Peru Payments & Fintech Regulation

Licensing, Authorisation & Market Access

BCRP Circular 0022-2025-BCRP, in force since 1 April 2026, replaces the 2010-era regulation (Circular 012-2010-BCRP) governing Peru's National Payments System and is the anchor instrument for this cycle's licensing-and-access developments. This is a Confirmed-confidence finding corroborated across a T1 BCRP-adjacent report and a T3 law-firm alert. Under this new regime, Electronic Service Providers (ESPs) — the non-bank PI/EMI segment of the market — must submit authorisation documentation on a phased schedule ending 31 December 2026, with the specific phasing determined by each provider's 2025 average monthly transaction values. This is a Probable-confidence finding resting on a single T3 practitioner-guide source.

The bank-PSP and non-bank PI/EMI distinction is structurally important here: bank participants in the payments system are already subject to existing prudential authorisation under banking law, whereas the phased ESP authorisation schedule is specifically targeted at closing an access-and-oversight gap for non-bank payment institutions and e-money issuers that previously operated with lighter-touch or no dedicated payments-specific authorisation. No T1-hosted primary text of Circular 0022-2025-BCRP was directly retrieved this cycle; the finding relies on T3 law-firm alert corroboration of a T1-adjacent BCRP report, a gap noted in this cycle's gaps register.

Outlook

The 31 December 2026 deadline for ESP authorisation filings is the key milestone to watch. How many ESPs successfully complete authorisation by that date, and whether BCRP grants any extensions to smaller providers further down the phased schedule, will determine the practical market-access effect of this reform on Peru's non-bank payments sector.

Licensing, Authorisation & Market Access

Peru's market-access architecture liberalised materially this cycle across three coordinated regulatory actions. The SBS approved Resolucion SBS N 01747-2026, a Banking-as-a-Service regulation, following a public consultation begun in May 2026 that attracted more than one hundred sector participants. The regulation allows banks and e-money issuers to expose their infrastructure to both supervised and unsupervised third parties, opening a formal pathway for fintechs to build regulated financial products on top of incumbent bank and e-money-issuer rails without themselves holding a full banking licence.

Separately, the BCRP now formally recognises four payment-service-provider categories, including a newly created entidades de servicios de pago category specifically for unsupervised payment fintechs. Firms in this new category must report information to the BCRP within specified timeframes, giving the central bank visibility into a segment of the market that previously operated with less formal oversight, while stopping short of bringing these firms under full prudential supervision.

The SBS also published a draft flexibilising financial licensing for EDEs (electronic money issuers), ETFs, and self-funded credit companies, cutting authorisation timelines by roughly forty percent, from approximately eighteen months to a maximum of nine months. This is a tier-1-sourced development from the official gazette El Peruano and represents a significant reduction in the time-to-market for new non-bank payment institutions.

Finally, the SBS modified its 2021 novel-models regulatory sandbox regime via Resolucion SBS N 04142-2025, removing the prior requirement that sandbox participants already hold an SBS organisation authorisation before entering the sandbox. This specifically opens the sandbox to genuinely pre-authorisation fintech experimentation, a segment previously excluded by the prior rule's circularity.

Taken together, these four actions constitute a coordinated liberalisation of Peru's payments market-access architecture: a new PSP category with lighter-touch reporting, a BaaS framework enabling infrastructure-sharing, faster licensing timelines for e-money issuers, and a genuinely open sandbox. The bank-versus-non-bank distinction remains structurally important throughout: banks and e-money issuers are the infrastructure providers under BaaS, while the new PSP category and sandbox reforms are aimed squarely at non-bank entrants.

Outlook

The practical test of the BaaS framework will be how many banks and e-money issuers actually expose infrastructure to third parties in the coming cycles, and how the SBS supervises firms that access that infrastructure without themselves being directly regulated. The new PSP category's reporting obligations to the BCRP will similarly need to be tested in practice; the specified timeframes for reporting were not detailed in this cycle's sourcing. The flexibilised licensing timeline and open sandbox together suggest continued near-term growth in new non-bank entrants to Peru's payments market.

Licensing, Authorisation & Market Access

Peru's national payments-system regulatory architecture has been substantially replaced this cycle. BCRP Circular 0022-2025-BCRP approved a new General Regulation for the National Payments System, in force since 1 April 2026, wholesale-replacing the prior Circular 012-2010-BCRP that had governed the sector for a decade and a half. The regulation is issued under the authority of Payments Law 29440 as amended by Legislative Decree 1665, giving it a statutory anchor distinct from a purely discretionary circular. This is a high-confidence, high-impact development sourced to a specialised Peruvian law-firm publication (Estudio Rodrigo), and it functions as the anchor instrument for several connected licensing and market-access changes landing in the same window.

