Candidate-provided, 10 of 11
The certificate is a personal document. Argentina's registry refuses intermediaries outright. Your job is to ask, with consent, and verify what arrives, not to run a search.
Free tool
Who is allowed to pull a criminal record certificate, which identity documents actually verify a person, and what each country's data protection regime expects once you hold the file. Eleven Latin America markets, updated for Chile's December 2026 data law.
Built for founders and operators hiring offshore staff who want to verify a candidate properly without importing a US screening process that does not fit.
Verification by market
Pick a country to see the document to request, who is permitted to obtain it, what it costs the candidate, and the data protection rules that attach once you hold it.
Screening by market
Pick a Latin America market to see which documents verify a candidate, who is allowed to obtain the criminal record certificate, and what the local data protection regime expects of you once you hold it.
Ask for the constancia only where the role justifies it, and expect the state-level split to add days. Identity is the easier win here: the CURP and the INE card together verify the person, and the RFC confirms a contractor is actually registered with SAT and able to invoice.
Most constrained first
Mexico criminal record check
Candidate must obtain and share it
Why it matters
A US employer runs a background check by instructing a vendor. The vendor searches records on the candidate’s behalf and returns a report, and the employer’s obligations run through disclosure and authorization paperwork. Almost none of that machinery exists in the same shape south of the border, and the mismatch is quiet: you can spend two weeks waiting for a report that was never going to arrive, or you can ask for a document that a court in that country has held you had no right to demand.
Two structural differences explain nearly every surprise. The first is access. In 10 of the 11 markets compared here, the criminal record certificate is a personal document that only the individual can obtain. Argentina’s Registro Nacional de Reincidencia is explicit about it: the certificate is requested through the official channel, the email used must be in the applicant’s own name, and the registry does not work with intermediaries. There is no vendor workaround, because there is no vendor-shaped hole in the process. The employer’s role is to ask the candidate for a document and verify what they receive.
The second is permission. In the United States the debate about criminal history is largely about timing and individualized assessment. In parts of Latin America the question is whether an ordinary employer may ask at all. Brazil sits at the sharp end, and the reasoning there is worth reading in full before you write a screening policy that covers the region.
Two axes
The certificate is a personal document. Argentina's registry refuses intermediaries outright. Your job is to ask, with consent, and verify what arrives, not to run a search.
Judicial, disciplinary, and fiscal records are free consultations by ID number through the Policia Nacional, Procuraduria, and Contraloria portals. Authorization is still required to store the result.
The Certificado Unico Laboral bundles penal, police, and judicial records into one free document made for job applications. No other market in the set offers an equivalent.
It helps to keep the two axes apart, because a market can be open on one and closed on the other. Colombia is the most open access regime in the region and still requires prior, express authorization under its habeas data statute before you process what a lookup returned. Guatemala has the fewest formal constraints of any market here and no comprehensive data protection law at all, which lowers the compliance floor without lowering the obligation. Brazil makes the certificate free and easy to obtain at federal level while restricting who may be asked for it more tightly than anywhere else in the set. Reading a market as simply easy or hard is what produces the wrong policy.
Brazil
In a repetitive appeals proceeding numbered IRR-243000-58.2013.5.13.0023, Brazil’s Superior Labor Court fixed binding theses on when an employer may require a criminal record certificate from a job candidate. The first thesis holds that the requirement is not legitimate, and constitutes moral injury, when it amounts to discriminatory treatment or is not justified by an express legal provision, the nature of the role, or the special degree of trust the role demands. The second sets out the mirror image: the requirement is legitimate when one of those justifications is present. The third is the one that changes the arithmetic. Where the justification is absent, the moral damage is in re ipsa, which means the candidate does not have to prove any harm at all. The request itself is the injury.
The categories the court treated as justified are concrete and narrow: domestic workers, carers for children and for elderly or disabled people in nurseries, care homes and similar institutions, drivers including cargo transport, bank employees, workers handling weapons or toxic substances, and roles with access to classified information. Read that list against the roles a US company typically hires in Brazil, backend engineers, designers, analysts, customer support, and the gap is obvious. A screening policy that requires a certidao de antecedentes criminais from every hire is not a careful policy in Brazil. It is a standing liability with a court-defined damages theory already attached to it.
