Peru (PE)

Licensing, Authorisation & Market Access

Peru's e-money licensing architecture rests on Ley 29985 (Ley del Dinero Electronico), which reserves e-money issuance to SBS-supervised Empresas Emisoras de Dinero Electronico (EEDE) and multi-operation banks under Ley 26702 art.16-A/17.6, establishing EEDE as a dedicated non-bank licence category with its own minimum capital requirement. The operative implementing regulation is SBS Resolution No. 6284-2013, alongside sandbox regulation SBS Resolution No. 2429-2021 for novel business models. SBS continues actively authorising new EEDEs -- BiPay is the latest addition -- alongside incumbents Tarjetas Peruanas Prepago (Ligo/LigoPay, roughly 45% revenue share), Peruana Soluciones, Servitebca and GMoney, evidencing an active licensing pipeline under the existing regime.

The defining development of this cycle is BCRP Circular No. 0022-2025-BCRP, the new General Regulations for the National Payments System, in force from 1 April 2026 and replacing the 2010-era Circular 012-2010-BCRP under Payments Law 29440 as amended by Legislative Decree 1665. It creates a four-category PSP taxonomy -- multi-operation companies, e-money issuers, Banco de la Nacion, and money-transfer companies -- plus a new non-SBS-supervised Entidad de Servicios de Pago (ESP) category built specifically for fintechs, with registration for ordinary payment agreements now available alongside the prior BCRP-authorisation track reserved for prominent payment systems. This is the first time Peru has created a payment-fintech licence tier that sits outside direct SBS prudential supervision, and it materially lowers the market-access threshold for smaller payment-services fintechs previously operating in a regulatory grey zone.

The new regime is not access-only, however: PSPs must implement transaction controls, retain information for five years, promptly inform clients, and communicate transfer completion, with non-compliance capable of drawing fines up to 20 UIT and suspension or revocation risk. This compliance-cost overlay applies specifically to nonbank PSPs newly brought into the perimeter, distinguishing the ESP's lighter registration bar from a lighter compliance bar.

Outlook

The PSP taxonomy's phased adaptation deadlines run through the end of 2026, meaning the practical contours of ESP registration, and the extent to which it genuinely lowers barriers versus simply relocating them, will only become clear as fintechs work through adaptation over the coming two quarters. The continuing pace of new EEDE authorisations suggests the pre-existing licensed non-bank track remains an active parallel route rather than one fintechs are abandoning in favour of ESP status.

Conduct, Safeguarding & Financial Promotions

Safeguarding of e-money float in Peru is anchored in Ley 29985 art.6, which mandates that e-money issuers constitute fideicomisos (trusts) as the guarantee mechanism for the value of e-money issued, with SBS empowered to regulate alternative guarantee modalities; user data is separately protected under Ley 29733. This trust-based mechanism remains the core safeguarding architecture for nonbank e-money issuers and has not been altered this cycle.

Conduct regulation has tightened on two fronts. Resolucion SBS N. 01689-2025 amended the Reglamento de Gestion de Conducta de Mercado (Res. 3274-2017) and the Reglamento de Infracciones y Sanciones (Res. 2755-2018) to align with Ley 32294, introducing a new seven-business-day deadline for informing customers of credit-denial decisions. Subsequently, Resolucion SBS N. 01029-2026 added new light-to-very-grave infractions for consumer protection, including a grave infraction for non-compliance with advance-payment or instalment rules causing at least 20 UIT of economic harm to users, and separately incorporated new very-grave infractions specifically tied to cybersecurity failings across financial, insurance, pensions, market-conduct and risk-management systems -- an overlap with this cycle's W3 and W7 findings.

Consumer protection in the promotions space continues to run through Law 31143, which protects financial-services consumers from usury, complementing INDECOPI's general consumer-protection mandate as the authority for financial promotions, advertising and complaints-handling.

Outlook

The direction of travel is unambiguously tightening: two successive SBS resolutions within roughly a year have added disclosure deadlines, new infraction categories, and cybersecurity-specific sanctions exposure. Because the new PSP/ESP regime under BCRP Circular 0022-2025-BCRP layers additional nonbank-specific conduct obligations on top of this SBS baseline, nonbank PSPs face a compounding compliance burden through 2026 as both regulators' new obligations phase in concurrently.

