Argentina BCRA sets anti-fraud rules for banks

The Central Bank of Argentina published the implementation schedule for its operational risk management framework, which now includes fraud prevention. Communication A 8471 requires financial institutions and other payment service providers to assign specific functions, document anti-fraud programs and meet stages that begin in 2026 and continue through 2027.

What does the BCRA's new regulation add?

Communication A 8471 adds a specific Fraud Risk Management section for the first time under the Guidelines for Risk Management in Financial Institutions. According to Bruchou & Funes de Rioja, it requires a documented Anti-Fraud Program covering coordination among compliance, legal, cybersecurity and AML/CFT teams, as well as detection through technology tools, whistleblower channels, incident response protocols, training and annual review.

The law firm also outlines a three-stage rollout. Stage 3, from June 1, 2027 through August 31, 2027, is reserved for self-assessing full compliance with the applicable requirements and submitting a final report by the entities.

Who does it apply to, and what must they do?

The official text published in the Official Gazette makes clear that, in addition to financial institutions, other registered and or BCRA-authorized payment service providers must assign a fraud risk management function starting January 1, 2027. They must also carry out a fraud risk self-assessment, develop a mitigation plan and align with the technology risk and information security rules in point 6.4.

Bruchou & Funes de Rioja adds that financial institutions will have to designate a Fraud Risk Management Function, either as a dedicated unit or within operational risk. That function must develop and implement the anti-fraud program, manage the full risk lifecycle, coordinate with outside bodies, maintain a centralized incident database and lead internal training.

What kind of oversight does the BCRA want?

Specialized commentary says the framework is meant to bring prevention and detection of illicit activity into operational risk management. It also indicates that institutions will have to report fraud indicators periodically to the Board of Directors, with a focus on digital fraud and institutional coordination against new criminal tactics.

How does this connect to digital wallets and Open Finance?

At the same time, the BCRA updated its technology risk management rules and added two-factor authentication for high-risk operations in digital wallets, along with fraud mitigation measures and customer consent management, according to coverage by El Cronista, Examedia and other specialized outlets.

The regulatory agenda also includes the Open Finance model. According to El Cronista, the decree promoting that scheme names the BCRA as the implementing authority responsible for defining the parameters, standards and requirements under which individuals may share their information, with express consent, with registered financial institutions. That opens an additional compliance front in privacy and information security.

What happens with loan collection and wallets?

Communication A 8406, which creates the Transfer Collection scheme as a replacement for scheduled DEBIN, also affects fraud management and user protection. According to Mario Vadillo, the credit issuer may only debit the installment from the same bank account where the loan was credited, limiting the possibility of surprise debits from other accounts or wallets.

Econoblog added that the new scheme allows loan collection with virtual wallets at banks, but limits its use to financial institutions and non-financial credit providers authorized by the BCRA. That adds information security and fraud mitigation requirements for those operating automatic debits on accounts and wallets.