Latin America Financial Cyber Rules: Mexico, Argentina, Chile and Colombia regulators

Banks and payment firms operating across Latin America face four different supervisory cyber rulebooks, with incident clocks that range from 30 minutes to five business days and very different expectations of the CISO. This guide compares the financial sector cyber rules of Mexico's Comisión Nacional Bancaria y de Valores (CNBV), Argentina's Banco Central de la República Argentina (BCRA), Chile's Comisión para el Mercado Financiero (CMF) and Colombia's Superintendencia Financiera (SFC). It covers scope, governance, testing, third parties, incident reporting and where service accounts and other non-human identities fit. It is written for regional CISOs, compliance teams and technology risk managers at banks, payment service providers and fintechs with licences in more than one of these markets. Brazil has its own guide: see the Brazil Central Bank Cybersecurity Resolution Guide. Countries are listed alphabetically, and order is not a ranking.

Each section cites the regulator's published text or a copy of it. Two points rely on secondary sources and are attributed where used: the in-force date of BCRA Communication "A" 7724 (iProfesional, with the BCRA's own 180-day rule) and the Chile RAN Chapter 20-8 text, read in a copy hosted by Transbank. Several of these rules date from 2018 to 2021 and have been amended in places. Confirm against the official text before relying on it.

Key takeaways

• Argentina widened scope in 2026. BCRA Communication "A" 8401 of 13 February 2026 brings payment-system market infrastructures and registered payment service providers into the technology and information security minimum requirements, with PSPs due to comply from 4 August 2026.
• Chile has the fastest clock. CMF RAN Chapter 20-8 requires operational incidents to be reported within a maximum of 30 minutes of their occurrence.
• Colombia standardises reporting. SFC Circular 033 of 2020 adopted a unified cyber incident taxonomy, the Traffic Light Protocol and a metrics format (Formato 408) on top of Circular 007 of 2018.
• Mexico mandates an independent CISO. CNBV rules for credit institutions require a Chief Information Security Officer reporting to the director general, free of conflicts with IT, plus at least two independent penetration tests a year.
• Machine access is in scope everywhere. Each regime addresses authentication, access profiles or third-party access, so service accounts, API keys and vendor credentials need owners, reviews and logs.

The four regimes at a glance

Other financial entities in Mexico, such as fintech institutions, have their own CNBV rules not covered here. Chile's cross-sector Framework Cybersecurity Law sits on top of CMF rules: see the Chile Cybersecurity Framework Law guide.

Argentina: BCRA

The BCRA approved the minimum requirements in March 2023, consolidating its 2020 cyber resilience guidelines, its 2021 self-assessment and incident response guidance, and measures such as two-factor authentication for digital wallets, aligned with BIS and FSB recommendations (BCRA announcement). Contemporary reporting by iProfesional lists governance with board oversight, risk assessment covering third parties, obsolescence, unauthorised software and AI, documentation and controls for AI and machine learning models, biometric authentication risks and a cyber incident management policy.

Communication "A" 8401 of 13 February 2026 updated the text to version 3a. Points that matter to security teams:

• Scope (Section 1.1): financial institutions, the four payment-system market infrastructures and PSPs in the BCRA register.
• Framework (Section 1.2): a risk management framework proportionate to services and technology, aligned with operational resilience goals and the three lines model.
• Critical outsourcing (Section 10.1): notice to the BCRA's external systems audit function at least 60 calendar days before starting a critical service, including locations and subcontractors.
• Contracts (Section 10.3): audit rights for the entity and the regulator, data deletion after termination and cyber incident coordination, with subcontractors bound by the same terms.
• Exit (Section 10.2): termination plans covering data retrieval and system documentation.

The incident management section of the current text was not available in the copy we read; check Section 8 of the BCRA's ordered text for reporting duties and clocks.