The most consequential of the connected changes is a phased authorisation requirement for Electronic Service Providers (ESPs) that do not manage deposit accounts or issue e-money — a category distinct from banks and from licensed non-bank payment institutions and e-money institutions (PI/EMI). These ESPs must submit authorisation documentation on a schedule keyed to their 2025 average monthly transaction values, with the process required to complete by 31 December 2026. Critically, the regulation allows ESPs to continue operating while their applications are processed, avoiding a market-access cliff-edge; this is a source-corroborated, high-confidence finding (Chambers and Partners practice guide).

The second connected development is SBS Resolution 01747-2026, published 3 July 2026 in El Peruano, which establishes Peru's first express Banking-as-a-Service framework. The framework governs supervised BaaS providers that enable third parties — whether themselves supervised or not — to offer financial services via regulated digital infrastructure. This is a bank-and-nonbank-spanning instrument: the BaaS provider itself sits within SBS's supervisory perimeter, but the framework is explicitly designed to let both supervised and unsupervised third parties distribute financial services through that provider's regulated rails.

The bank-versus-non-bank distinction is explicit and material throughout this cluster of reforms. Banks already operating within SBS's prudential perimeter face the new payments-system regulation and the BaaS framework as extensions of an existing supervisory relationship; non-bank PI/EMI-type providers and the newly-defined ESP category face a more consequential shift, since for many of them this cycle's regulation is the first formal authorisation touchpoint with SBS at all. This asymmetry — incremental extension for banks, first-time formalisation for many non-banks — is the analytical spine of this module's read on Peru this cycle.

Outlook

The 31 December 2026 ESP authorisation deadline is the clearest near-term checkpoint: it will reveal how many previously informal or lightly-regulated electronic service providers complete formal authorisation, and conversely how many exit the market rather than complete the process. The BaaS framework is too new to have generated a first wave of registered providers within this cycle's evidence base; the next material checkpoint is the first cohort of SBS-supervised BaaS providers and clarity on how SBS intends to supervise, or disclaim responsibility for, the unsupervised third parties such providers may enable.

Licensing, Authorisation & Market Access

Peru's core payments-regulatory framework was restructured this cycle by BCRP's new General Payments Regulation, issued under Circular Nº 0022-2025-BCRP and effective 1 April 2026, which replaces the central bank's 2010-era rulebook in its entirety. The most consequential structural change is the extension of BCRP authorisation to non-bank payment service providers performing acquiring, fund-disbursement, collection, and payment-initiation activities — functions that, prior to this cycle, operated in a comparatively unregulated or legally ambiguous space relative to bank-channel payment activity. The regulation applies a staggered compliance timeline: in-scope PSPs must complete authorisation by deadlines tiered according to monthly transaction volume, with the full compliance window running through the end of 2026. The finding is high-confidence, directly corroborated by a BCRP primary publication (the Reporte del Sistema Nacional de Pagos, March 2026) and independently corroborated by secondary industry and legal commentary describing the same instrument and effective date.

The bank-versus-non-bank distinction is the analytical spine of this development. Banks and other BCRP-supervised financial entities already operated within an existing prudential-authorisation perimeter; the substantive change this cycle is squarely on the non-bank side, where payment fintechs performing acquiring, disbursement, collection, or initiation functions move from an unregulated or ambiguously regulated position into a formal BCRP authorisation requirement — a status the evidence describes as ending the sector's prior legal-grey-area position. This is a market-access-defining change: any new non-bank entrant must now plan around BCRP authorisation as a gating requirement rather than a voluntary or informal registration, and existing non-bank PSPs must sequence their authorisation applications against the volume-tiered deadline structure to remain in continuous legal operation through the transition.

For market-access purposes, the practical effect is twofold. First, market entry for a new non-bank payment provider now runs through a defined BCRP authorisation process rather than through incorporation and informal market operation alone, raising the compliance bar for entry. Second, existing non-bank PSPs operating at higher monthly transaction volumes face nearer-term deadlines than smaller players, creating a de facto phased consolidation pressure across the non-bank segment.

Outlook

The compliance runway to monitor is the volume-tiered deadline structure itself: providers with higher monthly transaction volumes face nearer-term deadlines, and the full compliance window closes at the end of 2026. Confirmation of the primary full text of Circular Nº 0022-2025-BCRP — relied on this cycle through the BCRP's own periodic payments-system report and secondary legal commentary rather than direct retrieval of the circular itself — would strengthen confidence in the precise deadline tiers and any transitional provisions for PSPs already operating at the point the regulation took effect.