This is the strongest argument for building screening around the role rather than around the country. The check that is prudent for a bookkeeper with payment authority is not the check that is defensible for a frontend developer, and Brazil is where that distinction has been written into binding case law rather than left to good practice.
Reference table
The criminal record document, who may obtain it, what it costs the candidate, and the data protection regime that applies once you hold the result.
| Rank | Country | Constraint on employer use | Who obtains the certificate | Document | Cost to candidate | Data protection regime |
|---|---|---|---|---|---|---|
| 1 | Brazil | Role-justified only | Candidate only | Certidao de Antecedentes Criminais | Free at the federal level | LGPD, Lei 13.709/2018 |
| 2 | Mexico | Justification expected, reform pending | Candidate only | Constancia de No Antecedentes Penales | Varies by state, typically a small fee | LFPDPPP, published March 20, 2025 |
| 3 | Chile | New data regime lands December 2026 | Candidate only | Certificado de Antecedentes para Fines Particulares | Low fee, free in some channels | Ley 19.628, replaced by Ley 21.719 from December 1, 2026 |
| 4 | Argentina | Closed at source | Candidate only | Certificado de Antecedentes Penales | Fee payable by the applicant | Ley 25.326 |
| 5 | Uruguay | Scope limited by statute | Candidate only | Certificado de Antecedentes Judiciales | Standard fee, urgent tier costs about double | Ley 18.331 |
| 6 | Colombia | Open lookup, constrained use | Employer may look it up | Antecedentes judiciales, plus antecedentes disciplinarios and responsabilidad fiscal | Free | Ley 1581 de 2012, Habeas Data |
| 7 | Ecuador | Standard, with an enforced data law | Candidate only | Certificado de Antecedentes Penales, formerly the record policial | Free | Ley Organica de Proteccion de Datos Personales, 2021 |
| 8 | Peru | Standard, purpose-built document | Candidate only | Certificado Unico Laboral, or the separate Certificado de Antecedentes Penales | CUL is free; the penal certificate is about 52.80 soles | Ley 29733 |
| 9 | Costa Rica | Standard, with registration duties | Candidate only | Hoja de Delincuencia | Small fee | Ley 8968 |
| 10 | Dominican Republic | Standard | Candidate only | Certificado de No Antecedentes Penales | Small fee | Ley 172-13 |
| 11 | Guatemala | Least constrained | Candidate only | Antecedentes Penales and Antecedentes Policiacos | Small fee for each | No comprehensive data protection statute |
Ranking reflects how constrained employer use of criminal record data is, combining binding case law, pending statutory reform, certificate scope limits, and the strength of the data protection regime. It is a planning aid, not a legal opinion, and not a risk rating for the country. Procedures at issuing authorities change; confirm the current process for the specific country and role before acting on it.
By the numbers
10 of 11
Markets where only the candidate can obtain the criminal record certificate
1
Market with a free public records lookup an employer can run directly
5
Markets where the certificate costs the candidate nothing
Timing
Chile is the market to handle first, because a deadline is attached to it. Ley 21.719 was published in the Diario Oficial on December 13, 2024 and takes effect on December 1, 2026, replacing a framework that dated from 1999 and had no dedicated regulator. The new regime creates an Agencia de Proteccion de Datos Personales, grants full access, correction, and deletion rights, requires notification of a breach within 72 hours, and carries penalties reaching 20,000 UTM, with a revenue-based ceiling for repeat infringements. A foreign employer holding screening records about Chilean candidates is inside its scope.
None of that requires a rebuild if you are already doing the obvious things. Write down the purpose for which you collect a certificate, keep it only as long as that purpose lasts, name a person responsible for the file, and be able to honour a deletion request without an archaeology project. Teams that put those four things in place before December are compliant by default. Teams that wait will be doing it under a regulator that did not exist when their process was designed.
