Argentina BCRA launches anti-fraud score for transfers

The Central Bank of Argentina issued Communication A 8473 and launched a fraud-risk assessment system for electronic payments based on information the BCRA itself will provide to instant transfer administrators. The measure applies to financial institutions, PSPCPs and scheme administrators, and it is tied to a public data opening designed to detect suspicious activity, accounts linked to fraud and illegal gambling.

What changes with Communication A 8473?

The rule requires a fraud-risk score for customer onboarding, transaction monitoring and periodic review of registries, with evidence available to the Superintendency of Financial and Exchange Institutions. It also says the information and the score may be used only for the intended purposes, with traceability and safeguarding controls.

According to analysis by Bruchou & Funes de Rioja, the BCRA will provide instant transfer administrators, on a monthly and free-of-charge basis, public or aggregated information on individuals. That data must be combined with information from the Fraud Prevention Center and, eventually, with shared transaction data. From there, a score will be built for each CUIL or CUIT and made available to banks and PSPCPs that originate instant transfers.

Who does it affect, and what must they keep?

Communication A 8473 applies to financial institutions, Payment Service Providers that offer payment accounts, and instant transfer administrators. It also requires them to preserve evidence of how the score is used in key processes. They must also adopt security, confidentiality, integrity and availability measures for information, with controls over access, use, transfers and incidents.

Bruchou & Funes de Rioja says that evidence must be available for the regulator's supervision. The same analysis adds that entities covered by the rule may face sanctions under articles 41 and 42 of the Financial Institutions Law, including fines, disqualifications and other administrative measures if they fail to comply.

What deadlines did the BCRA set?

The rule sets staggered deadlines, 60 calendar days from the time administrators provide the technical documentation on the score for customer onboarding and periodic registry review, and 90 calendar days for transaction monitoring.

For instant transfer administrators, Bruchou & Funes de Rioja identifies a separate 120-day deadline from the publication of the rule to implement the scheme. Reporting in Argentina also indicated that rollout would be gradual and that, starting in September 2026, administrators would begin receiving public information to build risk profiles and distribute them free of charge to banks and PSPCPs.

How does this connect with other rules in the region?

In Argentina, Ciberseguridad Latam has been highlighting BCRA Communication A 7724 as a relevant tool in bank cybersecurity regulation and in the fight against cybercrime. At the same time, local general-interest press noted that Communication A 8471 incorporated internal and external fraud into the operational risk management framework and required anti-fraud strategies, policies and practices, along with a formal responsible structure.

In Mexico, the CNBV has also been adjusting authentication and security rules for operations conducted through technology agents and digital channels. According to Ciberseguridad Latam, those easing measures cover balance inquiries and low-risk operations, although stronger multi-factor requirements remain in place for higher-risk transactions. ZeroTrust Consulting added that some rules allow SMS to be used as an authentication factor in certain lower-risk schemes.

The SHCP's Economic Policy Criteria 2027, meanwhile, say the agency will take part in coordination and communication efforts among financial authorities to address cybersecurity incidents and will continue promoting regulatory changes in anti-money laundering and counter-terrorism financing. A Truora analysis also notes that the CNBV requires continuous identification and verification of customer identity before and throughout the entire relationship with the institution, not only at onboarding.

Operational scope, deadlines and legal background

Communication A 8473/2026 from the Central Bank of the Republic of Argentina launched a mandatory regime to prevent and mitigate fraud in electronic transfers, covering financial institutions, payment service providers that offer payment accounts and administrators of instant transfer schemes. The framework relies on a risk-profiling tool for banks and digital wallets, and it also targets accounts linked to illegal gambling.

According to El Destape, the text published in the Official Gazette refers to a technical annex that was not included in the notice, so several obligations cannot be reconstructed precisely from the official version alone. That lack of documentation leaves some uncertainty until institutions receive the operational specifications. The new regulation, however, is already in force as mandatory.

The compliance deadlines were also split. Instant transfer scheme administrators have 120 calendar days from publication to meet the new requirements, while financial institutions have 60 days and payment service providers 90 days to implement different sections once the technical documentation is received. In practice, that forces banks and fintechs to adjust internal processes in stages, not under a single general deadline.

The tool was covered by El Destape, Yogonet Latinoamérica and Rosario Finanzas, all of which linked it to the fight against fraud in electronic payments. According to those reports, broader use of public data is intended to strengthen internal transaction analysis and monitoring systems, with early detection of suspicious operations. Rosario Finanzas added that the system was presented as a way to strengthen oversight of illegal gambling transactions, with greater supervision and traceability of transactions tied to illicit activity.

Recent case law adds other precedents. In a case summarized by Infobae, an expert report concluded that the bank's electronic banking system met the technical standards required by the BCRA and showed no security failures during the period under review. Even so, the court ordered the money returned and moral damages paid to the victim. The ruling voided 17 transfers made within minutes for 176,900 pesos, according to Infobae, and held the bank responsible for customer service and for how the fraud complaint was handled.

Noticias NQN reported another case in Cinco Saltos, where a court voided an unsolicited digital loan and ordered the customer's record deleted from the BCRA's Debtors Registry. That precedent focused on how institutions apply digital onboarding and identity validation processes in remote transactions.

The trend is rounded out by the conviction of ICBC bank reported by 0264 Noticias, which included repayment of funds and a fine equal to 65 total basic baskets, plus nearly 12 million pesos. That case was presented as a sign of severe financial liability in response to security failures or cyberattack incident handling in electronic banking.