meta_id 3495591

On September 14, 2026, the Financial Markets Commission (CMF) published the final version of regulations strengthening the consent management system for reporters of the Consolidated Debt Registry (REDEC), established through General Norm N°540. The regulation aims to enhance debtor protection, promote best practices among reporters, and facilitate CMF supervision. Key adjustments incorporated feedback addressing technological aspects, implementation timelines, and reporting requirements. Major provisions include: Implementation is phased to allow reporting entities adequate time to adapt. Consent preservation: Reporting entities must store digitalized consents using mechanisms that guarantee confidentiality, integrity, authenticity, fidelity, and long-term verifiability. This replaces the previously consulted requirement for a SHA-256 encrypted hash code, adopting instead a principles-based, technologically neutral approach to reduce implementation costs. Debtor notification: Reporting entities must notify debtors when consent is granted or revoked, including the date, time, channel, and internal consent code, improving transparency and traceability throughout the consent lifecycle. Digitalized consent and internal coding: A Technical Annex defines the required formats for digitalized consents and requires the assignment of an internal code for each consent for effective traceability throughout the duration of the reportable obligation. Exemption regime: Entities that, by virtue of their business model, choose not to access debtor information subject to consent are exempt from the associated consent management requirements. API framework: Three APIs are established to operationalize the interaction between reporting entities and the CMF: API 1 for querying REDEC debtor information (currently in production); API 2 for CMF requests for digitalized consents from reporting entities; and API 3 for reporting entities to transmit digitalized consents to the CMF. Revocation of third-party authorizations: Debtors may revoke authorizations granted to third parties before the expiry of the access period via the CMF's Know Your Debt platform. Implementation will be done in a gradual manner: The requirements to notify the debtor set forth in sections 7.1 and 7.4 of NCG No. 540 are effective one month after the publication of the regulation (October 14, 2026). The requirement regarding the use of the consent APIs specified in 7.2 of NCG No. 540 is effective as of the third month following the publication of the regulation (December 14, 2026). The submission of regulatory files RDC01 and RDC02 containing the amendments to Section III of the regulation will be required starting with the report that must be submitted with information for the third month following the publication of the regulation (December 14, 2026). The submission of regulatory files RDC30 and RDC31 containing the indicated amendments will be required starting with the report that must be submitted with information for the month following the publication of the regulation (October 2026). .