Peru's SBS opens open finance consultation

Peru’s SBS authorized a public consultation on the second block of the draft General Regulation for the country’s Open Finance System. The proposal covers digital infrastructure, a trust framework and standards, along with security and data quality. According to El Peruano, the comment period is open for 18 calendar days, while Andina said input on Titles V through VII may be submitted until Nov. 6, 2026.

What does this second regulatory block include?

The second round of proposed rules covers the technical and governance pieces that would support the open finance framework. According to specialized coverage by TokenPost, the package includes a participant directory, a developer portal, data exchange interfaces, and security and data quality requirements.

The publication keeps the proposal in public comment stage. Actualidad Civil reported that the SBS authorized release of the draft for consultation, allowing interested parties to submit observations before the final version.

How long can input be submitted?

The period reported by local media is 18 calendar days, according to El Peruano. Andina added that input on the consultation for Titles V through VII will be received until Nov. 6, 2026, and then reviewed before the final version of the rule is issued.

What other supervisory front is appearing in parallel?

The SBS is also monitoring a reported information exposure incident linked to Interseguro. The Rio Times said the agency began follow-up and supervisory actions after notification of an alleged data theft and will assess the source of the incident, the data compromised, forensic results, preventive measures, and compliance with information security and cybersecurity rules.

That episode was also covered by DigiSERT, which reported that Interseguro blocked compromised access, renewed credentials and security keys, hired international specialists, and notified authorities. The same source said policies, coverage, claims handling, and benefit payments continued to operate normally.

DigiSERT added that, in a preliminary analysis, Interseguro said the compromised data was mainly identification, contact, and policy numbers, and that the incident appeared limited to its own systems, without affecting other companies in the group. The source presented that attribution as preliminary, not as a definitive confirmation.