Conduct, Safeguarding & Financial Promotions

The Banco Central de Reserva del Perú approved new rules for firms that receive and later settle merchant proceeds from card, QR and immediate-payment acceptance. The rules cover fund-handling conditions, commissions, contracts and interoperability, and take effect from 2027. This extends BCRP conduct and safeguarding regulation beyond its prior focus on payment-system interoperability mandates into the fund-handling practices of payment-acceptance and aggregator firms specifically, firms that hold merchant proceeds between the point of customer payment and eventual settlement to the merchant.

A related interoperability requirement applies to immediate-payment acceptance operations using alias or QR codes: these must comply with the BCRP's pre-existing interoperability rules regardless of the underlying technical infrastructure processing the payment. This confirms that interoperability obligations are infrastructure-agnostic and apply at the level of the payment-acceptance function itself rather than being tied to a specific rail or technology stack.

These new conduct rules sit alongside the BCRP's established phased interoperability strategy under Circular N.° 0024-2022-BCRP, which by April 2025 had already delivered over 176 million interoperable transactions worth approximately S/11,000 million, evidence of a payments market where interoperability is already operationally mature even as the central bank now extends its regulatory reach into fund-handling and commercial-terms conduct for the firms operating within that interoperable system.

Outlook

The full text of the new fund-handling circular was not independently retrieved this cycle; current confidence in its precise scope is Probable, based on press reporting rather than the underlying BCRP text. With a 2027 effective date, the period ahead is the window in which payment-acceptance and aggregator firms should expect further BCRP implementation guidance clarifying the specific fund-handling, commission-disclosure and contract-term conditions the rule will impose.

Operational Resilience & Critical Infrastructure

Circular 0022-2025-BCRP imposes a defined set of operational-resilience obligations on payment-system participants: risk-management, information-security and cybersecurity policies, and participation in business-continuity testing. Non-compliance carries fines of up to 20 UIT. This is a Probable-confidence finding resting on a single T3 practitioner-guide source, and it applies to payment-system participants generally, without distinguishing between bank-PSP and non-bank PI/EMI participants — a notable structural feature, since it means the same resilience-testing and cybersecurity-policy standard applies across both segments of the market under this instrument.

This operational-resilience layer sits alongside, and shares its legal basis with, the licensing and authorisation reforms tracked under W1a: both stem from the same Circular 0022-2025-BCRP instrument, in force since 1 April 2026. No further detail on the specific content of the required risk-management or cybersecurity policies, or on how BCRP intends to supervise business-continuity testing in practice, was located this cycle.

Outlook

The practical enforcement of the 20 UIT fine structure for non-compliance is the item to watch: whether BCRP issues its first sanctions under this resilience framework in the coming cycles would meaningfully upgrade the current single-source finding and demonstrate the regime's practical teeth.

Operational Resilience & Critical Infrastructure

The Banco Central de Reserva del Perú issued Circular N° 0022-2025-BCRP, published in December 2025, approving a new General Regulation of the National Payment System that replaces the 2010-era rulebook governing Peru's payment-system infrastructure. The new regulation entered into force on 1 April 2026 and establishes phased adequacy deadlines running through the end of 2026, applicable across the full range of payment-system participants: banks, fintechs, acquirers and technology providers are all captured, with no carve-out distinguishing bank from non-bank participants in the compliance timeline. This is a bank-and-non-bank-parity approach to infrastructure modernisation — the new rulebook does not sequence non-bank PSPs behind banks in adequacy obligations, but requires both categories to reach compliance on the same phased schedule through end-2026.

The practical effect of replacing a rulebook that had stood since 2010 is significant: Peru's payment-system infrastructure standards had not been comprehensively updated across a period that saw substantial growth in fintech and e-wallet participation in the market. The new regulation's phased-adequacy structure suggests BCRP recognised that immediate full compliance was not realistic given how much has changed operationally since 2010, and opted instead for a managed transition running the length of 2026.

Outlook

The phased adequacy deadlines under Circular 0022-2025-BCRP complete at the end of 2026. Whether banks, fintechs, acquirers and technology providers all reach compliance on comparable timelines, or whether non-bank participants lag, will be the key marker of whether this infrastructure modernisation delivers genuine parity in practice or simply parity on paper. No further granularity on specific adequacy sub-milestones within 2026 was available this cycle.

Operational Resilience & Critical Infrastructure

Peru's central bank has issued a binding universal-interoperability mandate that fundamentally restructures the country's payments infrastructure. Circular N 0017-2026-BCRP, published 15 July 2026, requires all banks, cajas, fintechs and e-wallets to accept and process instant alias, QR, or mobile-number-based transfers up to S/30,000 per operation, on a twenty-four-hour, seven-day, three-hundred-sixty-five-day basis, and explicitly prohibits any institution from discriminating against a transfer based on which institution originated it. The circular enters into force approximately sixty days after publication, landing around mid-September 2026.

