Peru's BCRP regulates digital payments
The BCRP approved rules for acquiring and fund collection. It requires segregated funds, transparency, and takes effect Jan. 1, 2027.
Peru's Central Reserve Bank formalized the Payment Acceptance Service Regulation through Circular No. 0026-2026-BCRP, a rule that sets the framework for companies processing merchants' digital payments, including acquiring and fund collection. The scope is broad, covering payment service providers, payment infrastructures, and their administrators and direct and indirect participants. In practice, the text sets minimum standards for merchants that accept cards, QR codes, instant payments, and other instruments through POS terminals or equivalent technology channels.
The core of the regulation is merchant fund protection. The rule requires money received by the Payment Acceptor before settlement to be kept in collection accounts or in accounts at authorized financial institutions, separate from the provider's own funds and used only to receive and transfer those resources. It also requires daily reconciliation between the balance in those accounts and merchant settlement obligations. The design is meant to reduce operational and balance-sheet risk, and to prevent confusion between third-party money and provider liquidity.
The rule also adds transparency obligations for contracts and operations. Payment infrastructure administrators and acceptors must publish relevant fee and commission information, while merchant contracts must spell out service conditions, applicable charges, settlement timelines, each party's responsibilities, and dispute-handling mechanisms. According to economic coverage, when operations run through a payment infrastructure, interchange fees must follow objective, transparent, proportional, and non-discriminatory criteria. In parallel, the regulation sets minimum requirements for merchant onboarding and evaluation, fund settlement, claims handling, and risk management.
The regulatory timeline gives companies a transition period before the rule takes effect on Jan. 1, 2027. That window matters because the regulation is part of a broader sequence of reforms in Peru's payments system. The General Regulation of the National Payment System, in force since April 2026, had already created the figure of Payment Service Entities and served as a framework rule. The new circular on payment acceptance completes that architecture and points to more granular oversight of the ecosystem, with effects on acquirers, acceptors, merchants, and the infrastructures that process and settle digital payments.
Executive summary
The Central Reserve Bank of Peru approved the Payment Acceptance Service Regulation through Circular No. 0026-2026-BCRP and set its effective date for Jan. 1, 2027. For the first time, the rule creates uniform standards for the acquiring and fund-collection activity tied to merchants' digital payments in the National Payment System. The scope is not limited to one technology, since it covers cards, QR codes, instant payments, and other instruments processed through POS terminals or equivalent enabled channels.
The regulatory move affects two layers of the ecosystem. On one side are the payment service providers that offer or participate in the Payment Acceptance Service. On the other are the payment infrastructures, including administrators and direct and indirect participants. That distinction matters because the BCRP is not regulating only a bilateral merchant-acquirer relationship, but also the technical and operational architecture that allows funds to be processed and settled. The result is a common baseline of minimum standards for security, efficiency, interoperability, and trust.
The most consequential practical measure is fund segregation. The regulation states that money received by the Payment Acceptor on behalf of merchants must be held in a collection account, or in accounts at financial system entities with a rating of no less than B+ or at electronic money issuers participating in the LBTR system, always for the exclusive use of receiving and transferring those funds. It also requires daily reconciliation between that account's balance and settlement obligations. Operationally, the design aims to reduce asset-mixing risk, liquidity pressure, and unnecessary exposure for merchants if the provider fails.
The regulation also imposes contractual and fee transparency. Acceptors and infrastructure administrators must publish relevant information about commissions, and merchant contracts must detail service conditions, fees, settlement timelines, responsibilities, and dispute-resolution mechanisms. According to economic coverage, when operations run through a payment infrastructure, interchange fees must follow objective, transparent, proportional, and non-discriminatory criteria. In parallel, the rule sets minimum requirements for merchant evaluation and onboarding, fund settlement, complaint handling, and risk management.
