Countries › Uruguay › Guide › 13. Regulation › Regulatory compliance essentials in Uruguay

Regulatory compliance essentials in Uruguay

Argentina. For full detail on Argentina, go to The Argentine Thread.

Last verified: 2026-10-27 · Status: Stable

Uruguay regulates business through a short list of horizontal laws: competition and merger control (Ley 18.159), personal data (Ley 18.331 and Ley 19.670), anti money laundering (Ley 19.574), bribery offences (Penal Code and Ley 17.060) and prior environmental authorization (Ley 16.466). Mergers between groups with Uruguayan turnover of UI 500 million (about US$83 million) and two parties with UI 30 million each need clearance before closing; since 1 January 2026 the base review term is 30 calendar days. Foreign companies are caught when their conduct or data processing targets Uruguay, and most fines are set in indexed units (UI or UR), so their peso value rises with inflation.

USD figures use UYU 40.214 per US dollar, the BCU quotation for DLS. USA BILLETE on 26 October 2026; amounts in Unidades Indexadas (UI) use UYU 6.6792 per UI, the BCU quotation for 27 October 2026, both retrieved from the BCU quotations service on 27 October 2026. Amounts in Unidades Reajustables (UR) use UYU 1,940.77 per UR, the value fixed by Decreto 229/026 of 22 September 2026 (IMPO lists it as the UR in force for September 2026). Conversions are rounded and for orientation only.

Key facts

Merger control regime	Mandatory prior authorization; suspensory Ley 18.159 art. 7 and 9, as of 2026-10-27 · in force
Merger threshold: combined Uruguayan turnover of all participants	500000000 UILey 18.159 art. 7 (Ley 20.212 art. 192), as of 2026-10-27 · in force
Merger threshold: Uruguayan turnover of each of at least two participants	30000000 UILey 18.159 art. 7 (Ley 20.212 art. 192), as of 2026-10-27 · in force
Merger review term, phase 1	30 calendar days from filing declared completeLey 18.159 art. 9 (Ley 20.446 art. 164), as of 2026-10-27 · in force
Maximum extension of merger review term	60 calendar daysLey 18.159 art. 9 (Ley 20.446 art. 164), as of 2026-10-27 · in force
Competition fine ceiling as share of annual turnover	10 %Ley 18.159 art. 17, as of 2026-10-27 · in force
Competition fine fixed ceiling (alternative limb)	20000000 UILey 18.159 art. 17, as of 2026-10-27 · in force
Competition fine minimum	100000 UILey 18.159 art. 17, as of 2026-10-27 · in force
Deadline to notify data breach to authority	72 hoursDecreto 64/020 art. 4, as of 2026-10-27 · in force
Data protection officer required above (private entities, large volume)	35000 peopleDecreto 64/020 art. 10, as of 2026-10-27 · in force
Data protection fine ceiling	500000 UILey 18.331 art. 35, as of 2026-10-27 · in force
Data law applies to foreign controllers targeting residents	Yes; offering goods or services to inhabitants or analysing their behaviour Ley 19.670 art. 37, as of 2026-10-27 · in force
Private personal databases must be registered	Yes, with the URCDP Ley 18.331 art. 28 and 29, as of 2026-10-27 · in force
AML fine ceiling for non financial obligated parties	20000000 UILey 19.574 art. 13 (Ley 20.469 art. 1), as of 2026-10-27 · in force
AML minimum record retention after relationship ends	5 yearsLey 19.574 art. 21, as of 2026-10-27 · in force
Maximum prison term for transnational bribery	3 yearsLey 17.060 art. 29, as of 2026-10-27 · in force
Maximum prison term for aggravated bribery (official)	6 yearsCódigo Penal art. 158, as of 2026-10-27 · in force
EIA required for power plants above	10 MWLey 16.466 art. 6 f, as of 2026-10-27 · in force
Maximum environmental fine	50000 URLey 16.112 art. 6 (Ley 19.535 art. 168), as of 2026-10-27 · in force
Minimum environmental fine	10 URLey 16.112 art. 6 (Ley 19.535 art. 168), as of 2026-10-27 · in force

