Compliance officer, prevention officer or data protection officer? What each law requires of the company and of the person

Law 19.913 created the Financial Analysis Unit (Unidad de Análisis Financiero, UAF) and requires the entities it lists to report suspicious transactions to it; its officer is the company’s counterpart before that body. Law 20.393, rewritten by Law 21.595 (the Economic Crimes Law) in 2023, makes companies criminally liable for the offences in its catalogue when the failure to effectively implement an adequate prevention model favoured or facilitated their perpetration; the prevention officer is an element of that model. Law 21.719 rewrote Law 19.628 on personal data and introduced the data protection officer. The role your company needs depends, first, on whether it appears on the list of Law 19.913 and, second, on the model it decides to adopt.

Outside this comparison there is another statutory, sector-specific role: Law 21.663 requires operators of vital importance to appoint a cybersecurity delegate, the counterpart of the National Cybersecurity Agency (Article 8 letter i). The rule has been in force since March 1, 2025, and the duty arises for each company when the Agency classifies it as an operator of vital importance or identifies some of its infrastructure, processes or functions as essential, which then become subject to Article 8 (Article 4, final paragraph).

Article 3 of Law 19.913 lists a long series of obliged activities. Besides banks, financial institutions, the securities market, insurance and fund managers, it includes currency exchange houses, cash and valuables transport, casinos, gaming rooms and racetracks, free trade zones, customs agents, auction houses, real estate brokers, notaries and registrars, car dealers, weapons, precious metals and stones, professional sports organizations, shooting, hunting and fishing clubs, the sale of purebred horses, and those registered with the CMF under the Fintec Law that provide crowdfunding, alternative trading systems, custody or intermediation of financial instruments, or payment initiation. Entities supervised by the CMF that voluntarily register with the UAF are added. The full list is in Article 3, and it is checked against the company’s actual line of business, not its name. For all of them, the fourth paragraph sets the duty: "deberán designar un funcionario responsable de relacionarse con la Unidad de Análisis Financiero" (they must appoint an officer responsible for dealing with the Financial Analysis Unit). Article 40 adds registration in the UAF registry and notice of any relevant change in the entity’s legal situation.

The expression "oficial de cumplimiento" does not appear in the law; the UAF instructions coined it. For reporting entities in general, Circular No. 62 of March 19, 2025, in force since June 1, 2025, applies; for gaming casinos, from October 1, 2026, joint Circular UAF No. 63 / SCJ No. 150. Circular 62 asks that the officer hold a position of high responsibility, such as an area or division manager, with resources and access to all transactions; only natural persons and micro and small companies may appoint the natural person, a partner, an administrator or an executive. The UAF does not register as officer anyone convicted of money laundering, its predicate offences or the financing of terrorism, and a change of officer is reported to it within 10 business days. The distinction matters when reading the obligations. What the law sets is the officer, the reporting of suspicious transactions (Article 3), the five-year record of cash transactions above USD 10,000 and their delivery when the UAF requires it (Article 5), and the registration. The periodic reporting of those transactions, monthly, quarterly or half-yearly depending on the sector, is set by Circular 62 (letter D, d.1), and what the circular sets can change without going through Congress.

The sanctions run against the entity. Article 19 grades the infringements and Article 20 sets the fines: up to 800 UF for minor ones, up to 3,000 UF for less serious ones and up to 5,000 UF for serious ones, which include breaching the duties of Article 3. Repetition, that is, two or more infringements of the same nature with no more than twelve months between them, allows the fine to be raised up to threefold. Article 21 extends the same sanctions to the directors or legal representatives who concurred with their will in the infringement.

Article 3 of Law 20.393 makes the legal entity criminally liable for the offences of Article 1 perpetrated in the course of its activity. The acts must be committed by, or with the intervention of, someone who holds a position, function or role in it or who provides it services managing its affairs before third parties. It is liable whenever the failure to effectively implement an adequate prevention model favoured or facilitated the act. It is not liable for an offence perpetrated exclusively against it. It is also liable, under the same requirements, for the act of a person linked to another legal entity with which it has ownership or shareholding relations. That other entity must provide it services managing its affairs before third parties or lack operational autonomy from it (Article 3, second paragraph). Article 4 defines the model by four elements, and the third is the person: one or more persons responsible for applying the protocols, with adequate independence, effective powers of direction and supervision, and direct access to management to inform it, render account and request measures beyond their remit. The legal entity provides them with the necessary resources and means, according to its size and economic capacity.

The law no longer says who appoints the officer, nor sets a term of office or a minimum profile: the 2023 rewrite replaced the fixed rules with a proportionality test, according to the company’s corporate purpose, line of business, size, complexity, resources and activities. Independence is the attribute the law returns to: Article 6 No. 3 counts the duly accredited autonomy of the crime prevention officer among the effective measures which, adopted before the formal charge, mitigate liability. The other three elements (risk identification; protocols with secure reporting channels and internal sanctions, incorporated into all employment and service contracts; and periodic evaluation by independent third parties) are explained in is the crime prevention model mandatory?.

