Countries › Chile › Guide › 13. Regulation › Regulation in Chile: merger control and competition, personal data, corporate criminal liability, anti money laundering and cybersecurity

Regulation in Chile: merger control and competition, personal data, corporate criminal liability, anti money laundering and cybersecurity

Last verified: 2026-10-26 · Status: Changing

Five regimes decide most compliance work for a foreign investor in Chile. Deals above UF 2.5 million of combined Chilean sales, where at least two parties each have UF 450,000, must be cleared by the Fiscalía Nacional Económica (FNE) before closing. Hard core cartels are crimes and can be fined up to 30 percent of affected sales. A new personal data law, Ley Nº 21.719, takes effect on 1 December 2026. It reaches foreign companies that target people in Chile, creates a data protection agency and sets fines of up to 20,000 UTM, or 4 percent of revenue for repeat offenders. Since 1 September 2024, companies are criminally liable for a long list of economic crimes unless they run an effective prevention model. Banks, brokers, realtors, notaries and other listed businesses must report suspicious transactions to the UAF. Essential service providers must alert the national CSIRT within 3 hours of a significant cyber incident.

USD figures use the Central Bank exchange rate of CLP 986.58 per US dollar published in the Diario Oficial for 23 October 2026 (CVE 2891564). UF figures use the SII value of CLP 41,221.08 for 26 October 2026, and UTM and UTA figures the SII values of CLP 72,151 and CLP 865,812 for October 2026. Conversions are for orientation only. For merger thresholds, the FNE converts sales at the UF value of 31 December of the year being measured.

Key facts

Merger notification threshold, combined Chilean sales of the parties	2,500,000 UFFNE Resolución Exenta Nº 157 of 2019; DL Nº 211 art. 48 a), as of 2026-10-26 · in force
Merger notification threshold, Chilean sales of each of at least two parties	450,000 UFFNE Resolución Exenta Nº 157 of 2019; DL Nº 211 art. 48 b), as of 2026-10-26 · in force
Notified mergers must wait for clearance before closing	Yes textDL Nº 211 art. 48 and art. 49, as of 2026-10-26 · in force
FNE phase 1 review period	30 business daysDL Nº 211 art. 54 and art. 59, as of 2026-10-26 · in force
FNE phase 2 maximum extension	90 business daysDL Nº 211 art. 54 c) and art. 59, as of 2026-10-26 · in force
Maximum competition fine, share of the offender's sales in the affected line during the infringement	30 %DL Nº 211 art. 26 c), as of 2026-10-26 · in force
Maximum competition fine where sales and gain cannot be determined	60,000 UTADL Nº 211 art. 26 c), as of 2026-10-26 · in force
Hard core cartels are a crime for individuals	Yes textDL Nº 211 art. 62, as of 2026-10-26 · in force
Date the new personal data law takes effect	2026-12-01 dateLey Nº 21.719 first transitory article, as of 2026-10-26 · pending
Maximum data protection fine, very serious breach	20,000 UTMLey Nº 19.628 art. 35 c) as amended by Ley Nº 21.719, as of 2026-10-26 · pending
Maximum data protection fine for repeat very serious breaches by large companies, share of annual revenue	4 %Ley Nº 19.628 art. 35 as amended by Ley Nº 21.719, as of 2026-10-26 · pending
Applies to foreign companies targeting or monitoring people in Chile	Yes textLey Nº 19.628 art. 1 bis c) as amended by Ley Nº 21.719, as of 2026-10-26 · pending
Companies can be criminally liable for bribery and other economic crimes	Yes textLey Nº 20.393 art. 1 and art. 3, as of 2026-10-26 · in force
Maximum value of one corporate day fine	5,000 UTMLey Nº 20.393 art. 12, as of 2026-10-26 · in force
Maximum number of day fines in one corporate fine	400 daysLey Nº 20.393 art. 12, as of 2026-10-26 · in force
Cash operation recorded and kept by reporting entities above	10,000 USDLey Nº 19.913 art. 5, as of 2026-10-26 · in force
Cash or bearer instruments carried across the border that must be declared, above	10,000 USDLey Nº 19.913 art. 4, as of 2026-10-26 · in force
Minimum record keeping period for cash operations	5 yearsLey Nº 19.913 art. 5, as of 2026-10-26 · in force
Maximum UAF fine for a serious breach (before tripling for repeat breaches)	5,000 UFLey Nº 19.913 art. 20 Nº 3, as of 2026-10-26 · in force
Deadline for the early alert of a significant cyber incident to the national CSIRT	3 hoursLey Nº 21.663 art. 9 a), as of 2026-10-26 · in force
Maximum cybersecurity fine for an operator of vital importance	40,000 UTMLey Nº 21.663 art. 40 Nº 3, as of 2026-10-26 · in force

