The Fintech Law is Chile's Law 21.521, published on January 4, 2023. It regulates technology-based financial services and creates the Open Finance System: banks and card issuers will share customer data with providers registered with the CMF, only with prior and explicit authorization (article 23). From December 1, 2026, Law 21.719 also applies.
The essentials in 30 seconds
- The Fintech Law is Law 21.521, published in the Official Gazette on January 4, 2023; its Title III creates the Open Finance System.
- Customer identification, product and transaction data may only be communicated with the customer's prior, explicit and specific authorization (articles 17 and 23).
- The CMF rule (NCG 514, as amended by NCG 569) will enter into force in July 2027 and limits each consent to 36 months.
- From December 1, 2026, banks and fintechs must also comply with Law 21.719: information, security, breach reporting, contracts with processors and ARSOP rights.
- A breach involving financial data may require notifying the CMF and, where there is a reasonable risk to data subjects, the Agency and each affected customer.
Anyone searching for «fintech law» finds rules from several countries. The one in force in Chile is Law 21.521, with two focuses: registering and supervising fintech service providers, and creating an Open Finance System in which customers' data is no longer locked away in their bank. If you want the full picture, start with our guide to the data protection law in Chile.
This article examines the second focus from a data protection perspective: who participates, what data flows, how customer authorization works and what changes with Law 21.719. The laws and the Financial Market Commission rules cited were reviewed on October 21, 2026.
What is the Fintech Law and what is the Open Finance System?
The Fintech Law is Law 21.521, published in the Official Gazette on January 4, 2023. Its Title II regulates services such as crowdfunding, credit and investment advice and the custody of financial instruments (article 2). Its principles include the «adequate safeguarding of the data processed» (article 1), and the Financial Market Commission (CMF) may not exempt anyone from the obligations the law sets out regarding personal data (article 4).
The Open Finance System (Sistema de Finanzas Abiertas), Chile's open finance framework, is set out in Title III (articles 16 to 27). It allows the exchange of information on financial customers «who have expressly consented to it», through remote and automated access interfaces, and requires participants to observe the principle of «data security and privacy» (article 16).
It is not yet in force: Title III takes effect with the CMF's rules (first transitory article). The CMF issued General Rule (NCG) No. 514 on July 3, 2024, and NCG No. 569, of June 1, 2026, set its entry into force 36 months after that first issuance: July 2027. From then, banks and card issuers will have 9 months for the interfaces with data on customers who are natural persons and 12 for legal persons; the other obligated institutions, between 20 and 30 months.
Who participates and what personal data flows through the System?
Article 17 distinguishes four roles; the table adds a fifth actor that the law does not regulate as a participant, the technology provider. The last column is guidance: the role is assessed processing activity by processing activity.
| Role under the Fintech Law | Who | What it does with the data | Usual position under Law 21.719 |
|---|---|---|---|
| Information-providing institution | Banks and card issuers. The law directs the CMF to extend the obligation to cooperatives, insurers, stockbrokers, family allowance funds and other entities (article 18). | Provides the data that a registered provider requests from it. | Controller. Providing data to another controller is an assignment (article 2 letter v). |
| Information-based service provider | Entities voluntarily registered in a public register kept by the CMF (article 19). | Receives data in order to provide a service to the customer. | Controller of what it receives, as assignee (article 15). |
| Account-providing institution | The institution where the customer holds their account (article 20). | Executes the payment orders transmitted to it by the initiator. | Controller. |
| Payment initiation service provider | Entities registered in a public register kept by the CMF (article 20). | Issues payment instructions on the customer's behalf, without using their information for other purposes. | Controller, limited to the purpose of the payment. |
| Technology provider | A cloud service or platform contracted by a participant. NCG 514 allows outsourcing. | Processes data on behalf of a participant. | Processor (article 15 bis). |
The first of the six categories in article 17, on terms and conditions and customer service channels, contains no personal data. The main ones are the identification and registration of customers «and their representatives» (No. 2), the contracted conditions and transaction history of accounts, cards, loans, insurance and investments (No. 3) and the data needed to initiate payments (No. 5); the communications for financial portability (No. 4) and any data added by the CMF (No. 6) may also contain personal data. The law allows up to five years of history; NCG 514, as amended by NCG 569, limits it to 24 months.
