New CMF regulation. Goes live in July 2027.
Open Finance System
Law 21.521 and CMF General Rule (NCG) 514
From July 2027, banks, card issuers, insurers and fund managers must share their customers' data. Only with the customer's express consent, and every consent must be provable.
No obligation • We reply within 48 hoursWhat the SFA is
It was created by Title III of Law 21.521 (the Fintech Law, January 4, 2023) and is regulated by NCG 514 (July 3, 2024) and NCG 569 (June 1, 2026), which set the technical standards.
The data still belongs to the customer. What changes is who can ask for it.
What information enters the system
Art. 17, Law 21.521Terms and conditions
Product conditions and service channels. Public, and first in the schedule.
Identification and registration
Identification data for customers and their representatives.
Products and transactions
Contracted terms and transaction history.
Financial portability
Communications for portability under Law 21.236.
Payment initiation
Data needed to order transfers to third parties.
Other data
Other financial information, with the customer's authorization.
Four roles, two ways in
- IPIMandatory
Information Provider Institutions
Banks, card issuers and other CMF-supervised institutions: cooperatives, insurers, fund managers and family allowance funds, among others.
Listing: IPI Roster
- IPCMandatory
Account Provider Institutions
Banks, cooperatives and prepaid issuers that hold accounts payments can be made from.
Listing: IPC Roster
- PSBIVoluntary
Information-Based Service Providers
Use customer data to provide a service: credit assessment, comparison sites, personal finance.
Listing: PSBI Register
- PSIPVoluntary
Payment Initiation Service Providers
Order transfers from the customer's account, on their behalf.
Listing: PSIP Register
One institution can hold several roles: a bank is an IPI and an IPC, and can also be a PSBI.
SFA timeline
- Jan 2023Law 21.521 (Fintech Law)
Published on January 4. Creates the Open Finance System.
- Jul 2024NCG 514
The SFA rule, issued on July 3, without a technical annex.
- Jun 2026NCG 569
Technical Annex No. 3, stricter consent and a new date: July 2027.
- Sep 2026In progressATENA sandbox and Directory
ATENA, the CMF and IDB sandbox, opens on September 30 for testing integrations.
What your organization should be doing now
- Q4 2026Annex No. 4
Pending: the system's costs.
- Jul 2027Go-live
The phased schedule begins, with a 60-day pilot for each API.
- Dec 2027First Group 1 APIs
Banks and issuers publish terms, conditions and channels.
- 2028 to Jan 2029Group 1 complete
Customer data, transactions and payment initiation.
- Mar 2029 to Jan 2030Group 2
Cooperatives, insurers, fund managers and allowance funds.
Built for SFA participants
Banks and card issuers
First on the schedule, with the most consents to manage.
Cooperatives, allowance funds and insurers
The same rules, more time and the option of simplified participation.
Fintechs and PSBIs
Every request needs a consent in force, tied to a service. The IPI cannot charge them for the data (art. 25), except for costs the CMF regulates.
Teams leading implementationLegalComplianceRiskTechnologyDigital product
No consent, no access
Free, informed, express and specific
Through secure digital channels, on a durable medium that proves how and when it was given.
Five things in plain view
Which data, to which institution, for which service, for how long and for what purpose.
A legitimate purpose
A specific purpose, tied to a service. The data requested must match it.
Maximum validity
36 months, or 90 days for scheduled one-off payments. After that, a new consent.
Control panel
Free, to see and revoke. If the customer hasn't visited in a year, they must be reminded.
Revoking stops and deletes
Whoever received the data stops access and deletes it. The change shows in every panel; if it starts at the IPI or IPC, it notifies within 5 minutes.
Five years of evidence
Access records and the status of each consent, available to the CMF.
Consent, step by step
Soyio records each step with date, time, channel and status, ready for the CMF.
In the SFA, consent is the only key. And the CMF will ask to see it.
Participant obligations
- Section I · Perimeter
Register and keep the Directory up to date
Registration with the CMF, with certifications and functional tests. Roles, APIs and certificates kept current in the Participant Directory.
- Sections II and III · Operation and security
Operate by API under FAPI 2.0
APIs are the only channel, with service levels, monitoring and contingency. FAPI 2.0 security (OAuth 2.0 and OpenID Connect, with PAR and mTLS).
