Paraguay

The Central Bank of Paraguay (Banco Central de Paraguay, or “BCP”) is Paraguay’s primary financial authority responsible for regulations, regulatory oversight, and enforcement for banks, financial, and credit institutions. BCP is the regulatory entity in Paraguay that formulates economic, monetary, and exchange policy.

BCP exercises its supervisory functions through three distinct superintendencies: the Superintendencia de Bancos (SB), which supervises banks, finance companies, and credit institutions; the Superintendencia de Valores (SV), created by Law No. 7,162/2023 replacing the former Comisión Nacional de Valores (CNV), which regulates the securities market with functional autonomy within BCP; and the Superintendencia de Seguros, which supervises the insurance sector.

The enactment of Law No. 7,503/2025 (National Payment System) has expanded the powers of the BCP over the National Payment System (SNP), including regulatory authority over fintech companies, payment service providers, and electronic payment means.

Financial institutions in Paraguay may be subject to a number of legal and regulatory considerations when they use cloud services. Relevant regulations include, but are not limited to:

• Resolution SB. SG. No. 229/2001, dated August 24, 2001. Regulates the procedures for backup file retention, decommission, and recovery by Financial Institutions.

• Resolution SB. SG. No. 281/2004, dated November 24, 2004. Regulates the decentralization of operations and data processing by Financial Institutions.

• Resolution SB. SG. No. 179/2005, dated October 20, 2005. Regulates the security procedures for transactions carried out through electronic media.

• Resolution No. 4, Minutes 67, dated December 27, 2012. Regulation on Financial Institutions' operational risk management.

• Resolution SB. SG. No. 124/2017. Information Technology Governance and Control Manual dated November 20, 2017. Reference framework for Financial Institutions supervised by the SB of the Central Bank of Paraguay to implement minimum requirements of governance and control of information and communication technologies.

• BCP Circular SB. SG. No. 119/2020, dated April 13, 2020. SB's interpretation regarding the use of cloud services for automation.

• BCP Resolution No. 10, Minutes 43, dated July 28, 2022. Regulation for computing in the cloud which establishes the minimum guidelines and the obligations that must be met by the entities supervised by the Superintendence of Banks ("SB")—a technical department of the BCP—that choose to use cloud services.

• Resolution SB. SG No. 18/2025, dated March 12, 2025. Establishes the procedure for submitting reports and incidents through the financial communications network.

• National Cybersecurity Strategy 2025–2028 (Decree No. 3900/2025), dated May 22, 2025. National strategy covering critical infrastructure protection, incident response (CERT-PY), and cyber resilience. MITIC (Ministry of Information and Communication Technologies) is the lead agency.

• Law No. 7,503/2025. National Payment System enacted June 27, 2025. Regulates the organization, operation, and supervision of the National Payment System (SNP). Designates BCP as enforcement authority with powers to regulate security measures, interoperability, and sanctions for fintech and payment service providers. Repeals prior Law No. 4,595/2012.

• Resolution No. 15, Minutes No. 35, dated August 27, 2025. Regulation on the Authorization of Payment Initiation Service Providers (PISP).

• BCP Resolution No. 25, Minutes No. 58, dated December 18, 2025. Regulations on role definition, registration, information transparency, and information security for payment service providers (PSPs) in the national payment system.

• Resolution SB.SG. No. 8, dated January 26, 2026. Resolution establishing the procedure for the registration of critical service providers of supervised entities through the Financial Communication Network (RCF).

• Resolution G.G. N° 87, dated February 7, 2026. Central Bank of Paraguay – Supplementary Regulations related to the General Regulation of the Payment Systems of Paraguay (SIPAP) approved by Resolution No. 2, Act No. 12 dated March 12, 2026.

• BCP Resolution No. 2, Minutes No. 12, dated March 12, 2026. General regulations for payment systems in Paraguay (SIPAP).

• Resolution G.G. N° 37, dated April 8, 2026. Implementation schedule and technical connection requirements for receiving data from Payment Processing Operators (PPOs) through the Financial Communication Network (FCN) – Amendment.