The data of a customer that is a legal person is not personal data, but the data of its representatives and attorneys-in-fact is (article 2 letters f and ñ of Law 21.719). And article 22 of the Fintech Law requires that, when setting security measures, account be taken of «the status of sensitive data» of the information: from December 1, 2026, the data protection law will expressly classify as sensitive the data that reveal a person's «socioeconomic situation» (article 2 letter g).
How does customer authorization work in the Open Finance System?
Article 23 of the Fintech Law is the central rule. The provider must authenticate the customer and obtain their «prior and explicit consent» through secure electronic means. To consult information, consent must be given «freely and in an informed, express and specific manner as to the type of financial information, the purpose and the maximum period of validity of that authorization», and must identify the provider. The customer may revoke it at any time.
The bank must provide the information even if it has no contract with the provider, but only if the provider has the customer's consent (article 19), and that disclosure does not breach its duty of confidentiality or secrecy (article 24). The detail is in section III.D of NCG 514, as replaced by NCG 569:
- Maximum duration of 36 months, even if the contract lasts longer; 90 days for a single scheduled payment.
- No design pressure: no pre-ticked options, no discounts in exchange for consent and no services made conditional on it, unless it is unfeasible to provide them without that consent.
- Purpose linked to a service: the rule warns that «the mere assignment of data that is not linked to the provision of a service is not a legitimate purpose within the framework of the Open Finance System».
- Proof on a durable medium of the consent and of the circumstances in which it was given.
- Consent dashboard, free of charge and remote, at banks and providers, to view and revoke each authorization, with a record of the interactions kept for at least five years.
- The bank may not obstruct: it may not alter the provider's request or ask for additional consent for the same exchange.
| Requirement | Fintech Law (art. 23) and NCG 514 as amended by NCG 569 | Law 21.719 (art. 2 letter p and art. 12) |
|---|---|---|
| Qualities | Prior, explicit, free, informed, express and specific. | Free, specific, unambiguous, informed and prior. |
| Specific as to | Type of information, purpose and period of validity. Identifies the provider. | The purpose or purposes of the processing. |
| Duration | Up to 36 months (NCG 514). | No fixed period. Data is kept only for as long as necessary for the purposes (art. 3 letter c). |
| Revocation | At any time. The provider may no longer use or store that data (arts. 23 and 24). | At any time, without stating a reason and without retroactive effect (art. 12). |
| Conditionality | Prohibited, unless the service is unfeasible without consent (NCG 514). | Presumed not to be freely given if obtained when performing a contract or providing a service for which that collection is not necessary, unless consent is the only consideration (art. 12). |
| Proof | Durable medium and consent dashboard (NCG 514). | It is for the controller to prove that it had consent (art. 12). |
The Law 21.719 column will apply from December 1, 2026; the Fintech Law and NCG 514 column, once the CMF rule enters into force in July 2027. Since the System will start operating after the data protection law, it is advisable to design the flow now so that it complies with both. Until November 30, 2026, the original Law 19.628 applies.
What changes with Law 21.719 from December 1, 2026?
The Fintech Law does not displace the data protection law: its articles 24 and 27 preserve Law 19.628, which Law 21.719 rewrites with effect from December 1, 2026 (first transitory article). A bill to postpone the law, at its first constitutional stage in the Senate, proposes December 1, 2027; it is a bill, not a law. On the current legal dates, the new data protection law will apply before the CMF rule and will add these duties:
- Lawful basis and purpose. In the System, the basis is the customer's authorization: identification, product and transaction information «may only be communicated» with it (article 17). The ground in article 13 letter a) covers something else: data on obligations of an economic, financial, banking or commercial nature processed under Title III of the data protection law, which regulates information on their fulfilment or non-fulfilment. The data received may only be used for the purposes consented to, without prejudice to another lawful basis (NCG 514, section IV.D letter e); Law 21.719 will allow a different purpose only if it is compatible with the original one, if a contract with the data subject justifies it, if the data subject consents again or if the law so provides (article 3 letter b). See lawful bases and consent.
- Documented assignment. If a bank provides data to a provider that will use it for its own service, there is an assignment between controllers, which must be recorded in writing or by a suitable electronic means (article 15). The record required by article 21 of the Fintech Law (requester, reason and purpose, type of data and date) covers much of that. See assignment of personal data.
