BCRA tightens anti-fraud controls in payments

The Central Bank of Argentina (BCRA) formalized a new fraud risk assessment framework for electronic transfers on September 10, 2026, through Communication A 8473 published in the Official Gazette. The rule covers financial institutions, administrators of electronic funds transfer payment schemes, and payment service providers that offer payment accounts. It requires them to combine the score with their own due diligence and monitoring controls.

What changes with Communication A 8473?

The short answer is that the fraud risk score becomes a mandatory operational tool, but it cannot be used as the only criterion for decisions about customers. The BCRA said financial institutions and PSPCPs must continue applying their own due diligence mechanisms, transaction monitoring, enhanced analysis, and mitigation measures.

According to Urgente24, the BCRA will provide the information needed to build that score every month and at no cost to administrators of immediate transfer payment schemes. The score will then be delivered free of charge to financial institutions and PSPCPs through a monthly file with CUIL and CUIT data, plus an API for checking the updated value.

KPMG Argentina said Communication A 8473 introduced specific provisions to reduce fraud, and that implementation deadlines vary depending on the type of regulated entity and obligation involved. Urgente24 said administrators of payment schemes have 120 calendar days from publication to comply, which sets the first adaptation milestone in January 2027.

What deadlines do banks and PSPCPs have?

Financial institutions have 60 days to add the score to customer onboarding and periodic review processes, and 90 days for transaction monitoring, counted from the moment they receive the technical documentation required under Communication A 8473. That sequence leaves banks and payment providers dependent on the prior delivery of technical inputs by scheme administrators.

What did Communication A 8477 add?

Communication A 8477, published in the Official Gazette on September 18, 2026, updated SINAP Circular 1-255 on National Payment System Rules and Complementary Provisions. Indicadores.ar said the measure introduced replacement pages in the circular in line with Communication C 102183 and aimed to keep Argentina’s digital payments legal framework consistent.

The update applies to banks, electronic transfer networks, payment scheme administrators, and payment service providers, including digital wallets, according to that specialized outlet and the Official Gazette itself. On the same date, the agency also published Public Tender 36/26 to hire cybersecurity monitoring and detection services for 24 months, along with specialized consulting to strengthen its incident management model for up to 165 business days.

What does the parallel move show?

The regulatory and operational package is complemented by CERT.ar’s publication space, which keeps guides, recommendations, and best practices on incident prevention and response for different sectors, including finance. In Argentina’s case, the sequence shows a simultaneous tightening of controls, regulatory updates, and internal monitoring capacity.

By contrast, the materials reviewed on Mexico point to broader financial oversight, but not to new public cybersecurity rules comparable to the BCRA’s technical communications. Noticias de la Nación reported, without official confirmation in that coverage, a temporary management intervention at CIBanco and Intercam Banco, while El Heraldo de México and Kilómetro Cero described budget cuts and a wider hardening of the banking ecosystem after FinCEN’s allegations.