The rule

1. A concentration is any act by which two or more previously independent economic agents, not in the same business group, stop being independent. This covers a merger, the acquisition of rights giving decisive influence over another agent's management, a joint venture that acts permanently as an independent agent, and the acquisition of control over another agent's assets. A concentration with effects in Chile must be notified to the FNE before it closes when two tests are both met in the previous financial year. First, the combined Chilean sales of the parties (with their business groups) are at least UF 2,500,000. Second, at least two of the parties each have Chilean sales of at least UF 450,000. Notified deals are suspended and cannot close until the decision is final. The FNE has 10 business days to declare the filing complete. It then has 30 business days in phase 1 to clear the deal, clear it with remedies, or open phase 2 for up to 90 more business days. In phase 2 it can clear, clear with remedies, or prohibit the deal. If the FNE misses a deadline, the deal is deemed cleared on the terms offered. Deals below the thresholds can be notified voluntarily. If they are not, the FNE can investigate them for one year after closing.
Cost to do it: DL Nº 211 sets no filing fee. The real cost is the notification itself, which needs market data, the parties' good faith statement and the documents listed in the merger notification regulation, prepared by local competition counsel, plus waiting up to 10, 30 and 90 business days before closing.
Example: UF 2,500,000 is about CLP 103,053 million, and UF 450,000 is about CLP 18,549 million, at the 26 October 2026 UF. A foreign group with CLP 95,000 million of Chilean sales buying a Chilean target with CLP 20,000 million passes both tests (combined CLP 115,000 million; both parties above the individual threshold) and must file before closing. / The combined threshold is about US$104.5 million and the individual threshold about US$18.8 million. In the example, the buyer has about US$96.3 million of Chilean sales and the target about US$20.3 million, so the deal must be filed.Decreto Ley Nº 211 of 1973 (consolidated by DFL Nº 1 of 2004, Ministerio de Economía), Title IV added by Ley Nº 20.945; thresholds set by FNE Resolución Exenta Nº 157 of 25 March 2019, Art. 47, art. 48, art. 49, art. 50, art. 54, art. 57 and art. 59, 2016-08-30 official text · verified 2026-10-26

2. Any act or agreement that prevents, restricts or hinders free competition, or tends to do so, is sanctioned. Listed examples include agreements between competitors to fix prices, limit output, allocate zones or quotas, or rig tenders; abuse of a dominant position; predatory pricing or unfair competition aimed at gaining dominance; and interlocking executives or directors at competing companies whose groups each have annual revenue above UF 100,000, if the overlap still exists 90 days after the year end. The Tribunal de Defensa de la Libre Competencia (TDLC) can fine up to 30 percent of the offender's sales in the affected product or service line for the period of the infringement, or up to twice the economic benefit gained. Where neither can be determined, the fine can reach 60,000 UTA. Directors, managers and anyone who took part can also be fined, and their fines cannot be paid by the company or its group. For cartels, the TDLC can also bar the company from public contracts and concessions for up to five years. Closing a notifiable deal without filing is fined up to 20 UTA per day of delay. Buying more than 10 percent of a competitor's capital must be reported to the FNE within 60 days when both companies have annual revenue above UF 100,000. Hard core cartels are also crimes punished with presidio menor en su grado máximo to presidio mayor en su grado mínimo (a range that reaches into the major prison terms of five years and one day upward under Código Penal art. 25). The first party to give the FNE evidence under art. 39 bis is exempt from criminal liability.
Cost to do it: Fines up to 30 percent of affected sales or twice the gain, or up to 60,000 UTA (about CLP 51,949 million or US$52.7 million) where neither can be measured. Gun jumping fine up to 20 UTA a day (about CLP 17.3 million or US$17,552 a day).
Example: A company whose cartel affected CLP 20,000 million of sales of the product line over the infringement period faces a fine of up to CLP 6,000 million, plus personal fines on the managers involved, a possible five year bar from public contracts, and criminal prosecution of the individuals. / On the same facts, the maximum fine is about US$6.1 million. A notifiable deal closed 30 days before filing risks up to 600 UTA, about CLP 519.5 million or US$526,554.Decreto Ley Nº 211 of 1973 (consolidated by DFL Nº 1 of 2004), as amended by Ley Nº 20.945, Art. 3, art. 3 bis, art. 4 bis, art. 26, art. 62 and art. 63, 2016-08-30 official text · verified 2026-10-26