The rule

1. All markets are governed by free competition. Abuse of a dominant position and any practice, conduct or recommendation, individual or concerted, whose effect or object is to restrict, limit, hinder, distort or prevent current or future competition in the relevant market is prohibited. The law applies to every individual or company, public or private, local or foreign, active in Uruguay, and also to activities carried out abroad insofar as they have effects in Uruguay. Agreements between competitors to fix prices or conditions, restrict output, share markets, customers or suppliers, or rig bids are expressly prohibited (art. 4 BIS), with no efficiency defence written into that article; other conduct listed in art. 4 (unequal conditions, tying, refusal to deal, blocking access to essential facilities or new entrants, exclusive zones) is prohibited when it has the anticompetitive effect described in art. 2, and the authority may weigh efficiencies and the benefit passed to consumers. Winning the market through greater efficiency is not a restriction of competition.
Cost to do it: No fee or registration is required to comply; the cost is internal review of distribution, pricing and trade association practices.
Example: Two Montevideo distributors agreeing a common price list for a product fall within art. 4 BIS numeral 1 whatever their size. / A US manufacturer that agrees with a rival abroad to stop exporting to Uruguay is reached by art. 3 because the agreement has effects in Uruguay.Ley Nº 18.159 (Defence of Free Competition), art. 4 as reworded and art. 4 BIS as added by Ley Nº 19.833, art. 2, 3, 4, 4 BIS and 6, 2007-07-20 official text · verified 2026-10-27

2. When an investigation finds anticompetitive conduct, the Comisión de Promoción y Defensa de la Competencia must order it to stop and sanction those responsible with a warning, a warning published at the offender's cost in two national newspapers, or a fine from UI 100,000 up to the highest of UI 20,000,000, 10 percent of the offender's annual turnover, or three times the harm caused if it can be determined. Directors and managers who actively contributed may also be fined, and conduct of a controlled company is also attributable to its controlling company. In concerted practices between competitors, reporting the agreement or providing evidence that allows the others to be sanctioned is a special mitigating factor. A final fine resolution is directly enforceable (título ejecutivo).
Cost to do it: Fines run from UI 100,000 (about UYU 667,920, US$16,609) to the highest of UI 20,000,000 (about UYU 133,584,000, US$3.32 million), 10 percent of annual turnover or three times the harm.
Example: A company with annual turnover of UYU 2,000,000,000 that joins a price cartel faces a ceiling of UYU 200,000,000, because 10 percent of turnover exceeds UI 20,000,000 (UYU 133,584,000). / For a company with US$50 million of annual turnover, the 10 percent limb gives a ceiling of US$5 million, above the UI 20,000,000 limb of about US$3.32 million.Ley Nº 18.159, art. 17 (inciso 5 as reworded by Ley Nº 19.355 art. 205), 19 and 20, art. 17, 19 and 20, 2007-07-20 official text · verified 2026-10-27