This is a tier-1-sourced, Confirmed development with high impact rating: it closes what had previously been a fragmented interoperability landscape in which a transfer's success could depend on which wallet or bank the sender and recipient each held accounts with. By mandating universal acceptance regardless of origin institution, the BCRP is treating payment interoperability as critical infrastructure requiring binding, not voluntary, standardisation.

The BCRP is separately reported to be piloting a further structural development: a UPI-inspired instant-payments platform, internally referenced as TAPP, targeted for a pilot beginning end-2026. The stated design goal is payment initiation that is independent of the specific wallet or bank the underlying user holds their account with, a step beyond simple acceptance-mandate interoperability toward a shared initiation layer. This pilot is sourced to tier-3 reporting only, with lower confidence than the binding Circular 0017-2026 mandate, and should be read as a probable but not yet confirmed development.

The bank-versus-non-bank distinction is structurally central to both developments: the interoperability mandate applies uniformly across banks, cajas municipales, fintechs and e-wallets alike, meaning non-bank payment institutions face the same binding infrastructure obligation as licensed banks, a notable levelling of resilience obligations across the bank/non-bank divide that is less common in payments regulation generally.

Outlook

The immediate catalyst to watch is compliance readiness ahead of the circular's entry into force around mid-September 2026; smaller cajas and e-wallets with less mature technical infrastructure may face the greatest integration burden. Beyond that near-term milestone, the TAPP pilot's progress through end-2026 will indicate whether Peru moves toward a genuinely wallet-agnostic payment-initiation model, which would represent a further structural step beyond the current interoperability mandate.

Operational Resilience & Critical Infrastructure

BCRP Circular 0017-2026 requires all interoperable-payment participants — banks, cajas, fintechs and digital wallets alike — to support instant transfers keyed to a DNI (national identity document) alias rather than requiring senders to know a recipient's account number. The obligation takes effect sixty days after publication, with phased availability rolled out per institution rather than as a single simultaneous cutover. This is an infrastructure-interoperability mandate with direct operational-resilience implications.

The choice of the DNI as the payment alias is a notable design decision. Rather than introducing a payments-specific identifier, Peru is building its instant-payments interoperability layer directly on top of its existing national identity infrastructure. This lowers the friction of alias adoption, but it also concentrates operational-resilience risk: any disruption or data-quality issue in the national identity system's records has a direct and immediate knock-on effect on payments-alias resolution across every participating institution simultaneously.

Because the mandate applies across banks, cajas, fintechs and digital wallets without exception, it is a rare instance in this cycle's evidence base of a single obligation applying identically across the bank/non-bank divide that otherwise structures much of Peru's payments-regulatory architecture. This is a probable-tier, moderately-sourced finding (The Rio Times, tier 3) rather than a confirmed reading of the underlying BCRP circular text itself, and the precise technical specification for alias-resolution infrastructure is not established in this cycle's evidence base.

The operational-resilience stakes of this mandate compound with the other infrastructure-facing changes landing in the same period, including the new National Payments System regulation's authorisation and reporting requirements and the card-sector two-factor-authentication and liability-shift obligations. No source in this cycle's evidence base documents an actual operational incident, outage, or fraud event connected to the DNI-alias mandate; this is expected given the obligation's recency and phased rollout.

Outlook

The phased, per-institution rollout structure means instant-payment interoperability via DNI alias will not reach full market coverage on a single date; the practical checkpoint to watch is which institutions have gone live with alias-resolution support as the compliance window progresses through the remainder of 2026. A second item to watch is whether BCRP publishes any technical standard, uptime requirement, or fraud-control specification alongside the interoperability mandate; none has surfaced in the evidence base for this cycle.

Operational Resilience & Critical Infrastructure

Two Peru-specific crypto-sector items are tracked here this cycle, one carried under the Sentinel.gi feed convention and one as a short dashboard entry. Chapter VIII (Regla de Viaje) of Resolución SBS N.° 02648-2024 — Peru's Travel Rule for virtual-asset service providers — enters into force on 1 August 2026, closing a two-year grace period for domestic and foreign-branch VASPs. This item carries an AML/CFT dimension that is routed to the Financial Integrity Monitor under the standing Sentinel-feed convention; it is noted here only for its operational-infrastructure relevance to VASPs' compliance-system readiness ahead of the 1 August commencement date, without independent illicit-finance analysis. Separately, as a dashboard item, Proyecto de Ley N.° 1042/2021-CR — the broader legislative vehicle that would establish a dedicated crypto-asset framework — remains stalled in committee since being sent back on 19 March 2025, with no enactment timeline. The structural gap this leaves is the continued absence of a dedicated crypto-asset licensing regime in Peru, a condition unchanged by the Travel Rule's narrower CTF-specific commencement.

