fraud prevention into a cross-cutting obligation, not a task limited to digital channels.

Argentina also remains on the radar because of market-rule and data debates linked to open banking, although much of that material belongs to the comparative framework from previous months. In October, the relevant message is that financial regulation is integrating the technology and security dimension more directly.

Brazil

Brazil was the country with the strongest institutional signal in data protection this month. The ANPD not only closed the Feira de Santana case with sanctions and corrective measures, it also kept moving on its regulatory update and glossary agenda, aimed at clarifying obligations for regulated entities and professionalizing enforcement. That combination leaves a clear mark on what the regulator expects, quick response, documentation, and verifiable controls.

The Brazilian picture does not end with the municipal case. The English-language update to the LGPD and references to rules on incident notification, processors, and international transfers show an institution trying to keep pace with recent regulatory changes. It is also relevant that the Senate is still advancing broader initiatives, from fundamental rights to possible requirements for political processes.

By volume and depth, Brazil was likely the country where compliance was most clearly forced to produce concrete evidence during the month. The difference from other jurisdictions is that here, sanctions are not a potential threat, but an outcome that has already materialized.

Chile

Chile had one of the month’s most important regulatory debates because of the delay to Law No. 21.719. The Senate approved the bill moving its effective date to October 15, 2027, but the legislative process is still open and the current legal date remains December 2026. That creates a window of uncertainty that affects implementation decisions, budgets, and compliance timelines.

The verified content also shows that the law includes data subject rights, security and breach-notification duties, and a sanctions regime. That is why the debate is far from minor. Any shift in dates does not remove the need to design processes, risk matrices, and response mechanisms.

Chile is also part of the debate over the composition of the future agency and the possibility of staggering supervisory and sanctioning powers over time. Operationally, that means organizations should neither overstate nor understate the delay until the text actually becomes law.

Mexico

Mexico combined financial supervision and platform oversight with a more demanding regulatory tone. The CNBV carried out its second PLD/FT certification review of 2026, while the coverage cited technical requirements tied to incidents, penetration testing, and remediation. The Supreme Court also confirmed, according to the available coverage, CONDUSEF’s sanctioning power over certain operational obligations in the financial system.

Although part of the available material on Mexico belongs to other regulatory themes, the takeaway for this report is that the country is pushing entities to professionalize evidence, traceability, and incident control. This is not only about filing forms, but about demonstrating operational capability in the face of security and conduct events.

Guatemala

Guatemala gained visibility because of the legislative revival of cybersecurity bill 6347. Its inclusion on the agenda for a first debate, the technical table with the banking sector, and earlier committee work show that the discussion is no longer at a preliminary stage, it is now a legislative process with affected stakeholders involved.

The bill aims to strengthen the state response to digital threats and, according to the coverage, includes new structures such as CONCIBER, DICIBER, and CRIC-GT. Since that still remains part of the proposal, the prudent reading is to watch how the text evolves and what scope it eventually has in the relationship between the public sector, banking, and incident response.

Peru

Peru posted an important signal in open finance and payments regulation, with the SBS opening a consultation and publishing the first regulatory block for the system. Although October’s material is more regulatory than punitive, the direction is clear, the country is preparing for a financial data-sharing model that will require tighter identity controls, consent management, and traceability.

The country also continues to generate digital security rules and technical alerts in other areas, although several of those items come from material without a confirmed date and are therefore excluded from the period’s volume. For this report, the reading is that Peru’s ecosystem is still refining the regulatory layer, not closing it.

Colombia

Colombia appears less dense in verified October events under this axis, even though discussions remain active on open finance, API regulation, and data governance in the financial system. Much of the corresponding material belongs to the September comparative frame, so it should not be counted as October volume.

The useful signal is that the country continues moving toward greater interoperability and tighter controls over data and third parties. There is no move in this corpus as forceful as the ones seen in Chile, Brazil, or Argentina, but the direction is consistent.

Paraguay

Paraguay had a more qualitative than quantitative presence in the available material. The coverage cited debates on data protection, access to information, and the use of the law for political or administrative purposes, but without a sufficiently solid verifiable regulatory item to mark a milestone for the period.

For that reason, the country remains a monitoring signal rather than an axis with volume comparable to other markets. For a strict monthly reading, that matters, because it avoids overstating public debates that have not yet turned into confirmed regulatory changes.

Trends and Signals to Watch

A month-over-month comparison shows a sharp drop in the total verified volume, from 849 to 392 events, but not a corresponding drop in regulatory intensity. Regulation remains the dominant axis, even as documented events fell from 403 to 185. The shift does not point to disengagement, but to a narrower selection of the material that entered the October corpus.

The comparison also shows a notable shift in threats. Fraud or phishing cases fell from 159 to 13, while cases with ransomware or extortion as the primary focus rose from 1 to 6. Based on verified material from the period, that variation means October should not be read as a lower-risk month, but as a month with a different mix. More than mass fraud, the corpus showed sanctions, regulatory adjustments, and some extortion events with only partial classification.

