REDEC and Cybersecurity: A “High Value Target” for cybercrime.

In three months, the CMF's Registro de Deuda Consolidada (REDEC) goes live. And while most of the institutions covered by it are focused on handling the new reports, the consents required and the deadlines, an even bigger challenge is emerging that almost nobody is discussing: the new cybersecurity risks this law brings with it.

REDEC is a confidential platform run by the CMF that consolidates debt information on individuals and companies. For reporting entities, though, it is not just a lookup system: it is a new high value attack surface. A single compromised access can expose extremely valuable financial data, sharply raising the likelihood of breaches that, if they are linked to control or diligence failures, trigger heavy penalties.

The New Landscape: REDEC as a “High Value Target”.

REDEC turns every reporting entity into an access point to one of the most critical databases in the Chilean financial system. That means that, by querying and processing this information, those institutions become, often without even realizing it, what cyber intelligence calls a High Value Target (HVT).

An HVT is defined as an asset whose capture gives the attacker a disproportionate strategic advantage and causes systemic damage to the organization.

Processing the information this Law opens access to creates critical targets, because it concentrates borrowers' identity, debt levels and payment behavior in one place: financial intelligence ready to be used for fraud and extortion against the people affected.

The CMF's NCG N°540, which sets out the operating rules for REDEC, makes this risk concrete: access to the information happens through the Commission's Servicio de Consulta, which provides an API that requires the reporting entity to be identified and authenticated. The regulation also states, in section 5, that accesses must be logged in electronic records, which will be traceable and available for review by the audit function and by the Commission whenever it so requires.

An attacker won't try to breach the CMF. They will try to compromise the credentials and records of a reporting entity, especially entities with less robust infrastructure, in order to act as a "legitimate user".

What NCG 540 requires: unprecedented technical rigor

To mitigate the risks posed by access to the Registry and by the concentration of data of this kind, the CMF has issued a technical compliance standard that shifts responsibility from the regulator to the Board. Under NCG 540, cybersecurity becomes an unavoidable compliance parameter: the entity has to implement security measures proportionate to the risk in order to guarantee the confidentiality and the deletion of the data, meeting the standard of technical due diligence that the CMF expressly requires.

This new standard of Technical Due Diligence rests on three fundamental pillars:

1. Identification and Traceability of Specific Staff: The regulation puts an end to internal anonymity. It is no longer enough to record that "the institution" ran a query. The staff who use the information must be fully identified, and their accesses must be logged in traceable electronic records available for audit. That forces entities to implement robust digital identity systems that guarantee that whoever accesses the API is the person actually authorized to do so.

2. Destruction of the Data Queried: Once the purpose of the query has been fulfilled, the information must be deleted from the entity's systems and from those of its agents. Keeping parallel databases, or databases of the data queried, is not just bad practice: it is now an explicit violation, and one that needlessly increases the company's attack surface.

3. Responsibility for Agents: The regulation establishes that cybersecurity failures by agents (for example, a credit scoring fintech that queries REDEC through the API on behalf of a bank) are directly attributable to the reporting entity. Agents' failures are attributable to the entity if it fell short in its duties of selection, supervision and technical control.

That said, the standard is not uniform: it introduces a criterion of operational proportionality. Both the Law and its regulation explicitly distinguish between institutions according to their transaction volume, complexity and risk profile, requiring more robust cybersecurity controls and more frequent audits from entities with greater technical and financial capacity.

The Legal Cascade: one event, multiple penalties

In today's Chilean regulatory ecosystem, a security breach in access to REDEC does not remain an unfortunate, isolated event. An incident of this kind can leave you facing a genuine regulatory cascade, where a single leak or unauthorized access can simultaneously trigger four enforcement fronts protecting different legal interests:

1. CMF administrative penalty (Law 21.680): For undermining REDEC's operation, confidentiality and security standards.

2. Agencia Nacional de Ciberseguridad penalty (Law 21.663): Because they are classified as Essential Service Providers, and in some cases as Operators of Vital Importance, reporting institutions can face fines from the ANCI for failing to meet the minimum technical standards of resilience and Information Security.

3. Criminal liability of the legal entity (Law 20.393): The extensive catalog of offenses in Law 20.393 now includes the computer crimes defined in Law 21.459. If the unlawful access/interception or forgery results from the absence of management and supervision duties and is carried out for the company's benefit, the company would face heavy fines, publication of the judgment and even a permanent ban on entering into acts and contracts with the State.

4. Agencia Nacional de Protección de Datos penalty (Law 21.719): Although the Law takes effect in December 2026, systems have to be designed for it now (Privacy by Design), because any architecture built today that does not account for data privacy will be obsolete and punishable once enforcement begins.

Digital identity as a cybersecurity measure

How does your institution guarantee that access to the CMF's API has not been compromised by a phishing attack on the employee who runs the queries? How would you prove to an auditor that the information queried was in fact deleted from your servers?

A passive log record is no longer enough. What you need is a system that acts as a strong authentication layer, tying every API access to a verifiable, immutable identity event.

Toward a Resilience Infrastructure

To meet the standard set by NCG N°540, there are three concrete, cross-cutting risk mitigation measures you can implement starting today:

1. Biometric Authentication and Passkeys: Make sure the employee accessing the API is who they claim to be, using biometric factors or passkeys that cannot be intercepted through phishing, meeting the individual traceability the regulation requires.

2. Immutable Management of Technical Evidence: In an audit scenario, traditional audit records (logs) are not enough if they can be altered or deleted. What you need is an infrastructure that guarantees the immutability of the evidence through mechanisms such as trusted timestamping (time-stamping) and cryptographic chaining (hashing). This makes it possible to reconstruct with forensic accuracy who accessed a piece of data, when and why, providing the proof of integrity needed to demonstrate compliance and due diligence before the CMF, the ANCI or the Ministerio Público.

3. Control of Data Exposure: You have to implement automated physical and logical deletion mechanisms that trigger as soon as the purpose of the query has been fulfilled. By guaranteeing that financial information is transitory and is not stored in local repositories, you largely remove the possibility of becoming an HVT.

Conclusion:

The full entry into force of REDEC redefines the standard of responsibility for the financial sector. Faced with this new risk landscape, cybersecurity stops being an operating expense and becomes the first line of defense against a new threat landscape and a penalty regime that, spread across several laws, leaves no room for mistakes.

The new frontier of compliance is not only reporting, consent management and deadlines: it is the technical hardening of access to REDEC and of the data it opens up. That is where regulatory and reputational responsibility is decided today.