Argentina's BCRA tightens transfer controls

Update September 16, 2026: The BCRA clarified that Communication "A" 8473 imposes a mandatory risk score for immediate transfers and set staggered deadlines for payment scheme administrators, banks and payment service providers. More details also emerged on how the score will be fed and where it must be used.

The Central Bank of the Argentine Republic has published Communications "A" 8472 and 8473, two nationwide rules that affect financial reporting and registration, the operations of payment service providers, and the fraud prevention framework for electronic transfers. Taken together, the measures change rules for off-bank collection companies, complementary agencies, digital wallets, banks and administrators of immediate transfers.

What changed with Communication A 8472?

Communication A 8472 amended three BCRA ordered texts, on Complementary Financial Services and Permitted Activities, Expansion of Financial Institutions, and Payment Service Providers. According to the Official Gazette and the regulatory summaries cited, the rule redefines the role of off-bank collection companies and allows complementary agencies registered as collection companies to outsource services to individuals or legal entities, with prior approval from the financial institution and under the same conditions required of the agency.

The change also broadens the operating scope of financial institutions and payment service providers that use complementary agencies. The new wording defines off-bank tax and utility collection firms as providers of payments and collections on behalf of third parties, with networks of their own or third-party agents and payment methods such as cash and other instruments. AXI and Siap Blog del Contador described the measure as an update to the rules for off-bank collection companies and complementary agencies.

Who is covered by the new anti-fraud framework?

Communication A 8473 creates a mandatory fraud prevention and mitigation regime for electronic transfers that applies to financial institutions, payment service providers that offer payment accounts, and administrators of immediate transfer schemes. Kori reported that the BCRA approved new measures to reduce fraud in electronic payments through a mandatory individual risk assessment for immediate transfers.

According to those analyses, the framework will be used in transaction monitoring, new customer onboarding and the periodic reviews required under know-your-customer, or KYC, rules. Specialized coverage added that immediate transfer administrators, including Coelsa, NewPay, Red Link and Interbanking, will be responsible for generating and distributing risk profiles for each person.

The technical and legal analysis published by abogados.com.ar says the new score will draw on three inputs: public information provided by the BCRA, data from the Fraud Prevention Center and transactional information that the scheme administrators agree to share with one another. The result will be made available to financial institutions and PSPCPs monthly and at no cost, through a file and an API.

Another report, from Urgente24, said the fraud risk score will be calculated for each individual person's CUIL or CUIT and that institutions will not be allowed to rely exclusively on that score, to avoid automatic account blocks or transfer rejections based only on the assigned risk level.

How is it being implemented, and what deadlines did the BCRA set?

The scheme will be rolled out through monthly files and an API that immediate transfer administrators will use to distribute scores and risk profiles to institutions, according to the technical analysis published by The Metal Vortex and the legal analysis from abogados.com.ar. That same analysis says banks and PSPs cannot decide solely on the score and must retain their own responsibility, along with evidence that the information was used properly.

The deadlines are staggered as well. Kori said administrators of immediate transfer payment schemes have a specific deadline to build the technical infrastructure for the risk assessment system. Financial institutions and payment service providers also have 60 calendar days to implement the items in sections 5.1 and 5.3 of the annex, and 90 calendar days for section 5.2, counted from receipt of the corresponding technical documentation.

The legal analysis from abogados.com.ar added that administrators of immediate transfer payment schemes have 120 calendar days from the communication's publication to develop the score infrastructure. Financial institutions and PSPCPs must then incorporate it into customer onboarding and periodic portfolio review processes within 60 calendar days, and into transaction monitoring schemes within 90 calendar days, starting when they receive the administrator's technical documentation.

What does this have to do with technology controls in the financial system?

Microjuris linked these decisions to the ordered text on minimum requirements for managing, implementing and controlling risks related to information technology, information systems and associated resources for financial institutions, tied to Communication A 6017. That regulatory framework already requires banks to maintain security systems that protect consumers from cyberfraud.

At the same time, specialized coverage in payments and online gambling said the risk profile framework is also aimed at detecting fraud and accounts used for betting and illegal gambling. In that line, Yogonet's reporting said the additional public information made available to immediate transfer administrators will be part of a broader strategy against fraud and illicit operations in the payment system.