Peru

The Superintendencia de Banca, Seguros y Administradoras de Fondo de Pensiones or “SBS” (Superintendence of Banks, Insurance, and Pension Fund Administrators) is Peru’s primary authority responsible for the regulation and supervision of financial, insurance, and private pension entities.

The Banco Central de Reserva del Perú or “BCRP” (Central Reserve Bank of Peru) designates, regulates, and supervises systemically important payment systems. Under Legislative Decree No. 1665 and Circular No. 0022-2025-BCRP, the BCRP also regulates Payment Service Entities (ESPs), establishing authorization requirements and cybersecurity standards for payment systems.

The Superintendencia del Mercado de Valores or “SMV” (Superintendence of Securities Market) regulates securities markets, listed companies, and capital market participants in Peru.

The Autoridad Nacional de Protección de Datos Personales or “ANPDP” (National Personal Data Protection Authority), under the Ministry of Justice, is responsible for enforcing Law No. 29733 (Personal Data Protection Law) and its implementing regulations.

Financial institutions in Peru may be subject to a number of different legal and regulatory considerations when they use cloud services. Relevant regulations include, among others:

Resolution SBS No. 2286-2024 Regulations for Credit and Debit Cards, establishes general provisions applicable to credit and debit cards, including those related to the responsibilities of companies in conducting transactions, and security and authentication requirements.

Resolution SBS No. 504-2021 Regulations for the Management of Information Security and Cybersecurity contains guidelines and good practices applicable to information security management based on NIST and ISO/IEC standards.

Resolution SBS No. 877-2020 Regulations for Business Continuity Management, as amended by Resolution SBS No. 814-2025, contains minimum standards for business continuity management, an obligation to report certain events that cause a significant interruption of the financial institution’s operations, and a list of controls that the financial entity must implement in its business continuity management.

Resolution SBS No. 2116-2009 Regulations for Operational Risk Management, establishes that financial institutions must have comprehensive risk management policies that are appropriate for their size and the complexity of their operations and services. Under Resolution SBS No. 814-2025, financial institutions are now required to include the results of annual recovery time objective (TOR) tests for digital channels (such as mobile wallets and internet banking) within their Annual Operational Risk Management Report (IG-ROp) submitted to the SBS.

Resolution SBS No. 02429-2021 Regulations on regulatory sandbox for innovation pilots. Establishes requirements for authorization, risk evaluation, user protection, and exit plans. Originally limited to entities supervised by the SBS, but extended to other entities by resolution SBS No. 04142-2025.

Resolution SBS No. 2755-2018 Regulations on Infringements and Sanctions of the Superintendency of Banking. Establishes the framework for violations and administrative sanctions across supervised financial entities. The annexes list specific violations classified by severity.

Resolution SBS No. 01029-2026 Amendments to the Regulations on Infringements and Sanctions of the Superintendency of Banking. Clarifies criteria regarding causality and impact in existing regulations on information security and other matters.

Circular No. 0022-2025-BCRP General Regulation of the National Payment System (December 2025), establishes a comprehensive framework for Payment Service Entities (ESPs), including authorization requirements, cybersecurity standards, and operational resilience obligations for participants in Peru’s National Payment System.

Resolution SBS No. 04142-2025 Regulatory Sandbox Expansion (November 2025), modifies Resolution SBS No. 2429-2021 to allow non-supervised fintech entities to participate in regulatory sandbox innovation pilots, broadening the scope of innovation testing in financial services.

Legislative Decree No. 1665 Amendments to the Payment Law (Law No. 29440), expanding the BCRP’s regulatory and supervisory powers over payment systems and payment service entities.

Resolution SBS No. 272-2017 Regulation on Corporate Governance and Integrated Risk Management, establishes corporate governance requirements for SBS-supervised financial institutions, including mandatory independent directors on boards, remuneration committees, conflict of interest management policies, and updated risk management concepts (risk capacity, risk appetite, and risk ceilings) aligned with Financial Stability Board principles.

Law No. 31814 Law for the Promotion of the Use of Artificial Intelligence (5 July 2023), establishes a risk-based framework for AI use that applies to all private sector entities, including financial institutions deploying AI systems for credit scoring, fraud detection, and customer services.