Chile: CMF

RAN Chapter 20-10, issued on 7 July 2020 and in force from 1 December 2020, requires the board to approve a cybersecurity strategy and ensure an information security and cybersecurity management system (CMF press release). Entities define critical assets and the functions protecting them, detect threats and vulnerabilities, respond and recover, identify assets that form critical infrastructure for the financial industry and payment system, and exchange technical incident information. It complements Chapter 20-7 on outsourcing.

Chapter 20-8, in the version issued by Circular 3,640 of 31 August 2018, sets the reporting rules:

• 30 minutes: report operational incidents affecting continuity, funds, service quality or reputation within a maximum of 30 minutes of their occurrence, at any hour, through the regulator's extranet mailbox. Missing details do not justify delay.
• Closing report: when the incident closes, with causes, affected services, third parties involved and measures taken. The regulator may ask for recovery plans or forensic reports.
• Responsible officer: an executive-level officer and a substitute who send reports and answer the regulator.
• Industry alerts: share cybersecurity incidents with the rest of the industry through an alert system as soon as possible, describing the threat and affected channels and, where known, the malware and protective measures.
• Customers: inform users promptly when an incident affects service or becomes public, and keep them updated.

Colombia: SFC

Circular 007 of 5 June 2018 added Chapter V, "minimum requirements for managing information security and cybersecurity", to the Circular Básica Jurídica.

• Policy and unit: a board-approved cybersecurity policy (3.1.1) and a unit managing information security and cyber risk whose budget is managed separately from operations and IT (3.2.9). The unit reports to the board and senior management at least every six months (3.2.3).
• SOC: entities decide by risk analysis whether to use a security operations centre, which may be operated from abroad (3.2.8).
• Third parties: contracts with critical third parties include cybersecurity obligations, with periodic verification (3.9, 3.10).
• Testing: security in the development lifecycle, and continuity plans that cover cyberattacks tested with simulations (3.8, 4.1.6, 4.1.7).
• Reporting: significant incidents affecting confidentiality, integrity or availability are reported to the SFC with a description, impact and measures (3.7.1); affected consumers are informed with remediation measures (3.7.3). Entities may report to COLCERT or sector CSIRTs (4.3.3).

Circular 033 of 17 November 2020 added numeral 5 to the chapter: the unified cyber incident taxonomy (TUIC), the Traffic Light Protocol for incident reports to the SFC's operational risk mailbox, and Formato 408 for reporting security and cybersecurity metrics.

Mexico: CNBV

The CNBV's resolution of 15 November 2018 added Articles 168 Bis 11 to 168 Bis 17 to the rules for credit institutions (published in the Diario Oficial de la Federación).

• Controls (168 Bis 11): network segregation, secure configuration, encryption, authentication and audit logs, with logs kept three years for critical information and at least six months otherwise.
• Director general (168 Bis 12): approves the security master plan (Plan Director de Seguridad), at least annual security reviews, and at least two independent penetration tests a year on different systems and applications, with remediation plans sent to the CNBV within 10 business days.
• CISO (168 Bis 13, 14): appointed by and reporting to the director general, with no conflicts of interest with IT and no day-to-day operation of security; leads incident response and reviews access profiles at least annually.
• Incidents (168 Bis 16): immediate notice by email to the CNBV for incidents meeting the criteria, Annexes 64 and 64 Bis within 5 business days, an investigation and work plan within 15 business days after the incident ends, and notice to affected clients within 48 hours if sensitive information is compromised.
• Registry (168 Bis 17): a database of incidents, failures and vulnerabilities kept for at least 10 years.
• Contingencies (164 Bis): operational contingencies lasting at least 60 minutes reported within 60 minutes of meeting the criteria.

Incident reporting compared

A regional playbook must run all four clocks in parallel, plus personal data breach notices. See the Cyber Incident Reporting Requirements Map and the Latin American Banking Trojans Guide for the threats most often behind these reports.

