Uruguay BCU proposes stronger authentication

The Financial Services Superintendency of the Central Bank of Uruguay opened a public consultation in September 2026 on a draft rule that would change the obligations of issuers of electronic instruments and the complaints process. The proposal focuses on transaction security and fraud prevention, according to El País (Uruguay).

What does the BCU's new proposal require?

The draft adds a requirement to use strong authentication to improve the security of card-not-present transactions, in response to the fraud levels seen in that type of payment. The same requirement would also apply to the enrollment of electronic instruments in digital wallets.

The rule makes clear that issuers would have to apply strong customer authentication whenever it is required for card-not-present transactions, in line with current standards. For digital wallet enrollment, they could treat a tokenized instrument, uniquely and securely linked to the customer's device, as a possession factor.

What exceptions does the text include?

The draft introduces an exception to strong authentication for beneficiary-initiated recurring payments. The provision covers service subscriptions and automatic debits, according to the text released by the BCU Financial Services Superintendency.

That section defines which transactions would fall outside the strengthened requirement, without changing the rest of the obligations for issuers of electronic instruments. The proposal aims to organize the treatment of repetitive payments within the security framework now under consultation.

How does the response deadline for complaints change?

The draft sets a maximum deadline of 60 calendar days from the filing of a complaint when the investigation requires the involvement of foreign institutions. That procedural standard would serve as the reference point for financial entities that issue electronic instruments.

The measure is meant to give the process a time limit when the response depends on steps taken outside the country. In that case, the BCU says the final response cannot go beyond those 60 calendar days.

What is the scope of the public consultation?

The proposal is aimed at issuers of electronic instruments and their complaint-handling regime. The draft is still under public consultation, so the material released by the BCU describes proposed changes, not a rule already in force.