Uruguay's BCU orders stronger digital security

Starting Oct. 1, 2026, new Banco Central del Uruguay rules will tighten security for transactions carried out through electronic channels. The measure applies to banks, financial intermediation cooperatives, credit administrators, financial services firms, exchange houses, fund transfer companies and peer-to-peer lending platforms.

What does the new resolution require?

The rule requires reinforced authentication with at least two different factors to access digital channels, make transfers or payments from bank accounts, apply for loans remotely and access, change or update sensitive data. Telenoche also reported that the two-factor requirement extends to remote card purchases and changes to personal data.

The regulator's approach is not limited to logging into a platform. It also covers operations that move money or affect sensitive information, such as passwords, email addresses or phone numbers. According to Telenoche, any attempt to change that data must trigger immediate electronic alerts.

What anti-fraud controls must institutions implement?

Covered institutions must have mechanisms to identify unusual transactions, verify geolocation, warn about the use of unknown devices and detect suspicious patterns in rejected transactions. The BCU also asked them to periodically assess the effectiveness of those systems and apply corrective measures when needed.

Coverage from El Observador adds that the rule relies on closer monitoring of transaction behavior. In practice, that means reviewing signals that help distinguish routine activity from out-of-pattern operations, especially when devices or locations are not recognized by the institution.

What exceptions does the rule allow?

Telenoche reported that there are exceptions to the use of both factors for some specific transactions. These include transfers between accounts held by the same owner, payments to contacts on trusted lists and public transit fares.

That framework shows the BCU paired stricter authentication requirements with some lower-friction use cases. The available coverage does not spell out any other exceptions, so the full scope should be read within what both outlets reported.

What happens if an institution fails to comply?

Institutions that fail to meet the new requirements can face sanctions and fines from the regulator, according to Telenoche. The rule is already in force and covers a broad range of financial and payment-sector players.