Corporate Compliance

Law No. 20,393 (Ley N° 20.393) establishes the criminal liability of legal entities and allows that liability to be exempted or mitigated when the company has implemented an effective crime prevention model. Law No. 21,595 (Ley N° 21.595), on economic crimes, significantly broadened the catalog of offenses that can be attributed to the company, which makes the model relevant for organizations of every size, not only large ones. More than a document, the model must be operational and traceable: a risk matrix, a prevention officer, a whistleblowing channel, training, and controls applied in day-to-day operations. Assessing whether your company needs one is today a risk management decision, not merely a matter of formal compliance.

Law No. 21,595 (Ley N° 21.595) reorganized and toughened the treatment of economic crimes and environmental offenses, established its own penalty regime, and substantially expanded the catalog of offenses that can give rise to criminal liability of legal entities under Law No. 20,393 (Ley N° 20.393). Its entry into force is staggered. In practice, this means that many conducts in a company’s everyday operations now fall within the scope of criminal risk, so prevention models must be reviewed and updated to cover the new catalog. Ignoring this change leaves the company exposed to penalties that previously did not reach it.

Law No. 21,719 (Ley N° 21.719) modernizes the protection of personal data, creates the Personal Data Protection Agency (Agencia de Protección de Datos Personales), and enters into full force on December 1, 2026. Companies that process data will need a lawful basis for each processing activity, keep a record of processing activities, carry out impact assessments where applicable, sign contracts with their data processors, notify security breaches, and, in certain cases, appoint a data protection officer. Fines can be high. It is wise to use the time before the law takes effect to diagnose the company’s situation and bring its processes into line before the deadline.

Law No. 21,643 (Ley N° 21.643) requires every company to incorporate into its internal regulations a prevention protocol covering workplace harassment, sexual harassment, and violence at work, to set up a reporting channel, and to conduct investigations with due process, confidentiality, and defined deadlines, in addition to adopting protective measures for the affected person. From a compliance perspective, this means documenting the protocol, training managers, keeping a record of complaints, and being able to show that the company acted in accordance with the law. Merely nominal compliance offers no protection: in an inspection or a lawsuit, what is assessed is the effective application of the protocol.

The whistleblowing channel is a mechanism that allows employees and third parties to report irregular conduct safely and confidentially, such as acts that may constitute a crime, internal fraud, or harassment situations. It is a central component of the prevention model under Law No. 20,393 (Ley N° 20.393) and of the duties imposed by Law No. 21,643 (Ley N° 21.643), and it must guarantee the whistleblower’s confidentiality and the prohibition of retaliation. Beyond the legal requirement, a well-managed channel makes it possible to detect and correct problems in time, before they escalate into penalties or a court dispute. Its value depends on complaints being investigated and resolved seriously.

Without an effective prevention model, the company is more exposed to the criminal liability of legal entities under Law No. 20,393 (Ley N° 20.393), expanded by Law No. 21,595 (Ley N° 21.595) on economic crimes. That liability can translate into fines, asset forfeiture, bans on contracting with the State and even, in serious cases, the dissolution of the legal entity. Added to this are the reputational effects and the loss of the ability to invoke the model as an exempting or mitigating circumstance. An operational and traceable model not only reduces criminal risk: it also brings order to management and facilitates commercial relationships that increasingly demand compliance standards.