Peru

The defining development of this cycle is BCRP Circular No. 0022-2025-BCRP, the new General Regulations for the National Payments System, in force from 1 April 2026 and replacing the 2010-era Circular 012-2010-BCRP under Payments Law 29440 as amended by Legislative Decree 1665. It creates a four-category PSP taxonomy -- multi-operation companies, e-money issuers, Banco de la Nacion, and money-transfer companies -- plus a new non-SBS-supervised Entidad de Servicios de Pago (ESP) category built specifically for fintechs, with registration for ordinary payment agreements now available alongside the prior BCRP-authorisation track reserved for prominent payment systems. This is the first time Peru has created a payment-fintech licence tier that sits outside direct SBS prudential supervision, and it materially lowers the market-access threshold for smaller payment-services fintechs previously operating in a regulatory grey zone.

The new regime is not access-only, however: PSPs must implement transaction controls, retain information for five years, promptly inform clients, and communicate transfer completion, with non-compliance capable of drawing fines up to 20 UIT and suspension or revocation risk. This compliance-cost overlay applies specifically to nonbank PSPs newly brought into the perimeter, distinguishing the ESP's lighter registration bar from a lighter compliance bar.

Outlook

The PSP taxonomy's phased adaptation deadlines run through the end of 2026, meaning the practical contours of ESP registration, and the extent to which it genuinely lowers barriers versus simply relocating them, will only become clear as fintechs work through adaptation over the coming two quarters. The continuing pace of new EEDE authorisations suggests the pre-existing licensed non-bank track remains an active parallel route rather than one fintechs are abandoning in favour of ESP status.

Conduct regulation has tightened on two fronts. Resolucion SBS N. 01689-2025 amended the Reglamento de Gestion de Conducta de Mercado (Res. 3274-2017) and the Reglamento de Infracciones y Sanciones (Res. 2755-2018) to align with Ley 32294, introducing a new seven-business-day deadline for informing customers of credit-denial decisions. Subsequently, Resolucion SBS N. 01029-2026 added new light-to-very-grave infractions for consumer protection, including a grave infraction for non-compliance with advance-payment or instalment rules causing at least 20 UIT of economic harm to users, and separately incorporated new very-grave infractions specifically tied to cybersecurity failings across financial, insurance, pensions, market-conduct and risk-management systems -- an overlap with this cycle's W3 and W7 findings.

Consumer protection in the promotions space continues to run through Law 31143, which protects financial-services consumers from usury, complementing INDECOPI's general consumer-protection mandate as the authority for financial promotions, advertising and complaints-handling.

Outlook

The direction of travel is unambiguously tightening: two successive SBS resolutions within roughly a year have added disclosure deadlines, new infraction categories, and cybersecurity-specific sanctions exposure. Because the new PSP/ESP regime under BCRP Circular 0022-2025-BCRP layers additional nonbank-specific conduct obligations on top of this SBS baseline, nonbank PSPs face a compounding compliance burden through 2026 as both regulators' new obligations phase in concurrently.

A GAFI-aligned travel-rule obligation for VASPs is reported to take effect from November 2026, though this cycle's automated verification challenge flags a likely source-misattribution -- the operative instrument may be SBS Resolution 02648-2024 (dated August 2024) rather than the cited resolution, with an effective date closer to August 2026. Confidence on this specific point is held at Assessed pending primary-source confirmation.

On the CBDC side, BCRP and Viettel/Bitel launched Peru's first CBDC Innovation Pilot under an October 2024 framework agreement aimed at facilitating digital-payment access for the unbanked, running for one calendar year with a possible one-year extension. The associated BiPay digital-currency pilot has been reported reaching 4.9 million users and 23.5 million cumulative transactions using offline-capable technology aimed at financially excluded sectors, though this figure is itself flagged as potentially stale relative to March-June 2026 reporting suggesting an extension to March 2027 with somewhat different user and transaction counts.

