Peru's SBS sets new rules for banks

Resolution SBS No. 01741-2026 sets new requirements for financial system companies on market conduct, fees and expenses, and adds a mandatory reference to information security and cybersecurity rules. The provisions will take effect on July 3, 2027, giving institutions roughly a year to adapt from the date of publication.

What changes with the SBS resolution?

The rule updates the Regulation on Market Conduct Management for the Financial System and the Regulation on Commissions and Expenses for the Financial System. According to Normas Legales Online, the requirement is not limited to commercial issues or fee transparency. It also explicitly brings information security and cybersecurity rules into the compliance framework.

That change comes on top of a regulatory environment in which Peruvian banks were already adjusting processes because of the spread of artificial intelligence. Gestión reported that, under Peru's AI regulation, financial entities will have to strengthen controls over AI systems and show that their use follows transparency, human oversight and proper governance criteria.

How does it intersect with artificial intelligence rules?

The new SBS requirement overlaps with obligations already in force for AI use in sensitive sectors, including finance. According to Gestión, the first compliance deadline expired on September 10, 2026, for private companies and organizations that develop and deploy AI systems in health, education, justice, security, the economy and finance.

That same day, Infobae said Peru is considered a regional leader in AI regulation, with one of the first specific laws and its implementing rules. The coverage added that the framework is complemented by memorandums to import and adopt AI technologies from the United States, which increases pressure on financial institutions to align their technology risk and cybersecurity management with international standards.

What problems do financial companies see?

The main obstacle is operational. Business sources cited by Gestión said the lack of specialized talent in AI, cloud and cybersecurity makes it harder to comply effectively with the new obligations, and that large institutions are moving faster than small and mid-sized firms, widening a compliance gap within the financial system itself.

Infobae also reported that many organizations, including in finance, are rolling out isolated AI pilots without integrated governance. That leaves gaps against regulatory demands for transparency, human oversight and information security, and is speeding up the need to formalize AI and cybersecurity committees and policies.

How does it fit into Peru's broader regulatory framework?

Peru's AI strategy and regulation are based on a risk-based and proportional approach, according to specialized coverage by CS TIC TV. In that same analysis, Oscar Montezuma stressed the need to integrate interoperability, ethics and international technical cooperation standards, a point pushing banks and other financial entities to coordinate model risk management with AI, data protection and cybersecurity frameworks.

Coverage by La República also adds nuance to the adaptation timeline. The regulation includes staggered grace periods and gradual implementation, with deadlines of up to three years for micro and small businesses, and extended windows for sectors such as energy and mining through 2029. In that map, the financial sector is among those required to comply earlier on AI, information security and cybersecurity, because of the exposure of its processes and the growing use of automated models in lending and other services.