Argentina

Issued on 10 March 2023, it replaced the earlier IT-risk rules for financial entities with a 12-section annex covering technology and security governance, risk management (including third-party and AI-related risk), information security, business continuity, cyber-incident management, software development, third-party relationships and electronic channels. It took effect 180 calendar days after dissemination, and Communication A 8401 of 13 February 2026 supplied replacement pages for the consolidated text.

Signed on 31 May 2023 and published on 2 June 2023, RESGC-2023-963-APN-DIR#CNV replaces the RG 788 annex with guidelines for thematic (SVS+) securities: social, green, sustainable and sustainability-linked bonds, plus gender, blue, orange and transition labels. Notes issued under the regime must follow the guidelines (substituted Art. 132 of the CNV Rules), and ESG mutual funds must hold at least 75% of assets in eligible instruments. It applies from the day after publication (Art. 15).

Requires financial and exchange entities to run a risk-based ML/TF/PF prevention system (Art. 3) with an annually reviewed compliance manual (Art. 9), a principal and an alternate compliance officer (Arts. 10–11) and a risk self-assessment sent to the UIF and BCRA before 30 April each year (Art. 5). Most of Arts. 1–35 were substituted by UIF Resolution 199/2024, Art. 40 on suspicious-report timing was replaced by Resolution 56/2024, and Resolution 78/2025 replaced Art. 37 on transactional profiles and raised the cash thresholds in Arts. 42 and 44 to 40 minimum wages.

Resolution 27/2018 of the Oficina Anticorrupción (1 October 2018, B.O. 4 October 2018) approves, in Annex I, integrity guidelines that companies can use to design the programmes described in Arts. 22 and 23 of Law 27,401. Decree 277/2018 assigned the Oficina Anticorrupción the task of issuing this guidance, and the guidelines are a technical guide, not a binding rule. Section 3.5 treats internal reporting channels as optional and says they should allow confidential or anonymous reports; section 3.6 covers protection of whistleblowers against retaliation, including sanctions for retaliation.

Governs the capital market and the CNV's supervisory powers; it repealed the 1968 Public Offering Law 17,811 and was later amended by the Productive Financing Law 27,440. Art. 117 prohibits manipulation, deception and intervening in public offerings without CNV authorisation, and Art. 132 sets the sanctions the CNV applies, including fines.

Amends the Criminal Code for computer crime: it adds unauthorised access to restricted systems or data (Art. 153 bis), fraud by computer manipulation (Art. 173(16)) and damage to data, programs or systems (Art. 183), and rewrites the offences on electronic correspondence, personal data banks and interruption of communications (Arts. 153, 155, 157 bis, 197). Art. 77 now treats digital documents and signatures as documents. Sanctioned on 4 June 2008 and published on 25 June 2008.

Employers with more than 300 workers must prepare an annual social balance sheet, send it to the union holding personería gremial within 30 days of preparation and deposit a copy with the Ministry of Labour (Art. 25). Art. 26 sets its contents, such as labour costs, staffing and workplace accidents, and the first balance falls due in the year after the threshold is reached (Art. 27).

Creates the UIF (Art. 5) and lists the obliged subjects in Art. 20, among them CNV-registered agents, insurers and virtual asset service providers; the updated text reflects Law 27,739 (B.O. 15 March 2024) and Decree 274/2025 (B.O. 16 April 2025), which substituted Art. 21. Art. 21 now requires customer and beneficial-owner due diligence, reporting of suspicious operations without any delay, confidentiality, compliance officers and ten-year record keeping. Art. 24 sets fines of one to ten times the value of the operations for unreported or late suspicious reports, or 15 to 2,500 modules for other breaches.

Makes processing unlawful without free, express and informed consent unless an exception applies (Art. 5) and requires prior notice to data subjects (Art. 6). Access requests must be answered within ten calendar days (Art. 14) and rectification or deletion carried out within five business days (Art. 16); controllers must take security measures (Art. 9). The AAIP has been the control body since Decree 899/2017.

Covers public, private and mixed entities that habitually intermediate between the supply of and demand for financial resources (Art. 1), and bars them from starting business without prior BCRA authorisation (Art. 7). Art. 19 reserves the law's denominations for authorised entities and bans unauthorised persons from advertising to attract public funds; Art. 41 lists the sanctions, from a call to attention, a warning and fines to disqualification of managers and revocation of the licence.

Brings all insurance and reinsurance activity in Argentina under the law and its control authority, and limits insurance business to authorised companies, cooperatives, mutuals, branches of foreign insurers and public bodies (Arts. 1–2). Arts. 64–67 vest supervision of all insurers in the SSN, an autarchic body, while Art. 58 allows a call to attention, a warning, a fine, suspension for up to three months or revocation of authorisation.