Outlook

Peru's digital-money posture over the next cycle will likely be defined less by new legislation than by implementation detail: confirming the correct VASP travel-rule instrument and effective date, and refreshing BiPay pilot metrics against a primary BCRP source, are both flagged as priorities for the next research pass rather than settled facts this cycle.

The most consequential development this cycle is that BCRP Circular 0022-2025-BCRP extends cybersecurity and information-security provisions -- previously applicable only to banks and SBS-supervised entities -- to ESPs and other payment-system participants for the first time, materially broadening the resilience perimeter to cover nonbank PSPs newly recognised under the new payments regulation.

More broadly, Peru's cybersecurity compliance landscape combines data-protection duties under Law 29733, SBS's financial-sector rules, and cybercrime legislation under Law 30096, with PCI DSS mandatory for payment processing and PeCERT coordinating the national cybersecurity strategy.

Outlook

The extension of SGSI-C-equivalent cybersecurity obligations to ESPs, combined with SBS's parallel addition of very-grave cybersecurity infractions under Resolucion SBS N. 01029-2026, signals that operational-resilience expectations for nonbank payment fintechs will converge rapidly toward bank-grade standards over the 2026 adaptation window, raising compliance costs for the newly-scoped ESP tier discussed under W1a.

On the acquiring side, Niubiz (formerly VisaNet) remains Peru's largest acquirer, with over 300,000 affiliated merchants and 25 years of trading history, using CyberSource antifraud technology alongside PCI DSS Level 1 certification and card tokenisation. Its merchant pricing runs to a one-off S/300+IGV affiliation fee, S/50+IGV monthly maintenance, a 3.45%+IGV commission on Visa transactions and 3.98%+IGV on Mastercard, plus roughly $0.15+IGV per transaction. Izipay, a rival acquirer, is certified under PCI DSS Level 1, which it states guarantees protection and secure handling of cardholder information for its payment-link and e-commerce products.

Outlook

Scheme conduct in Peru remains structurally stable this cycle, with the APT Regulation and interoperability circular continuing to anchor card and wallet-rail conduct. The 132-million-transaction interoperability metric suggests continuing rapid uptake of the newer wallet-based rails, which may over time exert competitive pressure on the card-scheme fee structures documented above.

Two structural developments reinforce this trajectory. Law No. 32211, enacted December 2024, exempts remittances sent to Peru via money-transfer companies from IGV and permits Banco de la Nacion to offer accounts and loans to Peruvians residing abroad -- a fiscal and market-access measure explicitly targeting diaspora remittance flows. Separately, the four operating EEDEs (Peruana Soluciones, Tarjetas Peruanas Prepago, Servitebca and GMoney) have had direct access to the CCE's clearing and settlement services and BCRP's RTGS system since June 2023, giving nonbank e-money issuers direct access to systemically important settlement infrastructure as part of BCRP's phased retail-payments interoperability strategy.

Most notably this cycle, the US Federal Reserve authorised Banco de Credito del Peru (BCP) to open a branch in Miami, intended to make remittances faster and cheaper by enabling direct account-to-account transfers between BCP US and BCP Peru with fewer intermediaries -- a cross-border infrastructure development with clear read-across to W12 correspondent banking and W13 commercial intelligence.

Outlook

The corridor's growth trajectory, fiscal exemption, nonbank settlement access, and now a Fed-approved direct-branch settlement channel together point to a maturing, increasingly disintermediated US-Peru remittance corridor. The next research cycle should track whether other Peruvian banks follow BCP's lead in seeking direct US correspondent presence, and whether EEDEs' settlement access is extended further under BCRP's interoperability strategy.

Consolidation activity continues around Credicorp: Culqi was acquired by Credicorp Capital and integrated into the group's digital-payments ecosystem via its Krealo venture arm. Elsewhere in the fintech venture landscape, Leasy raised over US$28 million in debt and equity for vehicle financing, and Riqra exceeded US$1 billion in B2B e-commerce transactions.