Stablecoins & Digital Money

Peru has no comprehensive cryptoasset or stablecoin legal framework, and cryptoassets are not recognised as official payment methods. The most significant crypto-specific instrument remains Supreme Decree 006-2023-JUS, which requires Virtual Asset Service Providers (PSAVs) to implement AML systems and report to the UIF. SBS, SMV and BCRP maintain a supervisory-gap posture: SBS issues risk warnings and would only authorise or register crypto companies if a pending framework law is enacted; SMV limits its role to risk warnings and advertising restrictions; and BCRP focuses on distinguishing crypto from legal tender while separately running its own CBDC pilot.

A GAFI-aligned travel-rule obligation for VASPs is reported to take effect from November 2026, though this cycle's automated verification challenge flags a likely source-misattribution -- the operative instrument may be SBS Resolution 02648-2024 (dated August 2024) rather than the cited resolution, with an effective date closer to August 2026. Confidence on this specific point is held at Assessed pending primary-source confirmation.

On the CBDC side, BCRP and Viettel/Bitel launched Peru's first CBDC Innovation Pilot under an October 2024 framework agreement aimed at facilitating digital-payment access for the unbanked, running for one calendar year with a possible one-year extension. The associated BiPay digital-currency pilot has been reported reaching 4.9 million users and 23.5 million cumulative transactions using offline-capable technology aimed at financially excluded sectors, though this figure is itself flagged as potentially stale relative to March-June 2026 reporting suggesting an extension to March 2027 with somewhat different user and transaction counts.

Outlook

Peru's digital-money posture over the next cycle will likely be defined less by new legislation than by implementation detail: confirming the correct VASP travel-rule instrument and effective date, and refreshing BiPay pilot metrics against a primary BCRP source, are both flagged as priorities for the next research pass rather than settled facts this cycle.

Operational Resilience & Critical Infrastructure

Peru's baseline operational-resilience regime is Resolucion SBS No. 504-2021, which establishes the Reglamento para la Gestion de la Seguridad de la Informacion y Ciberseguridad, requiring a proportionate Information Security and Cybersecurity Management System (SGSI-C) and amending Corporate Governance/Risk, Operational Risk, Card and E-money Operations regulations. The regime differentiates three proportionality levels: 'general application' for banks, financieras, cajas, insurers, AFPs, Banco de la Nacion, e-money issuers and cash-transport firms; 'simplified' for Edpymes, Fondo Mivivienda, Agrobanco, COFIDE and money-transfer companies; and 'reinforced' for larger, systemically concentrated firms. Regulated entities must report to SBS when a cybersecurity incident has significant impact via loss or theft of information, internal or external fraud, negative reputational impact, or interruption of operations.

The most consequential development this cycle is that BCRP Circular 0022-2025-BCRP extends cybersecurity and information-security provisions -- previously applicable only to banks and SBS-supervised entities -- to ESPs and other payment-system participants for the first time, materially broadening the resilience perimeter to cover nonbank PSPs newly recognised under the new payments regulation.

More broadly, Peru's cybersecurity compliance landscape combines data-protection duties under Law 29733, SBS's financial-sector rules, and cybercrime legislation under Law 30096, with PCI DSS mandatory for payment processing and PeCERT coordinating the national cybersecurity strategy.

Outlook

The extension of SGSI-C-equivalent cybersecurity obligations to ESPs, combined with SBS's parallel addition of very-grave cybersecurity infractions under Resolucion SBS N. 01029-2026, signals that operational-resilience expectations for nonbank payment fintechs will converge rapidly toward bank-grade standards over the 2026 adaptation window, raising compliance costs for the newly-scoped ESP tier discussed under W1a.

