Peru tightens financial cybersecurity rules
The BCR is weighing new cybersecurity requirements for banks, while the SBS advances security and interoperability rules for open finance.
Peru’s central bank is weighing extra cybersecurity requirements for financial institutions that want to connect to payment systems. At the same time, the SBS has already advanced new rules for open finance and third-party financial products, with security, business continuity and interoperability requirements for data sharing between banks and fintechs.
The Central Reserve Bank of Peru is weighing extra cybersecurity requirements for financial institutions that want to connect to payment systems. The measure was still under review, and no final text or effective date had been announced, according to ATV. At the same time, the SBS has already moved ahead with new rules for third-party financial products and the open finance system.
What does the resolution on third-party products establish?
SBS Resolution No. 02645-2026 sets obligations for transparency, risk management, cybersecurity, business continuity and conflict-of-interest prevention for entities that market third-party financial products, according to Infobae Perú’s coverage. The rule applies to insurers and pension fund administrators, which will be able to sell those products under that regulatory framework.
Infobae Perú also reported that the resolution was linked to the possibility that those entities could offer crypto assets, although the central point confirmed in the coverage is the set of obligations they must meet to operate in that activity. The regulatory focus was placed on risk management and on the ability to keep services running during incidents or outages.
What changed in open finance?
The SBS pre-published a second regulatory block for the open finance system with common standards for interoperability, security and operational continuity in the exchange of financial information between banks and fintechs. According to Gestión, scheduled maintenance should be notified five business days in advance, except in emergencies tied to vulnerabilities, threats or incidents.
That second block aims to organize how financial information is shared among system participants and how maintenance windows are handled. The exceptions for urgent cases tied to vulnerabilities, threats or incidents leave room for faster action when stability or security is at risk.
What scope does the BCR review have?
The BCR review is aimed at financial institutions that want to connect to payment systems, but the bank has not yet defined the final text of those additional requirements or when they would take effect. ATV said the initiative remains under study, with no official timeline released.
The convergence of these measures points to a stricter regulatory line in Peru for access, data exchange and third-party financial services. Based on the material available, the BCR has not closed its proposal, while the SBS has already advanced two regulatory layers with concrete security and continuity obligations.