A less-covered but structurally important segment is Peru's 242 credit and savings cooperatives (COOPAC), which operate under SBS supervision and play an important financial-inclusion role especially where traditional banking has low presence; since 2025 they have benefited from the Cooperative Deposit Insurance Fund. Industry-association growth is also notable: the Peru Payments Association grew from 4 to 34 members in its first year, encompassing fintechs, acquirers, non-bank issuers, wallets and technology providers.

Outlook

The combination of continuing bank dominance, active EEDE competition, Credicorp-led consolidation, and a rapidly-growing industry association points to a market structure in transition rather than settled. COOPAC payments-product detail remains under-covered and is flagged as a priority gap for the next research cycle, given the segment's financial-inclusion significance.

Running in parallel, Resolucion SBS N. 01029-2026 updated the Reglamento de Infracciones y Sanciones across financial, insurance, pensions, market-conduct and risk systems, incorporating new very-grave infractions especially in cybersecurity. Also relevant to this module, Resolucion SBS N. 00771-2026 granted a second extension, to 1 June 2026, of the deadline for banks to assume full liability for unrecognised card-fraud losses on cards issued before July 2025, citing the logistical burden of mass card renewal with reinforced two-factor authentication.

Outlook

Three distinct INDECOPI sanctions against two major banks within a single trailing window, layered on top of an expanded SBS infractions regime, suggest enforcement intensity against bank PSPs' fraud-prevention and authorisation controls will remain elevated through 2026, with the now-passed 1 June 2026 liability deadline likely to generate a fresh wave of disputes over legacy-card fraud claims.

Merchant-onboarding timelines vary sharply by acquirer: Culqi offers 24-48 hour express verification, Izipay 3-5 business days, and Niubiz 1-2 weeks with more bureaucratic, documentation-heavy processing, making onboarding speed a competitive differentiator. Izipay applies real-time antifraud validation and PCI DSS Level 1 protections to its payment-link product, with funds settling to merchant bank accounts the next business day regardless of receiving bank. Third-party payment-technology partners, such as Nuvei, position their offerings around reducing risk, chargebacks and simplifying PCI DSS compliance for acquirers integrating with Niubiz in the Peruvian market.

Outlook

The persistent absence of a formal chargeback mechanism for QR-wallet transfers stands out as the acquiring segment's clearest structural gap relative to card rails, and is likely to draw increasing regulatory or scheme-level attention as Yape/Plin transaction volumes continue to scale under the interoperability framework discussed in W4.

BCRP's new TAPP infrastructure opens space for fintechs, bigtechs and telcos with innovative business models, starting with a payment-initiation model, with launch expected for December 2026. A draft regulation separately aims to open the SBS regulatory sandbox to non-licensed entities such as fintech companies, allowing pilot projects lasting 18 months (renewable for 12 more); sandbox participation does not itself confer authorisation to operate -- though no confirmed effective date for this draft expansion was retrievable this cycle.

Adoption metrics underline the pace of change: digitalisation per capita rose 45.8% between 2024 and 2025 to reach 665 annual payments per inhabitant, with 2026 seeing a further acceleration to an average of 1.105 billion monthly transactions, a 45% increase versus 2025. The 132 million interoperable Yape-Plin transactions recorded between June 2024 and June 2025 further evidence rapid uptake of the newer open payment-rail infrastructure.

Outlook

With TAPP targeted for December 2026 and Open Finance's first exchange targeted for late 2027, Peru is building toward platform-level payments competition that would open the market beyond the current EEDE/bank duopoly to fintechs, bigtechs and telcos. The unconfirmed sandbox-expansion timeline remains the clearest near-term information gap in this module.

On card-fraud liability specifically, INDECOPI's Consumer Protection Commission has set refund criteria: a user may request a refund when card cloning is shown, in cases of micropayment abuse, or where the client's authentication scheme fails to meet minimum security requirements established in regulation. Since July 2025, financial-system entities have had to assume responsibility for unrecognised card transactions unless they demonstrate user fault; the deadline extending this obligation to pre-July-2025 cards has been pushed to 1 June 2026 under Resolucion SBS 00771-2026.

