CMF cybersecurity rules: test your mobile banking app before and after every release.
Chapter 20-10 of the CMF's Recopilación Actualizada de Normas (RAN) asks banks to run security tests on their technology infrastructure, including pentesting and ethical hacking, and to report the results to the board at least every six months. Chapter 20-7 extends vulnerability assessments and penetration tests to critical outsourced services and cloud providers. Law 21.663 sets the national cybersecurity framework, and the CMF's standard for payment operations makes strong customer authentication mandatory in the app. Ostorlab tests your app and the APIs behind it, behind login, on every release.
- Covers the mobile app and the APIs it calls, on the build your customers download
- Tests login, one-time codes, step-up checks and payment flows with your test accounts
- Lists the SDKs and native libraries in each release and maps them to known vulnerabilities
- Proves each finding with a replayable exploit or request and response evidence
- Who it applies to
- Banks and other CMF-supervised entities covered by the chapter, including card issuers and payment card operators, and essential services under Law 21.663, including banking, financial services and payment means
- Key date
- Chapter 20-10 in force since 1 December 2020; strong customer authentication mandatory since 1 August 2026; personal data law in force 1 December 2026
- Focus
- Security testing, outsourcing and cloud risk, strong customer authentication and personal data protection
- Main reference
- CMF Recopilación Actualizada de Normas (RAN), Chapter 20-10
The Chilean texts behind your mobile channel
The CMF chapters sit alongside the cybersecurity framework law and the laws on payment fraud and personal data. The dates below are for the texts cited on this page.
- 29 May 2020
Ley 21.234 on payment fraud
A new liability regime for cards and electronic transactions takes effect. Users can limit their responsibility for unauthorised use, and issuers must block the payment means and restore funds within set deadlines.
- 1 December 2020
RAN Chapter 20-10
CMF Circular N° 2.261 of 6 July 2020 brings the information security and cybersecurity chapter into force: board-approved policies, a risk management process, security testing such as pentesting and ethical hacking, and six-monthly reporting of the results to the board.
- 8 April 2024
Cybersecurity Framework Law
Ley 21.663 is published. It creates the National Cybersecurity Agency (ANCI), sets general duties to prevent, report and resolve incidents, and classifies banking, financial services and payment means as essential services.
- 30 May 2024
Fraud law amended
Ley 21.673 tightens the restitution procedure of the fraud law and empowers the CMF to define when issuers must use strong customer authentication (autenticación reforzada de cliente).
- 13 December 2024
Ley 21.719 on personal data
Published, with entry into force on 1 December 2026. It requires data protection by design, security measures, impact assessments and breach reporting to the new Personal Data Protection Agency.
- 1 March 2025
Incident reporting and sanctions in force
The duties for Operators of Vital Importance, the incident reporting obligation and the sanctions regime of Law 21.663 take effect. Significant incidents go to the CSIRT Nacional, with an early alert within three hours.
- 17 June 2025
CMF authentication standard
Norma de Carácter General N° 538 sets minimum security, logging and authentication standards and the mandatory cases for strong customer authentication. It is amended by NCG N° 568 on 1 June 2026, and the mandatory cases apply from 1 August 2026.
- April 2026
Draft update to Chapter 20-7
The CMF puts a draft update of the outsourcing chapter and a new outsourced-services reporting file out for comment. The 2014 chapter, as amended in 2019, remains in force.
The Chilean rules, applied to your mobile app
For each rule: what the text says, what it means for a mobile banking app, how Ostorlab helps, and what stays with your team. CMF chapters are summarised from the Spanish texts.
- RAN Chapter 20-10, numeral 4.1 (Spanish text)
Test your security, with pentesting and ethical hacking
What the text says
The entity must carry out security tests on its technology infrastructure regularly, with sufficient scope and depth, to detect threats and vulnerabilities, such as pentesting and/or ethical hacking. The results are managed by the responsible areas and communicated to the board at least every six months, with the analyses and the agreed actions recorded in the minutes. The attack vectors to identify and evaluate include manipulation or interception of communications, phishing, malware, privilege escalation, code injection and denial of service.
What it means for your mobile app
This is the clause that names pentesting. Your mobile app and the APIs it calls are part of the infrastructure, and the board has to see the results twice a year.
