BCRA tightens fraud controls on transfers

The Central Bank of the Argentine Republic published the schedule for Communication A 8471 and, at the same time, advanced Communication A 8473, which adds a specific fraud risk management section and creates a risk profiling system for instant transfers. The framework applies to financial institutions, instant transfer administrators, and payment service providers that offer payment accounts.

What changes with Communication A 8471?

Communication A 8471 adds a specific section on fraud risk management within the "Guidelines for Risk Management in Financial Institutions." According to Cibersecurity Latam’s summary of the BCRA notice, that addition establishes obligations for financial institutions and other payment service providers.

The official publication places the measure within a broader risk management policy. In that same line, the BCRA said in its English-language portal that the strategy is aimed at strengthening fraud prevention in electronic payments.

How does the new fraud score work?

Communication A 8473 establishes a fraud risk profile system for instant transfers and a public database that instant transfer administrators will use to detect suspicious activity linked to fraud and illegal gambling. According to the BCRA, starting in September 2026 the Central Bank will make public information available so those administrators can build person-level risk profiles.

Bruchou & Funes de Rioja said the new score must be included as a mandatory input in new customer onboarding, account opening, and transaction monitoring processes. Los Primeros TV added that administrators, including Coelsa, NewPay, Red Link, and Interbanking, will be able to use the database to alert banks and digital wallets.

Urgente24 also reported that implementation will be gradual and that the goal is to detect accounts linked to suspicious transactions and illegal gambling. The BCRA, for its part, framed the measure as part of a broader strategy against fraud in electronic payments.

What control requirements does the rule impose?

Bruchou & Funes de Rioja said instant transfer administrators, financial institutions, and PSPCPs must apply security, confidentiality, integrity, availability, and safeguarding measures so BCRA information and the score are used only for the intended purposes. The analysis also requires controls and traceability for access, use, transfers, and incidents, with evidence available to the Superintendency of Financial and Exchange Institutions.

That regulatory reinforcement rests on concrete audit and compliance obligations for the actors in scope. In practice, the rule pushes transaction monitoring, customer onboarding, and periodic KYC reviews to incorporate the new risk input.

What does the Mexico case show about this regulatory pressure?

A private regulatory compliance case study reported that a CNBV audit of a Mexican financial group found the absence of a formal vulnerability management program, manual security reporting, and 47 critical vulnerabilities left unremediated. According to that case, the group accelerated the rollout of a cybersecurity program with vulnerability management, a 24/7 SOC, and automated regulatory reporting.

The same case says the 47 critical vulnerabilities were remediated in 90 days and that the audit was then approved. Meanwhile, Xataka México reported that the CNBV changed authentication rules for banking operations carried out through third-party apps or websites, with publication on September 1, 2026 and entry into force the next day.

ZTC Cyber Intelligence added that Mexican regulation allows SMS for certain authentication factors in schemes involving technology-based commission agents, a detail that provides technical context for the regulatory shift in that country.

Official confirmation and operational scope

The BCRA said on its official site on September 3, 2026, that it will strengthen its fraud prevention strategy and that instant transfer administrators will use public data to build a person-based fraud risk score. Coverage from LmNeuquen had already reported that the agency would tighten controls over instant transfers in Argentina, while State-of.biz added that the scheme will allow detection of unusual patterns and flows linked to illegal betting.

That profiling is tied to a concrete use within operations. According to an independent legal and technical analysis of Communication A 8473, the fraud risk score will be a mandatory input for new customer onboarding and transaction monitoring in instant transfers. Bruchou & Funes de Rioja also said the tool is part of a stricter control framework for this type of transfer.

The regulatory pressure comes amid active phishing and backdoor campaigns targeting organizations across Latin America, including banks and financial services, according to ANY.RUN. The company said one of those campaigns uses lures such as fake tax documents and DocuSign-style notifications, and described a four-stage infection chain.

ANY.RUN assigned the activity medium-confidence attribution consistent with Silver Fox or Winos4.0 tradecraft, while noting that the attribution is not confirmed. It also said the campaign’s stated goal is to gain persistent remote access, raising the exposure of financial institutions in the region to intrusions with real persistence.

In Honduras, La Prensa Honduras reported a purported network of six computer fraudsters that allegedly used phishing to enter a victim’s online banking and carry out 17 transfers totaling more than L586,000 in 41 minutes, according to the investigation cited by the outlet. That case shows how quickly these operations can unfold once access to an account is achieved.