The primary law governing Peru's financial system is Law No 26702, Ley General del Sistema Financiero y del Sistema de Seguros y Orgánica de la Superintendencia de Banca y Seguros, enacted in December 1996 (the “Peruvian Banking Law”). The Peruvian Banking Law sets the regulatory and supervisory framework for financial institutions, insurance companies, and entities engaged in complementary activities.

Peruvian banks and financial institutions are primarily regulated and supervised by the following institutions.

Superintendencia de Banca, Seguros y Administradoras Privadas de Fondos de Pensiones (SBS)

The SBS is the regulatory authority responsible for implementing and enforcing the Peruvian Banking Law, overseeing all banks and financial institutions in Peru. Since July 2000, it has also regulated private pension funds. The SBS’s objectives are to:

• protect the public interest;
• ensure the financial stability of the institutions it oversees; and
• penalise violations of banking regulations.

Its responsibilities include:

• reviewing and approving the establishment and organisation of subsidiaries of regulated institutions;
• overseeing mergers, dissolutions and reorganisations of financial institutions and insurance companies;
• supervising financial and insurance companies, including non-bank holding companies;
• reviewing and approving company by-laws and amendments;
• setting criteria for transferring bank shares and determining asset and liability valuations;
• managing the Central de Riesgos (Bank Risk Assessment Center), where all banks report data on businesses and individuals they deal with; and
• supervising anti-money laundering efforts through the financial intelligence unit.

The SBS enforces the Peruvian Banking Law via periodic resolutions. The Law mandates stringent loan loss reserve standards, aligns asset risk weighting with Basel Committee guidelines, and supervises holding companies of financial institutions. Banks, financial institutions and insurance companies are required to report relevant information periodically to enable off-site evaluation of financial performance, including audited financial statements, board reports and auditors’ reports. The SBS also conducts annual on-site examinations and ensures compliance with the Law. Violations of financial system regulations may lead to sanctions, including fines, licence revocation or sanctions against company directors and officers.

Banco Central de Reserva del Perú (BCRP)

The BCRP is responsible for setting Peru’s monetary policy. It manages the country’s international reserves, publishes financial data, and is the sole issuer of the national currency. While not directly overseeing financial institutions, the BCRP plays a critical role in regulating monetary aspects affecting banks, as well as payment systems. Regulations issued by the BCRP, as part of its duties, are mandatory for companies within the financial system.

Superintendencia del Mercado de Valores (SMV)

The Superintendencia del Mercado de Valores, formerly known as CONASEV (Comisión Nacional Supervisora de Empresas y Valores), regulates Peru’s securities market, promoting, overseeing and controlling entities involved in this market. It ensures compliance with the Peruvian Ley del Mercado de Valores (the Securities Market Law) and imposes sanctions for non-compliance. As provided by the Peruvian Banking Law, banking, financial and leasing companies, as well as insurance companies, are required to list the shares representing their capital stock on a stock exchange before commencing operations. Additionally, the SBS has the authority to mandate the listing of shares for companies not covered under the aforementioned requirement if deemed necessary.

The procedure for establishing a new financial institution in Peru is governed by the Peruvian Banking Law and the Reglamento de autorización de empresas y representantes de los Sistemas Financieros y de Seguros.

To establish a financial institution in Peru, entities must obtain prior authorisation from the SBS. This requirement applies to both local and foreign entities wishing to operate as banks or financial institutions. The SBS evaluates the entry of new companies into the financial system considering the economic feasibility of the project, as well as the suitability and economic solvency of shareholders, beneficial owners, directors and key executives.

The financial institutions authorisation regime in Peru is structured to ensure that new financial institutions meet stringent regulatory standards before commencing operations.

The authorisation process comprises two distinct stages: organisation licensing and operating licensing, along with an optional preliminary stage involving a pre-application meeting to present the business model and understand the regulator’s expectations.

Organisation Licensing

The first approval procedure is organisation licensing, which involves screening the shareholders and organisers of the financial entity to be incorporated. It also includes an analysis of the feasibility study for the financial entity, aimed at determining its viability and operational sustainability over time. This screening and analysis are carried out through the review of a series of documents by the SBS and the BCRP, along with meetings with the SBS. The first approval procedure concludes with the granting of the organisation licence by the SBS.

Once the organisation licence is issued, the organisers must execute the public deed of incorporation, which allows the establishment of the new financial institution to be registered in the Public Registries, thereby granting it legal personality. The organisers must also carry out all other necessary actions to obtain the operating licence. The organisation licence expires two years after its issuance if the applicant has not obtained the operating licence within that period.

