Peru's BCRP and SBS tighten payment rules

The Central Reserve Bank of Peru approved Circular No. 0026-2026-BCRP, which establishes the rules for the Payment Acceptance Service for payment service providers and payment infrastructures. The regulation adds requirements for risk and fraud management, information security, complaints handling, and participant responsibilities. It takes effect on Jan. 1, 2027.

What does the BCRP regulation require?

The regulation requires transaction data covered by the rule to be kept for five years under security measures. It also allows firms to request a transition period of up to 90 calendar days from the BCRP, as long as the request includes supporting documentation and a work plan. It also introduces minimum standards that apply regardless of the payment infrastructure used.

According to Cuatrecasas' analysis, the main regulatory areas include the handling and protection of funds, along with the segregation, administration and reconciliation of funds intended for merchants. The firm also pointed to evaluation and traceability obligations through the retention of transaction records. El Comercio added that payment infrastructures that enable the service must have specific rules and procedures for the flow of information and funds, the assignment of responsibilities among participants, settlement mechanisms, risk and fraud management, and complaint and dispute handling.

Infobae Peru also reported that the operational scope includes payments made through cards, QR codes, instant payments and other instruments. The same coverage said acquirers must verify the existence of the business, its economic activity and the ownership of the accounts used.

What changes for open finance?

The SBS authorized public consultation on the draft General Regulation for the Open Finance System through SBS Resolution No. 02433-2026. The text foresees financial data sharing only with prior user authorization and sets rules on system security, data integrity and user protection.

According to Infobae Peru, banks, finance companies, insurers and private pension fund administrators would only be allowed to share customer information when there is prior, free, informed, specific and unambiguous consent from the user. The coverage also said the SBS could suspend an entity's authorization for up to 120 calendar days if it detects risks to system security, data integrity or user protection.

The draft is set to take effect on Jan. 1, 2028, while the start of the entity registration process is scheduled for Aug. 1, 2027, according to the same reporting.