How Ostorlab helps
An AI-agent pentest tests the app and its APIs behind login, on the build you ship, with a working exploit you can replay for each AI-agent finding. Findings are rated critical, high, medium or low, tracked as tickets and retested once the fix ships.
What stays with you
Server and network testing, the internal report to the board, and remediation decisions.
- RAN Chapter 20-10, numeral 4.1; RAN Chapter 1-13, numeral 3.2 c) (Spanish text)
Keep patching and component management under control
What the text says
The entity must have a patch management programme so that patches are applied to software and firmware in a timely manner, a change management process that keeps infrastructure changes controlled and monitored, and an obsolescence process that keeps security standards appropriate to the entity's objectives. Chapter 1-13 also expects long-term technology planning with patch policies in place.
Source:RAN Chapter 20-10, numeral 4.1; RAN Chapter 1-13, numeral 3.2 c) (Spanish text)
What it means for your mobile app
The SDKs and native libraries in your app are software you ship. Each one needs a known version, a severity when a vulnerability appears, and a fix deadline you can prove.
How Ostorlab helps
SCA fingerprints statically compiled libraries and maps them to known vulnerabilities, release to release. Findings are rated critical, high, medium or low and tracked as tickets in the platform or in Jira and ServiceNow.
What stays with you
Patching servers and infrastructure, firmware updates and vendor maintenance contracts.
- RAN Chapter 20-10, numeral 4.1 (Spanish text)
Protect the electronic channels and their credentials
What the text says
Electronic channels used by customers must have appropriate access controls to mitigate, among other risks, impersonation or misuse of products and services by third parties. Identity and access management must cover privileged users and access to networks, operating systems, databases and business applications. The entity must also define which information has to be protected with encryption, the authorised cryptographic algorithms, and the controls used for transmission and storage.
What it means for your mobile app
API keys and tokens left in the app package are credentials anyone can extract. Authorisation between the app, the backend and external identity services has to hold at every boundary.
How Ostorlab helps
Ostorlab finds API keys, tokens and credentials in the app package and validates whether they work. It intercepts the app's traffic, even with TLS pinning, and tests the APIs for broken authorization (BOLA, BFLA, IDOR) and misuse of tokens and sessions.
What stays with you
Privileged account management, access reviews and physical access controls.
- RAN Chapter 20-10, numeral 4.1 (Spanish text)
Harden the app and check it on compromised devices
What the text says
The controls the entity puts in place must mitigate the risks that come from mobile devices, remote work and IoT devices, and the risks from the acquisition, integration or development of applications and systems and from putting them into production. The attack vectors to identify and evaluate include manipulation or interception of communications, code injection and privilege escalation.
What it means for your mobile app
Root and jailbreak detection, anti-tampering and pinning are the app-level controls behind this clause, and each one can be tested against the build customers download.
How Ostorlab helps
Mobile Shielding Scan runs the app in rooted and jailbroken environments, attempts to bypass root and jailbreak detection, anti-tampering and TLS pinning, and shows what the app does next. You get a hardening score and bypass evidence.
What stays with you
Choosing and configuring your shielding product, mobile device management and the remote work policy.
- RAN Chapter 20-7, numerals III.4, IV.1 b) and V (Spanish text)
Manage outsourcing and cloud providers
What the text says
The entity must make sure its provider keeps an information security programme that ensures confidentiality, integrity, traceability and availability of its own and its customers' information assets, consistent with the entity's policies. It must control and monitor the provider's security infrastructure and identity and access management for critical outsourced services, and for those critical services it must control that the provider carries out vulnerability assessments and penetration tests of its technology infrastructure regularly. Cloud services bring reinforced due diligence: the board pronounces annually on cloud risk tolerance, and critical or strategic cloud services require internationally recognised certifications, independent audit reports, legal analysis of the jurisdictions involved and isolation mechanisms. Critical processing abroad also requires a contingency data processing centre in Chile, unless the board-approved exception applies.
Source:RAN Chapter 20-7, numerals III.4, IV.1 b) and V (Spanish text)
What it means for your mobile app
Mobile apps bundle third-party SDKs that talk to their own backends, and payment backends often run in the cloud. Their security testing evidence belongs in your provider files.
How Ostorlab helps
Ostorlab lists the SDKs and native libraries in each release with their versions and their location in the app bundle, and shows what the app and its SDKs exchange with backends over the network. API testing covers the vendor backends you point it at.
What stays with you
Contracts, due diligence files, the annual board pronouncement on cloud risk and provider audits.