3. Ley Nº 21.719 rewrites Ley Nº 19.628, now called the law on Protection of Personal Data, with effect from 1 December 2026 (the first day of the 24th month after publication on 13 December 2024). The law applies to controllers or processors established in Chile, to processors anywhere acting for a Chilean controller, and to controllers or processors abroad whose processing targets goods or services to people in Chile, paid or not, or monitors their behaviour, including profiling. Controllers must adopt security measures suited to the risk, such as pseudonymisation and encryption. They must report security breaches that create a reasonable risk to data subjects to the new Agencia de Protección de Datos Personales without undue delay. They must also notify affected individuals where the breach involves sensitive data, data on children under 14, or financial, banking or commercial obligations. International transfers are lawful to countries the Agency declares adequate, or under contractual clauses, binding corporate rules or certification with adequate safeguards. Without these, only specific, non habitual transfers on listed grounds are allowed. Fines are up to 5,000 UTM for minor breaches, 10,000 UTM for serious breaches and 20,000 UTM for very serious breaches. Repeat offences can be fined up to three times as much. For companies that are not micro, small or medium sized under Ley Nº 20.416, repeat serious or very serious breaches can be fined up to 2 or 4 percent of the prior year's revenue, whichever is higher. Appointing a data protection officer is optional, and one officer can serve a whole group that applies the same policies.
Cost to do it: Fines up to 5,000, 10,000 or 20,000 UTM (about CLP 360.8 million, CLP 721.5 million or CLP 1,443 million; US$365,662, US$731,324 or US$1.46 million). If ordered corrective measures are not taken within 60 days, a 50 percent surcharge applies. Compliance costs (data mapping, privacy notices, transfer clauses, breach procedures) are private professional costs.
Example: A large retailer with CLP 50,000 million of revenue last year that repeats a very serious breach, such as knowingly transferring data abroad in breach of the law, faces up to the higher of 60,000 UTM (three times 20,000 UTM, about CLP 4,329 million) or 4 percent of revenue (CLP 2,000 million), so up to about CLP 4,329 million. / The same retailer has revenue of about US$50.7 million. Its maximum exposure is about US$4.39 million (60,000 UTM), against US$2.03 million under the 4 percent test.Ley Nº 21.719, which regulates the protection and processing of personal data and creates the Agencia de Protección de Datos Personales (amending Ley Nº 19.628), Art. 1 (new art. 1 bis, 14 quinquies, 14 sexies, 27, 28, 34 bis to 34 quáter, 35 and 50 of Ley Nº 19.628); first transitory article, 2024-12-13 official text · verified 2026-10-26 · changed: Ley Nº 21.719, published in the Diario Oficial on 13 December 2024, replaces the 1999 privacy regime of Ley Nº 19.628 from 1 December 2026. It adds extraterritorial reach, a supervisory agency, breach reporting, transfer rules, and fines of up to 20,000 UTM or 4 percent of revenue. Before this law, the old text had no specialised regulator and no fines on this scale.

