Peru Tightens BaaS Rules

Peru’s new SBS BaaS rule and the BCRP schedule for registering and authorizing digital payment service providers are pushing the country’s fintech ecosystem into a simultaneous review of compliance, technology architecture and cybersecurity.

According to a Traxxia analysis of the local market, the 2026 regulatory framework is also converging with other initiatives arriving in the same period, including BCRP digital payments, open finance and sandbox programs. That overlap points to tighter scrutiny of open banking models and embedded services, along with greater pressure on consumer protection and on the controls applied to APIs and third parties.

Risk, data and third parties

Traxxia says the requirement for the BaaS provider bank to retain full responsibility and extend its risk and compliance frameworks across the model’s entire perimeter is already changing how partnerships are negotiated. In practice, that means deeper due diligence on recipient fintechs, with specific assessments of information security, scoring models and the use of open finance data before BaaS agreements are signed.

Those tighter controls are also showing up in the strategy of several Peruvian fintechs, which, according to sector sources cited by Traxxia, are prioritizing partnerships with banks that have already adapted to the new rule. Operating only with direct registration or authorization from the BCRP for digital payments is becoming less attractive than meeting the broader requirements for integrated risk management, operational continuity and user protection set out by the regulation.

Regulatory bottleneck in 2026

The same analysis warns that the combination of the BCRP timeline and the new SBS BaaS rule is creating a compliance bottleneck in the second half of 2026. Banks and fintechs will need to move in parallel on regulatory remediation projects, capital strengthening, risk policy implementation and updates to cybersecurity frameworks.

The result is a market where the conversation is no longer centered only on launching new products. Going forward, the ability to sustain open banking and embedded services will depend on how each player organizes third-party governance, APIs and control processes to withstand tougher supervision.