BCP Reviews Banks as Paraguay Lacks Cyber Rules

Update September 4, 2026: A comparison with the cyber security regime of the Central Bank of Brazil was added. That regime already sets minimum mandatory procedures and an annual penetration test by an independent professional. It was also clarified that those requirements apply to banks, finance companies, credit cooperatives, payment institutions, brokers, distributors and PSTI, with compliance due by March 1, 2026.

The Superintendency of Banks at the Central Bank of Paraguay can request information from financial entities, review the actions of their boards, carry out extraordinary reviews of anti-money laundering controls, verify corporate governance rules and open administrative proceedings when it finds grounds to do so. At the same time, local experts say Paraguay still lacks a specific cybersecurity framework, even as cybercriminals are using artificial intelligence more often. Brazil, by contrast, has already closed out a regulatory structure with concrete technical obligations for its financial system.

What powers does the BCP have over banks?

The Superintendency of Banks at the BCP has broad oversight powers over the financial entities under its supervision, according to the General Banking Law and the applicable regulations. It can request information, review boards and launch administrative proceedings if it detects grounds to justify them.

La Tribuna also reported that Law No. 861/96 sets probity, qualification and experience requirements for those who chair, sit on the board or manage a financial entity. That same law places the management and administration of banks under the supervision of the Central Bank of Paraguay and the Superintendency of Banks.

What can happen after a serious violation?

Article 95 of the Central Bank of Paraguay Organic Law provides sanctions that can include removal from office and a ban of three to 10 years from serving again as president, director or administrator of a supervised entity. That applies to serious violations committed by presidents, directors or other officials of financial entities.

In that context, La Tribuna said in another report that "Miki" Zaldívar was still running Atlas Bank despite a money laundering accusation. The outlet tied that case to the need for the BCP to use its supervisory powers, including extraordinary review of anti-money laundering controls and corporate governance.

Where does the cybersecurity gap appear?

The gap is that, according to an expert interviewed by Caaguazú Noticias Digital, Paraguay does not have a specific cybersecurity framework. On top of that, the Personal Data Protection Law has already been approved, but its regulations and full entry into force are not expected until November 2027.

The same expert said that, in cases such as emptied accounts, unauthorized access or identity theft, the response falls mainly to the prosecutor's office and the Cybercrime Police. Both areas work with very limited resources, leaving a gap between the sophistication of attacks and the state’s response capacity, which is especially sensitive for the financial system.

What changes in Brazil?

Brazil already has a cybersecurity regime completed through BCB Resolution 538/2025 and CMN Resolution 5.274/2025. That framework sets minimum mandatory procedures and requires an annual penetration test by an independent professional, a requirement with no equivalent in Paraguay for banks, EMPE or other financial entities.

The Central Bank of Brazil's current rules apply in different but aligned ways to banks, finance companies, credit cooperatives, payment institutions, brokers, distributors and technology service providers for the financial system, all under explicit cybersecurity rules. The adaptation deadline closed on March 1, 2026, highlighting the distance with Paraguay, where there is still no unified financial cybersecurity framework with similar technical requirements.

What does the BCP say about the banking system?

Central Bank of Paraguay officials say the banking system operates under international standards for risk management and capital solvency. That message was part of the presentation by the BCP's new director, who also highlighted banking stability and the IMF review.

The coexistence of those standards with a specific cybersecurity regulatory gap leaves two different planes. On one hand, the banking framework does allow oversight of corporate governance, probity and money laundering. On the other, the response to digital attacks still rests on a criminal and police structure with limited resources, while Brazil has already turned financial cybersecurity into a supervised technical obligation.