BCRA and CNBV tighten anti-fraud rules

Update September 7, 2026: The BCRA added a comprehensive fraud-risk management framework for banks and payment service providers that offer payment accounts, and clarified that risk profiles built from public information will be used for transaction monitoring, onboarding and KYC reviews. In Mexico, the CNBV said balance inquiries can be made with a category 2 authentication factor.

The Central Bank of Argentina added Section 6.5 on fraud-risk management to its Guidelines for Risk Management in Financial Institutions. At the same time, through Communication "A" 8473, it launched a public database to detect suspicious activity tied to fraud and illegal gambling. In Mexico, the CNBV revised the rules so banks can send security codes by SMS and simplify some balance inquiries.

What does the BCRA require from banks and PSPs?

The new Section 6.5 requires financial institutions to maintain a documented antifraud program, with coordination across compliance, legal, cybersecurity and AML/CFT teams. It also calls for technology-based detection procedures, reporting channels, incident response protocols, training and an annual review. The text also strengthens the link between operational risk management, regulatory compliance and cybersecurity.

Communication "A" 8471, issued on August 27, 2026, introduced a comprehensive fraud-risk management framework for banks and for payment service providers that offer payment accounts, known as PSPCPs. According to the BCRA, fraud-risk profiles generated from public information can be used for transaction monitoring, customer onboarding and the periodic reviews required under know-your-customer rules.

The timetable in Communication "A" 8471, published in Argentina’s Official Gazette, sets a window from September 1, 2026 to December 31, 2026 for institutions to define their antifraud structure, policies and practices, roles and responsibilities, risk appetite and tolerance, and to identify operational and fraud risks linked to products, services, processes, digital channels and critical processes. Starting January 1, 2027, payment service providers registered or authorized by the BCRA that were not previously covered must assign a specific unit or owner, conduct a self-assessment, develop a mitigation plan and comply with point 6.4 on technology and information security.

How will the BCRA public database work?

Communication "A" 8473 says immediate transfer administrators will use a new public database to detect accounts linked to fraud and illegal gambling, and that they may alert banks and digital wallets. According to the cited coverage, the stated goal is to stop online scams and fight illegal gambling by identifying accounts that channel funds to unauthorized betting sites.

According to the published information, Coelsa, NewPay, Red Link and Interbanking will use that database to build person-level fraud-risk profiles. Those profiles will be available at no cost to financial institutions and PSPs for daily transaction monitoring and customer onboarding.

The BCRA’s official English-language notice added that those fraud-risk profiles will be used for transaction monitoring, onboarding and periodic KYC reviews, and that the rollout will be gradual.

What changed in Mexico with the CNBV?

Mexico’s National Banking and Securities Commission changed the rules for credit institutions to allow security codes, a category 3 authentication factor, to be sent by SMS, email or encrypted instant-messaging services. For higher-risk transactions, combined authentication factors remain in place.

The amendments to Articles 319 Bis 2, 319 Bis 3 and 319 Bis 5 also allow balance and transaction inquiries through technology-based commission agents to rely only on a category 2 authentication factor. Specialized outlets in Mexico say institutions will need to update apps, security policies, customer notices, authentication logs and the mechanisms used to change factors and contact methods.

The resolution amending Articles 319 Bis 2, 319 Bis 3 and 319 Bis 5 also explicitly incorporates technology-based commission agents and defines the set of operations they may perform, including opening low-tier accounts, related transfers, loans of up to 3,000 UDIs, payments for goods and services, and balance and transaction inquiries.

The text published from the Official Gazette says the regulatory goal is to create a differentiated authentication scheme for lower-risk operations, such as inquiries made through technology-based commission agents. That reflects a risk-based approach by transaction type within digital banking and fintech.

The changes also let users check account balances through apps and technology-based commission agents using only a Category 2 Authentication Factor, meaning a password or PIN, without requiring the category 3 factor for that specific operation.

The CNBV resolution states in its sole transitional article that the new rules on sending authentication factors and using SMS take effect on September 2, 2026. Expansión and XEU added that from that date, banks may send by SMS one of the codes used to verify a customer’s identity in certain transactions carried out through technology-based commission agents, including mobile apps and websites.

What regional impact does this round of changes have?

The measures in Argentina and Mexico are pushing banks, wallets and payment service providers to strengthen fraud controls, authentication and traceability for digital transactions. In Argentina, the focus is on risk governance, internal coordination and sharing fraud signals. In Mexico, the change centers on expanding channels to deliver authentication factors and adjusting verification schemes for digital operations.

What does the resolution changing the general rules for credit institutions say?

The CNBV resolution changes the general rules applicable to credit institutions to allow new authentication schemes for digital transactions. In particular, it authorizes sending security codes by SMS and adjusts authentication for balance and transaction inquiries made through technology-based commission agents.

The text amended Articles 319 Bis 2, 319 Bis 3 and 319 Bis 5, and stated that category 2 authentication should be used for certain balance inquiries. It also explicitly incorporated technology-based commission agents and defined which operations they may perform, including opening low-tier accounts, related transfers and balance and transaction inquiries.