Article 50 of Law 19.628, in the text set by Law 21.719, provides that the data controller may appoint a personal data protection officer. The appointment comes from the highest management or administrative authority, that is, the board, a managing partner or the highest authority of the company. The officer has autonomy from management in the matters of the law and meets requirements of suitability, capacity and specific knowledge. In micro, small and medium-sized companies the owner or its highest authorities are entitled to assume the tasks. The officer is allowed to perform other functions without conflict of interest, and a group under the same controller is entitled to appoint a single officer if all its entities operate under the same standards and the officer is accessible to all of them. The officer is bound to strict secrecy, and his or her functions, from advising the controller to an annual work plan with accountability, are in the same article.

The voluntary rule has one exception. Article 49 allows controllers to voluntarily adopt an infringement prevention model, whose programme contains, as its first element, the appointment of a data protection officer with defined means and powers. The requirement arises upon adopting the model, not only upon certifying it. The regulation, Supreme Decree No. 662 of 2025 of the Ministry of Finance, published on September 9, 2026, includes the officer in the programme submitted for certification. This whole regime takes effect on December 1, 2026, the date set by Law 21.719; a Government bill at its first stage in the Senate (Bulletin 18.623-07) proposes to postpone it to December 1, 2027. The role is developed in the data protection officer (DPO) and the model in the data infringement prevention model.

• Article 50 of Law 19.628 expressly allows other functions without conflict of interest, and Article 4 No. 3 of Law 20.393 requires independence and effective powers, without demanding exclusivity. Law 19.913 is silent, but Circular 62 asks the officer to hold a position of high responsibility, independence and access to all transactions.
• The combination breaks down where one role would supervise the other or where the person runs the supervised process: a sales manager as prevention officer for bribery risk, or a head of technology as data protection officer for the systems he or she designs.
• In a reporting entity the UAF officer is the fixed point. In small entities the other two roles may fall on the same person; as volume grows, the prudent course is to separate them, because the reports the circular requires absorb the officer’s time.
• Whatever the arrangement, it is advisable that each role report directly to the board. Law 20.393 does not require it: it asks for direct access to management, and that reporting line is the simplest way to accredit the independence its Article 6 No. 3 rewards. For the data protection officer the rule is stricter: autonomy from management (Article 50 of Law 19.628) and, within the infringement prevention model, direct accountability to whoever appointed the officer (Article 8 of DS 662). If the board made the appointment, an officer who reports only through the general manager hardly meets that rule.

Under Law 19.913 the personal exposure is twofold. Article 21 extends the fines of Article 20 to the directors or legal representatives who concurred with their will in the infringement. In addition, Article 6 forbids reporting entities, their employees and those who provide them services from informing the person concerned or third parties that information has been requested by or sent to the UAF, and Article 7 punishes that breach with imprisonment (presidio menor in its medium to maximum degrees) and a fine of 100 to 400 UTM. The same penalty reaches whoever, being obliged to inform the UAF, maliciously destroys, alters or conceals the records they are required to deliver, or delivers false records. The compliance officer is more exposed because he or she handles the reports, but these offences require conduct of one’s own; accepting the role is not enough to commit them. Separately, Article 27 punishes money laundering even when the perpetrator did not know the illicit origin of the assets through inexcusable negligence, with the penalty reduced by two degrees.

Under Law 20.393 nothing in the text sanctions the prevention officer for the company’s offences; the natural person answers for what he or she did, under the Criminal Code and, if the offence is an economic crime, under the rules of Law 21.595 explained in are managers and directors criminally liable?. Under Law 19.628 the officer’s own duty is strict secrecy over the personal data learned in the role; a public official who breaches it is sanctioned under Articles 246 to 247 bis of the Criminal Code, and the controller answers for its officer’s infringement, with a right of recourse against the officer (Article 50).

• The signatory: for the data protection officer, the board, the managing partner or the highest authority (Article 50 of Law 19.628). For the crime prevention officer the law does not name the body; a board resolution is advisable, because the legal entity must ensure the officer direct access to management and resources (Article 4 No. 3 of Law 20.393). In casinos, from October 1, 2026, the board appoints the UAF officer (UAF Circular 63 / SCJ 150).
• The powers in writing: direction and supervision, the right to request measures beyond the officer’s remit and the duty to render account (Law 20.393); means, powers and resources proportionate to the company (Article 4 No. 3 of Law 20.393 and Articles 49 letter b) and 50 of Law 19.628).
• The reporting line to the board and the conflict check: a direct reporting line to the board, stated in writing, and a record that the other functions of the position create no conflict of interest.
• For a reporting entity: an officer in a position of high responsibility with access to all transactions (Circular 62, letter B), registered with the UAF under Article 40, with changes reported within 10 business days and named in the Prevention and Detection Manual.
• The internal rules carried into contracts: Law 20.393 requires the protocols and internal sanctions to be expressly incorporated into all employment and service contracts, including those of top executives (Article 4 No. 2), and Article 49 of Law 19.628 requires the same for the data programme, or its inclusion in the internal regulations of Articles 153 and following of the Labour Code.
• The supporting records: the annual work plan and its accountability for the data protection officer (Article 50 letter f), and the periodic evaluations by independent third parties that Law 20.393 makes the fourth element of the model (Article 4 No. 4).