3. Any economic concentration needs prior authorization when, in any of the last three financial years, the tax exclusive turnover in Uruguay of all participants together is at least UI 500,000,000 and at least two participants each have Uruguayan turnover of UI 30,000,000 or more. If the combined UI 500,000,000 test is met but the individual tests are not, the parties must inform the authority, which may decide within 15 business days that the deal needs authorization. The filing must be made before closing or before taking control, whichever comes first. Concentration covers any act that transfers or changes control (decisive influence over strategy and competitive behaviour) over all or part of a business, including joint control, mergers, share and asset acquisitions. Exempt: buying a company in which the buyer already held at least 50 percent, buying debt or non voting shares, the purchase of a single company by a single foreign company with no prior assets or shares in Uruguay, and buying a bankrupt company when there was a single bidder. The deal may not close before express or tacit authorization.
Cost to do it: Ley 18.159 sets no filing fee; the cost is preparing the filing and the information the authority requires. Thresholds: UI 500,000,000 is about UYU 3,339,600,000 (US$83.0 million) and UI 30,000,000 about UYU 200,376,000 (US$4.98 million).
Example: Target with UYU 250,000,000 and buyer with UYU 3,200,000,000 of Uruguayan sales last year: combined UYU 3,450,000,000 exceeds UYU 3,339,600,000 and both exceed UYU 200,376,000, so clearance is required before signing completes. / A foreign buyer with no Uruguayan assets or shares buying one Uruguayan company with US$90 million of local sales falls under the art. 8 C exemption and needs no authorization.Ley Nº 18.159, art. 7 as reworded by Ley Nº 20.212 art. 192 and art. 8 as reworded by Ley Nº 19.833 art. 5, art. 7 and 8, 2023-11-06 official text · verified 2026-10-27 · changed: Ley Nº 19.833 of 20 September 2019 replaced the original notification system with prior authorization, triggered by combined gross Uruguayan turnover of UI 600,000,000. Ley Nº 20.212 of 6 November 2023 art. 192 rewrote art. 7 to the current cumulative test (UI 500,000,000 combined and UI 30,000,000 for at least two participants) plus the information duty when only the combined test is met.

4. The Comisión de Promoción y Defensa de la Competencia must, by reasoned resolution, authorize the deal, authorize it subject to conditions, or deny it within 30 calendar days counted from the administrative act declaring the filing complete and correct. Before that term ends it may extend it once by up to 60 more calendar days to deepen the analysis, to request more information from the parties or third parties, or to assess remedies, and it may also suspend the term for up to 60 additional calendar days to assess proposed remedies. Concentrations that restrict competition in the relevant market are prohibited; the review weighs the relevant market, external competition and efficiency gains. If the authority does not decide within these terms the deal is tacitly authorized, and authorization does not prevent a later conduct investigation.
Cost to do it: No fee is set in the law. Timing cost: up to 30 days base, 90 days with extension and 150 days if the remedies suspension is also used, all counted after the filing is declared complete.
Example: A filing declared complete on 2 November 2026 must be decided by 2 December 2026 unless the Commission extends the term before that date. / For a US$100 million acquisition the deal documents should allow at least 30 days after completeness, and up to about 150 days in a complex case, before the long stop date.Ley Nº 18.159, art. 9 as reworded by Ley Nº 20.446 art. 164 (in force 1 January 2026 under Ley Nº 20.446 art. 3), art. 9, 2025-12-16 official text · verified 2026-10-27 · changed: From 1 January 2026 Ley Nº 20.446 art. 164 cut the base review term from 60 calendar days (Ley Nº 19.833, with a 60 day extension added by Ley Nº 20.075 art. 147) to 30 calendar days counted from the act declaring the filing complete, kept a single extension of up to 60 days, and added a suspension of up to 60 days to assess remedies.

5. Uruguay's data protection law applies to controllers or processors established in Uruguay and, when not established there, if the processing relates to offering goods or services to inhabitants of Uruguay or analysing their behaviour, if international law or a contract so provides, or if means located in Uruguay are used (except mere transit, provided a representative domiciled in Uruguay is appointed). Private persons or companies that create, modify or delete personal databases must register them with the Unidad Reguladora y de Control de Datos Personales (URCDP). Transfers to countries without an adequate level of protection are prohibited unless an exception applies (for example unequivocal consent, performance of a contract with the data subject) or the URCDP authorizes them on sufficient guarantees, which may derive from appropriate contractual clauses. The URCDP may impose observations, warnings, fines up to UI 500,000, a five day suspension of the database or closure.
Cost to do it: Maximum fine UI 500,000, about UYU 3,339,600 (US$83,046) per sanction, plus possible suspension or closure of the database.
Example: A Uruguayan subsidiary that keeps an unregistered customer database risks a fine of up to UYU 3,339,600 and an order to suspend the database for five days. / A US e commerce site that markets to buyers in Uruguay is subject to Ley 18.331 under Ley 19.670 art. 37 A even without a local entity; the fine ceiling is about US$83,046.Ley Nº 18.331 (Personal Data Protection), art. 23, 28 and 35 as reworded by Ley Nº 18.719; Ley Nº 19.670 art. 37, Ley 18.331 art. 23, 28, 29 and 35; Ley 19.670 art. 37, 2008-08-11 official text · verified 2026-10-27