The broader context matters. The General Regulation of the National Payment System, in force since April 2026, had already introduced Payment Service Entities and worked as a framework rule for enabling specific standards. Under that umbrella, Tapp by Niubiz was identified as the first authorized Payment Service Entity to operate. The new payment acceptance regulation completes that sequence, and its January 2027 effective date opens an adjustment period that the market will need to use to update contracts, accounts, reconciliations, reporting, governance, and interoperability arrangements.
Context and background
The Payment Acceptance Service Regulation is not an isolated measure, but a specific piece of a broader reform of Peru's payment system. Its direct precedent is the General Regulation of the National Payment System, approved through Circular No. 0022-2025-BCRP and in force since April 1, 2026, which specialized media described as a framework rule capable of setting common principles, definitions, and obligations, while allowing the BCRP to issue concrete rules for specific services or infrastructures.
That regulatory shift already introduced the category of Payment Service Entities, a framework that groups providers performing one or more payment-related services. Gestión explained that the framework also expanded the BCRP's authority to regulate participants in the payment system, including payment service entities and fintech firms operating in transfers and international payments. Infobae, meanwhile, reported that Tapp by Niubiz was the first Payment Service Entity authorized to operate under the new regulation.
Circular No. 0026-2026-BCRP builds on that earlier structure to solve a narrower but commercially significant problem, organizing the payment acceptance service, meaning the activity of companies that process merchant collections. Microfinanzas.pe said that the activity had been operating without uniform rules despite involving multiple infrastructures. That fragmentation is exactly what the new regulation seeks to correct with minimum common standards, regardless of the technology used.
The timing also helps explain the regulatory moment. The BCRP formalized the rule on Oct. 3, 2026, economic outlets reported it the same day, and the effective date was set for Jan. 1, 2027. That leaves an explicit adjustment window for the affected players. Coverage from El Comercio, Gestión, La República, Forbes Perú, and Infobae agrees that the transition is not immediate and that the regulator set aside a period for entities to adapt their processes.
The operating context of the ecosystem also matters because the new rules land in a payments chain that is already more demanding in terms of oversight. Infobae reported, in a separate article about SBS regulation, that supervised entities will have to report system outages and other significant operational incidents within up to two hours, with a final report due in 20 business days. That point belongs to another rule, but it helps frame the tougher operating and incident-reporting environment across the financial and payments system.
Key facts table
| Date | Event | Source | Confidence |
|---|---|---|---|
| 2026-09-06 | Gestión explained that the General Regulation of the National Payment System, Circular No. 0022-2025-BCRP, expanded the BCRP's powers and enabled regulation of payment service entities. | Gestión | Confirmed |
| 2026-09-14 | Infobae reported that Tapp by Niubiz was the first Payment Service Entity authorized to operate under the BCRP's new framework. | Infobae | Confirmed |
| 2026-09-15 | Microfinanzas.pe said the payment acceptance service had been operating without uniform rules despite using multiple infrastructures. | Microfinanzas.pe | Confirmed |
| 2026-09-23 | Actualidad Civil published SBS Resolution No. 02326-2026 and the definition of intermediary institutions linked to the Payment Service Entity framework. | Actualidad Civil | Confirmed |
| 2026-10-03 | The BCRP formalized Circular No. 0026-2026-BCRP, approving the Payment Acceptance Service Regulation. | Actualidad Civil | Confirmed |
| 2026-10-03 | El Peruano said the rule sets common minimum standards for acquiring and fund collection, with a focus on security, efficiency, and interoperability. | El Peruano | Confirmed |
| 2026-10-03 | Gestión reported that the regulation covers commissions, contracts, funds, and risk management for merchants' digital payments. | Gestión | Confirmed |
| 2026-10-03 | Infobae detailed that the rule requires separate accounts, fee transparency, and daily reconciliation. | Infobae | Confirmed |
| 2026-10-03 | El Comercio reported that the regulation will take effect on Jan. 1, 2027, and includes an adjustment period for entities. | El Comercio | Confirmed |
| 2026-10-04 | La República confirmed the Jan. 1, 2027 effective date and said the focus is on protecting merchant funds. | La República | Confirmed |