4. Since 1 September 2024, a company (any private legal entity, as well as State companies, political parties and religious legal entities) is criminally liable for the crimes listed in art. 1. These include the economic crimes of the Ley de Delitos Económicos (Ley Nº 21.595), which cover bribery of domestic officials (Código Penal art. 248 to 249) and of foreign public officials (art. 251 bis), as well as securities, banking, tax, customs, environmental and money laundering offences. Liability arises when the crime is committed within the company's activity by someone holding a position in it, or by someone managing its affairs with third parties, and the crime was favoured or facilitated by the lack of an effective and adequate crime prevention model. The same applies to related companies that provide services or lack operational autonomy. The prevention model must identify risky activities and set protocols that include secure whistleblowing channels and internal sanctions. These rules must be written into every employment and service contract, top executives included. The model must also have one or more independent compliance officers with resources, and periodic evaluation by independent third parties. The company is liable even if no individual is convicted or identified. A fine is always imposed, calculated as day fines: from 2 to 400 days at 5 to 5,000 UTM per day, capped at 600 days. Further penalties include dissolution in grave cases, a bar from State contracts, loss of tax benefits for 1 to 5 years, court appointed supervision for 6 months to 2 years, forfeiture, and publication of the judgment.
Cost to do it: The maximum fine is 400 day fines at up to 5,000 UTM each (2,000,000 UTM, about CLP 144,302 million or US$146.3 million), or 600 day fines where several fines combine. The minimum is 2 day fines at 5 UTM (about CLP 721,510 or US$731). Building and auditing a prevention model are private professional costs.
Example: For a simple offence (simple delito), the fine is capped at 200 day fines. If the court sets each day fine at 1,000 UTM, that is 200,000 UTM, about CLP 14,430 million. / The same fine is about US$14.6 million, before forfeiture of the proceeds and any bar from State contracts.Ley Nº 20.393 on criminal liability of legal entities, as replaced by Ley Nº 21.595, Ley de Delitos Económicos, art. 50, Ley Nº 20.393 art. 1, art. 2, art. 3, art. 4, art. 5, art. 8 to art. 15; Ley Nº 21.595 art. 1 to art. 4 and art. 60 Nº 1, 2023-08-17 official text · verified 2026-10-26 · changed: Ley Nº 21.595, published on 17 August 2023, widened corporate criminal liability from a short list of crimes to hundreds of economic offences. It also made the prevention model requirements stricter (independent evaluation, whistleblowing channels, contract clauses) and introduced the day fine system. Under art. 60 Nº 1, the changes to Ley Nº 20.393 took effect on the first day of the 13th month after publication, 1 September 2024.

5. Banks and financial institutions, factoring and leasing firms, fund managers, exchange houses, card issuers, money transfer and transport firms, stock and commodity exchanges, brokers, insurers, free zone operators, casinos, customs agents, auction houses, real estate brokers and developers, notaries, registrars, pension fund managers, professional sports clubs, savings cooperatives, vehicle dealers and rental firms, arms sellers, precious metal and jewellery dealers, securities depositories, and fintech platforms registered with the CMF must report suspicious transactions to the Unidad de Análisis Financiero (UAF). They must also keep records for at least five years of every cash operation above US$10,000 or its peso equivalent, and give them to the UAF on request. Tipping off a client is a crime, punished with prison and a fine of 100 to 400 UTM. Anyone carrying cash or bearer instruments above US$10,000 into or out of Chile must declare them to Customs. The UAF fines up to UF 800 for minor breaches, UF 3,000 for breaches of the cash record duty, and UF 5,000 for failing to report or to provide information, and up to three times those amounts for repeat breaches within 12 months. Directors and legal representatives who took part can be fined too. Money laundering itself is punished with presidio mayor en sus grados mínimo a medio and a fine of 200 to 1,000 UTM, and since Ley Nº 21.595 companies can be criminally liable for it.
Cost to do it: Administrative fines up to UF 800, UF 3,000 or UF 5,000 (about CLP 33.0 million, CLP 123.7 million or CLP 206.1 million; US$33,425, US$125,345 or US$208,909), and up to UF 15,000 (about CLP 618.3 million or US$626,727) for repeat serious breaches. Registering with the UAF and running a compliance function are private costs.
Example: A real estate broker receives CLP 9,865,800 in cash, the equivalent of US$10,000 at the 23 October 2026 rate. Any cash operation above that amount must be recorded and kept for five years. If the broker suspects the funds, it must file a report with the UAF and must not tell the client. / The cash record threshold is fixed at US$10,000 by law. Failing to file a suspicious transaction report can cost up to UF 5,000, about US$208,909, per breach.Ley Nº 19.913, which creates the Unidad de Análisis Financiero and amends laws on money laundering, Art. 3, art. 4, art. 5, art. 6, art. 7, art. 19, art. 20, art. 21 and art. 27, 2003-12-18 official text · verified 2026-10-26