6. Controllers and processors who learn of a security breach must inform the data subjects and the URCDP immediately and in detail, together with the measures taken. The regulation requires mitigation procedures to start within the first 24 hours and notice to the URCDP within at most 72 hours of learning of the breach. Public entities, private entities whose main business is processing sensitive data, and private entities processing large volumes of data must appoint a data protection officer; large volume means processing personal data of more than 35,000 people. The appointment must be communicated to the URCDP within 90 days of the start of processing.
Cost to do it: No fee for breach notice or officer appointment is set; the cost is an officer with accredited legal knowledge of data protection, who may be external or shared by entities with similar activities (Decreto 64/020 art. 12 and 15).
Example: A Montevideo fintech with 50,000 users exceeds the 35,000 person test and must notify its data protection officer to the URCDP within 90 days of starting processing. / If a US parent's cloud provider suffers a breach exposing Uruguayan customers' data on a Friday, notice to the URCDP is due within 72 hours, by Monday.Ley Nº 19.670 art. 38 and 40; Decreto Nº 64/020 (regulation), Ley 19.670 art. 38 and 40; Decreto 64/020 art. 3, 4, 10 and 14, 2020-02-17 official text · verified 2026-10-27

7. Besides BCU supervised financial entities (art. 12), a long list of non financial businesses must report unusual or suspicious transactions to the BCU's Unidad de Información y Análisis Financiero (UIAF) and apply client due diligence, including identifying the beneficial owner: casinos; real estate agents, developers and builders (except leases); lawyers, notaries and accountants when acting for clients in real estate deals, managing client money or accounts, organising contributions or forming, running or selling companies and trusts; auctioneers; dealers in art, antiques and precious metals; free zone operators and users; company and trust service providers; non profit organisations; auditors; and offshore administrative or data processing service providers. Records must be kept at least five years after the relationship or transaction ends. The Secretaría Nacional para la Lucha contra el Lavado de Activos y el Financiamiento del Terrorismo (SENACLAFT) sanctions non financial obligated parties with warnings, observations, fines or suspension, and may also fine directors and senior managers who did not act with due diligence.
Cost to do it: Fines from UI 1,000 (about UYU 6,679, US$166) to UI 20,000,000 (about UYU 133,584,000, US$3.32 million), graded by the case, conduct and the offender's usual business volume; temporary suspension up to three months.
Example: A real estate developer selling units in Punta del Este must identify buyers and their beneficial owners and keep the file for at least five years; a failure can draw fines up to UYU 133,584,000. / A free zone user handling a US$2 million order from a client who will not explain the source of funds should file an unusual transaction report with the UIAF and must not tell the client (art. 22).Ley Nº 19.574 (Integrated AML Law), art. 13 and 25 as reworded by Ley Nº 20.469 art. 1, art. 12, 13, 14, 21 and 25, 2026-03-19 official text · verified 2026-10-27 · changed: Ley Nº 20.469 of 19 March 2026 art. 1 reworded art. 13 (list of non financial obligated parties, including virtual asset real estate deals and company sale services) and art. 25 (registration with SENACLAFT of offshore support service providers).