What it means for non-human identities and AI agents

• Access profile reviews (Mexico 168 Bis 14): include service accounts, batch IDs and API clients in the annual CISO review, not only staff profiles.
• Authentication and logs (Mexico 168 Bis 11): machine-to-machine authentication and the logs it generates fall under the same retention periods.
• Third-party access (Argentina Section 10, Colombia 3.9 and 3.10): list the credentials each provider holds, build their revocation into exit plans, and require incident coordination when a provider's keys are exposed. See the Third-Party Access Guide.
• AI models (Argentina): the BCRA requirements reported by iProfesional ask for documented purpose, roles, models and datasets for AI and machine learning; agents that act with credentials need the same records, plus a named owner for each identity they use.
• Incident triggers: a leaked cloud key or misused integration token can meet Chile's 30-minute or Mexico's immediate threshold. Add NHI scenarios to classification criteria. See the Service Account Security Guide.

Compliance steps for regional groups

1. Map licences: list each entity, its regulator and the instrument that applies, including PSP registrations in Argentina.
2. Pull current texts: the compiled CNBV rules, BCRA ordered text, CMF RAN chapters and SFC Circular Básica Jurídica, and record versions.
3. Set the strictest common baseline: NHI Mgmt Group suggests a regional standard built to the strictest rule in each area, for example Mexico's CISO independence and penetration testing, then local add-ons.
4. Build one incident matrix: per country trigger, clock, channel, form and customer notice.
5. Review outsourcing: 60-day BCRA notice for critical services, SFC critical third-party clauses, and CNBV third-party infrastructure contracts.
6. Cover machine identities: inventory, owners, rotation and access reviews for service accounts, keys and vendor credentials in every country.
7. Exercise: test a cross-border incident that triggers all four clocks.

Framework mapping

This mapping is NHI Mgmt Group's own; none of the regulators publishes a NIST crosswalk.

Measuring progress

• Time to first regulator notice in exercises, per country, against 30 minutes (Chile) and immediate (Mexico).
• Penetration tests completed per year on distinct systems (Mexico target of at least two).
• Access profiles reviewed in the last twelve months, human and machine.
• Critical providers with contract clauses for audit, incident coordination and data deletion.
• Service accounts and API keys with a named owner in each country.

Common failure patterns

• A single regional clock: a 24-hour or 72-hour group standard misses Chile's 30 minutes and Mexico's immediate notice.
• CISO inside IT: a regional CISO who also runs IT operations conflicts with Mexico's independence rule.
• Late outsourcing notices: starting a critical cloud or processing service in Argentina without the 60-day notice.
• PSPs left out: Argentine payment subsidiaries assuming bank-only rules do not reach them after A 8401.
• Human-only reviews: annual access profile reviews that skip service accounts and vendor IDs.

Practitioner checklist

• List each entity's regulator, instrument and the date you last checked the compiled text.
• Keep a four-country incident matrix with clocks, channels and forms.
• Name the Chile 20-8 reporting officer and substitute.
• Report SFC incidents with the TUIC and TLP and file Formato 408 metrics.
• Confirm the CNBV CISO's reporting line and independence from IT.
• Schedule at least two independent penetration tests a year for Mexican banks.
• Send BCRA critical outsourcing notices at least 60 days ahead.
• Include machine identities in every access profile review.
• Run one cross-border exercise a year that triggers every clock.

Standards and references

• Diario Oficial de la Federación: CNBV resolution amending the Disposiciones for credit institutions (information security)
• BCRA: Communication "A" 8401, minimum requirements for technology and information security risks
• BCRA: announcement of the technology and information security risk requirements
• CMF: information security and cybersecurity standard, RAN Chapter 20-10
• CMF: RAN Chapter 20-8, operational incident reporting (copy hosted by Transbank)
• SFC: Circular Externa 007 of 2018 (official compilation)
• SFC: Circular Externa 033 of 2020 (copy)
• iProfesional: BCRA new cybersecurity obligations (Communication A 7724)

Related NHI Mgmt Group resources: Brazil Central Bank Cybersecurity Resolution Guide · Financial Services Cyber Regulation Map · Mexico Data Protection Law Guide · Colombia Data Protection Law Guide. This guide summarises financial sector cyber rules in Argentina, Chile, Colombia and Mexico as at 9 November 2026 and is not legal advice.