Peru's SBS sets BaaS cyber rules

Peru’s Superintendency of Banking, Insurance and AFPs approved SBS Resolution No. 01747-2026, the country’s first specific regulation for the Banking as a Service model, or BaaS. The rule gives providers a 180-day transition period from its publication in El Peruano to adapt their technology architectures, APIs and commercial contracts to new cybersecurity standards.

Coverage by La República says the regulation covers services such as account opening, fast loan issuance, electronic money issuance and card management through nonfinancial digital platforms. In those cases, banks and savings institutions will have to meet stronger requirements for technology security and customer data protection, under a framework the SBS aims to standardize across the financial system.

Other explanatory posts circulating on social media reinforced that reading of the new framework. A LinkedIn analysis said this is Peru’s first specific regulatory framework for BaaS and that applying it will require stronger technology risk management and cybersecurity capabilities as the model opens to fintechs and third-party platforms. In the same vein, a post from Círculo Financiero Corporativo said the SBS set new operational and security conditions for marketing financial products through recipient companies, with a focus on technology controls, incident monitoring and authentication mechanisms.

There were also Instagram and TikTok posts describing the resolution as an entry point for fintechs, mobile apps and technology companies to offer financial services using banking infrastructure. Those posts stressed that the integrations will have to operate with cybersecurity controls equivalent to those used by supervised financial institutions, along with incident oversight and compliance with SBS security guidelines.

In parallel, a reel about Peru’s open finance system mentioned the SBS and a roadmap, with references to an open banking and open finance scheme that includes cybersecurity and protection aspects, though it did not detail the specific regulatory sections visible in the post. The available material also includes an SBS post about financial institutions’ preparation in cybersecurity and operational resilience, along with references to technical meetings with the BCRP and SMV and to new rules on incident reporting and physical and electronic security in financial institutions.