NCG 502: Registration and Authorisation under the Fintech Law

NCG 502 is the General Standard issued by the Comisión para el Mercado Financiero (CMF) on 12 January 2024 that puts Title II of Law No. 21.521 (the Fintech Law) into operation. The CMF grounds the norm in articles 1, 3, 5 (numerals 1, 8 and 18) and 20 (numeral 3) of Decree Law No. 3.538, and in articles 4 to 13 of Law 21.521, following the agreement of its Council in Ordinary Session No. 374 of 11 January 2024. It was signed by Solange Berstein Jáuregui, then chair of the Commission.

Its scope is broad: it does not merely open a registry. In a single instrument it sets out who must register, how authorisation is requested for each regulated service, what must be disclosed to clients, what governance and operational-risk duties the provider assumes, and how much capital and guarantees must be held. The instrument is therefore the first full supervisory framework for technology-based financial service providers in Chile, and the reference every firm in the perimeter works from when designing its compliance programme.

That breadth is easier to navigate with the map of the norm in view.

NCG 502 is organised into nine sections plus three annexes. Understanding the map matters: each section contains the specific rules that apply to each regulated service, and the same provider can be touched by several of them at once.

The three annexes contain the glossary of definitions and the templates for reporting operational incidents and operational losses.

The sections above calibrate their duties around the six regulated services listed next.

The Fintech Law defines six regulated services. NCG 502 calibrates the registration, authorisation, disclosure, governance and capital duties for each one. Intermediation and custody of financial instruments are treated jointly in Section II.F, which reflects that the same provider often performs both activities:

To offer any of those services, a provider first works through the registration and authorisation process.

The registration request is filed electronically through the application made available on the CMF website, by the legal or contractual representative of the applicant, who is responsible for the accuracy and completeness of the information supplied. Registration by itself does not entitle the entity to operate: the provider must in parallel request the authorisation that corresponds to each specific service it intends to render, each one with its own supporting documentation set.

Section I also regulates three classes of exception, to the legal-person requirement, to the exclusive corporate purpose (giro exclusivo) and to the requirement of a Chilean domicile, which allow certain foreign or non-exclusive providers to register under specific conditions. Each exception comes with its own evidentiary and reporting obligations.

Once inside the register, the provider takes on the operational duties of Section IV.

Section IV is the operational heart of the norm. It breaks down by service the responsibilities of the board or equivalent body, the written policies and control mechanisms, the risk management function, internal audit, and the specific regimes for information security and cybersecurity, business continuity and outsourcing. Section IV also codifies the proportionality principle: smaller or lower-risk providers apply a lighter version of the same core duties, while providers with greater reach or systemic relevance face heightened requirements. Operational incidents and operational losses must be reported to the CMF using the templates in Annexes No. 2 and No. 3.

Alongside the operational régime, Section V sets the prudential floor of capital and guarantees.

Section V establishes a classification of providers by business volume and, on that basis, the minimum equity and guarantees that must be maintained. It also sets out how risk-weighted assets are computed for operational, market and credit risk, including the treatment of counterparty risk and a specific regime for crypto-assets with its list of type-A crypto-assets. The result is a graduated prudential framework, calibrated to the activity, that aligns with the CMF’s supervisory practice in other regulated sectors.

These duties came into force under a transitional regime with a fixed filing deadline.

Since that entry into force, one later standard has already reshaped parts of NCG 502.

On 2 December 2024 the CMF issued NCG 524, which amends NCG 502 on several fronts: it refines the wording of the registration request, it narrows the concept of “prior intent of intermediation” so that assignments of financial instruments made solely for collateral, guarantee, custody or collection purposes do not fall within the intermediation service, it rewrites the exception of exclusive corporate purpose (Title C.2) and of the Chilean domicile (Title C.3) and it adds a new Title G creating a targeted exception to the authorisation requirement for entities with a ten-year clean compliance record that serve only qualified investors.

The most frequent questions on the norm and its perimeter are gathered below.