Uruguay expands BCU financial oversight

The Central Bank of Uruguay has added stronger cybersecurity in the financial system and anti-money laundering efforts to its 2026-2030 Strategic Plan, while it moves forward on a draft Open Finance bill that would give it regulatory, supervisory and sanctioning powers over ecosystem participants.

Open finance with new powers

According to the BCU announcement, the proposal is intended to enable an open finance ecosystem in the country. The design would allow the central bank to regulate, supervise and sanction the actors involved, creating new compliance obligations for financial entities and technology providers that handle customers' financial data.

The model described by El País in Uruguay, based on articles 184 through 204 of a draft, aims to let individuals and companies authorize the exchange of their financial data between institutions and providers registered with the BCU. The goal is to modernize the system and enable new products and services, under a framework built on users' explicit consent for data sharing.

AEBU publicly questioned that future system and warned that many users could agree to share data without fully understanding the scope of that decision. The union also said the draft makes only limited mention of minimum security measures for companies operating in the system, in a context of rising cybercrime.

More control over the regulated perimeter

The roadmap to 2030 also says the authority began in 2026 with the regulation and implementation of new legislation on Electronic Money Issuing Institutions, including rules on risk analysis and guarantees, as well as changes in customer relationships to prevent fraud in securities intermediaries.

At the same time, the Official Gazette published Circular No. 2,508 from the Central Bank of Uruguay as an errata for Circular No. 2,507 in the Compendium of Securities Market Rules. That formal correction indicates that the regime for virtual asset service providers was modified after its original issuance.

El País also reported that the central bank set specific requirements and deadlines to regulate companies that provide digital asset services, in line with the implementation of Circular No. 2,507 and the plan to combat fraud and strengthen technology oversight.

SomoSuruguay reported that the 2026-2030 Strategic Plan came out of an internal strategic review process carried out in 2025, which defined institutional priorities for the next five years, including the open finance agenda and stronger financial cybersecurity, with express reference to official BCU documentation.