8. A public official who takes money or another benefit, or accepts its promise, to delay or omit an act of office or to act against their duties commits aggravated bribery (cohecho calificado), punished with 12 months of prisión to 6 years of penitenciaría, special disqualification for 2 to 6 years and a fine of 50 UR to 10,000 UR, increased by one third to one half when it leads to a contract with the official's agency or abuse of public procurement procedures. Whoever induces an official to commit bribery is punished for the mere instigation with one half to two thirds of the principal penalty. Offering or giving money or another economic benefit to a foreign public official to obtain or facilitate a Uruguayan foreign trade deal is transnational bribery, punished with 3 months of prisión to 3 years of penitenciaría.
Cost to do it: Fine for aggravated bribery from 50 UR (about UYU 97,039, US$2,413) to 10,000 UR (about UYU 19,407,700, US$482,611), plus imprisonment and disqualification.
Example: Paying a municipal inspector UYU 200,000 to skip a required inspection exposes the payer to prosecution for inducing aggravated bribery (Código Penal art. 159). / A Uruguayan exporter paying a foreign customs official US$10,000 to clear a shipment abroad risks 3 months to 3 years under Ley 17.060 art. 29.Código Penal art. 158 and 159 as reworded by Ley Nº 17.060 art. 8; Ley Nº 17.060 (Anti Corruption Law) art. 29, Código Penal art. 158 and 159; Ley 17.060 art. 29, 1998-12-23 official text · verified 2026-10-27

9. Listed activities, public or private, need a prior environmental impact study and prior authorization before works start: roads, bridges, railways and airports; ports and oil or chemical terminals; pipelines and outfalls; hazardous waste plants; mineral and fossil fuel extraction; power plants above 10 MW of any source; transmission lines of 150 KW or more (as written in the law); water works; industrial, agro industrial and tourism complexes that may cause serious impact; urban projects above 100 hectares; projects in the coastal defence strip; and analogous activities set by regulation. The authority may hold a public hearing and must deny authorization if the impact exceeds admissible minimums, and the Executive may suspend works at any time by reasoned resolution. These powers, originally given to the housing and environment ministry (MVOTMA), now belong to the Ministerio de Ambiente created in 2020, which may fine infractions of environmental rules from 10 UR to 50,000 UR.
Cost to do it: Cost of the study signed by a qualified university professional (Ley 16.466 art. 12) and the review time set by regulation; environmental fines from 10 UR (about UYU 19,408, US$483) to 50,000 UR (about UYU 97,038,500, US$2.41 million).
Example: A 50 MW wind farm exceeds the 10 MW threshold and cannot start construction without the prior environmental authorization; building first risks suspension and fines up to UYU 97,038,500. / A US$80 million solar project needs the authorization before groundbreaking; the maximum environmental fine of about US$2.41 million is a fraction of the cost of a suspended build.Ley Nº 16.466 (Environmental Impact Assessment), regulated by Decreto Nº 349/005; Ley Nº 19.889 art. 291 and 293; Ley Nº 16.112 art. 6 as reworded by Ley Nº 19.535 art. 168, Ley 16.466 art. 6, 7, 8, 14 and 16; Ley 19.889 art. 291 and 293 F; Ley 16.112 art. 6, 1994-01-19 official text · verified 2026-10-27

Area	Law	Authority	Maximum sanction	Approx. UYU	Approx. USD
Competition conduct	Ley 18.159 art. 17	Comisión de Promoción y Defensa de la Competencia	Highest of UI 20,000,000, 10% of annual turnover or 3x harm	133,584,000 (fixed limb)	3,321,828 (fixed limb)
Data protection	Ley 18.331 art. 35	URCDP	UI 500,000 fine, suspension or closure of database	3,339,600	83,046
AML (non financial)	Ley 19.574 art. 13	SENACLAFT	UI 20,000,000 fine or suspension up to 3 months	133,584,000	3,321,828
Environment	Ley 16.112 art. 6	Ministerio de Ambiente	50,000 UR fine	97,038,500	2,413,053
Bribery of official	Código Penal art. 158	Criminal courts	6 years penitenciaría and 10,000 UR fine	19,407,700 (fine)	482,611 (fine)

Main regulators and sanction ceilings (UYU and USD at the rates in the FX note)

Stage	Term	Trigger
Information only case (combined test met, individual tests not)	15 business days for the authority to call the deal in	Receipt of the information
Phase 1 decision	30 calendar days	Act declaring the filing complete and correct
Extension	Up to 60 more calendar days	Reasoned resolution before term expires
Remedies suspension	Up to 60 more calendar days	Assessment of proposed commitments
Silence	Tacit authorization	Expiry of the applicable term