What actually works
The national ID number is authoritative and cheap to check against the issuing authority. It is the highest value verification in the region and it carries no legal friction.
In Brazil a criminal certificate request outside the accepted categories is itself the liability. Match the check to the duties rather than running one policy everywhere.
Prior, express, informed authorization is the norm across the region. Capture it before the first lookup and keep it with a stated retention period.
Start with identity, because it is the highest value verification available and it carries none of the legal friction of criminal history. Every market here has an authoritative national identity number: the CURP and INE card in Mexico, the CPF from Receita Federal in Brazil, the DNI from RENAPER in Argentina and from RENIEC in Peru, the cedula de ciudadania in Colombia, the RUN in Chile, the DPI from RENAP in Guatemala. Confirming that the person in the interview matches the number on file, and that the number is real, closes the failure mode that actually recurs in remote hiring. Where you are engaging a contractor rather than an employee, the tax registration is the second check worth running, because a Mexican contractor with an RFC can issue a CFDI and a Brazilian professional contracting through a company will have a CNPJ. A contractor who cannot produce either is telling you something about how their side is set up.
Then verify the claims the role depends on. Employment history and education are checked the same way everywhere, by contacting the institution or former employer directly, and in most of the region a university will confirm a degree on request from the graduate. Reference conversations with named former managers do more work than any certificate for a knowledge role. For technical hires, a paid trial task tells you more about capability than every document on this page combined, and it carries no data protection exposure at all.
Reserve the criminal record certificate for the roles where it belongs. Payment authority, unsupervised access to customer funds or sensitive personal data, physical access to premises, and the specific categories Brazilian case law recognises are real justifications. A remote frontend role is not, and asking anyway is how a routine hiring process acquires a legal problem in the one market where the damages theory is already settled.
Consent
Consent is not a formality in this region. Colombia’s Ley 1581 de 2012 requires prior, express, and informed authorization from the data subject, captured by a means that allows later consultation, and enforced by the Superintendencia de Industria y Comercio. That duty does not disappear because the record was publicly consultable: the lookup may be free, but storing or acting on what it returned is processing. Brazil applies the LGPD, Mexico a new LFPDPPP in force since March 21, 2025 whose supervision moved from INAI to the Secretaria Anticorrupcion y Buen Gobierno, and Argentina and Uruguay operate the region’s two EU-adequate regimes.
The working version fits in a paragraph. Before you check anything, get written consent that names what you will verify and why. Ask for the narrowest document that answers the question. Record the outcome you needed rather than archiving everything you saw. Set a retention period and actually delete on it. Tell the candidate what you hold and honour a deletion request when the process ends. That standard satisfies every regime in this comparison, including the ones that have not written it down yet, and it costs nothing to run.
Methodology
Documents and issuing authorities are stated as published by the responsible national body: the Registro Nacional de Reincidencia in Argentina, the Policia Federal and state courts in Brazil, the Registro Civil e Identificacion in Chile, the Policia Nacional, Procuraduria and Contraloria portals in Colombia, the national interior ministry in Ecuador, the Poder Judicial CAPe platform and the gob.pe Certificado Unico Laboral in Peru, the Registro Judicial in Costa Rica, the Procuraduria General in the Dominican Republic, the Organismo Judicial and Policia Nacional Civil in Guatemala, state authorities in Mexico, and the Instituto Tecnico Forense register in Uruguay. Fees and validity periods are stated where the issuing authority publishes them and are described as bands where it does not.
The constraint ranking is a judgment, not a measurement. It combines binding case law, notably the TST theses in Brazil, pending statutory reform such as the Ley Federal del Trabajo amendment approved in the Mexican Senate, statutory limits on certificate scope as in Uruguay, and the maturity and reach of each data protection regime. Two markets with the same label can differ in practice, and a low ranking means fewer formal constraints rather than fewer obligations to the candidate. Nothing here is legal advice, and LavaStaff is not a law firm, an employer of record, or a tax adviser. Confirm the current rules for the specific country and role with qualified local counsel before you act on them.
