Peru's SBS updates rules for financial firms

Update September 3, 2026: Resolution SBS No. 02164-2026 added new provisions for entities in the financial and insurance system, and set them to take effect 90 calendar days after publication in El Peruano. The change adds to the broader regulatory package that had already covered authorizations, temporary access to data, and cooperation with the Public Ministry.

The SBS published new provisions for supervised companies, streamlined the authorization process for new financial and insurance entities, and added an agreement with the Public Ministry to expand the secure exchange of financial information. At the same time, Inacal updated technical standards on privacy and business continuity, while the artificial intelligence regulation set its first compliance deadline for September 10, 2026.

What changed in SBS authorizations?

Resolution SBS No. 02133-2026 introduces differentiated authorization paths for companies in the financial and insurance system, with a standard process for non-deposit-taking firms and a special authorization. The reform also sets stages and maximum review periods, along with stronger risk management and corporate governance requirements for new entities.

According to official and media coverage, the prequalification stage can last up to 15 days. After that, standard applications can take up to 120 days, non-deposit-taking firms up to 90 days, and the special path up to 70 days for organization. Infobae Peru also reported that new financial and insurance firms may temporarily access the Consolidated Credit Report during the process, provided security measures are in place.

What happens with access to credit history?

Temporary access to the Consolidated Credit Report will be allowed only during the authorization process and under strict safeguarding obligations. If authorization is not granted, the information must be deleted, and the new entities will be liable for any data leaks, according to Infobae Peru's coverage of the resolution.

Resolution SBS No. 02164-2026, published on August 31, 2026, also introduces new provisions applicable to companies supervised by the SBS and sets them to take effect 90 calendar days after publication in the official gazette El Peruano. That timeline adds another layer of regulatory adjustment for the sector.

How does this connect to oversight and personal data?

The same regulatory package coincides with an agreement between the SBS and the Public Ministry to strengthen cooperation against money laundering, terrorist financing, extortion, computer fraud, and other forms of organized crime. The agreement includes mechanisms to facilitate the Public Ministry's secure access to SBS consultation and financial information services.

To that, Peru's new technical standards approved by Inacal are added. NTP-ISO/IEC 29100:2026 replaces the 2021 version and its technical amendment, while NTP-ISO/IEC 27031:2026 replaces the 2012 version revised in 2022 and focuses on ICT preparedness to ensure business continuity.

What other obligations are pressuring the financial sector?

Financial institutions also face tighter obligations under the Personal Data Protection Law and its regulations, in force since March 2025. They must show monitoring, classification, and traceability of personal data, report certain incidents within 48 hours, and maintain appropriate security measures, with penalties that can reach about S/ 275,000, according to Sectoriales.

On AI, BDO Peru clarified that September 10, 2026 does not mark the full entry into force of the regulation under Law No. 31814. Instead, it is the deadline for the first transparency and good-practice requirements under Chapter II of Title VI in sectors such as the economy and finance. The firm added that other private sectors will have deadlines of two, three, or four years, depending on sector-specific use.

What did Indecopi say about user service?

Indecopi fined Banco Ripley S.A., BanBif, and Santander Consumer Bank S.A. at first instance with penalties totaling 51.12 UIT, about S/ 281,160, for blocking or making it harder for consumers to file complaints. The case increases regulatory pressure on complaint traceability and proper customer service in financial entities.

SBS coverage on AFOCAT added another operational change: the Paying Account may now be used only for traffic accident coverage and for the contribution to the SOAT and CAT Compensation Fund. In addition, there must be at least one other separate account to manage the 20% contribution set aside for administrative expenses and related obligations.