- RAN Chapter 1-13, numerals 3.2 c) and 5 (Spanish text)
Meet the management evaluation expectations
What the text says
In its management and solvency classification, the CMF evaluates the board's strategy for operational risk, the definition of information assets including those exposed in cyberspace, policies for activities handed to third parties with verifications and monitoring, technology and patch planning, continuity and contingency plans with periodic tests, and the independence of internal audit. For information security and cybersecurity it considers Chapter 20-10 directly. The bank's own administration must also analyse and pronounce on its management at least once a year, and present the result to the board.
Source:RAN Chapter 1-13, numerals 3.2 c) and 5 (Spanish text)
What it means for your mobile app
Nothing in this chapter asks for a specific tool. It asks for evidence that the controls around your mobile channel are owned, tested and reported.
How Ostorlab helps
Ostorlab gives you repeatable scan results per build and per release, with tickets and retest histories you can attach to internal reports. It does not replace governance, internal audit or the board's own review.
What stays with you
Governance, the three lines of defence, internal audit and the annual self-evaluation.
- Ley 20.009 as amended by Ley 21.234 and Ley 21.673; CMF NCG N° 538 as amended by NCG N° 568 (Spanish text)
Enforce strong customer authentication on payments
What the text says
Under the fraud law, as amended in 2024, the CMF defines the transactions that require strong customer authentication (autenticación reforzada de cliente, ARC). NCG N° 538, as amended by NCG N° 568, requires ARC based on at least two independent factors of different categories, mandatory for electronic fund transfers, including recipient data and recurring payments, customer onboarding into digital platforms, incorporation or modification of personal data, changes to authentication keys, and enrolment, replacement or removal of a trusted device. Issuers must keep auditable and traceable records of all transactions and authentication events, including failed attempts with error codes, monitor transaction patterns continuously, protect and expire authentication codes, and have tamper or cloning detection on authentication devices. Printed data sets for authentication had to be eliminated by 1 August 2026.
What it means for your mobile app
These are behaviours in the app and its APIs: OTP and biometric steps, device enrolment, changes to contact data, and the calls that could skip a step. The server has to enforce them.
How Ostorlab helps
Authenticated testing covers login and logout, token refresh, timeouts, session invalidation and MFA enforcement, including step-up flows, together with the API calls behind transfers, recipient changes and device enrolment. Ostorlab completes SMS, email or TOTP one-time codes with your test accounts.
What stays with you
Choosing authentication methods, the exemption policy for vulnerable customer groups, and the six-monthly report to the CMF if you use the exception.
- Ley 21.719, articles 14 quáter, 14 quinquies, 14 sexies and 15 ter (Spanish text)
Protect personal data in the app and report breaches
What the text says
Ley 21.719, in force from 1 December 2026, requires data protection by design and by default, and security measures that ensure the confidentiality, integrity, availability and resilience of processing systems, including pseudonymisation and encryption where appropriate and regular verification of their effectiveness. Breaches that pose a reasonable risk must be reported to the Personal Data Protection Agency without undue delay, and where they involve sensitive data or financial, banking or commercial data, also to the affected data subjects. Processing likely to produce a high risk requires a data protection impact assessment before it starts, and biometric data used to identify a person is sensitive data.
Source:Ley 21.719, articles 14 quáter, 14 quinquies, 14 sexies and 15 ter (Spanish text)
What it means for your mobile app
Payment credentials, biometrics, balances and transaction histories are exactly the data categories named. What the app and its SDKs store, log or send is part of the evidence.
How Ostorlab helps
Ostorlab looks for tokens and personal data in local storage, caches, logs and screenshots, checks transport protections, and shows what the app and its SDKs exchange with backends. It does not run impact assessments or file breach notifications.
What stays with you
The impact assessment, records of processing, the data protection officer and breach notifications to the Agency and to customers.
- Ley 21.663, articles 4, 7, 8 and 9, duties in force from 1 March 2025 (Spanish text)
Prepare for incidents alongside Law 21.663
What the text says
Under the Cybersecurity Framework Law, entities providing essential services, including banking, financial services and payment means, must permanently apply measures to prevent, report and resolve cybersecurity incidents. Operators of Vital Importance must keep a continuous information security management system, certify and periodically review continuity and cybersecurity plans at least every two years, run continuous review and exercise activity, and designate a cybersecurity delegate. Significant incidents are reported to the CSIRT Nacional: an early alert within three hours of knowledge of the event, and an update within 72 hours, or 24 hours when an Operator of Vital Importance has its essential service affected.