6. The Ley Marco de Ciberseguridad applies to institutions providing essential services and to those designated as operators of vital importance. Essential services include State bodies, the national grid coordinator and public service concessionaires. They also include private firms in power generation, transmission and distribution; fuel transport, storage and distribution; water and sanitation; telecommunications; digital infrastructure; digital and managed IT services; land, air, rail and sea transport; banking, financial services and payments; social security administration; postal services; health providers; and pharmaceutical production. Covered institutions must report cyber attacks and incidents that may have significant effects to the national CSIRT. The steps are an early alert within 3 hours of becoming aware, an update with an initial assessment within 72 hours (24 hours for an operator of vital importance whose essential service is affected), and a final report within 15 calendar days of the alert. Fines are up to 5,000, 10,000 or 20,000 UTM for minor, serious and very serious breaches, doubled to 10,000, 20,000 or 40,000 UTM for operators of vital importance. Breaches lapse after three years.
Cost to do it: Fines up to 20,000 UTM (about CLP 1,443 million or US$1.46 million), or 40,000 UTM (about CLP 2,886 million or US$2.93 million) for operators of vital importance. Running a 24 hour incident reporting process is a private cost.
Example: A payments company detects ransomware at 09:00 on a Monday. It must alert the CSIRT by 12:00, update by 09:00 on Thursday (72 hours), and file the final report within 15 calendar days of the alert. / A very serious breach by an operator of vital importance can be fined up to about US$2.93 million.Ley Nº 21.663, Ley Marco sobre Ciberseguridad e Infraestructura Crítica de la Información, Art. 4, art. 9, art. 39 and art. 40, 2024-04-08 official text · verified 2026-10-26

Regime	Main law	Authority	Trigger	Top sanction
Merger control	DL Nº 211 Title IV; FNE Res. Ex. Nº 157 of 2019	FNE; TDLC on review	Combined Chilean sales of UF 2,500,000 and two parties with UF 450,000 each	Measures under art. 26, up to 20 UTA a day for closing without filing
Anticompetitive conduct	DL Nº 211 art. 3 and 26	FNE investigates; TDLC rules	Any act that restricts or tends to restrict competition	30 percent of affected sales, twice the gain, or 60,000 UTA (about US$52.7 million); prison for cartels
Personal data (from 1 December 2026)	Ley Nº 19.628 as amended by Ley Nº 21.719	Agencia de Protección de Datos Personales	Processing in Chile, or targeting or monitoring people in Chile from abroad	20,000 UTM (about US$1.46 million); 4 percent of revenue for repeat offences by large companies
Corporate criminal liability	Ley Nº 20.393 as replaced by Ley Nº 21.595	Public Prosecutor and criminal courts	Economic crime in the company's activity without an effective prevention model	Up to 400 day fines of up to 5,000 UTM each, State contract bar, dissolution
Anti money laundering	Ley Nº 19.913	UAF	Business in a listed sector	UF 5,000 per serious breach (about US$208,909), tripled if repeated
Cybersecurity	Ley Nº 21.663	Agencia Nacional de Ciberseguridad and national CSIRT	Essential service provider or operator of vital importance	20,000 UTM, or 40,000 UTM (about US$2.93 million) for operators of vital importance

Chile's core regulatory regimes for investors at a glance (sources in the rules above; CLP at the October 2026 UF and UTM, USD at CLP 986.58).