Merger review timeline under Ley 18.159 art. 9 (as reworded by Ley 20.446 art. 164, from 1 January 2026)

Worked example

Acquisition screen: a foreign group with Uruguayan sales of UYU 3,000,000,000 (US$74.6 million) buys a local company with sales of UYU 400,000,000 (US$9.9 million). Combined UYU 3,400,000,000 exceeds UI 500,000,000 (UYU 3,339,600,000) and both exceed UI 30,000,000 (UYU 200,376,000), so the deal needs authorization before closing (Ley 18.159 art. 7). If the filing is declared complete on 2 November 2026, phase 1 ends on 2 December 2026; with the maximum extension it can run to 31 January 2027 (art. 9).
Cartel exposure: a supplier with annual turnover of UYU 1,000,000,000 (US$24.9 million) found to have rigged bids faces a fine ceiling of UYU 133,584,000 (US$3.32 million), because the UI 20,000,000 limb is higher than 10 percent of turnover (UYU 100,000,000), unless three times the harm is higher still (art. 17). Reporting the cartel first is a special mitigating factor.
Data and AML on market entry: a foreign online lender serving Uruguayan residents is subject to Ley 18.331 under Ley 19.670 art. 37 A, must register its databases, appoint a data protection officer once it processes data of more than 35,000 people, and must notify any breach to the URCDP within 72 hours (Decreto 64/020 art. 4 and 10).

Step by step

Before signing any acquisition or joint venture, test the last three financial years of Uruguayan turnover of all participants against UI 500,000,000 combined and UI 30,000,000 for two parties, converting at the UI value used by the regulation, and check the art. 8 exemptions.
If the deal is caught, file before closing or taking control; build at least 30 days after completeness, and up to about 150 days in complex cases, into the long stop date, and do not close before express or tacit authorization.
Review distribution, pricing and trade association practices against Ley 18.159 art. 4 and 4 BIS, including agreements made abroad with effects in Uruguay.
Map personal databases, register them with the URCDP, document cross border transfers (adequacy, consent or contractual clauses) and set up a 24 hour mitigation and 72 hour notification breach plan.
Appoint and notify a data protection officer within 90 days of starting processing if you process data of more than 35,000 people or sensitive data as a main business.
Check whether your business is an AML obligated party under Ley 19.574 art. 13 (real estate, free zones, company services, professionals); if so, adopt a written risk analysis, client and beneficial owner due diligence and five year record keeping.
Adopt an anti bribery policy covering domestic officials and foreign officials in export deals, including payments through agents.
For projects listed in Ley 16.466 art. 6, obtain the prior environmental authorization from the Ministerio de Ambiente before any works start.

Common traps

Merger thresholds are tested in any of the last three financial years, not only the latest one, and the combined test alone triggers an information duty even when the individual tests fail.
Closing before authorization breaches the standstill in art. 9; express or tacit authorization is the only safe harbour, and it does not block a later conduct case.
The single foreign buyer exemption (art. 8 C) is lost if the buyer or its group already holds assets or shares of other companies in Uruguay.
Fines in UI and UR rise with inflation; peso amounts in old advice are already out of date.
Directors and controlling companies can be fined for a subsidiary's competition infringement (Ley 18.159 art. 19), and directors and senior managers for AML failures (Ley 19.574 art. 13).
Foreign controllers targeting Uruguayan residents are subject to Ley 18.331 even with no local entity (Ley 19.670 art. 37).
Telling a client that an unusual transaction report was filed is prohibited (Ley 19.574 art. 22).
Starting works on a listed project before the environmental authorization can lead to suspension by the Executive at any time (Ley 16.466 art. 8).

Sources

← Key sectors in Uruguay: electricity, hydrocarbons, mining, forestry and software, the rules that open each to private investorsCourts, arbitration and enforcement in Uruguay →