Countries › Paraguay › Guide › 13. Regulation › Regulation essentials in Paraguay: competition and merger control, data protection, anti money laundering, foreign bribery and environmental licences

Regulation essentials in Paraguay: competition and merger control, data protection, anti money laundering, foreign bribery and environmental licences

Argentina. For full detail on Argentina, go to The Argentine Thread.

Last verified: 2026-10-28 · Status: Changing

Paraguay regulates business through a short list of horizontal laws: competition and merger notification (Ley 4956/2013, CONACOM), anti money laundering (Ley 1015/1997 as amended in 2019 and 2022, SEPRELAD), foreign bribery (Ley 6430/2019) and the environmental impact licence (Ley 294/1993, MADES). Deals that reach 45 percent of a national market or combined Paraguayan turnover above 100,000 monthly minimum wages (about US$52 million) must be filed with CONACOM within 10 business days of signing, with tacit approval if CONACOM does not decide in 90 business days. A general data protection law, Ley 7593/2025, applies from 27 November 2027 and reaches foreign companies that target people in Paraguay; most fines are set in minimum wages, so their guaraní value rises with each wage adjustment.

USD figures use PYG 5,847.90 per US dollar, the Banco Central del Paraguay reference quotation for 27 October 2026 (latest published planilla on the verification date). Amounts in minimum wages use the monthly minimum wage of PYG 3,044,000 and the daily wage (jornal) of PYG 117,077 in force since 1 July 2026 under Resolución MTESS 670/2026. Conversions are for orientation only.

Key facts

Merger control regime	Mandatory notification within 10 business days of signing; tacit approval after 90 business days Ley 4956/2013 art. 14 and 38, as of 2026-10-28 · in force
Notification threshold: market share acquired or increased	45 %Ley 4956/2013 art. 14, as of 2026-10-28 · in force
Notification threshold: combined Paraguayan gross turnover above	100,000 monthly minimum wages (PYG 304,400,000,000) PYGLey 4956/2013 art. 14; Res. MTESS 670/2026, as of 2026-10-28 · in force
CONACOM decision term	90 business daysLey 4956/2013 art. 14 and 38, as of 2026-10-28 · in force
Merger filing fee	0.005 to 0.1 % of deal value in ParaguayLey 4956/2013 art. 27, as of 2026-10-28 · in force
Maximum competition fine	20% of 12 months affected gross sales or 150% of illicit profit Ley 4956/2013 art. 63, as of 2026-10-28 · in force
Prescription of infringements and damages claims	4 yearsLey 4956/2013 art. 65, as of 2026-10-28 · in force
General data protection law in force from	2027-11-27 dateLey 7593/2025 art. 57, as of 2026-10-28 · pending
Breach notification to authority	72 hoursLey 7593/2025 art. 17, as of 2026-10-28 · pending
Applies to foreign controllers targeting or monitoring people in Paraguay	Yes Ley 7593/2025 art. 2, as of 2026-10-28 · pending
Maximum data protection fine (ordinary data)	2,500 daily minimum wages (PYG 292,692,500) PYGLey 7593/2025 art. 46, as of 2026-10-28 · pending
Maximum fine, children's sensitive data	10,000 daily minimum wages (PYG 1,170,770,000) PYGLey 7593/2025 art. 46, as of 2026-10-28 · pending
AML record keeping	5 yearsLey 1015/1997 art. 18 as amended by Ley 6497/2019, as of 2026-10-28 · in force
Maximum AML fine for companies	5,000 monthly minimum wages (PYG 15,220,000,000) or 50% of the operation PYGLey 1015/1997 art. 24 as amended by Ley 6497/2019, as of 2026-10-28 · in force
Virtual asset service providers are AML obligated subjects	Yes Ley 1015/1997 art. 13 as amended by Ley 6960/2022, as of 2026-10-28 · in force
Foreign bribery (briber), maximum prison	5 yearsLey 6430/2019 art. 3, as of 2026-10-28 · in force
EIA deemed approved without declaration after	90 daysLey 294/1993 art. 10, as of 2026-10-28 · in force