Operation timeline
| Date | Event | Actor/vector | Verified source |
|---|---|---|---|
| 2026-04-01 | The General Regulation of the National Payment System takes effect. | BCRP, national payment system | Microfinanzas.pe, Gestión, Infobae |
| 2026-09-06 | The Payment Service Entity framework is presented as the regulatory umbrella. | Gestión, fintech market | Gestión |
| 2026-09-14 | Tapp by Niubiz appears as the first authorized Payment Service Entity. | Niubiz, BCRP | Infobae |
| 2026-09-15 | The lack of uniform rules in the payment acceptance service is described. | Acquiring market | Microfinanzas.pe |
| 2026-09-23 | SBS issues a resolution referencing intermediary institutions within the ecosystem. | SBS, intermediary entities | Actualidad Civil |
| 2026-10-03 | The BCRP approves Circular No. 0026-2026-BCRP. | BCRP board | Actualidad Civil |
| 2026-10-03 | Guidance on funds, fees, contracts, and interoperability is published. | Acceptors, merchants, infrastructures | El Peruano, Gestión, Infobae, Forbes Perú |
| 2026-10-03 | The effective date is set for Jan. 1, 2027. | BCRP, affected entities | El Comercio, Gestión, Infobae |
| 2026-10-04 | Merchant fund protection is reaffirmed as the regulation's core. | BCRP, merchants | El Peruano, La República, Infobae |
Attack chain and TTPs
Although the material does not describe a cyberattack, it does allow a regulatory and operational chain to be reconstructed that functions as a control flow over digital acquiring. The first link is merchant onboarding, because the regulation sets minimum requirements for evaluating and enrolling merchants. Then comes fund receipt by the Payment Acceptor, custody in specific accounts, and daily reconciliation between balances and settlement obligations. The final stage is transfer to the merchant, accompanied by transparency obligations, clear contracts, and dispute-resolution mechanisms.
From a technical perspective, the main risk is not the exploitation of a classic vulnerability, but failure of asset segregation, contractual opacity, and mismatches between collected funds and funds pending settlement. The regulation addresses that risk with controls for segregated accounts, exclusive use of certain accounts for receiving and transferring funds, publication of fees and commissions, and minimum criteria for commissions and interchange when an infrastructure takes part in the operation. Daily reconciliation acts as an accounting integrity control.
The material also shows a more mature supervision model. The BCRP is not limiting itself to a conceptual definition of the service, but imposing governance and information-disclosure duties. That is consistent with a market where QR payments, cards, and instant transfers coexist across multiple actors, and where interoperability is shifting from an aspiration to a regulatory requirement. The open banking roadmap cited by Ligopay, with a possible payment initiation model in Phase 4, suggests that this framework could evolve toward an even more integrated environment.
| TTP | Description | Source |
|---|---|---|
| Onboarding and evaluation | Minimum requirements to evaluate and enroll merchants in the service. | Infobae |
| Fund segregation | Safekeeping of merchant funds in accounts separate from the provider's own resources. | El Peruano, La República, Infobae |
| Daily reconciliation | Daily verification between the collection account balance and settlement obligations. | El Peruano |
| Fee transparency | Publication of fees, commissions, and contractual conditions. | Infobae, Gestión |
| Risk management | Minimum rules to control operational and settlement risk. | Infobae, Gestión |
| Interoperability | Promotion of compatibility across payment methods and infrastructures. | El Peruano, Gestión, Forbes Perú |
Regional impact
Regional overview
The regulatory change is Peruvian, but its regional reading is clear: the BCRP is moving the digital payments sector toward a more regulated model, with common rules for acquiring, collection, transparency, and fund custody. For the region, the case matters because it sets a supervision pattern for companies that intermediate merchant payments and for the infrastructures that process them. It also aligns with the interoperability and open banking trend mentioned in the material.
The reference to a possible Phase 4 for payment initiation, included in Ligopay's analysis, suggests an architecture increasingly close to account-based or electronic-money payment schemes with the ability to connect different actors. In that scenario, payment acceptance regulation would not be a final stop, but an intermediate layer in a broader interoperability agenda. The signal is that Peru's payments market is already being prepared for deeper integration among acquiring, collection, accounts, and digital channels.
