Peru's SBS Regulates BaaS and Tightens Controls

Peru’s SBS has rolled out a package of regulatory changes covering Banking as a Service, approvals for new financial and insurance entities, cooperation with the Public Ministry, and new anti-money laundering and counterterrorism financing measures. The revised framework also keeps registration obligations in place for virtual asset providers that serve Peruvian residents, according to the material reviewed.

What does the new BaaS rule set establish?

Resolution SBS No. 01747-2026 creates an operating framework for Banking as a Service models in Peru and applies to entities that choose to participate in that segment. According to Ozone API, it requires board-approved policies, prior risk assessment, continuous monitoring of each third-party service recipient, risk reports by service to the SBS, contracts with at least seven minimum clauses, and a semiannual publication of the list of active recipients.

Ozone API says the rule takes effect on December 30, 2026, 180 days after publication, and sets adaptation deadlines for financial entities that want to operate under the scheme. The same analysis says the registration process is divided into two phases, organizational and technical, with board approval, a new-product risk report under Circular G-165-2012, FAPI 2.0 certification, an SFA compliance report, technical registration in the SBS central directory, technical onboarding on authorization servers, metadata and certificates, and sandbox testing for compliance, interoperability, security, and user experience.

The Ozone API note also details which uses the framework permits. These include savings accounts, term deposits and CTS accounts, electronic money accounts, lending, credit and debit cards, insurance products provided by banks, and embedded finance schemes routed through third parties. It excludes correspondent agents, ATMs, payment aggregation and disbursement services, and wallets that only tokenize credentials, which will remain under other regulatory regimes.

What changed for new financial and insurance firms?

The SBS formalized an overhaul of the authorization rules for new companies in the financial and insurance systems, with three filing paths and different deadlines. The update adds a standard procedure, one for non-deposit-taking companies, and a special authorization, according to El Peruano.

Infobae Peru reports that the reform also adds a mandatory prequalification stage of up to 15 days before applications for organization and operation are reviewed. It also says companies seeking to operate in lending can temporarily access the SBS Consolidated Credit Report during the process, with anonymized data and security safeguards.

If final authorization is not granted, the company must delete all information obtained and remains liable for any leaks, according to Infobae Peru. The change is designed to speed up reviews while keeping controls over the use of sensitive data during the process.

What steps did the SBS take against money laundering and fraud?

The SBS and the Public Ministry signed an interinstitutional cooperation agreement to strengthen joint work against money laundering, terrorist financing, extortion, computer fraud, and other forms of organized crime. According to El Peruano, the agreement enables mechanisms that give the Public Ministry secure access to the Web Risk Center, the Web Pension Consultations Module, and information tied to the private pension system.

The Andean News Agency also reported that the SBS published a draft rule on money laundering and terrorist financing in the prepublication section of its institutional website. The document is meant to reinforce the prevention framework for supervised entities and opened a period for stakeholder comments.

Coinfomania said the draft specifically targets businesses linked to chemical inputs and regulated goods, with the goal of preventing misuse in activities such as illegal mining and drug trafficking. At the same time, Cuánto está el dólar reported that the SBS is adjusting its supervision and regulation mechanisms for the Open Finance model, on the basis that financial information should be used only for the purposes authorized by the customer and that security is central to the process.

What happens with virtual asset providers?

Since the entry into force of the regulation implementing Law No. 31670, virtual asset service providers that operate with Peruvian residents must register with UIF-Peru, which is part of the SBS, and comply with suspicious transaction reporting obligations, according to Peru Yield Desk. The same analysis says the absence of registration does not automatically make the activity illegal, although it reduces users’ avenues for recourse in potential disputes.

Peru Yield Desk recommends checking whether platforms appear in the public registers of UIF-Peru or the SBS, confirming that local-currency payment rails rely on direct bank integrations rather than only P2P markets, and reviewing the date and scope of the latest published smart contract audit. It also says there is no general ban on Peruvian residents using DeFi protocols, but providers that offer those services professionally to Peruvian users are subject to registration duties and LA/FT obligations under Law No. 31670.

What other administrative changes did the SBS publish?

Perucontable reported that the SBS issued new guidelines for accounting for payments made by supervised entities in tax disputes. The measure requires a separate report on individual tax disputes in which prior payments have been made, strengthening documentation and reporting obligations for companies in the financial system.

Taken together, the measures outline a broader SBS regulatory agenda for Peru, with an emphasis on third-party oversight, controlled use of financial information, secure access to data, and traceability in sectors more exposed to operational and compliance risk.