Outlook

The commencement date of 1 August 2026 for the Travel Rule is the operational milestone to track for VASP readiness; any implementation friction or infrastructure gap among affected VASPs would be a relevant operational-resilience signal, though full illicit-finance analysis of the Rule itself sits with the Financial Integrity Monitor. No near-term legislative movement on Proyecto de Ley N.° 1042/2021-CR is currently evidenced.

Payment Corridor Dynamics

BCRP Circular 0017-2026-BCRP, published 15 July 2026, mandates 24/7 interoperable instant payments in Peruvian soles via alias — mobile number, national ID (DNI), or QR code — with full interoperability required across banks, cajas municipales, fintechs and digital wallets. The mandate takes effect 60 calendar days after publication. This is a Probable-confidence finding, corroborated by a T3 law-firm alert and a T4 press report, both citing the same instrument and effective-date mechanics.

The alias-based interoperability requirement is structurally significant because it spans the full range of payment-system participant types — banks, cajas, fintechs, and digital wallets alike — rather than being confined to bank-to-bank rails. This positions Peru's domestic instant-payments corridor as a genuinely cross-sector interoperable rail rather than a bank-centric real-time payment system layered on top of a fragmented non-bank ecosystem.

Outlook

The effective date, falling approximately 60 days after the 15 July 2026 publication, places the mandate's operational go-live in the third quarter of 2026. The item to watch is whether all covered participant types — particularly smaller cajas and fintechs — achieve interoperability compliance by that date, or whether BCRP grants phased extensions similar to the ESP authorisation schedule under Circular 0022-2025-BCRP.

Payment Corridor Dynamics

Circular N° 0017-2026-BCRP, published 15 July 2026, mandates that all digital-payment providers in Peru — spanning banks, cajas municipales, fintechs and e-wallets — permit instant, interoperable transfers of up to S/30,000 to any recipient, accessible via payment alias, QR code, mobile phone number or national identity number (DNI), operating twenty-four hours a day. The rule takes effect approximately sixty days after publication. This is a universal interoperability mandate in the fullest sense: it does not create a new scheme limited to a subset of providers, but requires the existing population of digital-payment providers, regardless of institutional type, to interoperate on common instant-transfer rails.

The S/30,000 ceiling and the alias/QR/phone/DNI addressing options are the two structural features that define this corridor. The multiple addressing methods lower the practical friction of initiating a transfer — a sender need not know a recipient's account number, only a phone number, DNI, or scanned QR code — while the S/30,000 ceiling sets a meaningful but bounded transaction-size limit for the instant-transfer rail, distinguishing it from higher-value settlement channels that may carry different risk controls. Because the mandate applies identically across banks, cajas, fintechs and e-wallets, it removes what would otherwise be a structural advantage for bank-affiliated providers in offering instant, low-friction transfers, and puts non-bank PSPs on the same functional footing for this transaction type.

Outlook

The near-term marker to watch is the roughly sixty-day period following the 15 July 2026 publication date, after which the mandate takes legal effect; whether the full population of digital-payment providers — banks, cajas, fintechs and e-wallets alike — demonstrates operational readiness by that date will be the first real test of this corridor's practical universality. Beyond that, whether transaction volumes on the mandated instant-transfer rail concentrate among particular provider types, or distribute evenly as the interoperability design intends, is a further open question with no data available this cycle.

Payment Corridor Dynamics

BCRP codified a nationwide instant-payments interoperability mandate this cycle via Circular N° 0017-2026-BCRP, dated 15 July 2026, requiring 24/7/365 interbank instant transfers with alias and QR-code addressing and a per-transaction cap of S/30,000. The mandate builds on BCRP's earlier collaboration with India's NPCI on a UPI-style Retail Payments Platform initiative, extending that groundwork into a binding interoperability circular rather than a pilot or voluntary arrangement. The finding is high-confidence, sourced to secondary Peruvian media reporting of the BCRP circular; the primary circular text itself was not independently retrieved this cycle.

For corridor dynamics specifically, alias- and QR-based addressing lowers the practical friction of person-to-person and person-to-merchant instant transfers by removing the need for account-number exchange. The S/30,000 per-transfer cap functions as a risk-containment ceiling on the instant rail specifically, distinguishing it from higher-value interbank settlement channels that continue to operate under existing arrangements. Combined with BCRP's parallel authorisation of non-bank PSPs under the new General Payments Regulation, the interoperability mandate extends the practical reach of instant payments beyond bank-to-bank corridors into corridors that non-bank payment initiators and collectors can now participate in on a formally authorised basis, materially accelerating Peru's retail-payments modernisation trajectory.

