Paraguay tightens cyber rules

The Central Bank of Paraguay clarified that, in response to media questions about Resolution SB.SG. Nº 00105/24, it can provide information and opinions on the financial system as a whole, but not on a specific financial institution. At the same time, DNIT has rolled out new reporting obligations for cryptoassets, and Paraguay’s financial system is moving ahead with rules on data, supervision and digital fraud prevention.

What did the BCP say about the ongoing debate?

The Central Bank of Paraguay said its mandate allows it to speak about the financial system in general, but not to make specific comments about one institution. That clarification came in response to media questions linked to the application of Resolution SB.SG. Nº 00105/24, amid public debate over software investments and supervision rules.

The BCP’s clarification aligns with other institutional positions that have been shaping Paraguay’s financial agenda. At a public hearing on a draft "Cybersecurity Law," participants said the text raises concerns about possible impacts on the financial sector, which is also governed by the Banking Law and by specific rules regulated and enforced by the Central Bank and the Superintendency of Banks.

What changed for cryptoasset operations?

DNIT activated General Resolution No. 47/2026, which requires cryptoasset transactions to be reported and information to be filed on who is operating, how much is being moved, from which wallets, and to where the assets are transferred, all through the Marangatu system.

According to the same resolution, as reported by En Paraguay Net, the first filing for fiscal year 2026 must be submitted in March 2027. The requirement applies to owners, administrators or responsible parties for cryptoasset platforms operating in Paraguay, as well as individuals, legal entities and other organizations that carry out these transactions.

The resolution also sets a $5,000 annual threshold for transactions carried out from Paraguay, above which individuals and legal entities must report their activity, even if they operate without a platform or through nonresident platforms, including direct transfers between private parties.

How is the relationship between banks and DNIT evolving?

DNIT and Asoban are advancing a secure information-sharing project that includes end-to-end digital encryption, full audit trail traceability and unified, automated standards for data transmission.

InfoNegocios Paraguay described the agreement as a new stage in the relationship between the tax authority and the financial system, with expected effects on taxpayer audits through the use of bank data and the automation of control processes. In parallel, the Central Bank of Paraguay and the Superintendency of Banks said a draft regulation for Law No. 6,534/2020 on Credit Personal Data Protection is being socialized, with the goal of setting modern risk-based supervision standards aligned with international practices.

What new demands are being added for banks and financial institutions?

Paraguay’s financial sector is facing an additional layer of requirements from the convergence of new Law No. 7,593/2025, Law No. 6,534/2020 and the supervision and control initiatives being pushed by the BCP, the Superintendency of Banks and other agencies.

A specialized analysis published by Forbes Paraguay said those rules will force banks to review models that intensively process personal data, build privacy controls into systems from the design stage and strengthen cyber defenses to comply with principles of data minimization, transparency and proactive accountability. At the Paraguay Banking Convention 2026, participants also discussed the impact of the new data protection law on the banking operating model, with expected changes in digital onboarding, credit scoring and online banking.

Local banks are also presenting themselves publicly as technically prepared for that scenario. Asoban president Osvaldo Serafini said the country’s banking sector has strong international certifications and robust technological risk management, in the context of an analysis of virtual protection and the new local economic order.

What other digital oversight fronts are appearing in Paraguay?

SEPRELAD takes part in forums such as the Paraguay Blockchain Summit, where it outlines financial supervision challenges tied to digital innovation, with a focus on technological risks and new forms of financial activity.

At the same time, the BCP has issued recent warnings about fraudulent websites that imitate legitimate banking services and recommended carefully checking the pages used for home banking, as well as avoiding access through suspicious links, even when they come from search engines. In another official communication, it urged people to verify the authenticity of loan offers received through digital channels and to check the BCP registry of entities before signing up for financial services, as a preventive measure against online fraud.