Peru's SBS tightens sanctions and opens consults

Peru's Superintendency of Banking, Insurance and AFPs approved Resolution SBS No. 01923-2026, which updates the Rules on Infractions and Sanctions for banks, pension funds, and insurers. The revision adds new offenses, changes existing ones, and removes outdated provisions, with the goal of strengthening the SBS's supervisory powers and aligning sanctions with the latest demands of the country's supervised financial sector.

What changed in the sanctions regime?

Resolution SBS No. 01923-2026 modifies the disciplinary framework that applies to supervised entities and adds infractions, updates others already in force, and eliminates provisions that had fallen behind current practice. According to the analysis cited by Baker Tilly Peru, the aim is to reinforce the regulator's oversight capacity and bring sanctions in line with current needs in Peru's financial system.

What projects did the SBS put out for public consultation?

The SBS authorized the release for public consultation of several regulatory initiatives tied to due diligence, prudential oversight, and sector accounting. These include a rule on insurance products covered under the Simplified Customer Due Diligence Regime, another on prudential provisions for financial and insurance companies with an additional business line, and amendments to the accounting manuals that apply to those firms.

The insurance proposal also had a more specific scope in the SBS's institutional release, with a plan to include four types of agricultural insurance under the simplified regime. These are catastrophic agricultural insurance, yield insurance, plantation insurance, and direct damage insurance. The public consultation remained open until August 28, 2026, and in another official notice, a 15-day calendar period for comments was set from its publication in El Peruano.

What other measures did the regulator adopt?

The SBS also set new measures to strengthen protection for depositors' money and oversight of the financial system. Among them, it required the Deposit Insurance Fund to keep a target reserve between 8% and 10% of the total estimated insured deposits, according to the reporting cited.

At the same time, it introduced stronger governance and risk management rules for financial groups. The coverage also said the authority moved forward with prudential provisions for companies authorized to operate with an additional business line, along with changes to their accounting manuals.

How does this connect to personal data and cybersecurity?

The regulatory framework cited in Peru also covers the personal data handled by financial entities. Law No. 29733 and its implementing regulation require that information identifying or making a natural person identifiable be handled under principles of legality, purpose limitation, and prior, informed, express, and unequivocal consent from the data subject.

According to the analysis cited by Gestión, the National Authority for Personal Data Protection can impose administrative fines of up to 100 UIT for very serious violations and up to 5 UIT for minor violations involving the failure to adopt security measures for sensitive data. That scheme also applies to entities in the financial system when they process personal data.

In coverage linked to an Interbank case, Gestión reported that the SBS will determine whether there were violations of the rules that apply to information security and cybersecurity. Any possible violations and sanctions will depend on the outcome of that review.