REDEC: where financial regulation meets data protection
The clock is ticking. Rolling out the Registro de Deuda Consolidada (REDEC), mandated by Law No. 21.680, is no longer a future project: it is the most important regulatory challenge of 2025.
Regulatory context: what is REDEC?
The Registro de Deuda Consolidada (REDEC), created by Law No. 21.680, is a platform run by the Comisión para el Mercado Financiero (CMF) that centralizes credit information on individuals and legal entities. Its purpose is to:
Improve credit risk assessment.
Strengthen financial supervision.
Protect consumer rights.
What reporting entities have to do
Every institution that grants credit (banks, cooperatives, card issuers, cajas de compensación and others) must:
Send periodic regulatory reports.
Guarantee the security and traceability of the information.
Manage debtors' consent.
Allow access, rectification and cancellation of data.
Comply with audits and face penalties for non-compliance.
Is your institution ready for the operational load this brings?
Dates you can't ignore
There is little time to adapt. The regulation sets out this timeline:
November 2025: REDEC goes live and the trial run starts for entities supervised by the CMF.
January – March 2026: Reporting starts for the remaining reporting institutions.
April 1, 2026: The Law and the Norma de Funcionamiento Operativo take full effect.
December 2026: Penalties begin (up to 20,000 UTM)
The key challenge: consent
Norma de Carácter General No. 540, which governs how to access REDEC, requires every institution to build and run its own individual consent management system. That system has to obtain, record and store the debtor's approval in a secure, auditable way.
On top of that, December 2026 is also when Law No. 21.719 takes full effect. It regulates the processing of personal data, and consent will be the main mechanism for using your users' data legally.
We have seen a lot of confusion on this point, so let's clear up the fundamental difference:
To REPORT (upload information): To send your debtors' information and build the registry at the CMF, NO consent is required from the debtor.
To QUERY (use information): This is the real challenge. To access a debtor's information in REDEC (for example, to use it in a new risk assessment), consent IS mandatory.
And the hardest part:
You have to manage revocations. If a customer revokes their consent through an electronic channel, the regulation requires the action to be immediate.
Consent is valid for only 15 banking business days.
You have to report weekly that you obtained every consent you needed.
This is where a robust solution like Soyio becomes crucial. You can't afford mistakes in consent traceability. You need a platform that guarantees collection, secure recording and real-time management of revocations, so the data is processed legitimately.
Ideally, you also want a solution that plugs into your processes easily, doesn't get in the way of your users' experience and lets you generate more and better business.
RDC reports: the new regulatory pulse
The "how" of compliance takes shape in the RDC regulatory files. These reports serve different functions and come with strict deadlines. Handling them manually is a recipe for disaster.
Here is a summary of the files you will have to generate:
RDC01 – Debtor list
Record of active operations.
Frequency: weekly (Friday) and month-end. Deadline: 3 business days.
RDC02 – Corrections
Corrections to earlier RDC01 reports.
Frequency: weekly (Friday). Deadline: 3 business days.
RDC20 – Stock variations
Reports purchases, sales, assignments and time-barred debts.
Frequency: every two weeks (Friday) and month-end. Deadline: 3 business days.
RDC22 – Accounting information
Accounting reconciliation of credit portfolios.
Frequency: quarterly. Deadline: 15 business days.
RDC30 – Consent record
Reports the consents obtained and revoked.
Frequency: weekly (Friday). Deadline: 3 business days.
RDC31 – Access under consent
Records who accessed REDEC (an authorized agent, for example).
Frequency: weekly. Deadline: 9 business days.
RDC40 – Request management
Traceability of rights requests (rectification, among others).
Frequency: daily. Deadline: 1 business day.
Finally: new rights and how to handle them
One of these reports, RDC40, connects to another requirement in this regulation. People have the right to update, rectify, supplement and erase their debt information, and you have to be able to receive those requests and handle them in under 15 business days.
This report is filed daily. That demands a level of automation and control your current systems probably don't have.
REDEC is a strategic shift that affects operations, technology and the customer relationship. Compliance is not optional, and the penalties for infringements (from minor to very serious) are already defined.
The question is not whether you will comply, but how you will do it without collapsing your operation.