• Resolution G.G. N° 54, dated May 4,2026 of the Central Bank of Paraguay. Implementation of the QR Hub component of the Instant Payment System (SPI) of the Payment Systems of Paraguay (SIPAP) – Amendment.

• Resolution G.G. N° 83, dated June 26, 2026, of the Central Bank of Paraguay. Operating Regulation for the Registry of Payment Service Providers (PSP) of the National Payment System at the Central Bank of Paraguay (BCP).

• Resolution G.G. Nº 91, dated July 7,2026. Implementation schedule and technical connection requirements for receiving data from payment media operators through the Financial Communication Network - Amendment.

• Resolution No. 6, Minutes No. 30, dated July 9, 2026. Regulations for Interoperability and Interconnection in the Credit and/or Debit Card System. Amendment.

• Resolution No. 2, Minutes No. 31, dated July 13, 2026. General Regulations of the Payment Systems of Paraguay (SIPAP).

• Resolution No. 7, Minutes No. 31, dated July 13, 2026, of the Central Bank of Paraguay. Determination of payment service providers subject to regulation, control, supervision and monitoring by the Central Bank of Paraguay within the framework of the National Payment System Law.

• Resolution No. 8, Minutes No. 31, dated July 13, 2026, of the Central Bank of Paraguay. Regulatory standard that establishes the tariff for the services of the National Payment System.

Regulations are changing rapidly in this space, and AWS is working to help customers proactively respond to new rules and guidelines. AWS encourages its financial institution customers to obtain appropriate advice on their compliance with all regulatory and legal requirements that are relevant to their business, and local regulations, guidelines and laws. 

AWS is committed to offering customers a strong compliance framework and advanced tools and security measures that customers can use to evaluate, meet, and demonstrate compliance with applicable legal and regulatory requirements.

Financial Institutions who are using or planning to use AWS services can take the following steps to better understand their compliance needs:

1. Consider the purpose of the workload(s) under consideration and the relevant categories of data in order to anticipate which legal and regulatory requirements may apply.

2. Assess the materiality or criticality of the relevant workload(s) in light of local requirements. 

3. Review the AWS Shared Responsibility Model and map AWS responsibilities and customer responsibilities according to each AWS service that will be used. Customers can also use AWS Artifact to access AWS’s audit reports and conduct their assessment of the control responsibilities.

Customers that have further questions about how AWS services can enable their security and compliance needs, or that would like more information, can contact their account representative.

Financial Institutions in Paraguay using AWS should also consider applicable privacy requirements, including Law No. 6,534/2020 Protection of Personal Credit Data, which aims to guarantee the protection of credit data of any person, regardless of their nationality, residence or domicile; and to regulate data collection activities and access to personal credit data.

Resolution No. 1,502/2022 issued by the Consumer Protection Agency (“SEDECO” by its Spanish acronym) dated October 5, 2022, regulates Articles 6, 9 and 20 of Law No. 6,534/2020. This Resolution provides that consent to the processing of personal credit data must be informed and obtained directly by each provider seeking to process such data and may not be deemed to extend to third parties that were not covered by the original authorization. In addition, the Resolution approves the Procedure for Handling Complaints filed by consumers and end users.

Law No. 7,593/2025 — Personal Data Protection Law (enacted November 27, 2025). Paraguay's first comprehensive GDPR-aligned data protection law, applicable to all public and private entities processing personal data in or relating to Paraguay. Key provisions include data subject rights (access, rectification, erasure, portability, review of automated decisions), mandatory DPO appointment, 72-hour breach notification, DPIAs, and international transfer safeguards. Creates the Agencia Nacional de Protección de Datos Personales as autonomous supervisory authority. Full compliance required by November 27, 2027. Law No. 6,534/2020 remains in force for credit data.

Customers maintain full control of the content they upload to AWS services under their AWS account(s), and maintain full responsibility for configuring access to AWS services and resources.

The AWS whitepaper, Using AWS in the Context of Common Privacy and Data Protection Considerations provides useful information to customers using AWS cloud services to store or process personal data.

Customers that have questions about the applicable regulations, and how these may apply to their use of AWS services, can reach out to their account representative.