Outsourced compliance officer in Uruguay: what they do and who needs one

Many companies find out they are obliged entities under Uruguay’s anti-money laundering rules when they receive a request from SENACLAFT or a bank asks for their procedures manual. That is when the practical question comes up: who will be the compliance officer, and can the role be handed to an outside firm? This guide explains what the rules say about appointing a compliance officer, their duties and requirements, how much room there is for an outsourced compliance officer in Uruguay, and how to set up external support that stays within the rules.

Main guide: compliance and governance, where we explain how we support companies and professionals with their compliance programmes.

What a compliance officer is

The compliance officer (oficial de cumplimiento) is the person appointed by an obliged entity to drive the implementation of procedures and obligations to prevent money laundering and terrorist financing. They are also the point of contact with the Financial Information and Analysis Unit (UIAF) of the Central Bank of Uruguay, with SENACLAFT and with other competent authorities (Decree 379/018, article 16).

The job is not to sign paperwork but to make the system work. For the general legal framework, see anti-money laundering law in Uruguay.

Who must appoint a compliance officer

Law 19,574 distinguishes two broad groups of obliged entities, each with its own supervisor:

Group	Who	Supervisor	Rules on the officer
Financial (art. 12)	Everyone under BCU oversight: banks, exchange houses, financial service companies, securities market and insurance participants, among others.	BCU (Financial Services Superintendency)	Compilation of Financial System Regulation and Control Rules and other BCU compilations
Non-financial (art. 13)	Casinos, real estate agencies and builders, lawyers, notaries and accountants in certain transactions, auctioneers, free zones, corporate service providers, non-profit organisations and non-financial trustees, among others.	SENACLAFT	Decree 379/018

The article 13 list was expanded by Law 20,469 (March 2026), which brought under SENACLAFT’s oversight non-financial trustees and providers of administration, accounting or data processing services that, from Uruguay, support individuals or companies carrying out financial activities abroad. Sector-by-sector detail is in our guide to SENACLAFT non-financial obliged entities.

Lawyers, notaries and accountants are only covered for the transactions listed in the law, never for advice alone. A company on neither list has no duty to appoint an officer, although its banks will still apply their own controls; see KYC and compliance in Uruguay.

Duties of the compliance officer

For non-financial obliged entities, article 17 of Decree 379/018 sets out these duties:

1. Periodically review prevention policies, procedures and controls.
2. Propose measures to mitigate the risks identified.
3. Propose alert mechanisms and procedures for future transactions, and build them into policies and training.
4. Help prepare the STRs sent to the UIAF.
5. Coordinate training plans for the relevant staff.
6. Verify compliance and results of the prevention programmes.

The same article requires the officer to have full independence and autonomy and unrestricted access to all the information they need.

In BCU-supervised entities, the officer is responsible for implementing, monitoring and controlling the prevention system and is the point of contact with the competent authorities (article 291 of the Compilation). In banks, finance houses and credit cooperatives, among others, the officer also prepares an annual report on the system’s effectiveness (article 150) and may not work in internal audit.

Requirements by type of obliged entity

Aspect	Non-financial obliged entities (SENACLAFT)	BCU-supervised entities
Who can hold the role	A person appointed by the obliged entity; it may be the obliged person themselves (art. 16, Decree 379/018).	An employee within the senior staff category; in money transfer companies, at management level (art. 292.1).
Residence	Not expressly required by the decree.	Must be based in Uruguay.
Conditions	Independence, autonomy and unrestricted access to information.	Training, seniority and the human and material resources to work autonomously and efficiently.
Notification	Registration data with SENACLAFT must be kept up to date; changes are reported within 30 days (art. 93).	Financial intermediation institutions report the officer’s name to the Superintendency within five business days of appointment or change (art. 548).

For the framework applying to financial entities, see financial regulation in Uruguay.

Can the compliance officer role be outsourced?

It depends on the supervisor. And precision matters: “outsourced compliance officer” is a commercial term, not a role defined by Uruguayan rules.

Non-financial obliged entities

Decree 379/018 requires appointing “a person” to drive the system and states that the role may be held by the obliged person themselves. It does not say the officer must be an employee, nor does it expressly regulate appointing an external professional. What it does make clear is that responsibility for compliance remains with the obliged entity (art. 16), and that whoever holds the role must have independence, autonomy and access to all information.