Scheme & Network Compliance

Card-scheme conduct in Peru is governed by BCRP Circular 0027-2022-BCRP (the APT Regulation), which requires registration with BCRP of card issuers and acquirers, sets compensation-and-settlement obligations, mandates interoperability among participants, and requires disclosure of MCC classifications. Complementing this, BCRP Circular No 024-2022-BCRP approved the Interoperability Regulations for Payment Services provided by PSPs, agreements and payment systems -- a framework credited with enabling 132 million interoperable transactions between digital wallets Yape and Plin between June 2024 and June 2025, a major structural interoperability success metric for Peru's retail-payments strategy.

On the acquiring side, Niubiz (formerly VisaNet) remains Peru's largest acquirer, with over 300,000 affiliated merchants and 25 years of trading history, using CyberSource antifraud technology alongside PCI DSS Level 1 certification and card tokenisation. Its merchant pricing runs to a one-off S/300+IGV affiliation fee, S/50+IGV monthly maintenance, a 3.45%+IGV commission on Visa transactions and 3.98%+IGV on Mastercard, plus roughly $0.15+IGV per transaction. Izipay, a rival acquirer, is certified under PCI DSS Level 1, which it states guarantees protection and secure handling of cardholder information for its payment-link and e-commerce products.

Outlook

Scheme conduct in Peru remains structurally stable this cycle, with the APT Regulation and interoperability circular continuing to anchor card and wallet-rail conduct. The 132-million-transaction interoperability metric suggests continuing rapid uptake of the newer wallet-based rails, which may over time exert competitive pressure on the card-scheme fee structures documented above.

Payment Corridor Dynamics

The US-Peru remittance corridor is the dominant cross-border payment flow into Peru and reached a record USD 5,368 million in 2025, 56% originating from the United States and equivalent to 1.6% of GDP, per BCRP-recorded inbound remittance data. BCRP's June 2026 Inflation Report revised its forward projections upward to USD 5,515 million for 2026 and USD 5,735 million for 2027, pointing to sustained corridor growth.

Two structural developments reinforce this trajectory. Law No. 32211, enacted December 2024, exempts remittances sent to Peru via money-transfer companies from IGV and permits Banco de la Nacion to offer accounts and loans to Peruvians residing abroad -- a fiscal and market-access measure explicitly targeting diaspora remittance flows. Separately, the four operating EEDEs (Peruana Soluciones, Tarjetas Peruanas Prepago, Servitebca and GMoney) have had direct access to the CCE's clearing and settlement services and BCRP's RTGS system since June 2023, giving nonbank e-money issuers direct access to systemically important settlement infrastructure as part of BCRP's phased retail-payments interoperability strategy.

Most notably this cycle, the US Federal Reserve authorised Banco de Credito del Peru (BCP) to open a branch in Miami, intended to make remittances faster and cheaper by enabling direct account-to-account transfers between BCP US and BCP Peru with fewer intermediaries -- a cross-border infrastructure development with clear read-across to W12 correspondent banking and W13 commercial intelligence.

Outlook

The corridor's growth trajectory, fiscal exemption, nonbank settlement access, and now a Fed-approved direct-branch settlement channel together point to a maturing, increasingly disintermediated US-Peru remittance corridor. The next research cycle should track whether other Peruvian banks follow BCP's lead in seeking direct US correspondent presence, and whether EEDEs' settlement access is extended further under BCRP's interoperability strategy.

Industry Structure & Commercial Dynamics

Five universal banks continue to control most deposits and loans in Peru, though competition from niche lenders and fintechs is reshaping service delivery, with digital wallets filling banking voids in underserved areas. Within the e-money segment, Tarjetas Peruanas Prepago (TPP/Ligo/LigoPay) has consolidated as revenue leader among the four registered EEDEs per SBS financial statements to July 2025, with a 45% share.

Consolidation activity continues around Credicorp: Culqi was acquired by Credicorp Capital and integrated into the group's digital-payments ecosystem via its Krealo venture arm. Elsewhere in the fintech venture landscape, Leasy raised over US$28 million in debt and equity for vehicle financing, and Riqra exceeded US$1 billion in B2B e-commerce transactions.