The rule

1. Cartels and abuse of dominance. Ley 4956/2013 bans agreements, decisions and concerted or consciously parallel practices, written or verbal, that aim to or may restrict competition in all or part of the national market, listing price fixing, output limits, market or customer sharing, discrimination, tying, bid rigging, quotas and collective boycotts; the Comisión Nacional de la Competencia (CONACOM) weighs efficiency gains proven by the parties. It also bans abuse of a dominant position, including unfair prices or terms, output limits, unjustified refusal to supply, discrimination, tying and squeezing suppliers under threat of breaking off the relationship. Holding a dominant position is not itself punished. The law reaches Paraguayan and foreign persons, public or private, including state monopolies, and anyone acting abroad whose acts have effects in the Paraguayan market, as well as the individuals who represent offending companies. Fines go up to 150 percent of the profit from the infringement or up to 20 percent of gross sales of the products concerned in the affected market over the 12 months before the proceeding opened, net of taxes, and never less than the quantifiable advantage; CONACOM can also declare agreements void and order conduct to stop. Infringements and damages claims prescribe in 4 years.
Cost to do it: No filing cost for complaints; exposure is the fine of up to 150 percent of the illicit profit or up to 20 percent of 12 months of affected gross sales.
Example: A distributor with PYG 20,000,000,000 of sales of the cartelised product in the affected market over the last 12 months faces a fine of up to PYG 4,000,000,000 under the 20 percent test. / On US$3.42 million of affected sales (PYG 20,000,000,000), the 20 percent cap is about US$684,000 (PYG 4,000,000,000).Ley Nº 4956/2013, Defensa de la Competencia, Art. 3, 8, 9, 63, 64 and 65, 2013-05-29 official text · verified 2026-10-28

2. Merger notification. A concentration (merger, acquisition of control of all or part of a company, or a full function joint venture) must be notified and registered with CONACOM within 10 days of signing the written agreement or publishing the offer, when at least one of two tests is met: the deal creates or increases a share of 45 percent or more of the national market for a product or service (or of a defined geographic market within it), or the combined gross turnover in Paraguay of the parties in the last financial year exceeds 100,000 monthly minimum wages, net of discounts, IVA, excise and other volume taxes. Merging parties notify jointly; an acquirer of control notifies alone. Transactions between the same parties within 2 years count as one. CONACOM must authorize, authorize with conditions or deny by reasoned resolution within 90 days of a complete filing; one request for more documents per stage suspends the clock once. If CONACOM does not decide in time, the deal is tacitly authorized. If a notifiable deal was not filed, CONACOM can order filing within 20 days. A fee of 0.005 to 0.1 percent of the value of the deal in Paraguay applies, falling as the deal grows. All terms in the law are business days. The merger chapter came into force one year after publication.
Cost to do it: CONACOM fee of 0.005 to 0.1 percent of the deal value in Paraguay (scale set by CONACOM within that band) plus local counsel and economist fees, which the law does not set.
Example: Turnover test: 100,000 monthly minimum wages at PYG 3,044,000 is PYG 304,400,000,000. A deal worth PYG 116,958,000,000 in Paraguay pays a fee between PYG 5,847,900 (0.005 percent) and PYG 116,958,000 (0.1 percent). / The turnover threshold is about US$52.1 million of combined Paraguayan turnover. On a US$20 million deal the fee is between about US$1,000 and US$20,000.Ley Nº 4956/2013, Defensa de la Competencia, Art. 12, 13, 14, 27, 38 and 70, 2013-05-29 official text · verified 2026-10-28