The only delegation the decree expressly regulates is that of customer due diligence procedures, and only to third parties that are themselves article 13 obliged entities, with the information handed over immediately to the delegating party, which keeps final responsibility (art. 19).

For this reason, the safest set-up for a notary, a real estate agency or a small corporate service provider is usually this: the owner or a team member is appointed as officer, and an outside firm does the technical support work. If an external professional is appointed, it is advisable to document it, guarantee real access to information and check SENACLAFT’s position for the specific case.

BCU-supervised entities

Here the room is narrower. The Compilation requires the officer to be senior staff and based in Uruguay. In addition, hiring third parties for services inherent to the business requires authorisation from the Financial Services Superintendency, outsourcing neither removes nor limits the institution’s responsibility, and customer acceptance cannot be outsourced (art. 35.1). In practice, the officer is internal and what is contracted out is support: reviews, training, methodologies or, in some cases, the reports by independent professionals that the rules themselves require (for example, from financial service companies, art. 151.26).

What external support can and cannot do

External support can take on	Stays with the obliged entity
Drafting and updating the risk assessment and procedures manual.	Approving policies and applying them day to day.
Designing due diligence forms and files, and reviewing samples.	Accepting or rejecting the customer and keeping records at its premises.
Delivering training and documenting it.	Making sure staff actually receive it.
Analysing alerts and helping prepare the STR.	Filing the report and answering for it.
Carrying out periodic reviews and reporting to the board.	Fixing the weaknesses found.

Confidentiality also binds the adviser: Law 19,574 prohibits obliged entities, including persons contractually related to them, from disclosing reports to customers or third parties (art. 22). The external support agreement should reflect this.

Procedures manual and risk assessment

The decree requires a risk assessment covering customer, geographic and operational risk, proportionate to the nature and size of the business (art. 4), and written policies and procedures to identify and assess risks, apply controls and monitor their effectiveness (art. 5). Each customer subject to due diligence must be rated high, medium or low risk, in writing.

A useful manual describes how the business really works: what is requested depending on risk, when enhanced due diligence applies, how the beneficial owner is identified, which red flags are monitored and how a case is escalated to the officer. Records must be kept for at least five years after the relationship ends or the transaction is completed (art. 15).

Staff training

Obliged entities with staff must train periodically those involved in covered transactions, so they know the rules, can recognise transactions linked to money laundering or terrorist financing and know how to act (art. 18). The officer coordinates these plans; programmes, attendance records and materials should be kept.

Suspicious transaction reports to the UIAF

• What is reported: transactions, whether completed or not, that are unusual, have no evident economic or legal justification or are unjustifiably complex, and those involving assets of suspicious origin (Law 19,574, arts. 12 and 13; Decree 379/018, art. 89).
• When: immediately once they are classified as such, even if the customer withdrew or the transaction did not go ahead.
• Minimum content: identification of the persons involved, a description of the transactions and the indicators that led to classifying them as suspicious (art. 90).
• How: the BCU enabled digital filing of STRs for the non-financial sector, using a gub.uy account and an advanced digital signature.
• Afterwards: if the UIAF gives no instructions within three business days, the obliged entity may act as it sees fit (Law 19,574, art. 22).

A report made in good faith and in line with the procedures does not breach professional secrecy or give rise to liability (art. 23).

Liability and penalties

Having an officer, in-house or with external support, does not shift responsibility. For non-financial obliged entities, SENACLAFT may impose a warning, observation, fine or suspension (temporary for up to three months or, with court authorisation, permanent). Fines range from UI 1,000 to UI 20,000,000 depending on the breach, the conduct and business volume, and directors and senior management who failed to act with due diligence may also be sanctioned (Law 19,574, art. 13). In the financial sector, failure to report is penalised under Decree-Law 15,322 (Law 19,574, art. 12).

Common mistakes

• Appointing someone “on paper” without time, access to information or authority.
• Assuming that hiring an external adviser transfers responsibility to them.
• Using a template manual that does not reflect the real business.
• Not documenting training or each customer’s risk analysis.
• Not updating the SENACLAFT registration when details change.

Frequently asked questions

Compliance officer support with GlobalTax

At GlobalTax we carry out the risk assessment, draft and update the manual, deliver training and support the compliance officer in periodic reviews and case analysis, under an arrangement that makes clear what stays with each party. Find out more on compliance and governance or through our contact page.