Argentina BCRA expands fraud controls to PSPs

Update September 2, 2026: The scope of Communication A 8471 has been confirmed for financial institutions, Payment Service Providers offering Payment Accounts (PSPCP), and other Payment Service Providers registered with the BCRA. A legal and technical review also confirmed that the rollout reaches full force on September 1, 2027.

The Central Bank of Argentina approved Communication A 8471, which adds a comprehensive fraud risk management framework to operational risk management for financial institutions, Payment Service Providers offering Payment Accounts (PSPCP), and other payment service providers registered with the BCRA. The rule requires a documented Anti-Fraud Program, a Fraud Risk Management Function, and a four-stage implementation schedule that ends on September 1, 2027.

What does the new BCRA rule require?

Communication A 8471 requires covered institutions to define an Anti-Fraud Program with formal responsibilities, detection procedures, reporting channels, and a centralized incident database. It also requires coordination between compliance, legal, cybersecurity, and AML/CFT teams. The rule calls for annual program reviews and allows the dedicated fraud function to be integrated into the existing operational risk unit.

According to the legal study cited, Stage 1 runs from September 1 to December 31, 2026, and requires the risk management framework, roles, appetite and tolerance, plus a preliminary identification of risks and critical processes. Stage 4 marks full force beginning September 1, 2027, giving institutions time to adapt internal controls and technology tools.

How does it affect digital wallets and payments?

In parallel, the BCRA requires interoperable digital wallets to be registered in the Interoperable Digital Wallet Registry in order to operate in the Argentine financial system, and wallets that also offer crypto assets must be registered as VASPs with the National Securities Commission. The July 2026 retail payments monthly report recorded 91 interoperable wallets and 64 payment acceptance operators.

Media coverage also attributed to the BCRA an update to technology risk rules that would add two-factor authentication for digital wallets, along with fraud mitigation measures and customer consent management. That report did not specify the applicable communication number.

What is changing in Mexico?

In Mexico, the CNBV and Banxico opened a public consultation on draft General Rules Applicable to Payment Rail Networks to limit the fees banks and issuing institutions receive for card payments. The consultation remains open until September 24, 2026 at 6:00 p.m., and the current text is still a proposal subject to comment.

The framework was softened from the initial draft and now calls for a gradual reduction. According to specialized coverage, the caps will converge at 1.30% for credit cards and 10.80 pesos per transaction for non-credit cards, with a cumulative cap of 0.30% of the total value of those operations. Another report added that after 12 months, the interim limits would fall to 1.40% and 11.80 pesos before reaching the final caps.

On authentication, an explanatory note on the reform to the Banking Single Circular says the resolution published on July 1, 2026 took effect on July 2 and gives institutions 90 business days to adapt processes, infrastructure, and protocols to the new biometric requirements. The same report says facial recognition was placed on the same legal footing as fingerprints and that cash deposits or withdrawals of 140,000 pesos or more in a single transaction will require a valid government ID and at least one biometric data point.

What other compliance rules are already in force?

In Mexico, the Mexican Stock Exchange reviews the minimum maintenance requirements for listed issuers every year, under Article 28 of the regulations applicable to issuers and other securities market participants issued by the CNBV. For SOFOM ENR entities, customer identification and compliance obligations are mainly based on Article 95 Bis of the General Law on Credit Auxiliary Organizations and Activities, under CNBV supervision, including onboarding and digital signature.

Additional details on Communication A 8471 and the Mexican reform

Communication A 8471 was published in the Official Gazette on September 1, 2026, with an official notice date of August 27. The Central Bank of Argentina text explicitly brings internal and external fraud into operational risk and links it to the assessment of capital adequacy against those events. It also requires semiannual reports to the Board for operational risk and quarterly reports for fraud.

The monitoring scheme set out by the rule adds key indicators, relevant incidents, metrics, corrective measures, newly detected methodologies, and opportunities for improvement. The documented anti-fraud program also includes coordination between areas, reporting channels, incident protocols, training, and annual review.

In Mexico, the CNBV published a resolution on September 1, 2026 that amends the General Rules Applicable to Credit Institutions and allows tokens or confirmation codes to be sent by SMS to the customer’s registered mobile phone for certain transactions. According to the coverage reviewed, the resolution took effect on September 2, 2026.

UNO TV reported that the change allows banks to send security codes by SMS to authenticate certain digital transactions. ABC Noticias, meanwhile, said the CNBV authorized sending tokens or confirmation codes by SMS to the customer’s registered mobile phone, within the secondary banking authentication regime.

More details on the Mexican reform and the BCRA timeline

In Mexico, the CNBV change allows authentication codes to be sent by SMS for certain transactions carried out through technology-based intermediaries. Coverage from MSN México said the rule took effect the day after publication and began being applied on September 2, 2026. Under that same framework, the exception for balance and transaction inquiries allows institutions to request only Authentication Factor Category 2, without also requiring the Category 3 second factor.