Operating Licensing

The second approval procedure culminates in the granting of the operating licence by the SBS, focusing on the operational aspects of the future financial entity. During this stage, the SBS evaluates the following.

• Operational capacity: the SBS assesses whether the entity has the necessary infrastructure and resources to operate effectively.
• Credentials of directors and principal officers: the qualifications and suitability of the entity’s directors and key executives are scrutinised.

Before filing for the operating licence, the financial entity must have retained its principal officers, implemented the necessary infrastructure, and completed the required policy and operational manuals. Once the operating licence is obtained, the financial entity may commence operations, unless it is a banking company, a finance company, or a leasing company, in which case it must first register its shares on the stock exchange.

In Peru, the acquisition of, or increase in, control over a bank is subject to specific regulatory requirements governed by the Banking Law and regulations set forth by the SBS, primarily, the Reglamento de Adquisición de la propiedad en el capital social de las empresas supervisadas y de los propietarios significativos. These requirements aim to ensure that any changes in ownership do not compromise the stability and integrity of the financial system.

Requirements Governing Change in Control

All transfers of shares in a financial institution must be registered with the SBS. If the company’s shares are publicly traded, electronic communication systems with securities clearing and settlement institutions ensure that the SBS has real-time access to this information. For companies whose shares are not publicly traded or are traded off-market, the general manager must submit a report to the SBS listing the share transfers made during the previous month.

Any individual or entity intending to acquire a stake in a financial institution resulting in ownership or control exceeding 10% of the total share capital requires prior approval from the SBS. This threshold applies to both direct and indirect ownership.

Additionally, if a legal entity domiciled in Peru holds a stake greater than 10%, its shareholders must obtain prior SBS approval before transferring rights or shares that exceed this threshold. For non-domiciled legal entities, they must notify the SBS of any changes in their shareholding composition that exceed 10%, providing details of the new shareholders.

Nature of Regulatory Filings and Related Obligations

The potential significant owner must submit detailed information to the SBS, including the source of funds, financial background, and plans regarding the bank’s management and operations. This allows the SBS to assess the suitability of the potential significant owners.

The SBS (within a period not exceeding 30 days) conducts an evaluation of the application, during which it may convene meetings with the acquirers, as well as the directors, managers and key officers of the company, among others, as deemed necessary.

Nature of the Ongoing Requirements Towards the Supervisor

The Reglamento de Adquisición de la propiedad en el capital social de las empresas supervisadas y de los propietarios significativos requires financial institutions to submit sworn statements annually from all significant shareholders and ultimate beneficial owners through means other than ownership, within 15 business days following the general shareholders’ meeting. Additionally, the SBS may require the company to update any previously submitted information related to the acquisition or increase of control and may request supporting documentation or other materials to verify the accuracy of the information and sworn statements submitted.

In January 2017, the SBS approved the Reglamento de Gobierno Corporativo y de la Gestión Integral de Riesgos (Regulations on Corporate Governance and Comprehensive Risk Management), applicable to financial system companies and specialised entities. These regulations establish the obligation for financial institutions to define principles and general guidelines for adopting and implementing corporate governance practices to guide the actions of a company’s governing bodies. The regulations also outline the roles and responsibilities of these governing bodies, which must maintain a structure and organisation consistent with the nature, size and complexity of their operations and services.

The Regulations mandate that companies develop general policies related to appropriate market conduct. Market conduct is defined as the set of practices governing companies’ interactions with users, the offering of financial products and services, information transparency, and claims management.

The Regulations specify that boards of directors must include a sufficient number of members to ensure effective and participatory performance. They also strengthen the presence of independent directors, requiring at least one independent director for companies with five or fewer directors, and at least two independent directors for companies with six or more directors. Criteria for qualifying as an independent director include the absence of any connections with the company, its management, economic group, or shareholders during the three years preceding their appointment. Additionally, independent directors are subject to a maximum tenure of ten years.

The Regulations introduce the Compensation Committee as a new mandatory board committee, in addition to the Audit and Risk Committees. Regarding remuneration systems, the regulations specify that companies’ compensation structures must align with their business strategy and policies while avoiding potential conflicts of interest.

Furthermore, the Regulations require companies to identify potential conflicts of interest and implement policies and procedures for their management, monitoring and control. They must also establish systems for the timely reporting of questionable practices within their organisations.

The Peruvian Banking Law establishes specific requirements for the registration and oversight of senior management within financial institutions. These regulations ensure that individuals in key leadership positions meet certain standards of competence and integrity.

Directors’ and Senior Managers’ Designation and Regulatory Approval

The Banking Law mandates that directors of financial institutions must meet both technical and moral suitability requirements. These requirements include the following.