Source:Ley 21.663, articles 4, 7, 8 and 9, duties in force from 1 March 2025 (Spanish text)
What it means for your mobile app
Incident detection, response and reporting stay with you. What you can prepare is the app and API side: fewer open findings, evidence that they are fixed, and a retest you can show after an incident.
How Ostorlab helps
Ostorlab does not run a SOC and does not report incidents to the CSIRT. It tests the controls in the app and its APIs, tracks findings to closure and retests them, so the app side of your incident plan rests on current evidence.
What stays with you
SOC and monitoring, incident response and the reports to CSIRT Nacional, exercises and the cybersecurity delegate.
Summary of public CMF and Chilean legal texts, checked on 27 September 2026. CMF chapters are summarised from the Spanish texts. The April 2026 draft update of Chapter 20-7 was not in force at this check and is not quoted here. This page is not legal advice.
Chilean rules, control by control
The controls the Chilean texts point to, how Ostorlab tests them in your app and its APIs, and the evidence you can keep.
| Control | How Ostorlab helps | Evidence you keep |
|---|---|---|
| Regular security testing, including pentesting and ethical hackingRAN 20-10, 4.1 | AI-agent pentest of the app and its APIs, behind login, on the build you ship. Details | A working exploit you can replay for each AI-agent finding, and a coverage heatmap |
| Electronic channel access controls, tokens and impersonationRAN 20-10, 4.1 | Intercepts traffic even with TLS pinning and tests authorization, token misuse and account flows. Details | Request and response evidence for each API finding |
| Patch management and fix deadlinesRAN 20-10, 4.1 | Fingerprints statically compiled libraries and maps them to known vulnerabilities, release to release. Details | Mapped vulnerabilities with upgrade or replace recommendations, and closure tracked across releases |
| Component inventory for each releaseRAN 20-10, 4.1; RAN 20-7, III.4 | Lists the SDKs and native libraries in each release with their versions, and shows which backends the app and its SDKs talk to. Details | Component identity, version and location in the app bundle, per release |
| Secrets and credentials in the app packageRAN 20-10, 4.1 | Finds API keys, tokens and credentials in the app package and validates whether they work. Details | Validated secrets, with the permissions and services they expose |
| Strong customer authentication on transfers and device changesNCG 538, as amended by NCG 568 | Logs in with one-time codes and tests MFA enforcement and step-up flows, and the API calls behind them. Details | Findings on login, transfer and device enrolment flows, with reproduction steps |
| Root, jailbreak and tamper protectionsRAN 20-10, 4.1 | Runs the app in rooted and jailbroken environments and attempts to bypass detection, tampering and pinning. Details | Hardening score, and bypass evidence for each protection that failed |
| Session and one-time code handlingNCG 538; RAN 20-10, 4.1 | Tests login and logout, token refresh, timeouts, session invalidation and code expiry. Details | Session and token findings, with request and response logs |
| Data protection on the device and in transitRAN 20-10, 4.1; Ley 21.719, art. 14 quinquies | Looks for tokens and personal data in storage, caches, logs and screenshots, and checks transport protections. Details | File system evidence showing what was written, where and when |
| Outsourced and cloud service testing evidenceRAN 20-7, III.4 and V | Tests the app and the vendor APIs you point it at, and keeps SDK and network evidence per release. Details | Scan results per release and per provider integration |
Ostorlab tests controls in the app and its APIs. SOC monitoring, incident response and reporting to the CSIRT Nacional, TLPT, governance, the annual cloud risk pronouncement and physical security stay with your teams.
Chilean controls to test in your mobile app
A practical list for security and technology risk teams, based on the CMF chapters, the authentication standard and the data protection law.
Security test scope
Put the mobile app and the APIs it calls in the scope of your Chapter 20-10 security tests, with a pre-release step and a regular cadence.
Six-monthly evidence
Keep the pentest and ethical hacking results, the analyses and the agreed actions ready for the board at least every six months.
Components and deadlines
Keep a versioned list of the SDKs and libraries in each release, and set fix deadlines by severity.
Cloud and provider files
Refresh the annual board pronouncement on cloud risk, and hold certification, audit and penetration test evidence from critical providers.
