Bolivia

The Central Bank of Bolivia (Banco Central de Bolivia or “BCB”) is responsible for formulating and managing the country’s monetary, credit, and exchange rate policies and issuing the corresponding regulations.

The Financial System Supervisory Authority (Autoridad de Supervisión del Sistema Financiero or “ASFI”) regulates, controls, and supervises financial services, financial institutions, and securities-market participants—collectively, the “Financial Institutions”. In payment systems, the BCB has general regulatory authority, while ASFI supervises regulated providers and their compliance with applicable BCB regulations.

The Pension and Insurance Supervisory Authority (Autoridad de Fiscalización y Control de Pensiones y Seguros or “APS”) is responsible for regulating and supervising pension funds and insurance companies. Under Supreme Decree No. 5384, ASFI rules for fintech services in the insurance sector must be consistent with the rules issued by APS. Insurance companies and pension entities using cloud services must comply with APS regulatory requirements in addition to applicable ASFI regulations.

The Financial Investigations Unit (Unidad de Investigaciones Financieras or “UIF”) is the anti-money laundering and counter-terrorism financing (AML/CFT) authority. Under Administrative Resolution UIF/19/2025, Virtual Asset Service Providers (VASPs; Proveedores de Servicios de Activos Virtuales or “PSAVs” in Spanish) are designated as obligated entities and are subject to registration and applicable AML/CFT/CPF reporting requirements. 

Financial Institutions in Bolivia may be subject to a number of different legal and regulatory considerations when they use cloud services. Relevant laws and regulations include, but are not limited to:

• Financial Services Law. Ley 393 de Servicios Financieros.

• Title VII, Chapter II of the ASFI Compilation of Rules for Financial Services — Regulation for Information Security Management (Título VII: Requisitos Mínimos de Seguridad, Capítulo II: Reglamento para la Gestión de Seguridad de la Información) as amended by Circular ASFI/955/2026 (see below)

• Supreme Decree No. 5384 — Financial Technology Companies. Regulates the incorporation and operation of Financial Technology Companies (Empresas de Tecnología Financiera or “ETFs”) providing technology-enabled services in financial services, securities markets, and insurance. It requires an ASFI incorporation authorization and operating license and allows ASFI to require participation in a controlled testing environment (regulatory sandbox). Covered service categories include blockchain, tokenized assets, virtual assets and/or VASP services, payments, financing platforms, and business technologies.

• Circular ASFI 885/2025 of July 3rd, 2025, amended by Circular 945/2026 of April 29th 2026. Approved amendments to the Regulation for Financial Technology Companies governing their incorporation, licensing, operation, and supervision. It also extended until June 30, 2026 the deadline for companies already operating to submit the letter of intent initiating their adaptation process.

• Circular ASFI 955/2026 — Modifications to the Regulation for Information Security Management (Resolución ASFI 499/2026 of June 11, 2026). Introduces a new dedicated Section 12 "Cloud Computing Services" (Servicio de Computación en la Nube) into the Regulation for Information Security Management, replacing former Articles 10-12 on IT outsourcing. It establishes comprehensive requirements for cloud adoption including: mandatory ASFI "No Objection" prior to contracting, implementation project requirements, contract specifications, grounds for rejection, and provisions for service suspension or modification. Applies to all new cloud service contracts from the date of publication in the GERF. Also incorporates a definition of "Personal Data" and updates the definition of "Cloud Computing."

These regulations cover a variety of contractual and operational requirements, including but not limited to information security management, IT operations, incident management, risk management, business continuity, IT outsourcing management, and IT audits.

Regulations are changing rapidly in this space, and AWS is working to help customers proactively respond to new rules and guidelines. AWS encourages its Financial Institution customers to obtain appropriate advice on their compliance with all regulatory and legal requirements that are relevant to their business, including local regulations, guidelines, and laws. 

AWS is committed to offering customers a strong compliance framework and advanced tools and security measures that customers can use to evaluate, meet, and demonstrate compliance with applicable legal and regulatory requirements.

Financial Institutions who are using or planning to use AWS services can take the following steps to better understand their compliance needs:

1. Consider the purpose of the workload(s) under consideration and the relevant categories of data in order to anticipate which legal and regulatory requirements may apply.

2. Assess the materiality or criticality of the relevant workload(s) in light of local requirements. Under Section 12 of the Regulation for Information Security Management, prior ASFI “no objection” is required when a cloud service will store or process personal data, information on financial operations, accounting information, or financial information, or will replace technological infrastructure supporting critical processes. The financial institution must submit an implementation project and satisfy the applicable risk, security, provider, and contractual requirements.

3. Review the AWS Shared Responsibility Model and map AWS responsibilities and customer responsibilities according to each AWS service that will be used. Customers can also use AWS Artifact to access AWS’s audit reports and conduct their assessment of the control responsibilities.

Customers that have further questions about how AWS services can enable their security and compliance needs, or that would like more information, can contact their account representative.

Financial institutions in Bolivia using AWS services should also consider applicable privacy requirements. AWS continually monitors the evolving privacy regulatory and legislative landscape to identify changes and determine what tools our customers might need to meet their compliance needs. AWS customers remain responsible for adhering to applicable compliance laws, regulations, and privacy programs.

Bolivia does not have a comprehensive data protection law. However, personal data protection is established through the following legal framework where privacy and personal data are addressed through constitutional and sector-specific rules, including:

• Constitution of 2009 (Constitución Política del Estado): Articles 21 and 25 protect the right to privacy, personal data, and inviolability of private communications. Articles 130–131 establish the “Acción de Protección de Privacidad” (constitutional habeas data remedy).

• Law No. 164 on Telecommunications and ICT (2011): Includes provisions to safeguard personal data, prevents unauthorized access and misuse of information, and establishes regulatory frameworks for protecting secrecy of communications.

• Supreme Decree No. 1793 (2013): Develops the framework established by Law 164, containing provisions on cybersecurity and data protection. Article 56 establishes rules for personal data processing, including prior informed consent, purpose limitation, restrictions on disclosure or transfer to third parties, and appropriate technical and organizational security measures.

• Title VII, Chapter II of the ASFI Compilation of Rules for Financial Services: Regulation for Information Security Management. Establishes minimum information security requirements for ASFI-regulated entities, including measures designed to ensure the confidentiality, integrity, and availability of information and specific requirements for cloud processing and personal data.

Customers maintain full control of the content they upload to AWS services under their AWS accounts and maintain full responsibility for configuring access to AWS services and resources.

The AWS whitepaper, Using AWS in the Context of Common Privacy and Data Protection Considerations provides useful information to customers using AWS cloud services to store or process personal data.

Customers that have questions about the applicable regulations, and how these may apply to their use of AWS services, can reach out to their account representative.