Banking and Fintech Alert - October 2026
For more information, contact:
Themes
SBS Publishes Second Block of the Open Finance System Regulation
The Superintendence of Banking, Insurance and Private Pension Fund Administrators (“SBS”) published for public comment the second installment of the draft General Regulation of the Open Finance System (the “Regulation”), which will govern the Open Finance System (“SFA”), through SBS Resolution No. 02519-2026. The proposal comprises Titles V through VII and supplements the first installment with the technical rules necessary to ensure that information exchange operates securely, in a standardized, interoperable, and reliable manner.
This second installment establishes the common digital infrastructure and the technical, security, and data quality standards applicable to SFA participants.
The main implications of the proposal are as follows:
- Common digital infrastructure: The proposal regulates the components and services that will facilitate interaction among participants, including the Participant Directory, the SFA Portal, the Developer Portal, the testing environment, among others.
- Testing and compliance: Before operating within the SFA, entities must complete the applicable tests, certifications, and validations for the requested role to demonstrate compliance with the relevant technical and operational requirements.
- Trust Framework: The proposal establishes rules and mechanisms to verify the identity, authorization status, roles, applications, certificates, and other trust elements of participants. The Participant Directory will serve as the official source of this information, and entities must perform the relevant validations before and during each interaction, rejecting or terminating the interaction whenever the required conditions cannot be verified.
- Interfaces and common standards: Information exchange will take place exclusively through APIs subject to common and mandatory standards: OpenAPI, REST architecture, and JSON messaging, as well as the data model and dictionary set out in Annex 3, which are based on ISO 20022. Data Provider Entities (“EPDs”) may not require additional parameters, headers, steps, or conditions, or bilateral agreements, to access or provide the data and information covered by the SFA.
- Security Profile and certification: The Security Profile will establish mandatory requirements concerning authentication, authorization, digital signatures, encryption, dynamic application registration, and token issuance and validation, and will adapt specifications from the OpenID Foundation’s FAPI 2.0 to the SFA. Participants must demonstrate compliance through certification valid for one year and obtain new certification upon the release of new versions, relevant changes, expiration, suspension or revocation of certification, critical vulnerabilities, and any other applicable circumstances.
- Service levels: Participants must comply with the applicable availability levels, response times, and error rates for the endpoints they operate. EPDs must also meet the minimum capacity requirements established for each API.
- Data quality: EPDs and Data Recipient Entities (“ERDs”) must incorporate SFA data into their data governance processes, implement controls appropriate to their respective roles, measure indicators, retain supporting evidence, and remediate identified deficiencies.
- Traceability: A unique identifier must be assigned to and propagated through each request and response, enabling SFA interactions to be reconstructed from end to end. Records and evidence of the interactions carried out must be retained for a minimum period of ten years.
The proposal will be open for comments until November 6, 2026.
Interested entities should assess, at an early stage, their API architecture, certification and testing processes, identity and authorization mechanisms, traceability, service levels, and data quality governance, and identify any gaps that could affect their future integration into the SFA.