Worked example

A US group buys 100 percent of a Chilean distributor. The group's Chilean sales in 2025 were CLP 95,000 million and the target's CLP 20,000 million. Converted at the UF of 31 December 2025, both exceed UF 450,000 and together exceed UF 2,500,000 (today about CLP 103,053 million or US$104.5 million), so the deal is filed with the FNE and cannot close until cleared (DL Nº 211 art. 48 and 49).
Timeline if the deal raises no concerns: 10 business days for the completeness check, then up to 30 business days in phase 1, roughly two months in total. If the FNE opens phase 2, add up to 90 business days, about four more months (DL Nº 211 art. 50, 54 and 57).
The same target sells online to Chilean consumers. From 1 December 2026, its customer database falls under Ley Nº 21.719. The buyer should map the data, review privacy notices, put transfer clauses in place before moving the data to US servers (art. 27 and 28), and set up a breach procedure for reports to the Agency (art. 14 sexies).
Before closing, the buyer checks whether the target has a crime prevention model that meets Ley Nº 20.393 art. 4: a risk map, protocols with whistleblowing channels, an independent compliance officer and periodic independent evaluation. Without one, the target can be criminally liable for bribery or other economic crimes by its staff, and the new owner inherits that exposure.

Step by step

1. At term sheet stage, measure the Chilean sales of each party and its group for the previous financial year in UF at the 31 December UF value, and test them against the UF 2,500,000 and UF 450,000 thresholds (FNE Res. Ex. Nº 157 of 2019).
2. If both thresholds are met, prepare a joint notification with the other parties on the FNE form and make closing conditional on clearance. Allow 10 plus 30 business days, and up to 90 more if phase 2 opens (DL Nº 211 art. 48 to 57).
3. If buying more than 10 percent of a competitor and both companies have annual revenue above UF 100,000, report the stake to the FNE within 60 days of closing (DL Nº 211 art. 4 bis).
4. Before 1 December 2026, map personal data flows, update privacy notices, put adequate safeguards in place for international transfers, and set up breach response and data subject request handling (Ley Nº 21.719).
5. Adopt or update a crime prevention model under Ley Nº 20.393 art. 4. A risk map, protocols, an independent compliance officer with resources, a whistleblowing channel, contract clauses for all staff and periodic third party evaluation are the core elements.
6. If the business is in a sector listed in Ley Nº 19.913 art. 3, register with the UAF, appoint a compliance officer and set up suspicious transaction reporting and cash records.
7. If the business provides an essential service under Ley Nº 21.663 art. 4, set up a process that can alert the national CSIRT within 3 hours of a significant incident.

Common traps

Closing a notifiable deal before clearance: notified deals are suspended by law, and closing without filing is fined up to 20 UTA a day of delay on top of other measures (DL Nº 211 art. 3 bis, 26 e) and 49).
Assuming small deals are safe: the FNE can investigate unnotified deals below the thresholds for one year after closing (DL Nº 211 art. 48).
Counting only the target's sales: in an acquisition, the buyer's whole business group's Chilean sales count, while on the target side only the acquired business counts (DL Nº 211 art. 48 ii).
Paying an executive's competition fine from company funds: fines on individuals cannot be paid by the company, its group or its shareholders (DL Nº 211 art. 26 c).
Treating Ley Nº 21.719 as local only: a foreign company with no Chilean entity that sells to or profiles people in Chile is covered (Ley Nº 19.628 art. 1 bis c) as amended).
Having a compliance manual on paper only: the defence requires a model that is effectively implemented, with independent evaluation and clauses in every employment and service contract (Ley Nº 20.393 art. 3 and 4).
Telling a client a report was filed: tipping off is a crime with prison and a fine of 100 to 400 UTM (Ley Nº 19.913 art. 6 and 7).
For deals or data flows involving Argentina, assuming that Argentine clearance or Argentine data rules settle the Chilean side: Chilean merger thresholds look only at sales in Chile, and transfers out of Chile need an adequacy decision of the Chilean Agency or contractual safeguards (DL Nº 211 art. 48; Ley Nº 19.628 art. 27 and 28 as amended).

Sources

← Mining, lithium and energy in Chile: concessions, the mining patent, the copper royalty, the lithium reserve, the renewable quota, environmental assessment and tax stabilityDisputes in Chile: courts, arbitration, enforcing foreign judgments and awards, the New York Convention and ICSID →