Peru speeds up instant payments, fintech oversight

The Central Reserve Bank of Peru has ordered all banks in the country to accept instant transfers through QR codes, DNI numbers or mobile phone numbers, as part of the instant payments system. The measure sets a maximum amount of S/ 30,000 per transaction, although providers may reduce that limit for security reasons.

Regulatory adjustment for fintechs

The regulatory shift is not limited to banks. The BCRP’s timetable for regulating payment service providers says entities that require authorization must complete the process between June and December 2026, depending on their transaction volume. Those that only need to register had until June 30, 2026. Under that framework, more than 50 fintechs could come under central bank supervision if they fail to meet the regulatory adjustment requirements on time.

What Circular 0017-2026 requires

Circular No. 0017-2026-BCRP, issued as part of the rollout of the instant payments system and the regulation of payment alias directory service providers, requires entities seeking authorization to submit a detailed report on risk management, information security, personal data protection and operational continuity measures. They must also attach an implementation, integration and testing plan that includes load, security and continuity tests, along with specific incident management, communication and reporting procedures to the Central Bank.

The same circular states that entities applying for authorization as a Directory Provider or Directory Manager must send the required information to the BCRP through the Banking Interconnection System, SIB-FTP WEB. It also gives the central bank authority to change the submission channel and set adjustment deadlines for delivering information and using the system or channel it determines.

BaaS and data protection

In parallel, an independent analysis of Peru’s new Banking as a Service regulation says Resolution SBS 01747-2026 directly activates Personal Data Protection Law No. 29733 and its current implementing regulation, DS No. 016-2024-JUS. That framework requires BaaS providers to add specific data protection obligations to their compliance model, including the appointment of a Personal Data Officer in large companies or companies processing data at scale, required since November 30, 2025.

The same analysis adds that Data Protection Impact Assessments will be required for high-risk processing, such as automated credit scoring enabled by BaaS. It also says the regulation approved by Resolution SBS 01747-2026 will take effect 180 calendar days after its publication, on December 30, 2026, giving supervised entities a six-month period to adapt contracts, operational and cybersecurity risk management schemes, and personal data protection policies.