3. Personal data protection (in force from 27 November 2027). Ley 7593/2025 is Paraguay's first general data protection law. It applies to any processing by a controller or processor established in Paraguay, even if processing happens abroad, and to controllers and processors not established in Paraguay when they process data of people located in Paraguay, offer goods or services to its residents or monitor behaviour in Paraguay. Processing needs a legal basis; controllers must apply security measures, run impact assessments for risky processing and notify security incidents to the new Agencia Nacional de Protección de Datos Personales (under MITIC) and, where relevant, to data subjects within 72 hours of learning of them. A data protection officer, and a local representative for foreign controllers, become mandatory in cases the implementing regulation will define. International transfers need an adequacy finding by the Agency or appropriate safeguards (specific or standard contractual clauses, binding corporate rules, codes or certifications), with exceptions including performance of a contract with the data subject and express consent. Fines run from 20 to 2,500 daily minimum wages, up to 5,000 for sensitive data and up to 10,000 for sensitive data of children, plus suspension of processing; fines are payable within 30 business days. The law takes effect 24 months after publication (published 27 November 2025); the regulation is due within the same 24 months, and until then Ley 6534/2020 on credit data stays the main rule.
Cost to do it: No registration fee in the law; exposure is fines of 20 to 2,500 daily minimum wages (PYG 2,341,540 to PYG 292,692,500, about US$400 to US$50,051), up to 5,000 (PYG 585,385,000, about US$100,102) for sensitive data and 10,000 (PYG 1,170,770,000, about US$200,203) for children's sensitive data, at the current jornal of PYG 117,077.
Example: A retailer that leaks its loyalty database and fails to notify within 72 hours risks a fine of up to PYG 292,692,500 per sanction once the law applies; health data raise the ceiling to PYG 585,385,000. / A foreign SaaS provider selling to Paraguayan residents is in scope even without a Paraguayan entity; a top tier fine for ordinary data is about US$50,000, and about US$200,000 for children's sensitive data.Ley Nº 7593/2025, De Protección de Datos Personales en la República del Paraguay, Art. 2, 12, 14, 17, 18, 19, 34, 46, 49, 57 and 60, 2025-11-27 official text · verified 2026-10-28 · changed: New law promulgated and published on 27 November 2025, creating the Agencia Nacional de Protección de Datos Personales; it enters into force 24 months after publication, so from 27 November 2027.

4. Anti money laundering duties. Ley 1015/1997, as amended, makes a long list of sectors obligated subjects: banks, finance companies, insurers, exchange houses, securities firms, investment and fund managers, cooperatives, gambling, real estate businesses, non profits, pawnshops, government entities, designated non financial activities and professions, tobacco businesses, sports clubs and federations, intermediaries in sports contracts, dealers in jewels, precious metals, art and antiques, businesses that transfer money or securities, and virtual asset service providers; the list is not closed. They must apply customer due diligence at onboarding and continuously, identify and verify beneficial owners, keep risk based procedures and systems, record all domestic and international operations and keep records for 5 years, and report to the Secretaría de Prevención de Lavado de Dinero o Bienes (SEPRELAD), the financial intelligence unit, any suspicious operation, completed or attempted, whatever its amount; bank and tax secrecy cannot be raised against SEPRELAD. Administrative fines reach 5,000 monthly minimum wages or up to 50 percent of the operation for companies, and 500 monthly minimum wages or 1 to 10 percent of the operation for individuals, with licence suspension or revocation, removal and 3 to 10 year bans for managers and suspension of dividends for up to 3 years to shareholders with management roles.
Cost to do it: Compliance officer, manuals and audits are not priced by law; the maximum company fine is 5,000 monthly minimum wages, PYG 15,220,000,000, about US$2.60 million, or up to 50 percent of the operation.
Example: A real estate agency that closes a PYG 2,000,000,000 sale without identifying the buyer's beneficial owner risks a company fine of up to PYG 1,000,000,000 (50 percent of the operation). / On a US$342,000 operation, the operation based ceiling is about US$171,000 for the company and US$3,420 to US$34,200 (1 to 10 percent) for a responsible individual.Ley Nº 1015/1997, as amended by Ley Nº 6497/2019 (art. 2, 14 to 19, 22 and 24) and Ley Nº 6960/2022 (art. 13, 25 and 28), Art. 13, 14, 15, 16, 17, 18, 19, 22 and 24, 2022-07-15 official text · verified 2026-10-28 · changed: Ley Nº 6497 of 26 December 2019 rewrote the due diligence, record keeping, suspicious reporting and sanctions articles; Ley Nº 6960 of 15 July 2022 rewrote the list of obligated subjects in art. 13, adding virtual asset service providers, and the sanction grading and SEPRELAD powers in art. 25 and 28.

