Argentina Drafts Hack Reporting and 15% Deal Rules

ARGENTINA · MARKETS

A draft from Argentina’s securities regulator would turn hacks, market rumours and big deals into formal filings that also reach New York.

Argentina’s securities regulator wants listed companies to report serious cyberattacks and answer market rumours under new Argentina disclosure rules. The Comisión Nacional de Valores (CNV) approved the draft for public comment on Wednesday, 7 October.

At least 13 Argentine companies, including YPF and Pampa Energía, have shares on the NYSE or Nasdaq, SEC listings show. Companies such as YPF translate their CNV filings and send them to the US Securities and Exchange Commission (SEC).

What the Argentina Disclosure Rules Would Require

The draft, General Resolution 1171, rewrites the CNV’s rules on material events, known locally as hechos relevantes. Issuers must report these immediately through the regulator’s online filing system.

The text keeps the broad duty to report anything that could substantially affect a security’s placement or trading. It then sets out a long list of examples, many with numerical thresholds.

Deals or extraordinary investments above 15% of equity would have to be reported, as would losses of the same size. Losses must be flagged once known, without waiting for the next financial statements.

Asset sales above 15% of the book value of that asset class also qualify. So do purchases or sales of stakes in other companies worth more than 20% of equity.

Lawsuits claiming more than 10% of equity would count, as would layoffs of 10% of staff within six months. Contracts with directors or related parties above 5% of equity or revenue would also count.

Trading halts longer than 30 minutes, in Argentina or abroad, must be disclosed. Director resignations must be reported on receipt, with the stated reasons, without waiting for their acceptance.

The Buenos Aires Stock Exchange building on Leandro N. Alem avenue, pictured in January 2007. Photo: Antonio García / Wikimedia Commons (CC BY 2.0)

Cyberattacks and Market Rumours

The draft expressly adds serious cybersecurity incidents to the events companies must report, the CNV said. Any operational, technological or IT-security incident that could significantly disrupt a business would qualify.

Filings would have to state the known and, where possible, foreseeable consequences and the steps taken in response. The draft sets no deadline in hours, only the duty to report immediately.

The SEC adopted similar rules on 26 July 2023. US companies must report a material cyber incident within four business days of judging it material, and foreign issuers use Form 6-K.

The draft also tells companies how to handle rumours and reports spread by third parties. If such a report is false, inaccurate or incomplete, the company must correct or deny it in a formal filing.

If it proves true, the company must disclose it immediately. Preliminary talks and non-binding agreements, however, would not count as material events on their own.

Companies could still ask the CNV to delay a disclosure that would harm them, such as an unfinished negotiation. The regulator’s board would rule within five business days, and a likely price move alone would not normally be enough.

Why the CNV Is Moving Now

The CNV, which sits under the Economy Ministry and is chaired by Roberto E. Silva, is Argentina’s counterpart to the SEC. It says it reviewed disclosure rules in Spain, the European Union, the United States and the United Kingdom.

In a CNV statement, Silva said the consultation seeks “to modernise the material events regime to provide greater certainty.” He tied the draft to a wider capital-market overhaul that the regulator is pushing.

That overhaul was on show at World Investor Week on Monday, 5 October, at the Buenos Aires Stock Exchange. The CNV organised it with IOSCO, the global association of securities regulators.

There, Deregulation Minister Federico Sturzenegger announced a bill to amend the Capital Markets Law and other finance laws, El Cronista reported. That bill still has to go to Congress and is separate from the CNV draft.

What It Means for You

For US holders of Argentine shares and ADRs, the change would mostly show up in Form 6-K filings. YPF, for example, filed a translated letter to the CNV with the SEC on Monday, 5 October.

In it, the oil company reported buying back US$4.37 million in face value of notes due this month. Under the draft, such letters would follow a fixed format, including the date of the event and, where possible, its financial effect.

Bond investors would also gain clarity, since late or deferred payments must be reported at once. Grace periods would not delay that disclosure, the draft says.

Nothing changes yet for investors under the proposed Argentina disclosure rules. The current rules stay in force until the CNV board approves a final resolution.

What Is Not Known

The CNV has not said when it will adopt final rules or whether the thresholds may change after comments. It has also not said how quickly a cyber incident must be reported in practice.

No public reaction from listed companies or from BYMA, the Buenos Aires exchange operator, could be found by early Thursday.

What Comes Next

Anyone can send comments through the CNV website for 15 working days, under a 2003 decree on participatory rule-making. The comments are not binding, and the board must then approve a final text.

The consultation does not change SEC duties for US-listed Argentine companies. Those firms must keep meeting the rules of both regulators.

Frequently Asked Questions

What did Argentina’s securities regulator propose?

The CNV proposed new rules on the material events that listed companies must disclose. They add cyber incidents, steps for handling rumours and numerical thresholds for big deals and losses.

Do the new Argentina disclosure rules apply now?

No. The draft is open for comment for 15 working days, and the CNV board must then approve a final version.

Which US-listed companies could be affected?

The rules would cover companies that report to the CNV, such as YPF, which also has shares on the NYSE. SEC listings show at least 13 Argentine companies on the NYSE or Nasdaq.

How does this compare with US rules?

Under SEC rules adopted in 2023, US companies must report material cyber incidents within four business days. Foreign issuers report them on Form 6-K.

What happens if a rumour about a company spreads?

Under the draft, the company must clarify it, and correct or deny it in a filing if it is false. If the rumour is true, the company must disclose the facts immediately.

Sources: Comisión Nacional de Valores, General Resolution 1171/2026 and annex (Boletín Oficial, 8 October 2026); Comisión Nacional de Valores, statement of 7 October 2026; US Securities and Exchange Commission, cybersecurity disclosure rules; US Securities and Exchange Commission, company tickers and exchanges; YPF, Form 6-K of 5 October 2026; Banco Central de la República Argentina; El Cronista (all accessed 8 October 2026).