Peru
Peru absorbs all of the verifiable impact in the material. The BCRP approved Circular No. 0026-2026-BCRP, which creates the Payment Acceptance Service Regulation and sets a specific framework for acquiring and fund collection in the National Payment System. The scope includes payment service providers and payment infrastructures, as well as their administrators and direct and indirect participants.
The most sensitive effect is on fund management. Resources that acceptors receive on behalf of merchants must be kept separate from their own funds, used only to receive and transfer those resources, and reconciled daily. The press also reported that the accounts may be held at financial system companies with a rating of no less than B+ or at electronic money issuers participating in the LBTR system. That design is meant to shield merchant money during the period before settlement.
At the same time, the rule forces market transparency. Contracts must state fees, conditions, settlement timelines, responsibilities, and dispute mechanisms. Payment infrastructure administrators and acceptors must publish relevant information on fees and commissions. Forbes Perú added that interchange fees, when a payment infrastructure is involved, must follow objective, transparent, proportional, and non-discriminatory criteria. That point matters because it introduces a competitive standard that affects the relationship among acquirers, acceptors, and infrastructures.
The adaptation timeline is the other key variable. The effective date was set for Jan. 1, 2027, and several reports stressed that entities will have time to adjust. That means the market has a concrete window to align reconciliation, fund segregation, operational reporting, contract documents, and fee publication. Institutionally, the regulation completes the architecture opened by the framework rule from April 2026.
Argentina
No additional facts were verified for Argentina in the material provided.
Chile
No additional facts were verified for Chile in the material provided.
Paraguay
No additional facts were verified for Paraguay in the material provided.
Bolivia
No additional facts were verified for Bolivia in the material provided.
Colombia
No additional facts were verified for Colombia in the material provided.
Brazil
No additional facts were verified for Brazil in the material provided.
Mexico
No additional facts were verified for Mexico in the material provided.
USA
No additional facts were verified for the United States in the material provided.
Uruguay
No additional facts were verified for Uruguay in the material provided.
Technical indicators
No technical IOCs were published in the available material. The file includes regulatory identifiers, such as Circular No. 0026-2026-BCRP, Circular No. 0022-2025-BCRP, and SBS Resolution No. 02326-2026, but it does not include domains, IPs, hashes, samples, malicious artifacts, or forensic compromise indicators.
Security team analysis
For security teams, the starting point is not malware hunting, but a review of the operational and contractual layer of payment flows. The BCRP regulation requires fund segregation, daily balance reconciliation, fee transparency, and formal service conditions. That calls for controls over accounting reconciliation, account segregation, document management, and exception monitoring in merchant settlement.
The first priority is to verify whether internal processes clearly distinguish third-party funds from company funds. Where collection accounts exist, the review should cover access, automated reconciliation, transfer rules, and alerts for deviations. If the organization operates as a payment acceptor or relies on third parties to settle merchant sales, the risk surface is not just technology, but also treasury, compliance, and complaint handling.
The second priority is contractual. The regulation requires merchant agreements to include commissions, timelines, responsibilities, and dispute mechanisms. Teams that manage vendors or third parties should check whether current documentation already covers those points or needs an update before Jan. 1, 2027. Any omission can become a compliance issue, but also a source of operational and reputational friction.
The third priority is fee and infrastructure governance. If the operation uses a payment infrastructure, interchange fees must align with objective, transparent, proportional, and non-discriminatory criteria. That requires mapping dependencies among acceptors, acquirers, processors, and infrastructure administrators. It also opens a workstream to detect conflicts in pricing and access to equivalent conditions.
The fourth priority is the adjustment window. The January 2027 effective date does not leave much room to redesign systems, publish information, adjust reconciliations, and rewrite contracts. In practice, the work should focus on inventorying flows, documenting accounts, parameterizing reconciliations, reviewing SLAs, and preserving evidence of fee publication. If the organization participates in multiple stages of the process, responsibilities should be separated by regulatory role before the cutoff date.