- Sections III and IV · Security and information
Manage consent and its evidence
Granting, panel, revocation with deletion and reporting to the CMF. An API event log kept for 5 years.
Who supervises and what is at stake
The CMF supervises every participant, including PSBIs and PSIPs that are not regulated today. If the customer is an individual, Law 21.719 applies too.
- CensureNo fine
A formal reprimand on the record with the CMF.
- FineUp to 100,000 UF
Or 30% of the irregular transaction, or twice the profit. Up to five times for repeat offenses.
- Removal from the systemRevocation or cancellation
Revoked authorizations, or removal from the register for failing the requirements.
Amounts under DL 3.538 (arts. 36 and 37), as raised by Law 21.314.
Two laws, two authorities
| Aspect | Law 21.521 and NCG 514 | Law 21.719 |
|---|---|---|
| What it regulates | Who takes part, how they connect, what is shared and how consent is given. | The processing of personal data, financial data included. |
| Who supervises | The CMF. | The Personal Data Protection Agency, with fines of up to 20,000 UTM. |
| Consent | Purpose, maximum validity and a control panel. | Legal basis, purpose and ARSOPB rights. |
One consent has to hold up before both the CMF and the Agency.
What sets an SFA-ready organization apart?
| Criteria | Traditional management | With Soyio |
|---|---|---|
| Consent | A checkbox or PDF not tied to a service or a purpose | Each consent tied to the authorized service, data, institution and period |
| Validity | No one tracks maximum terms or renewals | Expiry and renewal, with the new authentication on record |
| Revocation | An email to the call center and access cut off by hand | Revocation from the panel, access cut off immediately and a deletion order sent to the systems that received the data |
| Evidence | Scattered across the core system, the CRM and email | A signed record of each consent's date, time, channel and status, kept for 5 years |
| Two laws | One process for the CMF and another for the Agency | One record that proves purpose and legal basis to both |
| Audit | Reactive, once the official request arrives | In real time, by data subject, date, institution or status |
Soyio is the consent layer for the SFA
Your team builds the APIs. Soyio handles the consent that enables them, its evidence and its revocation, with the same record you use for Law 21.719 and REDEC.
The five elements the rule requires, in plain language, with an expiry alert.
View documentationA privacy center to see and revoke, with the annual inactivity notice.
View documentationCuts off access and asks the data recipient to delete it, with a record.
View documentationA timestamp and hash on every event, kept for 5 years and exportable.
View documentationThe consent management reports NCG 569 adds.
View documentation
Access to financial informationRequiredWhat you will share
- Data
- Accounts, balances and transactions
- Institution
- Your bank
- Service
- Credit assessment
- Period
- 12 months
- Purpose
- Creditworthiness assessment
Identity verification at onboarding
If you join as a PSBI or PSIP, verify who the person is before asking for consent.
We are fully aligned and prepared for Data Protection Law 21.719.
SFA frequently asked questions
These are the most common questions about the system. If yours isn't here, let's talk.
REDEC (Law 21.680 and NCG 540) is a debt registry run by the CMF: entities report to it and query it. The SFA (Law 21.521 and NCG 514) is a direct data exchange between participants, by API, without going through a central registry. Both require prior, traceable consent, and the CMF supervises both.
Yes, if it is a bank, a credit card or prepaid card issuer, or one of the supervised institutions the CMF designates: savings and credit cooperatives, insurance companies, fund managers and family allowance funds, among others. If it wants to join the system to offer a service using customer data from other institutions, it comes in through voluntary registration as a PSBI or PSIP.
The system goes live in July 2027. Banks and issuers publish their first APIs 5 months later and complete the rest within up to 18 months. Cooperatives, insurers, fund managers and family allowance funds have between 20 and 30 months from that date.
No. Data on individuals flowing through the SFA is personal data. The CMF supervises the system; the Personal Data Protection Agency supervises the processing. Consent must comply with both laws. See what Law 21.719 requires.
In ATENA, the technology sandbox the CMF launched with the IDB on September 30, 2026. It lets you test integrations, credentials and the connection to the Participant Directory before going live in production.
The SFA goes live in July 2027. Consent has to be ready before then.
Talk to our team about reaching the SFA with consent solved and evidence that holds up before the CMF and the Agency.
Subscribe to our newsletter
Privacy is making headlines
A weekly roundup of privacy, regulation, and technology news that could affect your business.
Subscribe (LinkedIn, opens in a new tab)