Instant-payments interoperability mandates of this kind typically function as a market-structure equaliser between incumbent banks and newer non-bank payment providers: because the rail's addressing and settlement mechanics are standardised at the central-bank level rather than negotiated bilaterally between participants, a smaller non-bank payment initiator gains access to the same instant-transfer rail as an incumbent bank, provided it clears the separate BCRP PSP authorisation bar introduced under the General Payments Regulation this cycle. This linkage means the practical value of instant-rail access is now conditioned on a compliance gate that did not exist in this form before this cycle.

Outlook

The item to monitor next cycle is adoption depth: whether interbank instant-transfer volumes materially shift toward the alias/QR rail now that the mandate is formally codified, and whether the S/30,000 cap becomes a binding constraint on use cases that would otherwise migrate to the instant rail from slower interbank channels. Corroboration of the primary BCRP circular text would also confirm whether any corridor-specific carve-outs or phased rollout provisions apply beyond the headline mandate reported this cycle.

Merchant Acquiring & Risk

The BCRP's new fund-handling rules, effective from 2027, bear directly on merchant-acquiring practice in Peru because they govern firms that receive and later settle merchant proceeds from card, QR and immediate-payment acceptance. The conditions set by the rule touch fund-handling itself, commissions charged on acceptance and settlement, the contractual terms between acquirers or aggregators and merchants, and interoperability obligations for the acceptance infrastructure involved. For a merchant-acquiring or payment-aggregation business operating in Peru, this is a central-bank-level tightening of the regulatory conditions attached to holding and settling merchant funds, rather than a scheme-level or bilateral-contract matter.

The interoperability dimension of the new rule is explicit: immediate-payment acceptance operations using alias or QR codes must comply with the BCRP's existing interoperability rules regardless of underlying infrastructure, meaning a merchant-acquiring firm cannot structure its technical stack to sit outside the interoperability mandate. This confirms that Peru's interoperability regime, already evidenced by the BCRP's own reporting of over 176 million interoperable transactions worth approximately S/11,000 million by April 2025 under the phased strategy of Circular N.° 0024-2022-BCRP, continues to extend its reach as acceptance and aggregation business models evolve.

Outlook

Merchant-acquiring and payment-aggregation firms operating in Peru have until 2027 to bring fund-handling, commission-disclosure and contractual practices into line with the new BCRP conditions. The specific detail of what the rule requires of acquirers versus aggregators, and whether any distinction is drawn between bank-affiliated and non-bank acquiring models, was not confirmed in the press reporting available this cycle and should be verified against the BCRP's own circular text once available.

Merchant Acquiring & Risk

SBS Regulation 2286-2024 mandates two-factor authentication for all card transactions — debit, credit and mobile-wallet-linked cards alike — and shifts liability for unrecognised-transaction losses onto issuers and acquirers, with the shift fully in force as of 1 July 2025 following phased implementation across 2024 and 2025. This is a probable-tier, moderately-sourced finding (Feedzai, tier 3) describing a structural reallocation of fraud-loss exposure within Peru's merchant-acquiring value chain.

The mandate's scope — all card transactions, without carve-outs identified in the evidence base — means acquirers and issuers cannot selectively apply two-factor authentication only to higher-risk transaction profiles. This has direct merchant-acquiring implications: acquirers must ensure their merchant-facing payment infrastructure supports two-factor authentication flows across the full range of card-transaction types they process, and the liability shift gives acquirers a direct financial incentive to ensure merchants' technical integrations correctly implement the required authentication steps.

This liability reallocation is now over a year into full effect, giving Peru's card-acquiring and issuing institutions a meaningful implementation runway; the evidence base for this cycle does not include fraud-loss volume data, dispute-rate statistics, or any regulatory review of the liability shift's practical operation, which is a material gap for assessing whether the reallocation has achieved its evident policy goal without generating a disproportionate compliance burden on smaller acquirers.

Because this obligation predates the current cycle's other headline developments — the national payments-system regulation, the BaaS framework, and the DNI-alias mandate — it should be read as part of the standing compliance baseline against which those newer measures are layered, rather than as this cycle's news in its own right.

Outlook

The primary item to watch is whether SBS, a card scheme, or an industry association publishes any data on dispute volumes, fraud-loss allocation, or authentication-failure rates since the liability shift took full effect in July 2025. A second item is whether the two-factor-authentication mandate is extended or adjusted for emerging card-adjacent payment forms as Peru's broader payments-infrastructure modernisation continues to develop in parallel.