Frequently asked questions
What changes between the framework rule from April 2026 and the October 2026 regulation?
The National Payment System framework rule created the general regulatory umbrella and the category of Payment Service Entities. The October 2026 regulation drills down into a specific activity, merchant payment acceptance, and sets rules on funds, fees, contracts, and interoperability.
What must payment acceptors do with the money they receive from merchants?
They must keep those funds in accounts separate from their own resources, use them only to receive and transfer merchant money, and perform daily reconciliation between the account balance and settlement obligations. That requirement appears both in the context section and in the Peru impact section.
Who is covered by the BCRP regulation?
Payment service providers that offer or participate in the Payment Acceptance Service, and payment infrastructures, along with their administrators and direct and indirect participants. The press coverage adds that it applies to companies that process payments through cards, QR codes, instant payments, and other channels.
What contractual elements will merchants need to review before Jan. 1, 2027?
Contracts must clearly state service conditions, applicable fees, settlement timelines, each party's responsibilities, and dispute-handling mechanisms. That obligation appears alongside fee publication and the minimum requirements for onboarding and complaints.
What effective dates and adjustment periods did the press report?
The effective date was set for Jan. 1, 2027. Several outlets, including El Comercio, Gestión, La República, and Infobae, also said there will be an adjustment period for covered entities to adapt before that date.
Material limitations
The material does not include the full text of Circular No. 0026-2026-BCRP, so it is not possible to reconstruct it article by article or specify rule-based exceptions beyond what the available journalistic and legal coverage reports. There is also no verifiable official information on sanctions, quantitative capital thresholds, supervisory metrics, or internal implementation timelines by entity type.
No technical IOCs, security incidents, victims, attributions, or malicious campaigns linked to the subject of this report were verified. The only available identifiers are regulatory. On the regional side, only Peru provides concrete facts; the other countries in the regional impact structure have no verifiable material in the provided file.
Sources
- El Peruano te informa: consulta aquí las principales normas legales para hoy sábado 3 de octubre del 2026elperuano.pe· El Peruano
- El BCR fortalece los pagos digitaleselperuano.pe· El Peruano
- Circular N° .0026-2026-BCRPactualidadcivil.pe· actualidadcivil.pe
- Negocios obtendrán mayor transparencia sobre tarifas y comisiones de empresas de pagos digitalesinfobae.com· Infobae
- Open Banking en Perú: la hoja de ruta de la SBS y cómo se preparan los actores del mercadoligopay.pe· Ligopay
- BCRP emite reglamento para empresas que procesan pagos digitales de comercios: ¿qué cambia?gestion.pe· Gestión
- BCRP aprueba reglamento para empresas que procesan pagos digitales de comerciosforbes.pe· Forbes Perú
- ¿Compras en la bodega con QR? El BCR acaba de cambiar las reglas sobre cómo se procesan los pagosinfobae.com· Infobae
- BCRP aprueba nuevas reglas para pagos digitales y refuerza protección a los comercioselcomercio.pe· El Comercio
- BCRP: fijan nuevas reglas en pagos digitales para proteger el dinero de los comercios desde 2027larepublica.pe· La República
- El país que ya paga dos veces al día: El mapa completo de la revolución de los pagos digitales en el Perúmicrofinanzas.pe· Microfinanzas.pe
- SBS busca que bancos informen en máximo dos horas sobre caídas de sistema y otros incidentesinfobae.com· Infobae
- Pagos desde y para el extranjero: fintech compiten con la banca en costos y tiempogestion.pe· Gestión
- Tapp: Niubiz se convierte en la primera entidad de servicios de pago autorizada a operar bajo nueva regulación del BCRPinfobae.com· Infobae
- BCRP aprueba nuevas reglas para pagos digitales y refuerza protección a los comercioselcomercio.pe· El Comercio
- Resolución SBS N°02326-2026actualidadcivil.pe· Actualidad Civil