ARC in the payment flows
Verify that transfers, recipient changes, recurring payments, personal data changes and trusted device enrolment all require two independent factors, enforced by the server.
Data on the device
Check the app package and the device for API keys, tokens and personal data in storage, caches, logs and screenshots.
Impact assessment inputs
Map what the app and its SDKs collect and send, and use it in the data protection impact assessments due before 1 December 2026.
Report and retest
Track findings to closure, retest after each fix, and keep the retest results as evidence for incident and audit files.
A suggested list, not a CMF template. This is not legal advice.
The capabilities behind this page
Each one has its own page with the details.
- Mobile Agentic Deep ScanAI agents pentest the store build on every release, with a working exploit you can replay for each AI-agent finding.Learn more
- Authenticated testingTest login, one-time codes and step-up flows with your test accounts.Learn more
- API and backend testingIntercept app traffic even with TLS pinning, then test the APIs and backends behind accounts and payments.Learn more
- Mobile SASTBinary-based static analysis of APK, AAB and IPA files, with taint analysis across the app and its embedded SDKs.Learn more
- SCA and SBOMFind vulnerable dependencies, including statically compiled native libraries, and track their closure release after release.Learn more
- Mobile Shielding ScanTest root and jailbreak detection, anti-tampering and pinning at runtime, and see which protections held and which were bypassed.Learn more
- Bring your own AI keyRun AI-agent scans on your own AI provider key with a spend cap per scan, so usage follows your internal policies.Learn more
- On-premises scanningScan staging apps, APIs and repositories behind your firewall or VPN, on infrastructure you control.Learn more
Trusted by banks and fintechs, including
Sources
The official texts this page is based on, checked on 27 September 2026.
- Recopilación Actualizada de Normas (RAN), Chapter 20-10: Gestión de Seguridad de la Información y CiberseguridadCMF, Circular N° 2.261 of 6 July 2020, approved by Resolución N° 3255, in force from 1 December 2020. Security testing, patch management, electronic channel controls and incident readiness. Spanish text
- Recopilación Actualizada de Normas (RAN), Chapter 20-7: Externalización de ServiciosCMF, Circular N° 3.570 of 7 October 2014, with the update by Circular N° 2.244 of 23 December 2019. Provider security programmes, vulnerability assessments and penetration tests of critical outsourced services, and reinforced due diligence for cloud services. A draft update was out for comment in April 2026 and was not in force at this check. Spanish text
- Recopilación Actualizada de Normas (RAN), Chapter 1-13: Clasificación de gestión y solvenciaCMF, consolidated text with Circular N° 2.373 of 14 July 2026. The management evaluation of banks, including operational risk, information assets, activities handed to third parties, patch planning and internal audit, and the annual self-evaluation. Spanish text
- Ley 21.663, Ley Marco de CiberseguridadPublished in the Diario Oficial on 8 April 2024; duties for Operators of Vital Importance, incident reporting and sanctions in force from 1 March 2025. Banking, financial services and payment means are essential services. Spanish text
- Decreto N° 295, Reglamento de reporte de incidentes de ciberseguridadMinistry of the Interior and Public Security, published 1 March 2025. The reporting regulation under Law 21.663, with the content of the incident reports to the CSIRT Nacional. Spanish text
- Ley 21.234 and Ley 21.673: responsabilidad por uso no autorizado de medios de pagoLey 21.234, published 29 May 2020, sets the liability regime for cards and electronic transactions. Ley 21.673, published 30 May 2024, amends it and requires the CMF to define the cases for strong customer authentication. Spanish text
- CMF Norma de Carácter General N° 538, as amended by N° 568CMF, NCG N° 538 of 17 June 2025 on security and authentication standards for operations under Ley 20.009, amended by NCG N° 568 of 1 June 2026. The mandatory strong customer authentication cases apply from 1 August 2026. Spanish text
- Ley 21.719: protección y tratamiento de los datos personalesPublished 13 December 2024, in force from 1 December 2026. Data protection by design, security measures, impact assessments and breach reporting to the new Personal Data Protection Agency. Spanish text
Frequently asked questions
Straight answers on coverage, setup, and how results reach your team.
Can't find your answer? Book a demo or contact us.
Test your mobile banking app against the Chilean rules
Start with a free scan of your app from the store, or book a demo to run logged-in tests of your app and APIs with our team.