What a supervised financial institution needs to handle electronic fraud claims under Ley 10.889 and to back the controls of SUGEF Regulation 5-26 before SUGEF: the emergency protocol, the procedures, the policies, the claim form, the dashboards and the traceability of every control. Twenty-two Word and Excel files, in Spanish. Every obligation cites the article that requires it.
22
files
8
Sections
7
Excel
The Implementation guide (G.1) is the entry document. It orders the 22 files in five stages —first the protocol, the claims procedure, the form and the deadline dashboard, because the deadlines are already running— and says which ones your legal team should review first. If you only read one file before handing out the rest, make it that one.
The questions a compliance officer asks when a claim comes in, and the ones that are settled once, with the file and section that answer them.
| I am looking for… | File | Exact location |
|---|---|---|
| What to do in the first minutes when a customer says they are being defrauded | Emergency and fraud victim support protocol L10889-4.3 | Section 4: eight immediate-response steps, each with its legal basis |
| What to give the customer on receiving the claim | Procedure for handling claims for unauthorised transactions L10889-4.1 | Section 4: receipt code, immediate blocking and contingency alternative |
| Which form to give the customer to file a claim | Claim form for unauthorised transactions L10889-4.2 | Sections A to H, with the data protection notice of Ley 8968 |
| When a claim's deadline expires and when to give notice of the extension | Claims deadline dashboard L10889-8.1 | «Reclamos» sheet: deadlines calculated from the filing date |
| In what order a claim is investigated | Procedure for handling claims for unauthorised transactions L10889-4.1 | Section 6: first the institution's controls and systems, then the customer's conduct |
| When I can reject a claim and with what evidence | Procedure for rejecting a claim and referring it to SUGEF and the OIJ L10889-4.4 | Sections 1 and 2: the prerequisite and the three grounds |
| What to send SUGEF when I reject a claim | Procedure for rejecting a claim and referring it to SUGEF and the OIJ L10889-4.4 | Section 5: Annex 1 checklist and model referral letter |
| Below what amount I refund without investigating | Below-threshold refund policy L10889-3.2 | Sections 2 and 3: the rule and the components of the cost-benefit analysis |
| How to calculate that threshold | Refund threshold cost-benefit analysis L10889-6.2 | «Cálculo» sheet: cost of investigating versus what would be overpaid |
| What the Board has to approve | Model Board resolution L10889-7.1 | Recitals and five resolutions, ready for the minutes |
| What the monitoring of atypical transactions must consider | Transaction monitoring and preventive blocking policy L10889-3.4 | Section 2: the eight factors of the multifactor analysis |
| Where two-factor authentication is required and which actions are risky | Authentication and information protection policy L10889-3.3 | Section 1: login, risky actions and self-service |
| What to notify the customer and how fast | Customer notification procedure L10889-4.5 | Section 1: transactions and security events, in under a minute |
| What data to record for each fraud case | Statistical case record and typology catalogue L10889-2.2 | «Casos» sheet: the nine minimum data points of art. 4 of the regulation |
| Which channels receive claims and which have gaps | Inventory of claim channels and digital channels L10889-2.1 | Channel sheets and a «Brechas» sheet that calculates itself |
| How to assess fraud risk by channel | Fraud risk assessment by channel L10889-6.1 | «Evaluación» sheet: inherent risk, controls and residual risk |
| How to train staff on the protocol | Emergency protocol training plan L10889-7.2 | Section 2: audience, content, format and frequency |
| What the institution must teach its customers | Digital cyber-hygiene education programme L10889-3.5 | Section 3: the eight minimum contents of art. 5 of the regulation |
| What to do when a court finds an account was used for fraud | Procedure for reporting accounts used in fraud L10889-4.6 | Section 2: four steps, only with a final court ruling |
| What is pending from SUGEF or may change | Regulatory and monitoring log L10889-8.2 | «Vigilancia» sheet: delegated matters and the action against art. 3 |
| Which document closes each self-assessment control | Catalogue and traceability matrix L10889-C.1 | «Trazabilidad» sheet: the 87 controls with their file |
| Where to start | Implementation guide L10889-G.1 | Suggested order in five stages |
The twenty-two files, with their code, their format and what each one contains. The Word files bring the obligation, the literal citation of the law and the fields your institution completes; the Excel files calculate: deadlines, gaps, residual risk and the refund threshold.
1 file
Explains the self-assessment instrument for Ley 10.889 and SUGEF Regulation 5-26: its 11 profile questions and 84 mandatory controls in ten domains, who answers each question, what effect each answer has and how to read the conformity, certainty and evidence indices. It also states what it does not calculate: fines.
2 files
Brings together the channels where claims are received and the digital channels, with what the law and the regulation require of each: 24/7 availability, recording of time and channel, self-blocking, two-factor authentication and notification in under a minute. A gaps sheet counts what is missing.
Records each fraud case with the nine minimum data points of art. 4 of SUGEF Regulation 5-26 and calculates the statistical analysis by typology that the same article requires. It includes a typology catalogue to adjust. The format for reporting to SUGEF is provisional: SUGEF has not defined it yet.
5 files
The governance document for fraud risk in digital channels: purpose, channels covered, risk assessment with the business units and control functions, when it is updated, lines of action and governance. It brings controls, customer education and statistical information under a single Board decision.