• Qualifications: directors are expected to possess relevant educational backgrounds, professional experience and skills necessary for their roles. This ensures that they have the requisite knowledge to make informed decisions that affect the financial institution’s operations.
• Disqualifications: there are several disqualifications (impediments) that may prevent individuals from serving as directors. These could include legal issues, past financial misconduct, or other factors that might undermine their ability to fulfil their duties responsibly.

The same suitability requirements applicable to directors extend to senior managers and executives. Their appointments must be reported to the SBS within one business day of the appointment. The SBS conducts a thorough assessment of these individuals, which includes evaluating their fitness and propriety through a detailed review process. This may involve:

• Fitness assessments: evaluating the professional qualifications, experience and expertise of the candidates.
• Propriety assessments: assessing the moral character and integrity of the individuals to ensure they have a clean record and are capable of upholding the institution’s ethical standards.

Screening Requirements

The screening requirements for directors and senior management include the following.

• Background checks: comprehensive background checks are conducted to verify the information provided by the candidates, including their professional history, any previous legal issues, and compliance with regulatory standards.
• Regulatory filings: financial institutions are required to submit relevant documentation to the SBS regarding the qualifications and backgrounds of their directors and senior managers, ensuring transparency in the appointment process.

In Peru, remuneration requirements for banks are established under the Reglamento de Gobierno Corporativo y de la Gestión Integral de Riesgos (Regulations on Corporate Governance and Comprehensive Risk Management), approved by the SBS. These requirements aim to align compensation practices with the institutions’ strategic goals, risk management and good governance principles.

Banks and other financial institutions must implement a remuneration system for employees and board members that is consistent with their business strategy and policies while avoiding potential conflicts of interest. This system must correspond to the nature, size and complexity of the company’s operations and services.

The Regulations mandate that the remuneration system includes policies and procedures to define the criteria and indicators for determining variable compensation for employees and board members, where applicable. These criteria and indicators must align with the objectives of their specific roles, as well as the frequency and form of payment. Employees and board members must also have access to these policies.

Variable compensation must reflect the company’s overall performance and long-term management. The time horizon associated with such compensation should account for the inherent risks of the company’s operations.

Furthermore, the regulations specify conditions under which protective clauses or agreements guaranteeing variable compensation payments may be invalidated.

All criteria and policies must be included in the contracts between the company and its employees, as well as in the acceptance documents signed by board members.

In Peru, the anti-money laundering (AML) and counter-terrorist financing (CFT) requirements applicable to the banking sector are primarily governed by the legislation establishing the Unidad de Inteligencia Financiera (UIF-Perú). Under this legal framework, financial institutions are designated as obligated entities required to report suspicious activities to the UIF.

Overall, the legal framework for AML and CFT in Peru requires financial institutions to implement comprehensive measures to prevent money laundering and terrorist financing. This includes establishing effective reporting systems, risk management protocols, and a strong commitment to compliance at all organisational levels. By adhering to these requirements, financial institutions play a crucial role in maintaining the integrity of the financial system and supporting national and international efforts to combat financial crimes.

Reporting Obligations

• Suspicious activity reporting: financial institutions must maintain a Registro de Operaciones (Operations Register) and report any suspicious or unusual transactions attempted or conducted. This reporting is crucial for the prevention and detection of money laundering and terrorist financing.

Preventions Systems

• Implementation of prevention systems: financial institutions are mandated to establish a robust system for preventing money laundering and terrorist financing. This system must include:
1. designation of a compliance officer responsible for ensuring adherence to AML and CFT policies; and
2. development of a manual detailing the policies and procedures related to AML and CFT compliance.

Risk Management

• Regulations on risk management: financial institutions are subject to the Reglamento de Gestión de Riesgos de Lavado de Activos y del Financiamiento del Terrorismo, which outlines the obligations to implement a risk management system addressing vulnerabilities to money laundering and terrorist financing. This includes:
1. regular risk assessments to identify and mitigate risks associated with their operations; and
2. the implementation of compliance measures and risk management strategies tailored to their specific exposure.

Conduct and Training

• Code of Conduct: institutions must ensure that their boards, managers and employees adhere to a Code of Conduct approved by the board. This Code is designed to:
1. promote the effective functioning of the AML and CFT prevention system; and
2. ensure confidentiality regarding information related to AML and CFT efforts.
• Training: institutions are required to provide ongoing training for their personnel on AML and CFT regulations, emphasising their roles in identifying and reporting suspicious activities.

