Peru SBS tightens cybersecurity contract rules

Peru’s Superintendency of Banking, Insurance and AFPs approved Resolution SBS No. 01741-2026, which updates the Financial System Market Conduct Regulation and the Fees and Expenses Regulation. The rule adds a requirement to apply current information security and cybersecurity standards during the signing and execution of contracts with financial users, and it will take effect on July 3, 2027.

What does the new resolution require?

Resolution SBS No. 01741-2026 requires companies within its scope to apply current information security and cybersecurity rules when they contract with financial users and carry out those relationships. The change affects how those ties are formalized and managed, not only at the technical level but also in terms of contractual compliance.

According to the Online Legal Regulations compilation, the measure amends two key rules in Peru’s financial system, the Market Conduct Regulation and the Fees and Expenses Regulation. That same source says the effective date will be July 3, 2027.

How does it connect to the cybersecurity regime?

The resolution builds on a framework that had already been developing in Peru and strengthens the obligation to organize internal security processes. A technical-regulatory analysis cited by Apaxi says that, after this rule, entities must notify the public through mass channels within 24 hours of cybersecurity incidents.

That same analysis adds that, if identifiable users are affected, direct notice must be sent within the following 10 business days, with details of the incident and the measures taken. Under that reading, the regulatory focus shifts toward greater transparency to the public, beyond contractual security.

What other regulatory signals are appearing in Peru’s financial system?

The SBS has also been increasing oversight of financial informality and market conduct. Diario Certeza reported that the agency shut down informal companies that were collecting money from the public without authorization and reminded users that they can report or check those cases through official channels, including toll-free phone lines and email.

In parallel, Actualidad Civil published Resolution SBS No. 02212-2026, issued under the General Law of the Financial System and the Insurance System and related rules. That publication says it is part of recent SBS regulatory updates, with a prudential and conduct focus rather than new, specific cybersecurity requirements.

What changed for data use and automation?

The regulatory debate has also reached the use of machine learning in the financial sector. Gestión and La República said that if a bank evaluates loans through a mobile app using machine learning models, it must tell the user and clearly explain the parameters used when it rejects an application.

According to those analyses, the requirement is aimed at transparency, protection against bias, and non-discrimination in automated decisions. In practice, Peru’s framework is adding obligations that cut across conduct, information security, cybersecurity, and explainability in digital financial services.

What internal measures are banks taking?

BCP said it may close personal accounts and block the Yape digital wallet if it detects mass transfers or commercial collections that violate its internal policies. Expreso reported that the decision falls under operational and compliance risk management for digital financial services.

Those internal controls now coexist with the SBS’s new regulatory requirements and with closer oversight of informality, incidents, and transparency toward users. Taken together, recent developments point to a stricter regulatory and operational agenda for Peruvian financial institutions.