BCU sets rules for critical outsourcing

Uruguay’s Central Bank financial supervision unit has published a new draft rule on outsourcing services for supervised institutions in the financial system, securities market, insurance, reinsurance, and pension funds. The proposal covers risk management, technology, and information security services, and sets a minimum prior notice period of 180 calendar days for certain cases involving customer data, operations, or critical technology infrastructure.

What services fall under this draft?

The scope includes outsourcing tied to risk management, technology, and information security, according to the material reviewed. It also covers certain services linked to hosting or large-scale processing of customer or operational data, as well as changes to critical technology infrastructure.

PPV Abogados’ analysis adds that the draft does not treat all services the same. In some cases, the main requirement is prior notice to the regulator, while in others the enhanced 180-day period is triggered.

What happens with SaaS and PaaS?

The analysis of the BCU proposal says SaaS and PaaS are exempt from the 180-day period under certain conditions. If those services do not handle customers’ personal data, or if that data is separated, they should be reported before contracting, but without the enhanced notice period.

That distinction makes the rule more specific for cloud setups and outsourced services that do not, according to the cited analysis, carry the same level of exposure for personal data. The material does not add further details on additional requirements or on the final text the BCU may eventually approve.

How does this connect to Uruguay’s regulatory agenda?

The BCU proposal comes alongside a recent anti-money laundering reform in Uruguay that, according to El Observador, expanded the scope of covered entities and tightened several control obligations. That coverage places technology and information security within a broader regulatory agenda for supervised entities.

According to the account summarized by El Observador, Law No. 20,469, approved on March 19, 2026, amended the Comprehensive Anti-Money Laundering Law No. 19,574. The specialist cited by the outlet said it added certain cybercrimes as predicate offenses for money laundering when they exceed 100,000 indexed units, and expanded the exposure of directors and senior management to sanctions for preventive failures.

The same coverage said the reform also added public bodies, non-state public entities, and companies with state participation as new reporting entities. It also strengthened the confidentiality of suspicious transaction reports and established mandatory cooperation between public agencies, prosecutors, the FIU, and SENACLAFT.

The text reviewed by El Observador also noted other changes, including extending the deadline for the FIU to block suspicious transactions from 72 hours to five business days, adding parallel asset investigations to criminal cases, and allowing expanded forfeiture of assets whose lawful origin cannot be justified, even when they are held in the name of third parties or nominees.