Peru's SBS unifies incident reporting

Update September 18, 2026: Resolution SBS No. 02271-2026 authorized the public release of the draft, which replaces separate reports for significant operational disruptions and significant cybersecurity incidents with a single operational incident report. It also confirmed a 30-calendar-day window for comments and observations.

Peru’s Superintendency of Banking, Insurance and AFPs (SBS) has authorized the public consultation of a draft rule that would create a single, standardized process for reporting significant operational incidents. The proposal replaces the report for significant operational disruptions and the earlier report for significant cybersecurity incidents.

What changes under the SBS proposal?

The draft establishes a single reporting mechanism for significant operational incidents, applicable to companies in the financial, insurance and pension systems. According to Andina, the text brings together requirements from business continuity and information security and cybersecurity rules.

The SBS also added specific incident categories, including business interruption, system or execution failure, non-disruptive compromise, data breach, financial fraud and information disorder. According to Andina, these categories also cover cybersecurity incidents at Peruvian financial entities.

What deadlines does it set for reporting?

The SBS draft sets different maximum deadlines for the initial report depending on the type of entity, counted from the moment the incident is classified as significant. Infobae Perú said companies with market concentration will have up to 2 hours, banks, finance companies, municipal and rural savings banks up to 5 hours, and other supervised firms one business day.

After the initial report, entities must file a first interim report within 24 hours at most. The final report must be submitted within 20 business days after the incident is resolved, and that deadline may be extended once, with a justified request filed before it expires, according to Infobae Perú.

How long will it remain under public consultation?

The SBS submitted the draft for public consultation and opened a period for comments from supervised entities and other interested parties before final approval. The deadline runs for 30 calendar days starting the day after the resolution is published in El Peruano, meaning until October 16, 2026.

Resolution SBS No. 02271-2026 set that same 30-calendar-day period, counted from the day after publication in El Peruano, for the public to submit comments and observations on the draft significant operational incident report.

In parallel, La República noted that the Regulation of the Artificial Intelligence Law, identified as D.S. No. 115-2025-PCM, set an initial mandatory compliance date of September 10, 2026 for strategic sectors, including finance. The same analysis said implementation is gradual by sector, and that for the private sectors of health, education, justice, security, economy and finance, the deadline is one year, with compliance starting on that date.