A less-covered but structurally important segment is Peru's 242 credit and savings cooperatives (COOPAC), which operate under SBS supervision and play an important financial-inclusion role especially where traditional banking has low presence; since 2025 they have benefited from the Cooperative Deposit Insurance Fund. Industry-association growth is also notable: the Peru Payments Association grew from 4 to 34 members in its first year, encompassing fintechs, acquirers, non-bank issuers, wallets and technology providers.

Outlook

The combination of continuing bank dominance, active EEDE competition, Credicorp-led consolidation, and a rapidly-growing industry association points to a market structure in transition rather than settled. COOPAC payments-product detail remains under-covered and is flagged as a priority gap for the next research cycle, given the segment's financial-inclusion significance.

Legal & Litigation

Enforcement activity against major banks intensified markedly. INDECOPI ordered Interbank to refund S/6,145.82 and USD 45.95 plus interest after a client suffered continued fraudulent card transactions despite blocking the card, with a four-year listing on the Register of Infractions and Sanctions -- an enforcement precedent on refund and APP-fraud protection duties. Separately, INDECOPI's Arequipa regional office confirmed, on second instance, a 4-UIT (S/21,453) fine against Banco de Credito del Peru for failing to provide adequate service after allowing six unrecognised operations following an ATM card-retention incident, faulting the bank for not applying pattern-based fraud alerts. A third action saw INDECOPI fine Interbank 3.49 UIT (S/19,195) for issuing and activating a Visa Access credit card without customer authorisation, ordering cancellation of the card, elimination of the associated debt, and refund of payments made under pressure -- the third distinct INDECOPI enforcement action against Interbank within the trailing window, forming a pattern signal.

Running in parallel, Resolucion SBS N. 01029-2026 updated the Reglamento de Infracciones y Sanciones across financial, insurance, pensions, market-conduct and risk systems, incorporating new very-grave infractions especially in cybersecurity. Also relevant to this module, Resolucion SBS N. 00771-2026 granted a second extension, to 1 June 2026, of the deadline for banks to assume full liability for unrecognised card-fraud losses on cards issued before July 2025, citing the logistical burden of mass card renewal with reinforced two-factor authentication.

Outlook

Three distinct INDECOPI sanctions against two major banks within a single trailing window, layered on top of an expanded SBS infractions regime, suggest enforcement intensity against bank PSPs' fraud-prevention and authorisation controls will remain elevated through 2026, with the now-passed 1 June 2026 liability deadline likely to generate a fresh wave of disputes over legacy-card fraud claims.

Merchant Acquiring & Risk

Peru's card-acquiring market is concentrated among Niubiz, Culqi and Izipay. Niubiz leads by volume, with over 300,000 affiliated merchants processing more than 400 million transactions annually and offering negotiated commercial rates for merchants above roughly S/500,000 in monthly volume. All four major acquiring gateways -- Niubiz, Izipay, Culqi and Mercado Pago -- comply with PCI DSS and process chargebacks, but Yape/Plin QR transfers lack a formal chargeback mechanism, with disputes resolved bank-to-bank and fraud risk mitigated via biometric authentication -- a structural gap between card-rail and wallet-rail dispute mechanics.

Merchant-onboarding timelines vary sharply by acquirer: Culqi offers 24-48 hour express verification, Izipay 3-5 business days, and Niubiz 1-2 weeks with more bureaucratic, documentation-heavy processing, making onboarding speed a competitive differentiator. Izipay applies real-time antifraud validation and PCI DSS Level 1 protections to its payment-link product, with funds settling to merchant bank accounts the next business day regardless of receiving bank. Third-party payment-technology partners, such as Nuvei, position their offerings around reducing risk, chargebacks and simplifying PCI DSS compliance for acquirers integrating with Niubiz in the Peruvian market.

Outlook

The persistent absence of a formal chargeback mechanism for QR-wallet transfers stands out as the acquiring segment's clearest structural gap relative to card rails, and is likely to draw increasing regulatory or scheme-level attention as Yape/Plin transaction volumes continue to scale under the interoperability framework discussed in W4.

