Peru SBS sets rules for open finance

Peru’s banking regulator, the SBS, has issued a draft rule that sets interoperability, security and operational continuity requirements for financial data exchange under the country’s Open Finance System. The proposal includes standards for APIs, authentication through each entity’s own security mechanisms, a ban on sharing banking credentials with third parties, data recovery, backups and periodic testing.

What does the proposal require for data exchange?

The proposal requires financial information exchanges to run on defined technical standards, entity-specific authentication, and continuity measures that include data recovery, backups and periodic testing. It also bars sharing banking credentials with third parties, a central point in the design of services connected to the system.

That framework is meant to organize how data is exposed and consumed within the Open Finance System, with explicit rules for APIs and for the way each entity validates access. The reviewed material does not spell out implementation deadlines or any penalties tied to noncompliance.

What changed for insurers?

A resolution published in El Peruano authorized insurance companies to sell third-party financial products or services through digital channels, as long as they implement mechanisms to comply with the information security and cybersecurity rules set out in the SBS regulation. The same rule also requires them to keep a centralized, up-to-date record of contracts or agreements with third parties, available to the SBS.

In addition, the resolution says supervised companies that distribute their own financial products through third parties must include those agreements in their business impact analysis. That analysis will be used to determine whether they qualify as prioritized products or services under operational continuity rules.

How does this connect with the BaaS model?

An eBIZ Latam analysis reads the Peruvian Banking as a Service framework as imposing stricter governance requirements for API exposure, third-party due diligence, integration observability and developer management. The same piece also mentions encryption, transaction monitoring and third-party management as relevant controls, although that is an interpretation of the rule, not an additional official clarification.

Taken together, the regulatory shift in Peru combines commercial opening with stricter obligations on security, traceability of agreements and operational continuity. On one side, the SBS seeks to organize financial data exchange under open finance. On the other, the insurer resolution extends cybersecurity requirements to the digital sale of third-party products.