Uruguay's BCU tightens payments, open finance

Update October 1, 2026: The BCU added new requirements to Cybersecurity Framework 5.0 for the payments system and electronic money issuers. It also added a specific rule for electronic money contracts, with a separate notice on exchange-rate risk and proof that the user received it.

The Central Bank of Uruguay added new requirements to Cybersecurity Framework 5.0 for the payments system and electronic money issuers. At the same time, it is moving ahead with its open finance project, keeping changes in digital payments and adding a specific rule for electronic money contracting.

What changes in digital payments?

The BCU proposal requires stronger authentication for card-not-present transactions and for linking electronic instruments to digital wallets. The regulator is seeking to update the framework for issuers and tighten controls on transactions that now depend on remote channels.

The published text also sets a maximum of 60 calendar days to issue a final response to complaints when the investigation must involve institutions abroad. The change is aimed at cross-border disputes and the time users wait for a resolution.

What does the open finance system foresee?

The Central Bank of Uruguay has presented a draft to move toward an Open Finance System, under which users could share their financial and payment data securely, with prior, express and informed consent. The model would let authorized institutions access that information through application programming interfaces, or APIs.

Under the proposal, access to financial data and payment initiation would happen through APIs with prior, express, informed and revocable consent at no cost. It also foresees free and paid access models between institutions, forbids passing specific charges on to users, and seeks to replace screen scraping with authorized channels supervised by the BCU.

What does Cybersecurity Framework 5.0 add?

The BCU added new requirements to Cybersecurity Framework 5.0 for the payments system and electronic money issuers, in line with the growth of electronic and instant transactions. The update aims to strengthen security requirements for players operating in an increasingly used infrastructure.

That backdrop comes with scale data that shows the pressure on the system. In the first half of 2026, there were 42 million instant interbank transfers, according to El Observador, 90% more than in the same period of 2025 and 25% more than in the previous half-year.

What new obligation applies to electronic money?

The BCU draft for electronic money says that, when a customer signs up for or opens an account or instrument, institutions must provide a separate document from the general and specific contract terms, with a prominent warning about exchange-rate risk and proof that the user received it. It is an additional information and contract-tracking requirement for electronic money issuers.

The measure is not part of Cybersecurity Framework 5.0, but it does add a specific obligation to the user relationship. At the same time, the open finance discussion continues to focus on data access through APIs, revocable consent, and replacing unauthorized mechanisms such as screen scraping.

What risks and uses are part of the debate?

The initiative drew comments about the risks tied to handling financial data within a digital infrastructure regulated and supervised by the BCU. That debate comes as the local payments system keeps expanding and adds more electronic and instant transactions.

Urutec described the move as an API-based model for sharing data with authorized institutions and accessing personalized services for payments, financial management, and credit. At the same time, a report on the evolution of the payments system said instant transfers already account for more than 70% of transactions between institutions, a figure that shows the scale of the regulatory shift in Uruguay.