BCU tightens electronic instrument security

The Central Bank of Uruguay has changed the security rules for electronic instruments and, starting Oct. 1, 2026, will require stronger authentication to access digital channels, make transfers or payments from bank accounts, request remote loans, and access, modify or update sensitive data. The update was announced in Circular No. 249, which reported changes introduced by Resolution No. 2025-744 of the Superintendency of Financial Services.

What changed in the security controls?

The new wording of articles 364 and 364.1 of the Compilation of Standards for Regulation and Control of the Financial System introduces stricter requirements for issuers. In addition to stronger authentication, article 364 now requires a monitoring and control system capable of detecting irregular activity linked to the use of the instrument or its environment, including changes and attempted changes to passwords and contact details.

What sanctions does the BCU set out?

Failure to comply with articles 364 and 364.1 can be punished with a fine ranging from 1/10,000 to 2/1,000 of the basic patrimonial responsibility for banks, according to the coverage consulted. That penalty structure accompanies the regulatory tightening the Uruguayan regulator applied to electronic instruments.

What other recent moves did the regulator make?

The BCU also approved a Governance Framework for the use of artificial intelligence, which covers information security, compliance with applicable rules, robustness, resilience, continuous monitoring and response to failures or vulnerabilities, according to Búsqueda. The framework also requires every AI system deployed or under development at the agency to be recorded in an institutional inventory as a mandatory minimum control, regardless of risk level. The coverage adds that the framework includes traceability mechanisms to reconstruct the decisions and outputs generated during the life cycle of AI systems the agency develops or contracts.

At the same time, El Observador reported that the BCU imposed a fine of 325,000 Indexed Units on Avenida S.A. after rejecting its defenses. According to that report, the company handed over cash received from abroad to a person who was neither an authorized representative nor formally linked to the customer, without applying due diligence.

As a compliance benchmark for the public sector, El Observador said only 10 of 244 state bodies were complying with the decree that requires two-factor authentication, based on data previously published by Búsqueda.