Product Innovation & Market Development

The wallet-to-bank barrier in Peru's payments market is described in industry commentary as having effectively disappeared following BCRP's interoperability consolidation, reflecting a maturation of product development in which digital wallets and traditional bank accounts now function as interoperable participants in a common payments ecosystem rather than separate, siloed products. This is a product-development outcome distinct from the underlying regulatory or infrastructure changes driving it, though it is a direct consequence of BCRP's interoperability strategy and the accompanying growth in industry participation described elsewhere this cycle.

An emerging product sub-vertical flagged for 2026 is AI-based SME credit-scoring for alternative lending, though the evidentiary basis for this development this cycle is limited and the finding should be treated as an early, uncertain signal rather than a confirmed market trend.

Outlook

Whether AI-based SME credit-scoring for alternative lending develops into a substantiated product trend, with named providers or transaction volumes, is the item to watch for confirmation in a subsequent cycle. Continued consolidation of wallet and bank-account interoperability into single-product user experiences is the broader trend already under way and worth tracking for further evidence.

Product Innovation & Market Development

BCRP is reportedly evaluating a new regulation for payment initiators, targeted for Q2 2026, as the fourth phase of its broader open-finance and interoperability roadmap, coordinated with SBS. This is an Uncertain-confidence finding resting on a single T3 industry-association source, and no confirmed instrument has been published this cycle.

This payment-initiators regulation, if it materialises, would sit as a distinct fourth phase alongside the payments-system overhaul (Circular 0022-2025-BCRP) and the instant-payments mandate (Circular 0017-2026-BCRP) already in force or taking effect this cycle — together forming a four-part sequenced modernisation programme spanning licensing, resilience, real-time payment corridors, and now potentially open-finance payment initiation. The regulatory-product-access framing here (a thematic regulatory development) is distinct from any specific announced commercial payment-initiation product launch, which would instead fall under commercial-intelligence coverage.

Outlook

Whether BCRP publishes the payment-initiators regulation within its targeted Q2 2026 window, or whether the timeline slips, is the key uncertainty to track. Given the single-source, Uncertain-confidence basis for this finding, corroboration from a second source or a formal BCRP consultation announcement would materially strengthen confidence in this development in the next cycle.

Product Innovation & Market Development

Two linked product-development tracks define this module's signal for Peru this cycle. First, BCRP's Transferencias Automáticas de Pagos (TAPP) platform, developed under a 2024 agreement between BCRP and India's National Payments Corporation and explicitly modelled on India's UPI system, is targeted to begin pilot operation in late 2026. TAPP is designed to open instant-payments rails directly to fintechs and merchants, extending Peru's interoperability push beyond bank-to-bank settlement and into a retail-payments architecture where non-bank participants can plug into the platform directly rather than through bank intermediation.

Second, and complementary to TAPP, BCRP announced it is evaluating a new regulation for payment initiators — "iniciadores de pagos" — as part of Phase 4 of its broader interoperability roadmap, with issuance targeted for the second quarter of 2026. A payment-initiator regulation would give third-party providers a defined legal basis to initiate payments on behalf of customers directly from their accounts at other institutions, the open-banking-style capability that TAPP's retail architecture would need in order to function as a genuine multi-provider platform rather than a bank-centric rail with fintech access as an afterthought.

Running in parallel, the Superintendencia de Banca y Seguros y AFP separately signalled a forthcoming Open Finance and Open Banking roadmap around the turn of 2025 into 2026. This SBS-side signal has not yet been clearly integrated with BCRP's Phase 4 payment-initiator work in available reporting, leaving open the question of whether Peru will end up with one coherent open-banking framework or two regulatory tracks addressing overlapping ground from different institutional angles.

Outlook

The Q2 2026 target for BCRP's payment-initiator regulation and the late-2026 target for TAPP's pilot launch are the two markers to watch, and their sequencing matters: if the payment-initiator regulation is finalised before TAPP's pilot begins, third-party initiators would have a clear legal basis to build on the platform from day one. If TAPP's pilot proceeds first, early platform design may need to accommodate initiator-regulation requirements retrospectively. Whether SBS's Open Finance roadmap converges with or diverges from BCRP's Phase 4 track remains an open structural question with no resolution visible this cycle.

Product Innovation & Market Development

Peru's digital-payments market grew sharply through 2025 and into 2026, driven substantially by the interoperability improvements building toward the BCRP's July 2026 mandate. BCRP's own national payments-system report, published March 2026, found that digital payments per adult reached 665 per year in 2025, an increase of 45.8 percent versus 2024, a growth rate the report attributes to wallet and debit-card usage expansion tied to the interoperability rollout already under way. This is a tier-1-sourced, Confirmed figure directly from the central bank's own systemic reporting.

