CMF announces full implementation of regulation on transaction security, authentication

July 31, 2026 - The Financial Market Commission (CMF) announces that General Rule No. 538, which establishes minimum security and authentication standards to process electronic payments and transfers, becomes fully effective this Saturday, August 1.

This means that the mandatory use of Reinforced Client Authentication (RCA) is now required in certain cases, primarily for electronic fund transfers and digital enrollment processes.

The standard defines RCA as an authentication procedure that considers two of the following three factors: knowledge (something the customer knows, such as a password); possession (something the customer has, such as a device); or inherence (an inherent characteristic of the customer, such as a fingerprint).

Furthermore, the regulation allowed entities to define groups of customers who could continue to use printed data for authentication (such as a coordinates card); in such cases, the authentication will not be considered RCA. However, issuers themselves are responsible for disclosing the risks associated with such use.