The other relevant change is that unclassified incidents rose from 19 to 26. That usually reflects limits in the source material, not necessarily a real increase in operational risk. In a compliance report, that difference matters because it avoids overreading the metric and reminds us that source language does not always allow each case to be classified precisely.

The most sensitive signal to watch for November is how quickly these discussions translate into implementation. Chile may or may not turn the delay of its law into a legal fact. Brazil may deepen its enforcement agenda. Argentina will have to show whether RG 1172/2026 becomes effective controls in PSAV. And Mexico will continue refining its financial and digital oversight architecture.

Recommendations for security teams

Security and compliance teams should exit October with three clear priorities. The first is to review their country-by-country regulatory obligations map and make sure legal interpretation does not depend on a single team. The month showed that privacy, cybersecurity, and financial oversight are moving together, and a change in one rule can affect incident response, audit, and customer service at the same time.

The second priority is to strengthen traceability. The cases in Brazil and Argentina show that regulators and judges expect evidence of actions taken, not just written policies. It makes sense to review who signs response plans, how incidents are documented, which alerts are logged, and what evidence remains available for audit or sanction. If the control exists but cannot be proven, compliance risk remains open.

The third priority is to validate the authentication and fraud layer. The Banco de La Pampa case and the reporting on credentials in Mexico reaffirm that social engineering still gets in through users and weak access controls. The response should include behavior monitoring, alerts tied to session origin, stronger verification for sensitive transactions, and escalation mechanisms that do not depend on operator instinct.

It is also advisable to update legislative compliance timelines. In Chile, do not assume an extension until it is enacted. In Brazil, review the obligations stemming from the LGPD and from ANPD resolutions and guidance. In Argentina, map RG 1172/2026 for PSAV and its new reporting duties. In Mexico, review the impacts of CNBV and CONDUSEF oversight. There is no need for a regional mega-initiative to improve. What is needed is country-by-country order.

Finally, teams should separate their playbooks by event type. The month makes clear that not every incident is ransomware, not every privacy issue is a technology breach, and not every regulatory violation starts with an attack. That distinction improves response, avoids overreaction, and helps allocate legal, technical, and operational resources more effectively.

Frequently Asked Questions

Which countries concentrated the strongest signals of regulation and compliance in October?

Chile, Brazil, Argentina, and Mexico concentrated most of the month’s verifiable developments. Chile debated postponing its data protection law, Brazil sanctioned a municipality and updated ANPD materials, Argentina added cybersecurity requirements for PSAVs, and Mexico strengthened financial supervision and enforcement.

Has the Chilean delay to Law 21.719 already taken effect?

No. The Senate approved the bill postponing its effective date to October 15, 2027, but the text still must complete its process in the Chamber of Deputies. Until that happens, the legal date remains December 1, 2026, according to the coverage included in the report.

What changes for virtual asset service providers in Argentina?

CNV General Resolution 1172/2026 requires them to adopt risk-based policies, procedures and controls, governance measures, periodic assessments, cyber resilience audits, and safeguards for user information. They must also immediately report cybersecurity incidents, operational disruptions, and other relevant events.

What did the Feira de Santana case show about data protection sanctions?

It showed that the regulator can move from oversight to a sanctions process within hours and require specific corrective measures. Brazil’s ANPD issued a warning, publicized the infringement and ordered remedial steps, while also recognizing six LGPD violations tied to the exposure of sensitive data belonging to 1,241 people.

Did the report find critical CVEs in October?

No. The critical CVE indicator is zero in the material analyzed for the period. That does not mean no critical vulnerabilities were exploited in the region, only that this October corpus did not document any with that level of certainty or with enough reference detail to include them.

Material limitations

This report was built exclusively from the material provided for October 2026 and from the facts in the comparative frame only when they were needed to contrast month-over-month changes. The declared time window for the indicators includes 392 facts dated in October 2026, 55 facts from earlier months used as a comparison frame, 8 undated facts excluded from the indicators, and 1 fact from after the period, also excluded.

A zero reading in an indicator does not mean there was no activity in the region. In particular, the figure showing 0 critical CVEs means only that none were recorded in the material analyzed for the period, not that no critical vulnerabilities were exploited in Latin America. The same applies to any other category that did not appear in the corpus with sufficient evidence.

Aggregated telemetry was not used because the material did not provide figures of that type for the period. Blocked attempts, scans, or automated detections were also not counted as incidents, because they are not equivalent to verified intrusions. When ransomware or extortion appeared, the taxonomy remained separate between confirmed encryption, exfiltration without encryption, and cases that could not be determined.

Facts without a confirmed date and facts from after the period were excluded from the indicator base. Unpermitted sources were also avoided by instruction, such as consumer social media posts or promotional material not suitable for supporting trends. In cases where journalistic or secondary coverage did not allow sufficient corroboration, the report attributed the claim to the source and preserved the margin of uncertainty.

Monitoring markers

Technical appendix: indicators of compromise and TTPs