Uruguay

UY · URY · Americas

5 regulators · 15 laws & regulations · 7 obligations

Obligation	Timing	Regulator	Arises from	Source
All industries
Do not dismiss or discipline harassment complainants or witnesses	Presumption applies for 180 days after a complaint	MTSS	Ley N° 18.561 — Ley de Acoso Sexual. Prevención y sanción en el ámbito laboral y en las relaciones docente-alumno (Law 18,561 — Sexual Harassment Law. Prevention and sanction in the workplace and in teacher-student relationships)	source
Art. 12 of Ley 18.561 bars dismissal or discipline of the affected worker and witnesses for their involvement. Dismissals or sanctions within 180 days of a complaint are presumed retaliatory unless the employer proves otherwise.
Identify and register beneficial owners with the BCU registry	Deadline Changes reported within 45 days (90 days where non-resident owners are involved)	—	Ley N° 19.484 — Normas de convergencia con los estándares internacionales en transparencia fiscal internacional, prevención y control del lavado de activos y financiamiento del terrorismo (Law 19,484 — Rules converging with international standards on international fiscal transparency and the prevention and control of money laundering and terrorist financing)	source
Art. 23 requires resident entities to identify their beneficial owners, and art. 24 extends this to non-resident entities with a permanent establishment, effective management in Uruguay or assets there above 2,500,000 indexed units. Art. 25 requires issuers of nominative shares to tell the BCU who holds them, and art. 29 requires beneficial owners and the ownership chain to be declared to the BCU registry. Art. 26 requires supporting documents to be kept, and art. 30 requires changes to be reported within 45 days, or 90 days where non-resident owners or chain members are involved.
Notify the URCDP of personal data security breaches	Deadline Within 72 hours of becoming aware	URCDP	Decreto N° 64/020 — Reglamentación de los arts. 37 a 40 de la Ley 19.670 y art. 12 de la Ley 18.331, referente a protección de datos personales (Decree 64/020 — Regulation of arts. 37 to 40 of Law 19,670 and art. 12 of Law 18,331)	source
Art. 4 requires the controller to inform the URCDP within a maximum of 72 hours of learning of the breach, and to tell data subjects in clear language where their rights are significantly affected. The processor must inform the controller immediately. A final report on measures taken is due once the breach is resolved; art. 3 requires steps to limit impact within the first 24 hours.
Prevent and sanction sexual harassment, keep complaints confidential and publicise a policy	—	MTSS	Ley N° 18.561 — Ley de Acoso Sexual. Prevención y sanción en el ámbito laboral y en las relaciones docente-alumno (Law 18,561 — Sexual Harassment Law. Prevention and sanction in the workplace and in teacher-student relationships)	source
Art. 6 of Ley 18.561 requires employers to adopt measures to prevent and sanction sexual harassment, keep complainants' and witnesses' identities and proceedings confidential, protect victims' physical and psychological integrity, and publicise an anti-harassment policy. Art. 5 gives the Inspección General del Trabajo y de la Seguridad Social oversight of compliance.
Banking
Customer due diligence including beneficial owners	At onboarding and ongoing	—	Ley N° 19.574 — Ley Integral contra el Lavado de Activos (Law 19,574 — Comprehensive Law against Money Laundering)	source
Art. 14 requires policies to identify and know clients, including the beneficial owner, and bans anonymous and fictitious-name accounts. Art. 15 requires identity checks from reliable independent sources and sets beneficial ownership at 15% of capital, voting rights or other control. Art. 16 lets entities scale measures by risk under a written risk analysis, requires verification before or during the relationship, and bars starting or continuing a relationship if due diligence cannot be applied. Art. 19 requires enhanced scrutiny of higher-risk situations, including politically exposed persons (defined in art. 20), legal persons with bearer shares and trusts.
Do not retaliate against employees who report breaches to the BCU, and protect their identity	—	—	Ley N° 17.613 — Nueva Ley de Bancos (Law 17,613 — New Banking Law)	source
Art. 3 of Ley 17.613 treats retaliation against employees of BCU-supervised financial intermediaries who report violations of banking laws, decrees, BCU general rules or specific instructions as an infraction, with measures under art. 20 of Decreto-Ley 15.322, and leaves the employer liable under civil and labour law. The existence of the report and the reporter's identity fall under the duty of secrecy (arts. 22 and 23 of Ley 16.696).
Keep AML transaction and customer due diligence records	Retention period 5 years minimum after the relationship ends or the transaction is completed (regulation may extend to 10 years)	—	Ley N° 19.574 — Ley Integral contra el Lavado de Activos (Law 19,574 — Comprehensive Law against Money Laundering)	source
Art. 21 requires obligated entities to keep records that allow individual transactions to be reconstructed and serve as evidence, and to make them available to supervisors and the competent criminal court on request. The minimum is five years after the relationship ends or the occasional transaction is completed, and regulation may extend it to ten years.
No obligations match these filters.