- Duty to inform. The privacy policy must state the recipients, the lawful basis, the retention period and the right to withdraw consent (article 14 ter letters d, i and k).
- Impact assessment. It will always be required, before processing begins, for a systematic and exhaustive evaluation of personal aspects based on automated processing or decisions, such as profiling, that produces significant legal effects on data subjects, and for massive or large-scale data processing (article 15 ter letters a and b). It is worth reviewing for any credit assessment service that uses data from the System.
- Disqualification. Anyone who has committed very serious and repeated infringements of personal data rules within a period of twenty-four months may not register as a provider (articles 19 and 20 of the Fintech Law). The provisional catalogue in the ninth transitory article applies «only for as long as Law No. 19.628 does not define a catalogue»; from December 1, 2026, Law 21.719 will define it in article 34 quáter, which takes up those eight types of conduct almost verbatim and adds three.
What does the law require for breaches and technology providers?
The Fintech Law requires compliance with the security and cybersecurity standards set by the CMF (article 22) and makes each participant responsible for the confidentiality and privacy of the data (article 24). From December 1, 2026, Law 21.719 will also require measures proportionate to the risk, such as pseudonymization and encryption, and, in the event of a security incident and if there is a judicial or administrative dispute, will place on the controller the burden of proving that those measures existed and worked (article 14 quinquies). See security measures.
If there is a breach, the notifications will be cumulative:
- To the CMF, without delay (article 22). NCG 514 sets a maximum of 30 minutes from when the entity becomes aware of it.
- To the customer, the CMF and the institution that provided the data, if a provider detects vulnerabilities that put the information at risk; it must also cut off access (article 24).
- To the Personal Data Protection Agency, from December 1, 2026 and without undue delay, when there is a reasonable risk to the rights and freedoms of data subjects (article 14 sexies).
- To each data subject, when the breach affects data relating to obligations of an economic, financial, banking or commercial nature (article 14 sexies).
Failing to make that communication will be a serious infringement (article 34 ter letter k); failing to make it deliberately, a very serious one (article 34 quáter letter f).
With technology providers, NCG 514 allows outsourcing provided that the risks of substitution, intervention, subcontracting and concentration are assessed. Law 21.719 will also require a contract setting out the object of the engagement, its duration, the purpose, the type of data, the categories of data subjects and the rights and obligations of the parties; it will prohibit the processor from delegating without specific written authorization from the controller and will require it to report breaches to the controller (article 15 bis).
How are ARSOP rights and portability exercised in open finance?
On a separate track. NCG 514 states that the operation of the System «shall be independent» of the exercise of data protection rights, although it requires procedures to channel them. Revoking an authorization in the dashboard cuts off the flow and requires the provider to stop using and storing the data obtained with it (article 24 of the Fintech Law). But it is not an erasure request: it does not reach the data the bank holds because of its relationship with the customer, and for that the customer must exercise the right to erasure (article 7), which has its own grounds.
From December 1, 2026, each participant must respond to requests for access, rectification, erasure, objection and portability within 30 calendar days, extendable once (article 11); today, under the original Law 19.628, the deadline is two business days. A rectification must be communicated to those who received the data, unless this is impossible or requires disproportionate effort (article 6), and the Fintech Law also requires queries and complaints about the data exchanged to be handled (article 24). See how to respond to ARSOP rights requests.
The word portability needs clarifying. The right in article 9 of Law 21.719 will cover the data that the data subject «has provided to the controller», if the processing is automated and based on their consent. The System covers more data, such as transaction history, but only between participants in the System. And the financial portability of Law 21.236 is a different procedure, which will use the System's interfaces (article 17 No. 4 of the Fintech Law).
What should a financial institution or fintech prepare?
It makes sense to work in parallel: the data protection law and the CMF have different dates.
- Define your role in each flow: information provider, service provider, payment initiator or processor. The same entity may have more than one.
- Inventory the data in article 17 that you will provide or receive. Anyone applying to register as an information-based service provider must submit to the CMF a model record of processing activities, with the purposes, retention periods and lawful basis of each activity.
- Design consent that complies with both laws, with simple revocation and retained proof.
- Update the privacy policy with the content of article 14 ter.
- Unify the breach protocol so that it covers notifying the CMF, the Agency and customers.
- Review contracts with technology providers and the procedure for responding to rights requests.