Startup Researcher added that SMS was enabled as an additional channel for delivering Category 3 authentication factors to the customer’s registered mobile number, preserving the factor scheme and reinforcing authentication traceability. Uno TV said the change required operational adjustments to apps and websites, and recommended keeping the registered mobile number up to date and enabling alerts to detect unrecognized transactions.

In Argentina, Communication A 8471 sets a first stage between September 1, 2026 and December 31, 2026 to define structure, anti-fraud strategies, policies, roles, responsibilities, risk appetite and tolerance, and a preliminary identification of risks and critical processes. It also adds a self-assessment and final report window between June 1, 2027 and August 31, 2027, before full force begins on September 1, 2027.

The timeline is broken into three concrete moments. First, the initial stage. Then, the self-assessment and final report. Finally, full force. The Official Gazette backed that schedule, while the specialized legal analysis highlighted that the process closes on September 1, 2027.

A specialized report on Banxico, attributed to Capital Negocios, said the central bank would have issued circulars and rules to strengthen minimum cybersecurity requirements for regulated entities, including IFPEs and IFCs. The same report said the framework is based on international standards, business continuity, and incident reporting within specific deadlines. According to that publication, the stated goal of those changes is to improve the operational resilience of the payments ecosystem.

Operational scope and regulatory crossovers

Communication A 8471 adds a dedicated section on fraud risk management to the Guidelines for Risk Management in Financial Institutions for the first time. According to Bruchou & Funes de Rioja, the framework requires a documented Anti-Fraud Program that coordinates compliance, legal, cybersecurity, and AML/CFT functions, with detection supported by technological tools, reporting channels, incident response protocols, training, and annual review.

That same legal study describes a three-stage implementation plan. Stage 3, from June 1, 2027 to August 31, 2027, is reserved for self-assessment of full compliance with the applicable requirements and the submission of a final report by the institutions.

The official text published in the Official Gazette also makes clear that, starting January 1, 2027, other payment service providers registered and or authorized by the BCRA must assign a fraud risk management function, perform a fraud risk self-assessment, develop a mitigation plan, and align with the technology and information security risk rules in point 6.4. Bruchou & Funes de Rioja adds that this Fraud Risk Management Function must coordinate with outside bodies, maintain a centralized incident database, and lead internal training.

The regulatory agenda is also linked to an Open Finance decree. According to El Cronista, that framework designates the BCRA as the implementing authority in charge of defining the parameters, standards, and requirements under which people may share their information, with express consent, with registered financial institutions. At the same time, Communication A 8406, which creates the Immediate Collection scheme as a replacement for scheduled DEBIN, also affects fraud management and user protection.

On that point, Mario Vadillo said the credit issuer may only debit the installment from the same bank account where the loan was disbursed, limiting the possibility of surprise debits from other accounts or wallets. Econoblog, meanwhile, said the new framework allows loan collection with virtual wallets at banks, but only for financial institutions and nonfinancial credit providers authorized by the BCRA.

More on the timeline and anti-fraud controls

Communication A 8471 added Section 6.5, "Fraud Risk Management," to the consolidated text "Guidelines for Risk Management in Financial Institutions" of the Central Bank of Argentina. The regime also sets that between 09/01/2026 and 12/31/2026 institutions must establish the operational risk management framework, including fraud risk prevention, and between 01/01/2027 and 05/31/2027 they must document processes and procedures for identifying, assessing, monitoring, controlling, and mitigating operational and fraud risks in critical processes.

The final stretch of the schedule, from 06/01/2027 to 08/31/2027, is reserved for the self-assessment of full compliance with Section 6. Full force then begins on 09/01/2027. According to the Official Gazette, there will be several adjustment stages before that point for financial institutions and other covered actors.

Communication A 8473 tightens controls on instant transfers to manage fraud risk and detect possible accounts linked to suspicious transactions and illegal gambling activity. Implementation will be gradual starting in September 2026. According to an official BCRA press release in English, instant transfer administrators will receive a set of public data to strengthen their analysis and monitoring tools.

With that information, those administrators must build fraud risk profiles by person and make them available at no cost to financial institutions and PSPCPs for transaction monitoring, onboarding, and periodic KYC reviews. The new Immediate Collection scheme replaces Immediate Debit and was designed with specific operating limits: debit authorization can only be made from the account where the credit was disbursed, installments must be fixed and identical, and a cap of 30% of the customer’s declared income applies.

In addition, collection attempts are limited to one on the due date and two retries at 48 and 96 hours. The debit must also be notified one business day in advance, and immediate stop-debit is available through digital channels. According to Blog del Contador/SIAP, the process will have no reversals and liability for fraud will fall on the institution or provider that orders the collection.