Peru's SBS Tightens Bank Risk Rules

Peru’s Superintendence of Banking, Insurance and AFPs (SBS) published a draft rule to add four types of agricultural insurance to the simplified customer due diligence regime, while also moving ahead with changes to corporate governance, risk management, consolidated supervision, Banking as a Service, open finance, artificial intelligence and customer service for banks and financial groups in Peru.

What changes in due diligence and agricultural insurance?

According to Agencia Andina, the proposal updates Circular No. S-661-2016 and is already posted on the SBS institutional website. The agency opened a comment period for the public and industry to submit feedback through August 28, 2026.

At the same time, the supervisor has been adjusting other parts of the prudential framework. Mercurio Legal reported that SBS Resolution 01976-2026 amends the Regulation on Corporate Governance and the Comprehensive Risk Management of supervised entities, adds three new definitions, and requires firms to seek compatible risk management standards across entities in the same group, aligned with their nature and complexity.

The official gazette added that the SBS strengthened consolidated supervision and aligned the framework with international standards through Resolution SBS No. 01959-2026. Under that approach, when the supervisor applies consolidated supervision, the company responsible for submitting consolidated information must seek to ensure that group entities adopt practices consistent with the regulation, reinforcing coherence between parent companies and subsidiaries.

Mercurio Legal also said Resolution SBS 01976-2026 will take effect on July 1, 2027, giving financial system firms time to adjust internal policies on corporate governance and integrated risk management, including operational and cybersecurity risks within the management framework. In the same vein, Infobae Perú reported that starting in 2027, companies within the same financial group will no longer be allowed to operate under different risk rules and will have to align internal policies with the new regime.

What changes does it introduce in technology, AI and new business models?

The regulatory tightening also reaches the technology layer. Stakeholders Perú reported that the SBS approved a Banking as a Service rule that redefines the technology partnership between banks and technology providers. Under that model, responsibility to customers and to the SBS always rests with the financial institution acting as the service provider, with oversight, technology risk management and compliance obligations for banks that integrate third-party digital solutions.

Hazlo Digital said the SBS expects to define the technological and regulatory foundations of Peru’s open finance model between September and November 2026, with an initial pilot involving four supervised financial entities.

That comes on top of the use of artificial intelligence tools within supervision itself. El Peruano published a report on MonitorIA, an SBS suptech tool that uses artificial intelligence and advanced analytics to monitor market conduct management, process large volumes of information and detect risks in time to guide evidence-based supervisory actions.

The regulatory debate also intersects with Law No. 31814 on artificial intelligence systems. Gestión detailed that under the regulation issued through DS 115-2025-PCM, regulated sectors, including the financial sector supervised by the SBS, may impose additional sanctions under their own regimes if documentation, transparency, impact assessment and human oversight obligations are breached in high-risk AI systems. The same coverage added that the general regime provides for fines of up to S/ 535,000, suspension of AI operations and possible administrative, civil or criminal liability in cases of noncompliance.

On customer service, RPP Noticias reported that the SBS requires banks to issue free certificates for debts that have been brought current and to provide service from human agents, not just bots.

How is the supervision of the financial system widening?

Infobae Perú added that traditional performance reviews now include cybersecurity metrics, operational risk and technology response capacity, broadening the practical scope of supervision in the sector. In that same context, Stakeholders Perú placed approval of the BaaS rule alongside progress by Peru’s Central Reserve Bank (BCRP) on the TAPP platform as digital payments infrastructure.