Banking and Finance Alert - October 2026
For more information, contact:
Themes
SBS publishes the first part of the Regulation on the Open Finance System
The Superintendence of Banking, Insurance and Private Pension Fund Administrators (“SBS”) published for public comment the draft resolution approving Titles I through IV of the General Regulations of the Open Finance System (“SFA”). The proposal establishes the framework for the secure and standardized exchange of data, subject to user control and consent, and forms part of the progressive implementation of the open finance model in Peru.
The first installment regulates, among other matters, the scope of application and definitions of the SFA, the data covered, the roles and responsibilities of its participants, the testing environment, the admission process and requirements, as well as general rules on user control and user experience.
The main implications of the proposal are as follows:
- Participants covered and participation of unsupervised entities. The Regulation applies to entities supervised by the SBS and falling within its scope, as well as to legal entities not supervised by the SBS that voluntarily apply to participate. Its provisions become enforceable when an entity is authorized to perform any of the roles established under the SFA.
- Main roles and obligations. The draft establishes two main roles: the Data Provider Entity (EPD), which holds, manages, or supplies data covered by the SFA; and the Data Recipient Entity (ERD), which requests, accesses, and receives such data. Both roles are subject to obligations relating to data security and quality, consent management, traceability, and service continuity.
- Data-Based Service Providers. Legal entities not supervised by the SBS may voluntarily join the SFA as Data-Based Service Providers (PSBD) and perform the role of ERD, subject to registration and authorization. Where they generate, hold, or manage data covered by the SFA for which they are subject to applicable requirements, they must also be authorized as EPDs.
- Information aggregation service. Entities authorized as ERDs may offer a service that allows users to view, in consolidated form and through a single platform or application, information on the accounts, products, and services they maintain with or have contracted from one or more EPDs, including balances, transactions, and other available data.
- User control. The model recognizes users as having control over the exchange of their information and requires consent management and user experience to comply with the rules established by the Regulation.
- Progressive implementation. The SBS will define and may update the list of entities required to participate, the deadlines for incorporation, and the categories of data and technical components subject to mandatory implementation, taking into account the progress of implementation and the conditions necessary for the SFA to operate.
- Entry into force. Under the draft, the Regulation will enter into force on January 1, 2028, except for provisions subject to a different deadline. Articles 19 through 22, concerning the Participants Directory, access to the testing environment, and registration and authorization, will enter into force earlier, on August 1, 2027. Matters pending further development will become effective within the deadlines subsequently established by the SBS.
The draft will be open for comments until October 23, 2026, through the official channels made available by the SBS.
Interested entities should assess the roles they could perform, the categories of data under their responsibility, and their capabilities in relation to APIs, security, interoperability, consent management, and user experience.