Snap Compliance
Solution Partners Consulting Partners
Contact us

Language

EN ES PT
Start free
Law 21.663 · ANCI · Chile

Law 21.663: bring your cybersecurity duties into your compliance model

The Cybersecurity Framework Law requires banking, financial services and means of payment to prevent, report and resolve incidents, with an early warning to the National CSIRT within three hours. Here is what it requires and how to manage it with controls, assessments and action plans.

See what it requires Talk to a specialist

At a glance

What it regulates

Cybersecurity of essential services

It sets the minimum requirements to prevent, contain, resolve and respond to cybersecurity incidents, and creates the ANCI and the National CSIRT (arts. 1, 10 and 24).

Who must comply

Essential services and operators of vital importance

The essential services listed in article 4 include banking, financial services and means of payment. Operators of vital importance, designated by the ANCI by resolution, also take on the duties of article 8.

Who supervises

ANCI · National CSIRT

The ANCI issues protocols and instructions, designates operators, supervises and sanctions; the National CSIRT receives the reports. If the sector regulator has at least equivalent rules, it supervises instead (art. 37).

In force

1 March 2025

The law has applied since 1 January 2025; the duty to report, the duties of operators of vital importance and the sanctions, since 1 March 2025 (DFL 1-21.663).

Read the official text: Ley 21.663

What it requires

What Law 21.663 requires

Every obliged institution prevents, reports and resolves incidents. Operators of vital importance must also meet the duties of article 8.

Ongoing cybersecurity measures

Apply technological, organisational, physical or informational measures on an ongoing basis to prevent, report and resolve incidents, following the ANCI's protocols and standards and those of the sector regulator (art. 7).

Report to the National CSIRT

Early warning within three hours, second report within 72 —24 if an operator of vital importance sees its essential service affected— and final report within fifteen calendar days of the warning (art. 9 and Decree 295, arts. 9 to 13).

Information security management system

Operators of vital importance implement a continuous system that assesses the likelihood and impact of incidents, and keep a record of its actions (art. 8, letters a and b).

Certified continuity plans

Operational continuity and cybersecurity plans, certified by bodies on the ANCI's register and reviewed at least every two years, plus the certifications the law requires (art. 8, letters c and f, and art. 28).

Exercises and containment

Continuous reviews, exercises, drills and analysis of networks and systems, communicated to the National CSIRT, and timely measures to reduce the impact and spread of an incident (art. 8, letters d and e).

Action plan and notice to those affected

Report the incident action plan to the National CSIRT, adopted within seven calendar days at most, and notify potentially affected parties when the ANCI requires it (art. 8, letter g, and art. 9).

Training and cyber hygiene

Ongoing training, development and education programmes for employees and contractors, including cyber hygiene campaigns (art. 8, letter h).

Cybersecurity delegate

Appoint a cybersecurity delegate who acts as the ANCI's counterpart and reports to directors, managers or senior executives (art. 8, letter i).

Consequences

Infringements and fines

Infringements are minor, serious or very serious (arts. 38 and 39), with fines of up to 5,000, 10,000 and 20,000 UTM, rising to 10,000, 20,000 and 40,000 UTM if the offender is an operator of vital importance (art. 40). Failing to report under article 9 is a serious infringement, and repeating it within a year raises the classification. The fine takes into account, among other factors, the measures the institution had adopted, the severity of the effects and its size and economic capacity. Infringements lapse after three years.

How we help

How Snap Compliance helps

Snap Compliance is not a cybersecurity tool: it does not detect attacks or file reports with the National CSIRT. What it does is bring Law 21.663 into your compliance model. Compliance Agent adds it to your catalogue of applicable regulations and turns it into controls, assessments, KRIs and action plans with owners and follow-up, which can be mapped to other regulatory frameworks. Risk Copilot assesses cybersecurity risks on likelihood-and-impact heat maps, from inherent to residual risk, and its AI suggests mitigating controls. And the ISO/IEC 27001:2022 toolkit provides editable documentation for an information security management system; it is a starting point and does not certify your organisation.