5. Foreign bribery. Since November 2019 promising or guaranteeing a benefit to a foreign public official or an official of an international organisation, for that person or a third party, in exchange for a discretionary official act, is a crime punishable by up to 2 years in prison or a fine, rising to up to 5 years when the act breaches the official's duties; offering benefits for votes, laws, regulations or the award or continuation of contracts in international business before a foreign or international body, or for judicial acts of foreign judges, prosecutors or arbitrators, is also punished. Foreign officials who solicit or accept such benefits face up to 3 years, or up to 5 years for judges, prosecutors and arbitrators. Omitting an act counts as an act, and a payment to an arbitrator without the other party's knowledge counts as a benefit. The law punishes individuals; it contains no corporate liability article.
Cost to do it: No fee; the cost is an anti bribery programme for intermediaries and agents, which the law does not price.
Example: A Paraguayan exporter's manager who promises a commission to a customs official in a neighbouring country to speed up a shipment commits soborno transnacional under art. 3, punishable in Paraguay. / A US$50,000 'success fee' to an official of an international body to win a contract falls under art. 3, second paragraph, whatever the deal size.Ley Nº 6430/2019, Previene, tipifica y sanciona los hechos punibles de cohecho transnacional y soborno transnacional, Art. 2, 3 and 4, 2019-11-18 official text · verified 2026-10-28

6. Environmental impact licence. An Environmental Impact Assessment is mandatory for listed public and private works and activities: urban developments and settlements, farming, ranching and forestry, industrial plants of any kind, mining and fossil fuel extraction and processing, pipelines, hydraulic works, power plants and transmission lines, charcoal, waste treatment and disposal, roads, ports, airstrips, storage facilities, construction and earthworks, hazardous substances, exotic species and native forest use, and any other activity that by size or intensity may cause impacts. Studies must be prepared by registered consultants and paid by the project owner. The authority issues a Declaración de Impacto Ambiental approving (simply or with conditions), returning or rejecting the project; under the law, an assessment that receives no declaration within 90 days is approved without further steps. The declaration is the licence to start or continue the activity and is required to obtain credit or guarantees, permits from other agencies, and subsidies or tax exemptions. Concealment or false data, or changes to the project to evade the law, lead to cancellation of the licence and immediate suspension of the works. The environment secretariat was raised to the Ministerio del Ambiente y Desarrollo Sostenible (MADES) in 2018, which designs, supervises and enforces national environmental policy.
Cost to do it: Consultant and study costs are borne by the project owner (art. 4); no fee amount is set in the law.
Example: A feedlot or industrial plant cannot draw bank credit or obtain a municipal permit until it holds its Declaración de Impacto Ambiental (art. 12). / A US$10 million solar plant with its transmission line is a listed activity (art. 7 h) and needs the declaration before works start; incentives under other laws also require it (art. 12 c).Ley Nº 294/1993, Evaluación de Impacto Ambiental; Ley Nº 6123/2018 (MADES), Ley 294 art. 1, 4, 7, 10, 11, 12 and 14; Ley 6123 art. 1, 1993-12-14 official text · verified 2026-10-28

Area	Law	Authority	Key trigger or duty	Maximum sanction	Approx. PYG	Approx. USD
Cartels and dominance	Ley 4956/2013 art. 8, 9, 63	CONACOM	Effects in the Paraguayan market	150% of illicit profit or 20% of 12 months affected sales	Depends on sales	Depends on sales
Merger control	Ley 4956/2013 art. 14, 27	CONACOM	45% share or turnover above 100,000 monthly minimum wages; file within 10 business days	Nullity, conditions or divestiture; fee 0.005 to 0.1% of deal value	304,400,000,000 threshold	52.1 million threshold
Personal data (from 27 Nov 2027)	Ley 7593/2025 art. 2, 17, 46	Agencia Nacional de Protección de Datos Personales (MITIC)	72 hour breach notice; transfers need adequacy or safeguards	10,000 daily minimum wages (children's sensitive data)	1,170,770,000	200,203
Anti money laundering	Ley 1015/1997 art. 13 to 24 as amended	SEPRELAD and sector supervisors	Due diligence, beneficial owner, 5 year records, suspicious reports of any amount	5,000 monthly minimum wages or 50% of the operation (companies)	15,220,000,000	2.60 million
Foreign bribery	Ley 6430/2019 art. 3	Public Prosecutor and courts	Benefits to foreign or international officials	Up to 5 years prison
Environmental licence	Ley 294/1993 art. 7, 10, 14	MADES (Ley 6123/2018)	Listed works and activities need a Declaración de Impacto Ambiental	Licence cancelled and works suspended

