SBS updates rules for financial firms

Update September 7, 2026: The SBS issued Resolution No. 02133-2026 and defined differentiated authorization paths for companies in the financial and insurance systems. The rule also governs temporary access to the Consolidated Credit Report during the process, with strict duties to safeguard the information.

The SBS published new rules for supervised companies, streamlined the authorization process for new financial and insurance entities, and added an agreement with the Public Ministry to expand the secure exchange of financial information. At the same time, Inacal updated technical standards on privacy and business continuity, while the artificial intelligence regulation set an initial compliance deadline for September 10, 2026.

What changed in SBS authorizations?

Resolution No. 02133-2026 introduces differentiated authorization paths for financial and insurance companies, with a standard procedure for non-deposit-taking firms and a special authorization track. The reform also sets stages and maximum review periods, along with stronger risk management and corporate governance requirements for new entities.

According to official and media coverage, the prequalification stage may last up to 15 days. After that, standard applications can take up to 120 days, non-deposit-taking firms up to 90 days, and the special track up to 70 days for organization. Infobae Perú also reported that new financial and insurance companies may temporarily access the Consolidated Credit Report during the process, as long as security measures are in place.

What happens to access to credit history?

Temporary access to the Consolidated Credit Report will be allowed only during the authorization process and under strict safeguards. If authorization is not granted, the information must be deleted, and the new entities will be responsible for any data leaks, according to Infobae Perú's coverage of the resolution.

Resolution No. 02164-2026, published on August 31, 2026, also introduces new provisions for companies supervised by the SBS and says it will take effect 90 calendar days after publication in the official gazette El Peruano. That adds another layer of regulatory adjustment for the sector.

How does this connect with oversight and personal data?

The same regulatory package comes alongside an agreement between the SBS and the Public Ministry to strengthen cooperation against money laundering, terrorist financing, extortion, computer fraud, and other forms of organized crime. The agreement includes mechanisms to make it easier for the Public Ministry to access secure SBS financial query and information services.

To that, Peru's new technical standards approved by Inacal are added. NTP-ISO/IEC 29100:2026 replaces the 2021 version and its technical amendment, while NTP-ISO/IEC 27031:2026 replaces the 2012 version revised in 2022 and focuses on ICT readiness to ensure business continuity.

What other obligations are pressing the financial sector?

Financial institutions are also facing tougher obligations under the Personal Data Protection Law and its regulations, in force since March 2025. They must prove monitoring, classification, and traceability of personal data, notify certain incidents within 48 hours, and maintain adequate security measures, with penalties that can reach about S/ 275,000, according to Sectoriales.

On AI, BDO Perú clarified that September 10, 2026 does not mark the full entry into force of Regulation of Law No. 31814. Instead, it is the deadline for the first transparency and best-practice requirements under Chapter II of Title VI in sectors such as the economy and finance. The firm added that other private sectors will have two-, three-, or four-year deadlines, depending on sector-specific use.

What did Indecopi say about user service?

Indecopi fined Banco Ripley S.A., BanBif, and Santander Consumer Bank S.A. at first instance with penalties totaling 51.12 UIT, about S/ 281,160, for blocking or making it harder for consumers to file complaints. The case adds pressure on complaint traceability and proper customer service at financial institutions.

The SBS's official coverage of AFOCAT added another operational change: the Paying Account may now be used only for traffic accident coverage and the contribution to the SOAT and CAT Compensation Fund. In addition, there must be at least one other separate account to manage the 20% contribution set aside for administrative expenses and related obligations.