Product Innovation & Market Development

2025-2026 marks a transformative phase for Peruvian payments product development. The new General Regulation of the National Payment System provides a comprehensive PSP framework, an expanded regulatory sandbox opens doors for fintech innovation, and an Open Finance Roadmap charts a path toward a more competitive, inclusive financial system. SBS published its Open Finance Roadmap in February 2026, anticipating the first data exchange under Open Finance by late 2027, with continued BCRP circulars on payment services and possible SMV sandbox mechanisms expected in the interim.

BCRP's new TAPP infrastructure opens space for fintechs, bigtechs and telcos with innovative business models, starting with a payment-initiation model, with launch expected for December 2026. A draft regulation separately aims to open the SBS regulatory sandbox to non-licensed entities such as fintech companies, allowing pilot projects lasting 18 months (renewable for 12 more); sandbox participation does not itself confer authorisation to operate -- though no confirmed effective date for this draft expansion was retrievable this cycle.

Adoption metrics underline the pace of change: digitalisation per capita rose 45.8% between 2024 and 2025 to reach 665 annual payments per inhabitant, with 2026 seeing a further acceleration to an average of 1.105 billion monthly transactions, a 45% increase versus 2025. The 132 million interoperable Yape-Plin transactions recorded between June 2024 and June 2025 further evidence rapid uptake of the newer open payment-rail infrastructure.

Outlook

With TAPP targeted for December 2026 and Open Finance's first exchange targeted for late 2027, Peru is building toward platform-level payments competition that would open the market beyond the current EEDE/bank duopoly to fintechs, bigtechs and telcos. The unconfirmed sandbox-expansion timeline remains the clearest near-term information gap in this module.

Consumer Protection & APP Fraud

Consumer protection in Peru's payments space runs on a dual track. The Codigo de Proteccion y Defensa del Consumidor (Ley 29571) empowers INDECOPI to receive and resolve consumer complaints, fine violators, mediate through conciliation, and order corrective measures such as refunds, with serious infractions drawing fines of up to 450 UIT. The mandatory Libro de Reclamaciones mechanism requires providers to respond within 30 calendar days, with automatic fines for non-response and refusal to provide the book itself treated as an INDECOPI-sanctionable infraction.

On card-fraud liability specifically, INDECOPI's Consumer Protection Commission has set refund criteria: a user may request a refund when card cloning is shown, in cases of micropayment abuse, or where the client's authentication scheme fails to meet minimum security requirements established in regulation. Since July 2025, financial-system entities have had to assume responsibility for unrecognised card transactions unless they demonstrate user fault; the deadline extending this obligation to pre-July-2025 cards has been pushed to 1 June 2026 under Resolucion SBS 00771-2026.

Complaint volumes remain high: INDECOPI recorded over twenty thousand reports against banking and financial services in the 16 March-24 July window, with recurring issues including undue charges, refund disputes and inadequate service, and BCP, Interbank, BBVA, Banco Falabella and Scotiabank among the most-reported entities.

Outlook

With the bank-liability deadline for legacy cards now passed as of 1 June 2026, and complaint volumes remaining elevated, the coming cycle is likely to test how consistently banks apply the user-fault standard in practice, and whether INDECOPI's enforcement pace (evidenced in W7) continues to escalate in response.

AML/CFT & Financial Crime (Sentinel.gi-fed)

This module's intelligence is sourced from the Sentinel.gi feed and is carried here as baseline institutional context rather than original illicit-finance analysis; readers seeking deeper illicit-finance-specific treatment should consult the Financial Integrity Monitor directly. UIF-Peru, Peru's financial intelligence unit, was created under Ley 27693 (2002) and incorporated into SBS as a specialised unit with functional and technical autonomy under Ley 29038 (2007), responsible for receiving, analysing and transmitting information to detect money-laundering and terrorist-financing across obligated payment-sector subjects. Peru has undergone four GAFILAT mutual-evaluation rounds (2003, 2005, 2013 and 2018) assessing its AML/CFT system.