Separate tier-3 industry-forum reporting from August 2026 places the figure somewhat higher, at 767 digital payments per adult per year, and situates Peru third in Latin America by this measure behind Brazil and Chile, and second specifically when measured against the banked population. This higher figure carries materially weaker sourcing than the BCRP's own tier-1 report and should be treated as a directional industry estimate rather than an official statistic; the two figures are not necessarily measuring an identical basket of payment types or an identical population base.

Alongside this growth, the SBS re-denominated e-money and basic-account transaction and balance limits in UIT (unidad impositiva tributaria, Peru's tax-unit index) terms rather than fixed soles amounts, via Resolucion SBS N 00704-2026 dated 12 March 2026. This is a product-design-relevant change: rather than requiring periodic manual revision of soles-denominated limits, the new UIT-indexed structure adjusts automatically each year as the tax-unit value changes, giving e-money product design more predictable long-term limit trajectories.

Read together, these developments show a market where usage growth, infrastructure mandate, and product-parameter design are moving in a mutually reinforcing direction: rising usage volumes are both the product of, and the justification for, continued infrastructure and product-limit modernisation.

Outlook

The next cycle's BCRP national payments-system report will be the key indicator of whether the growth trajectory continues once the universal-interoperability mandate takes effect in mid-September 2026; a further acceleration in digital-payments-per-adult figures would corroborate the causal link industry commentary has drawn between interoperability and usage growth. The gap between the BCRP's own 665-per-adult figure and the higher tier-3 767 figure also warrants reconciliation in future reporting.

Product Innovation & Market Development

Three distinct product and market-development signals surfaced for Peru this cycle. First, SBS published its Open Finance roadmap in February 2026, beginning with Open Banking, and explicitly cited approximately ninety-two percent household mobile and telecom penetration — sourced to OSIPTEL data — as market-readiness context. This is a high-confidence, well-sourced finding (Chambers and Partners) describing a policy-level signal of direction rather than a binding technical mandate.

Second, BiPay obtained Empresa Emisora de Dinero Electrónico (EEDE) authorisation via SBS Resolution 00173-2026, dated 21 January 2026, converting a DNI-linked digital-wallet pilot into a formally licensed e-money issuer. This finding is sourced to a primary regulatory publication rather than commercial commentary, giving it the highest confidence rating among this cycle's W9 findings. The BiPay conversion is a concrete, first-party-confirmed instance of SBS's e-money-issuer authorisation pipeline actively processing a pilot-to-licence transition.

Third, BCRP's March 2026 national payments-system report documents growing stablecoin use as a cross-border payment and value-transfer instrument. This finding sits at the boundary between World Payments' product-innovation lens and the Crypto Monitor's stablecoin-regime ownership; per this cycle's subscription arrangement, the digital-asset regulatory reading of this observation belongs to the Crypto Monitor's coverage, and this module does not analyse it further beyond noting that BCRP itself is the source of the underlying market observation.

Taken together, the Open Finance roadmap and the BiPay authorisation point toward a Peruvian payments product landscape diversifying along two axes simultaneously: a policy-driven opening of account-information access, and a licensing-driven formalisation of previously pilot-stage e-money products.

Outlook

The clearest near-term product-development checkpoint is whether SBS follows the February 2026 Open Finance roadmap with a published technical standard or binding API-access mandate. A second item to watch is whether other digital-wallet pilots beyond BiPay follow the same pilot-to-EEDE-licence conversion path, which would indicate SBS's e-money authorisation pipeline is becoming a repeatable route to market for wallet products.

Commercial Intelligence & Fintech

Two discrete commercial-intelligence items are tracked for Peru this cycle. The Peru Payments Association grew its membership from four to thirty-four associates in its first year of operation, a rapid formalisation of the private payments-industry base that runs ahead of, and appears to anticipate, the new BCRP PSP authorisation regime tracked separately this cycle. Separately, Banco de Crédito del Perú's bank-integrated crypto pilot platform, branded 'Criptococos,' was authorised in 2025 as a product launch by an incumbent bank rather than a licensed independent VASP; the pilot illustrates incumbent-bank crypto-as-rail market entry ahead of any formal crypto-asset licensing regime in Peru. Confidence in the BCP pilot item is low, resting on a single tier-four source and the amount of the initiative was not publicly disclosed; the Peru Payments Association membership figure is assessed-confidence.

Outlook

No further commercial developments — additional M&A, funding rounds, or product launches — were evidenced for Peru's payments and fintech sector this cycle beyond the two items noted above. The item to monitor is whether other incumbent banks follow BCP's lead into bank-integrated crypto pilots ahead of Peru's still-absent dedicated crypto licensing framework.