Digital identity in Argentina, layer by layer.

In Argentina, no single body governs digital identity. There is one source that attests to it, two that require knowing who is transacting and one regime that sets how the data is processed. This is how each layer fits.

Argentina at a glance

Identity
RENAPER, Registro Nacional de las Personas
Financial system
BCRA, Banco Central de la República Argentina
Anti-money laundering
UIF, Unidad de Información Financiera
Personal data
Law 25,326 on Personal Data Protection (AAIP)
Document
DNI, five versions in force

Regulation guides for Argentina

One guide per topic. Each one explains what the rule requires and what VU verifies to comply with it.

Identity verificationThe five types of Argentine DNI in circulation, what is read from each one and what it is checked againstRead the guideKYCWho is an obligated party, what they have to know before onboarding a customer and how it is scaled by risk, including politically exposed personsRead the guideAMLThe anti-money laundering regime: monitoring, beneficial ownership and suspicious transaction reporting to the UIFRead the guideDigital onboardingFully remote sign-up, with no branch, and the evidence it has to leave to hold up before the supervisorRead the guideLiveness detectionHow to show that a real, present person is on the other side, in active and passive formsRead the guideFraud preventionImpersonation and synthetic identity, at sign-up and in later use of the accountRead the guide

The frame of reference

Three questions organize the Argentine picture: who says a person exists, who requires knowing them before letting them transact, and under what conditions that data can be processed. Each one has a different authority.

  • RENAPER — the Registro Nacional de las Personas (Argentina's national registry of persons) is the body that records the identity of people in Argentina and issues the DNI. It is the source of truth: when a process asks whether a person and their document exist and match, the answer comes from RENAPER and not from the document itself.
  • UIF — the Unidad de Información Financiera (Argentina's financial intelligence unit) is the enforcement authority for the anti-money laundering and counter-terrorist financing regime established by Law 25,246. What decides who it reaches is the status of obligated party, which the law sets by activity. Whoever holds that status bears three duties: knowing the customer before onboarding them, retaining the evidence of that identification and reporting what is required. The operational question is not what a company does, but whether that activity is on the list.
  • BCRA — the Central Bank regulates financial institutions. Of everything it requires, what concerns an onboarding is customer onboarding through non-face-to-face channels: how identification is done remotely and what record that identification leaves. Its rules add to those of the UIF rather than replacing them, so a financial institution answers to both.
  • Law 25,326 on personal data protection — enacted in 2000 and still in force, it frames the processing of everything the process captures, including biometrics. Its enforcement authority is the AAIP, the Agencia de Acceso a la Información Pública (Agency for Access to Public Information), which oversees how companies and public bodies process data and supports data subjects in exercising their rights of access, rectification and erasure. It imposes its own duties of purpose, notice to the data subject, legal basis for processing and security measures, and it is not met by meeting the anti-money laundering regime. They are two parallel obligations.

The practical distinction is this: the UIF and the BCRA say what has to be known, RENAPER is what it is checked against, and the personal data law says what can be done with what was checked.

Argentina's data law is outdated and, at the same time, adequate for the European Union. Both things are true, and for the same reason. The text dates from 2000 and has fallen short of the digital economy. Reform bills have been introduced, none enacted, so Law 25,326 remains the law in force. That same age placed it among the region's first data laws, and the European Union has recognized Argentina as a country with an adequate level of protection since 2003, a status it confirmed in its January 2024 review. For a company operating in the country the consequence is concrete: the local standard is not a lower floor, and it makes sense to design data processing so that it also withstands the reform when it comes.

Frequently asked questions about regulation in Argentina

There is not just one, and that is the first confusion worth clearing up. RENAPER records the identity of people and issues the DNI, so it is the source against which who someone is gets attested. The UIF defines what an obligated party has to know about its customers before letting them transact and what evidence it has to retain. The BCRA regulates financial institutions, including onboarding through non-face-to-face channels, and its requirements add to those of the UIF without replacing them. And Law 25,326 on personal data protection, enforced by the AAIP, governs the processing of everything that process captures. An Argentine digital onboarding answers to all four frameworks at the same time.

Law 25,326 on personal data protection, enacted in 2000 and still in force. It is enforced by the AAIP, the Agencia de Acceso a la Información Pública (Agency for Access to Public Information), which oversees that companies and public bodies process personal data securely, and it is where a person files a claim to find out what data is held about them, correct it or ask for it to be deleted. In a digital onboarding this translates into two things. The captured biometrics are personal data, so they need a declared purpose, notice to the data subject and security measures. And complying with the UIF does not exempt anyone from complying with the data law: they are different regimes, with different authorities. The law has become outdated for the digital economy and reform bills have been introduced, none enacted. Even so, the European Union has considered Argentina a country with an adequate level of data protection since 2003 and confirmed that status in 2024.

It is defined by activity, not size: financial and foreign exchange institutions, insurers, the capital market, virtual asset service providers, notaries and several non-financial activities, each with its own obligations. A company can be covered by just one of its business lines. The detail is in the guide to KYC in Argentina.

Yes. The BCRA allows it for financial institutions and the UIF defines what has to be known about the customer whatever the channel. What changes is not the identification standard but how it is proven: in digital, the process record is the evidence. The digital onboarding guide covers it in detail.

Four things, with evidence retained: that the document is authentic, that the face matches the one on the document, that the person is present and alive, and that the data is consistent with the sources and with the applicable restricted lists. What each one involves is in the digital onboarding guide.

It is the control that decides whether the captured face belongs to a person present at that moment and not to a photo, a video or a generated image. Without it, biometric matching is fooled by a photo of the holder. Its active and passive forms and the ISO/IEC 30107-3 standard are in the liveness detection guide.

Next step

Bring Argentine regulation into your onboarding

The four checks the Argentine regime requires are not four projects. They are configurable steps in a single verification flow, and what turns them into compliance is the evidence they leave.

Request a demo

No commitment

Take control of digital identity