Horizontal regulation at a glance (amounts at the July 2026 minimum wage; USD at PYG 5,847.90)

Worked example

Acquisition: a regional buyer acquires control of a Paraguayan food distributor; combined Paraguayan turnover last year was PYG 350,000,000,000 (about US$59.9 million), above the PYG 304,400,000,000 threshold. The buyer alone files with CONACOM within 10 business days of signing the share purchase agreement. With a deal value in Paraguay of PYG 116,958,000,000 (US$20 million), the fee is between PYG 5,847,900 (US$1,000) and PYG 116,958,000 (US$20,000). CONACOM has 90 business days from a complete filing; silence means approval.
Data: an online retailer based abroad that ships to Paraguayan customers will be within Ley 7593/2025 from 27 November 2027. A breach affecting customer data must be notified within 72 hours; the fine ceiling for ordinary data is 2,500 jornales, PYG 292,692,500 (about US$50,051).
AML: a real estate agency (an obligated subject under art. 13 k) brokering a PYG 2,000,000,000 (about US$342,000) sale must identify the buyer and beneficial owner, keep the file for 5 years and report the deal to SEPRELAD if suspicious, whatever its amount; a breach can cost the company up to PYG 1,000,000,000 (50 percent of the operation) or up to PYG 15,220,000,000 (5,000 monthly minimum wages).

Step by step

Before signing any acquisition or joint venture, test Paraguayan turnover of both sides against 100,000 monthly minimum wages (PYG 304,400,000,000 at the July 2026 wage) and the 45 percent share test; if met, prepare the CONACOM filing so it goes in within 10 business days of signing.
Diary the CONACOM clock in business days (art. 38): 90 business days from a complete filing, suspended once per stage for a document request; tacit approval if no resolution.
Check whether your business is on the art. 13 AML list (real estate, gambling, jewellery, art, sports, money transfer, virtual assets, professionals and others); if so, register with SEPRELAD or your sector supervisor, appoint a compliance officer and adopt a written risk based manual.
Map personal data flows now: Ley 7593/2025 applies from 27 November 2027, and contracts with foreign processors should carry transfer clauses ready for the Agency's adequacy rules.
Before any physical project listed in Ley 294 art. 7, hire a registered environmental consultant, file the assessment with MADES and do not start works, seek credit or claim incentives until the Declaración de Impacto Ambiental is issued.
Extend anti bribery controls to agents and intermediaries dealing with foreign officials, since Ley 6430/2019 punishes promises as well as payments.

Common traps

The merger filing is due 10 business days after signing, not before closing; CONACOM can order a late filing within 20 days, and the law's terms are all business days (Ley 4956 art. 14 and 38).
The turnover threshold moves with the minimum wage: each annual wage increase raises the guaraní threshold, so recompute it at the wage in force when you sign.
Agreements declared anticompetitive by a final CONACOM resolution are void, and damages claims in court depend on that final resolution (Ley 4956 art. 64).
The data law is not yet in force, but it reaches foreign companies with no Paraguayan presence that offer goods or services to residents or monitor behaviour in Paraguay (Ley 7593 art. 2); a local representative may become mandatory once the regulation is issued (art. 12).
Suspicious operations must be reported whatever their amount, including attempted operations; there is no minimum (Ley 1015 art. 19 as amended).
AML sanctions reach people as well as companies: directors and managers can be removed and barred for 3 to 10 years, and shareholders with management roles can lose dividends for up to 3 fiscal years (Ley 1015 art. 24).
Ley 294 requires the environmental declaration not only to build but also to obtain credit, other permits and tax exemptions (art. 12), and false data cancel the licence and stop the works at once (art. 14).
Ley 6430/2019 covers bribery of foreign and international officials only by individuals; it has no corporate liability article, so do not assume a compliance programme defence or company fine regime like Brazil's or Chile's.

Sources

← Energy, mining and key sectors in Paraguay: ANDE's monopoly, independent power, renewables, mining royalties, oil and gas and crypto miningCourts, arbitration and enforcement in Paraguay: the 2025 arbitration law, foreign awards and judgments, the New York Convention and ICSID →