Sets the amount below which the institution refunds what was taken without a detailed investigation (Ley 10.889, art. 13), with the components of the cost-benefit analysis and the rule for referrals to SUGEF. The threshold is stated in every referral, so SUGEF will be able to compare it across institutions.
Strong authentication at login, in risky actions and in self-service; a review of the factors the customer could pass on to a third party; and the five protection mechanisms of art. 14 of the regulation. It is also the source of the two-factor log that Annex 1 requires to reject a claim.
Documents the preventive, detective and corrective controls, the eight factors of the multifactor analysis (art. 12 of the regulation), the parameters to approve or decline transactions, prior confirmation of atypical ones and preventive blocking of funds (art. 17). It is the institution's core evidence when a customer files a claim.
The permanent programme for customers: the eight minimum contents of art. 5 of the regulation —from SIM swapping to fake links, calls and emails—, the institution's own campaigns and how to explain to customers that they claim with the form and the OIJ complaint.
6 files
The core procedure of the law: 24-hour receiving channels, receipt and immediate blocking, deadlines, a two-stage investigation —first the institution's controls and systems, then the customer's conduct—, resolution, refund, compensation, the 120-day limit, below-threshold refunds and claims pending on 22 April 2026. It opens with the three common mistakes it avoids.
The simple form required by art. 3 of the law, in eight sections: for the institution's use (code, time, channel and blocking), claimant details, product, transactions not recognised, what happened in their own words, OIJ complaint, their deadlines and rights, and the data protection notice of Ley 8968.
The response in the first minutes when someone reports they have been defrauded or are at immediate risk: when it is triggered, who applies it —all staff—, its principles, eight immediate-response steps with their legal basis, alignment with the regulation's controls, training and the annual update with SUGEF authorisation.
How to reject a claim with evidence: the prerequisite of showing the controls were met, the three grounds with the evidence each requires, the content of the rejection decision, the copy to the OIJ and SUGEF, the Annex 1 checklist and a model referral letter. It covers the effect of Circular SGF-OFC-0831-2026.
What is notified to the customer and how fast —transactions and security events, in under a minute—, through which channels, how identity is verified for sensitive confirmations, what evidence is kept and the rule against shortened links. Notifications are also the source of two Annex 1 logs.
Reporting to SUGEF and the OIJ the accounts used to receive fraud proceeds, which applies only with a final court ruling: four steps, the limits set by data protection and how the information SUGEF communicates is fed into monitoring.
2 files
The risk assessment that frames the strategy: by channel and typology, probability, impact, existing controls, their effectiveness and residual risk, with an action plan and owner. A sheet records the participants from the business units and control functions. The methodology is a proposal: the regulation sets none.
Calculates the threshold by comparing the cost of investigating a claim —including the risk of paying compensation for resolving late— with what would be overpaid by refunding without investigating. The formula is a proposal built on the consequences the law itself sets; the law requires the analysis but not its method.
2 files
Brings together in a single resolution the decisions the regulation leaves to the Board: approving the strategy and setting how often it is reviewed and how often the risk assessment is updated. It can also approve the below-threshold refund policy. With recitals, five resolutions and signatures.
How to meet the two requirements of art. 11 of the law on the protocol: that all staff know it and that they are trained regularly. Audience, content, format and frequency —all staff, front-line and call centre staff, new hires—, assessment and a record per person.
2 files
Calculates, from each claim's filing date, the legal deadlines —30 calendar days, notice and validity of the extension, crediting and the 120-day limit— and flags when a claim is about to expire or has expired. It includes the current base salary, a summary and a holidays sheet so the extension counts business days.
Records what may change the institution's obligations: matters SUGEF has not yet issued, the unconstitutionality action against art. 3 of the law and the annual updates to the regulations. It comes preloaded with the situation at the cut-off date, 15 October 2026.
2 files
In what order to use the files, who completes them and how they are prioritised: five stages, from immediate operation to continuity; the five steps to complete a template; and the four documents with effect on third parties that your legal team should review first.
The 22 files with their phase, format, the self-assessment controls each one closes and whether it needs priority legal approval; and the traceability of the 87 controls to the file that remedies them. It also explains why there are no files on suppliers: the law imposes no obligations on them.
This package is the design of your programme. We say it here and not in the small print: to stand behind it before a customer, SUGEF or a judge, your institution still has to do five things.
Complete each template with your institution's real data —channels, owners, recording systems, internal deadlines— and remove the opening guidance and the example rows.
Decide on the recommendations of the instrument. Each document marks where the law does not define something and proposes a reading; the decision rests with your compliance officer and legal team.
Take the strategy, the review periods and the refund threshold to the Board, with model resolution 7.1.
Submit the emergency protocol to SUGEF for prior authorisation (SUGEF Regulation 5-26, art. 10), train the staff and publish it on your website.
Have your legal team review first the four documents with effect on third parties: the form (4.2), the protocol (4.3), the rejection procedure (4.4) and the account reporting procedure (4.6).
No document in this package is legal advice. And the law reverses the burden of proof: what your institution states in these documents it must be able to prove with records, logs and minutes.
Immediate download after payment, in a private portal. Internal-use licence for one organisation.
Lucia
Virtual assistant · Snap Compliance
Before we start
I'm Lucia. I'll be assisting you here and helping you with whatever you need from Snap Compliance.
We process your data in accordance with the applicable laws and regulations.