Snap Compliance modules

Corporate Governance Management Risk Management ISO/IEC 27001:2022 toolkit

Other regulations in Chile

Ley 19.913 · UAF

Law 19.913: anti-money laundering compliance in Chile

Ley 20.393 · Ministerio Público

Law 20.393: corporate criminal liability in Chile

Ley 21.719 · Agencia de Protección de Datos Personales

Law 21.719: personal data protection in Chile

All regulations in Chile

Frequently asked questions about Law 21.663

What is Law 21.663 and when did it take effect?
Law 21.663, the Cybersecurity Framework Law, was published on 8 April 2024. It creates the National Cybersecurity Agency (ANCI) and, within it, the National CSIRT (arts. 10 and 24), and sets the duties of essential service providers. Under DFL 1-21.663 it has applied since 1 January 2025, and its articles 5, 8 and 9 and the sanctions in Title VII since 1 March 2025. In Compliance Agent you can add it to your catalogue of applicable regulations.
Who must comply with Law 21.663?
Article 4 applies to essential service providers: State bodies, public service concession holders and private institutions in electricity, fuels, water, telecommunications, digital infrastructure and services, transport, banking, financial services and means of payment, social security, postal services, healthcare and pharmaceuticals. The ANCI may classify other services as essential and designate operators of vital importance, who carry additional duties (arts. 5 and 8). All of them must apply ongoing measures to prevent, report and resolve incidents (art. 7).
Is a bank or a card issuer bound by Law 21.663?
Yes. Banking, financial services and means of payment are essential services under article 4, so they must apply ongoing cybersecurity measures and report their incidents to the National CSIRT. In addition, the ANCI's Exempt Resolution 87 of December 2025 designated banking, financial services and payment institutions as operators of vital importance, based on the CMF's report and criteria such as systemic importance. Those entities also carry the duties of article 8, which Compliance Agent helps organise into controls.
What is an operator of vital importance and how is it designated?
It is an essential service provider —or, in some cases, a private institution that is not one— whose service depends on networks and IT systems and whose disruption would have a significant impact on security, public order or the continuity of essential services (art. 5). The ANCI designates it by reasoned resolution, with reports from sector bodies and a public consultation, and reviews the list at least every three years (art. 6 and Decree 285). The designation can be challenged through the remedies of Law 19.880.
What additional duties do operators of vital importance have?
Article 8 requires a continuous information security management system that assesses likelihood and impact, with a record of its actions; operational continuity and cybersecurity plans, certified and reviewed at least every two years; continuous reviews, exercises and drills; measures to contain incidents; the certifications of article 28; training with cyber hygiene campaigns; and a cybersecurity delegate. Compliance Agent helps turn those duties into controls, assessments and action plans with follow-up.
What are the deadlines for reporting an incident to the National CSIRT?
Under article 9 of Law 21.663 and Decree 295: an early warning within three hours of learning of the incident; a second report within 72 hours, or 24 if an operator of vital importance sees its essential service affected; and a final report within fifteen calendar days of the warning. If the incident has not yet been handled, partial reports are sent every fifteen days. Operators of vital importance also report their action plan, adopted within seven calendar days at most.
Which cybersecurity incidents must be reported?
Those with a significant effect: incidents capable of disrupting the continuity of an essential service, affecting people's physical integrity or health, or affecting systems that hold personal data (art. 27). Decree 295 adds compromises of the integrity, confidentiality or availability of assets and systems, and unauthorised access, even if the service was not affected (art. 3). The number of people affected, duration and geographic reach are weighed. Reports are filed on the ANCI's platform and leave out personal data.
What fines does Law 21.663 provide for?
Infringements are classified as minor, serious and very serious (arts. 38 and 39). Fines reach 5,000, 10,000 and 20,000 UTM respectively, and double that —10,000, 20,000 and 40,000 UTM— if the offender is an operator of vital importance (art. 40). Failing to report an incident under article 9 is a serious infringement. The fine considers, among other factors, how much the institution had done to protect its IT security, and its size and economic capacity. Risk Copilot helps size those risks.
Who supervises Law 21.663 in the financial sector: the ANCI or the CMF?
As a rule, the ANCI: it supervises, may carry out inspections and order audits, and sanctions (arts. 11 and 37). But if the sector authority has issued cybersecurity rules with effects at least equivalent to the ANCI's, that authority supervises and sanctions under its own procedure (arts. 26 and 37). In banking, chapter 20-10 of the CMF's RAN governs information security and cybersecurity management. Compliance Agent lets you map controls across regulatory frameworks and assess both.
Is ISO 27001 certification enough to comply with Law 21.663?
Not necessarily. The law does not name ISO/IEC 27001: it requires operators of vital importance to have a continuous information security management system (art. 8) and the certifications that the law and the ANCI determine, issued by certifiers on its register; the ANCI may recognise international certifications (art. 28). The standard is a good basis for that system, but it does not replace reporting or certified plans. Snap's ISO/IEC 27001:2022 toolkit provides its editable documentation; it does not certify.

Would your program withstand a supervisor's review today?

We review with you where your institution stands against these rules and what it still needs to demonstrate compliance.

Talk to a specialist

Free self-assessment · Chile

How ready is your organization for Chile's Law No. 21.719?

Answer the questions that apply to your organization and see its blocking findings, its gaps by domain and its estimated exposure, with an action plan in Word. Available in Spanish.

16 domains · 45 to 90 minutes · save and resume 46 days until enforcement

Start the self-assessment (in Spanish)