LavaStaff scopes, sources, vets, and supports the hire, and on managed engagements handles payroll and compliance, directly or through a vetted EOR partner depending on your needs, so your internal team does not have to build that operating layer from scratch.
Questions
Usually not in the way a US employer means it. In ten of the eleven markets compared here the criminal record certificate is a personal document that only the individual can obtain, so there is nothing for a screening vendor to search on your behalf. Argentina's Registro Nacional de Reincidencia states outright that the request must come from the applicant's own account and email and that it does not work with intermediaries. Colombia is the exception: judicial, disciplinary, and fiscal records are all free public lookups by ID number. Everywhere else, the correct process is to ask the candidate for the certificate, with their consent, and verify what they hand you.
Only when the role justifies it. In IRR-243000-58.2013.5.13.0023 Brazil's Superior Labor Court fixed binding theses holding that requiring a criminal record certificate from a job candidate is illegitimate and causes moral damage where it is discriminatory or not justified by an express legal provision, the nature of the role, or a special degree of trust. Where no justification applies, the damage is in re ipsa, meaning the candidate does not need to prove harm to recover. The court accepted categories such as domestic workers, carers for children and for elderly or disabled people, drivers, bank employees, workers handling weapons or toxic substances, and roles with access to classified information. A blanket request for an ordinary remote developer role does not fit those categories.
It is the one document in the region built specifically for hiring. The Certificado Unico Laboral bundles a candidate's penal, police, and judicial records into a single free certificate obtained through the Peruvian state platform gob.pe. Peru also issues a standalone Certificado de Antecedentes Penales through the judiciary's CAPe platform for about 52.80 soles, valid for 90 calendar days. If you are hiring in Peru, ask for the CUL by name: it is free, it covers all three record types at once, and it is the form of request the Peruvian state itself designed for this situation.
Each country has a national identity number that is genuinely authoritative, which is a stronger starting point than most US employers expect. Mexico uses the CURP together with the INE voter card, and the RFC confirms a contractor is registered with the tax authority. Brazil uses the CPF issued by Receita Federal. Argentina and Peru both use a DNI, issued by RENAPER and RENIEC respectively. Colombia uses the cedula de ciudadania, Chile the cedula carrying the RUN, and Guatemala the DPI issued by RENAP. Verifying the identity number against the issuing authority is the single highest value check you can run, and in most markets it is also the easiest.
Chile's Ley 21.719, published on December 13, 2024, takes effect on December 1, 2026 and replaces the country's 1999 data protection framework. It creates a dedicated Agencia de Proteccion de Datos Personales, grants full access, correction, and deletion rights, requires breach notification within 72 hours, and carries fines reaching 20,000 UTM, or a share of revenue for repeat offenders. Screening records held by a foreign employer about Chilean candidates fall within its scope, so any process being built in the second half of 2026 should be built to that standard rather than retrofitted afterward.
Yes, and in most of the region it must be prior, express, and documented. Colombia's Ley 1581 requires prior and informed authorization captured in a form you can produce later, and the fact that a record was publicly consultable does not remove that duty when you store or act on what you found. Brazil's LGPD, Mexico's LFPDPPP, Peru's Ley 29733, Ecuador's data protection law, Costa Rica's Ley 8968, and the EU-adequate regimes in Argentina and Uruguay all impose a lawful basis and purpose limitation. The practical version is short: get written consent before you check anything, tell the candidate what you are checking and why, and delete the records on a schedule you can describe.
It depends on the engagement. A staffing partner that sources and vets candidates typically runs identity, employment history, and skills verification as part of delivering a shortlist, while any criminal record certificate remains a document the candidate obtains and consents to share. The responsible legal employer owns the employment-side compliance duties. The written engagement should state who verifies what, what evidence is retained, where it is stored, and for how long, before the first candidate is screened.
Ready To Move
LavaStaff helps you scope, source, vet, and launch nearshore talent that works your hours. Share your role and we will bring you a shortlist of screened candidates, with payroll and compliance handled, directly or through a vetted EOR partner.