If your entity is a bank, a card issuer, a cooperative, an insurer or a fintech, Law 21.719 in banking and financial services sets out what we leave up and running. For the overall picture, see the summary of Law 21.719 and the guide to Chile's personal data protection law.
Will your entity participate in the Open Finance System?
In a 30-minute assessment for banks, card issuers, cooperatives, insurers, brokerage firms and fintechs, we review what role you will have in the System, how your consent flows fit with Law 21.719 and what you are missing in security, breaches and contracts before the deadlines set by the law and the CMF.
Schedule an assessmentFrequently asked questions
What is the Fintech Law in Chile?
It is Law 21.521, published in the Official Gazette on January 4, 2023. It regulates technology-based financial services, such as crowdfunding and credit advice, and creates the Open Finance System in its Title III. It is supervised by the Financial Market Commission (CMF).
Is «Ley Fintec» the same as the Fintech Law?
In Chile, yes: the official name is «Ley Fintec», usually rendered in English as the Fintech Law, and it is Law 21.521. Its article 3 defines Fintec as the activities that use innovation and technological developments to design, offer and provide financial products and services.
What is the Open Finance System?
It is the open finance system created by Title III of Law 21.521. It allows banks, card issuers and other institutions to share the data of customers who authorize it with providers registered with the CMF, through remote and automated access interfaces (article 16). It also allows payments to be initiated on the customer's behalf (article 20).
Who is required to participate in the Open Finance System?
Banks and issuers of credit cards and prepaid payment cards (article 18 of Law 21.521). The same provision directs the CMF to extend the obligation to savings and credit cooperatives, insurance companies, stockbrokers, family allowance funds and other supervised entities. Information-based service providers participate voluntarily, by registering in a CMF register.
Can my bank share my data without my consent in open finance?
No. In the Open Finance System, identification, product and transaction information «may only be communicated» with the customer's authorization (article 17 of Law 21.521). That authorization must be prior and explicit, and must specify the type of information, the purpose and the period (article 23).
How long does consent last in the Open Finance System?
As long as each authorization specifies, up to a maximum of 36 months even if the contract lasts longer, under the CMF's NCG 514 as amended by NCG 569, which will enter into force in July 2027. For a single scheduled payment, the maximum will be 90 days. The customer may revoke it earlier, at any time (article 23 of Law 21.521).
When does the Open Finance System start operating?
The CMF's NCG 514 will enter into force in July 2027, 36 months after it was first issued on July 3, 2024, under the amendment made by NCG 569 of June 1, 2026. From then, banks and card issuers will have between 5 and 18 months depending on the type of interface, and the other obligated institutions between 20 and 30 months. Deadlines reviewed as of October 21, 2026.
Does Law 21.719 apply to the Open Finance System?
Yes. Articles 24 and 27 of the Fintech Law preserve Law 19.628, which Law 21.719 rewrites from December 1, 2026. Entities must comply with both: the consent required by article 23 of the Fintech Law and the duties of information, security, breach reporting and ARSOP rights under the data protection law.
What happens if there is a data breach in the Open Finance System?
The entity must report it to the CMF without delay (article 22 of the Fintech Law); NCG 514, which will enter into force in July 2027, sets a maximum of 30 minutes. From December 1, 2026, if there is a reasonable risk to data subjects, it must also report it to the Personal Data Protection Agency and, if it affects sensitive data or data relating to obligations of an economic, financial, banking or commercial nature, communicate it to each affected customer (article 14 sexies of Law 21.719).
Is financial portability the same as data portability?
No. Financial portability is regulated by Law 21.236 and will use the interfaces of the Open Finance System for communications between providers. Data portability will be, from December 1, 2026, a right under article 9 of Law 21.719: to receive a structured copy of the data provided to the controller, when the processing is automated and based on consent.
Official sources
- Law 21.521, Fintech Law — Library of the National Congress
- Law 19.628 consolidated with the amendments of Law 21.719 (in force from December 1, 2026)
- Law 21.719 — text as published, with its transitory provisions, Library of the National Congress
- CMF, General Rule (NCG) No. 514, regulating the Open Finance System (July 3, 2024)
- CMF, General Rule (NCG) No. 569, amending NCG 514 and adding Annex No. 3 (June 1, 2026)
This article is for information purposes only and does not constitute legal advice for a specific case.