Effective 14 May 2025, Supreme Decree No 008-2025-JUS added private-offering investment-fund managers not supervised by SMV, and factoring companies outside Ley 26702's scope, as new UIF-obligated subjects, widening the obligated-subject perimeter. A GAFI-aligned travel-rule obligation for VASPs is reported to become effective from November 2026, posing information-management and inter-institutional cooperation challenges -- though, as flagged under W2, an automated verification challenge this cycle raises doubt over the precise instrument number and effective date, suggesting the correct citation may be SBS Resolution 02648-2024 with an August 2026 effective date. UIF-Peru's training materials also track FATF's periodic high-risk jurisdiction listings -- including North Korea, Iran and Myanmar -- as part of obligated subjects' ongoing due-diligence responsibilities.

Outlook

The obligated-subject perimeter is expanding and the travel-rule obligation is approaching, but the precision of the travel-rule's instrument citation and effective date should be treated as unconfirmed pending primary-source verification, a point flagged for follow-up analysis by the Financial Integrity Monitor.

Correspondent Banking, Settlement & Access

BCRP designates, regulates and supervises Peru's systemically important payment infrastructures: Sistema LBTR (the RTGS system), the CCE (deferred net settlement of low-value instruments), and the SLMV securities-settlement arrangement. The BCRP LBTR settlement circular sets Pre-Reserva minimum liquidity requirements (at least 0.25% of obligations) for Type I (banks) and Type II CCE participants, provides intraday repo operations to cover debit balances, and establishes settlement priority rules for CCE/SLMV over standard transfer orders.

The module's analytical spine is the persistent asymmetry between bank and non-bank access to this infrastructure. BCRP maintains an approved list of first-category foreign banks (minimum US$1.4 billion capital) used for reserve placement and correspondent purposes, spanning HSBC USA, Credit Suisse USA, MUFG Union Bank and Morgan Stanley -- a bank-only correspondent channel. This cycle's most significant development narrows that asymmetry at the margin: the US Federal Reserve's approval of Banco de Credito del Peru's Miami branch reinforces financial ties between Peru and the US, expanding financial services and simplifying international transactions and account-opening for cross-border clients, though this remains a bank-led development rather than one extending direct correspondent access to nonbank PSPs.

Peru's broader financial-system structure includes four government-owned entities -- BCRP, Banco de la Nacion, COFIDE, and the Agrarian Bank -- with SBS policy generally following BIS regulatory guidelines.

Outlook

The bank/non-bank correspondent-access asymmetry remains structurally intact even as BCP deepens its own direct US settlement channel; EEDEs' CCE/RTGS access documented in W5 is a domestic, not cross-border, exception to this asymmetry, and the coming cycle should watch for any move to extend correspondent-style cross-border access to nonbank PSPs.

Commercial Intelligence (M&A, Investment & Product)

Krealo, Credicorp's venture-capital arm, invested in paytech Akua, which raised US$13 million to scale its payments platform, and separately entered Colombian health-fintech startup Welli -- an investment whose value was not publicly disclosed. Culqi, Credicorp's fintech, appointed Spencer Friedman -- with experience at Rappi, Uber and Deloitte -- as its new CEO effective September 2025, a leadership-change event carried here as a dated entry rather than a closed-enum commercial event.

Regulatory-market events also reshaped the commercial landscape this cycle. In April 2026 the US Federal Reserve approved Banco de Credito del Peru's application to open a branch in Miami, a strategic international-expansion event expected to be measured on profitability, remittance volume, and bilateral trade dynamism. BCRP's publication of Circular No. 0022-2025-BCRP in December 2025, approving the new General Regulation of the National Payments System, formally brought payment fintechs into the National Payment System perimeter for the first time. SBS published its Open Finance Roadmap in February 2026, marking the formal start of Peru's open-banking construction process in coordination with BCRP.

Outlook

Krealo's continuing deployment of venture capital into payments and adjacent fintech (Akua, Welli) alongside Culqi's leadership refresh point to sustained investment appetite within the Credicorp ecosystem specifically, even as the sector's most consequential commercial catalysts this cycle were regulatory rather than transactional -- the new payments regulation, the Open Finance Roadmap, and the Fed's Miami-branch approval.