Supreme Decree No. 115-2025-PCM Implementing Regulation for Law No. 31814 (9 September 2025), classifies AI systems by risk level and sets compliance deadlines for entities deploying AI in Peru.

Resolution SBS No. 01747-2026 Regulation on Banking as a Service (BaaS) (published July 1, 2026, effective December 30, 2026). Establishes requirements for financial institutions offering services through the BaaS model, including: authorization and notification to the SBS, information security and cybersecurity requirements, provider-receiver exclusivity rules, notification obligations for critical technology providers processing financial data, and reporting of significant contractual changes. Includes express exclusions for payment aggregation services, digital wallets acting as tokenizers, and embedded finance.

BCRP Circular No. 0017-2026-BCRP Regulation on Instant Payment Services with Alias (Reglamento del Servicio de Pagos Inmediatos con Alias) (published July 15, 2026, effective September 13, 2026). Establishes the regulatory framework for instant payments using aliases (e.g., phone numbers, email addresses) in Peru's National Payment System, including: authorization requirements for service providers, cybersecurity and operational resilience standards, risk management obligations, a sanctions regime with fines up to 120 UIT, and an adaptation period until December 31, 2026 for existing providers. 

Customers who have questions about the applicable regulations, and how these may apply to their use of AWS services, can reach out to their account representative.

AWS is committed to offering customers a strong compliance framework and advanced tools and security measures that customers can use to evaluate meet, and demonstrate compliance with applicable legal and regulatory requirements.

Financial institutions who are using or planning to use AWS services can take the following steps to better understand their compliance needs:

1. Consider the purpose of the workload(s) under consideration and the relevant categories of data in order to anticipate which legal and regulatory requirements may apply.

2. Assess workload(s) in light of local requirements. For example, SBS requires financial institutions to notify the SBS of their use of cloud services provided by a third party such as AWS if certain requirements stipulated in Resolution SBS No. 504-2021 are met, and requires financial institutions to seek the SBS’s authorization if such requirements are not met.

3. Review the AWS Shared Responsibility Model and map AWS responsibilities and customer responsibilities according to each AWS service that will be used. Customers can also use AWS Artifact to access AWS’s audit reports and conduct their assessment of the control responsibilities.

Customers who have further questions about how AWS services can enable their security and compliance needs, or who would like more information, can contact their account representative.

Financial institutions in Peru using AWS services should also consider applicable privacy requirements, including for example Law No. 29733 (Personal Data Protection Law) and Supreme Decree No. 016-2024-JUS (Regulation to the Personal Data Protection Law).

Ministerial Resolution No. 476-2025-JUS/SG (published December 31, 2025). Methodology for Calculating Fines for Violations of Personal Data Protection Regulations. Establishes guidelines and criteria for the Authority to determine the calculation of fines for violations of personal data protection regulations. It also establishes aggravating and mitigating circumstances.

Supreme Decree No. 016-2024-JUS (published 30 November 2024, effective 30 March 2025) is the new implementing regulation for Law No. 29733, replacing Decree No. 003-2013-JUS. Key obligations include: mandatory breach notification to the Authority within 48 hours, mandatory appointment of a Data Protection Officer (DPO) for entities processing large volumes of personal data, a new right to data portability, extraterritorial application to foreign entities offering services to individuals in Peru, and enhanced protections for children’s data on digital platforms.

Directorial Resolution No. 100-2025-JUS/DGTAIPD (published December 31, 2025), approves the Directive that establishes dispositions for the designation, duties and responsibilities of the Data protection Officer (ODP). This Resolution complements the obligation contained in the implementing regulations of the law, and requires public entities, qualifying private legal persons, and FONAFE companies to designate a ODP where they handle large-volumes of data, handle sensitive data as part of their core business, or are public entities per se. The designating entity must notify the appointment of the ODP to the ANPDP, publish the ODP’s contact details externally, and ensure continuous accessibility.

Customers maintain full control of the content they upload to AWS services under their AWS account(s) and maintain full responsibility for configuring access to AWS services and resources.

The AWS whitepaper Using AWS in the Context of Common Privacy and Data Protection Considerations provides useful information to customers using AWS cloud services to store or process personal data.

Customers that have questions about the applicable regulations, and how these may apply to their use of AWS services, can reach out to their account representative.