Complaint volumes remain high: INDECOPI recorded over twenty thousand reports against banking and financial services in the 16 March-24 July window, with recurring issues including undue charges, refund disputes and inadequate service, and BCP, Interbank, BBVA, Banco Falabella and Scotiabank among the most-reported entities.

Outlook

With the bank-liability deadline for legacy cards now passed as of 1 June 2026, and complaint volumes remaining elevated, the coming cycle is likely to test how consistently banks apply the user-fault standard in practice, and whether INDECOPI's enforcement pace (evidenced in W7) continues to escalate in response.

Effective 14 May 2025, Supreme Decree No 008-2025-JUS added private-offering investment-fund managers not supervised by SMV, and factoring companies outside Ley 26702's scope, as new UIF-obligated subjects, widening the obligated-subject perimeter. A GAFI-aligned travel-rule obligation for VASPs is reported to become effective from November 2026, posing information-management and inter-institutional cooperation challenges -- though, as flagged under W2, an automated verification challenge this cycle raises doubt over the precise instrument number and effective date, suggesting the correct citation may be SBS Resolution 02648-2024 with an August 2026 effective date. UIF-Peru's training materials also track FATF's periodic high-risk jurisdiction listings -- including North Korea, Iran and Myanmar -- as part of obligated subjects' ongoing due-diligence responsibilities.

Outlook

The obligated-subject perimeter is expanding and the travel-rule obligation is approaching, but the precision of the travel-rule's instrument citation and effective date should be treated as unconfirmed pending primary-source verification, a point flagged for follow-up analysis by the Financial Integrity Monitor.

The module's analytical spine is the persistent asymmetry between bank and non-bank access to this infrastructure. BCRP maintains an approved list of first-category foreign banks (minimum US$1.4 billion capital) used for reserve placement and correspondent purposes, spanning HSBC USA, Credit Suisse USA, MUFG Union Bank and Morgan Stanley -- a bank-only correspondent channel. This cycle's most significant development narrows that asymmetry at the margin: the US Federal Reserve's approval of Banco de Credito del Peru's Miami branch reinforces financial ties between Peru and the US, expanding financial services and simplifying international transactions and account-opening for cross-border clients, though this remains a bank-led development rather than one extending direct correspondent access to nonbank PSPs.

Peru's broader financial-system structure includes four government-owned entities -- BCRP, Banco de la Nacion, COFIDE, and the Agrarian Bank -- with SBS policy generally following BIS regulatory guidelines.

Outlook

The bank/non-bank correspondent-access asymmetry remains structurally intact even as BCP deepens its own direct US settlement channel; EEDEs' CCE/RTGS access documented in W5 is a domestic, not cross-border, exception to this asymmetry, and the coming cycle should watch for any move to extend correspondent-style cross-border access to nonbank PSPs.

Regulatory-market events also reshaped the commercial landscape this cycle. In April 2026 the US Federal Reserve approved Banco de Credito del Peru's application to open a branch in Miami, a strategic international-expansion event expected to be measured on profitability, remittance volume, and bilateral trade dynamism. BCRP's publication of Circular No. 0022-2025-BCRP in December 2025, approving the new General Regulation of the National Payments System, formally brought payment fintechs into the National Payment System perimeter for the first time. SBS published its Open Finance Roadmap in February 2026, marking the formal start of Peru's open-banking construction process in coordination with BCRP.

Outlook

Krealo's continuing deployment of venture capital into payments and adjacent fintech (Akua, Welli) alongside Culqi's leadership refresh point to sustained investment appetite within the Credicorp ecosystem specifically, even as the sector's most consequential commercial catalysts this cycle were regulatory rather than transactional -- the new payments regulation, the Open Finance Roadmap, and the Fed's Miami-branch approval.