Peru has established a comprehensive depositor protection regime to enhance confidence in the banking system and safeguard depositors’ interests. This regime is primarily governed by the Banking Law, which outlines the characteristics and purpose of the Fondo de Seguro de Depósitos (Deposit Insurance Fund, hereinafter referred to as the FSD). The FSD is a private entity responsible for protecting depositors of a financial institution authorised to accept public deposits in the event that it is intervened by the SBS. The FSD pays insurance to depositors equivalent to the amount of their deposit plus accrued interest, up to a maximum coverage amount that is updated quarterly.

All financial institutions authorised to accept public deposits are members of the FSD. However, institutions entering the FSD must contribute to it for 24 months to ensure that their operations are backed by the fund.

The FSD is governed by a Board of Directors and a Technical Secretariat with functions and powers established in the FSD statute. The Board of Directors is composed of a representative from the Ministerio de Economía y Finanzas (Ministry of Economy and Finance, hereinafter, MEF), a representative from the BCRP, three representatives from financial institutions, and a representative from the SBS, who presides over the board and has a casting vote in the event of a tie.

The FSD covers only nominative deposits, meaning those in which the name of the depositor(s) ‒ whether individuals or non-profit private legal entities ‒ appears. Covered deposits include demand deposits, savings accounts, time deposits and compensatory time savings accounts (CTS). Interest accrued on these deposits is also covered from the start date or last renewal. Other types of legal entities are only covered for their demand deposits, up to the maximum coverage limit. Notably, deposits made by financial institutions with each other are not covered.

The maximum coverage amount is updated quarterly. For the period from September to November 2024, it stands at PEN121,900 (approximately USD32,500). The insurance coverage applies to deposits that a depositor holds in each FSD member institution, up to the maximum coverage limit in each institution.

The FSD’s resources are primarily constituted by the premiums paid by member institutions. Additionally, it receives income from fines imposed by the SBS and BCRP, as well as from deposits, securities and other assets that remain dormant in a financial institution for ten years without any movement. Exceptionally, the FSD may access lines of credit from the Public Treasury, approved through an Emergency Decree, and credit lines guaranteed by the Public Treasury under the same terms.

These resources are invested according to an investment policy determined by the Board of Directors, considering criteria of safety, liquidity, profitability and diversification. The Banking Law prohibits the FSD from placing deposits or making investments in national financial system companies or from purchasing machinery, equipment and furniture. The primary source of income for the FSD comes from the premiums that its members pay within ten business days after each quarter ends. These premiums are determined by the risk classification assigned to the institutions by specialised companies and by the amount of covered deposits.

Adherence to Basel III Standards

The SBS has progressively implemented key components of Basel III, adapting them to the Peruvian context. The framework focuses on risk-sensitive capital requirements, liquidity coverage and improved risk management practices. While Peru generally aligns with Basel III principles, notable differences include gradual implementation schedules and adjustments tailored to local market conditions.

Through Legislative Decree No 1531, enacted in March 2022, various articles of the Peruvian Banking Law were amended. These amendments were made under the delegation of legislative powers to the Executive Branch, aiming to align the regulatory framework for financial system companies with Basel III standards, particularly in terms of the composition of regulatory capital.

The amendments revised the provisions regarding the regulatory capital applicable to financial system companies, limits on its calculation, and risk measurement methodologies used to determine effective capital requirements, among others. Additionally, financial system companies were mandated to maintain capital buffers, including conservation buffers, countercyclical buffers and market concentration risk buffers, above the minimum requirements established by the Peruvian Banking Law. As a result of these amendments, financial system companies are also required to establish processes to evaluate the adequacy of their regulatory capital based on their risk profile. Boards of directors are now responsible for ensuring that companies maintain regulatory capital levels above global limits and the additional buffers, consistent with their risk profile. Furthermore, the SBS was empowered to establish regulatory capital requirements for additional risks.

Consequently, in December 2022, the SBS issued several resolutions to align Peru’s regulatory framework with Basel III standards, without prejudice to modifications and new regulations that the SBS has continued to issue.

Risk Management Rules

Banks in Peru are subject to comprehensive risk management regulations covering operational, credit, liquidity and market risks. The SBS requires financial institutions to implement internal risk management systems proportional to their size, operational complexity and the nature of their activities, ensuring robust oversight and adherence to risk control practices.

Quantity and Quality of Capital Requirements

Following the amendments introduced by Legislative Decree No 1531, Peru’s capital adequacy requirements stipulate that banks must maintain a Common Equity Tier 1 (CET1) ratio of 4.5% of total risk-weighted assets (RWAs) and contingencies, a Tier 1 Capital ratio of 6% of RWAs, and a Total Capital Ratio of 10% of RWAs.

In addition, financial system companies are required to maintain capital buffers, such as conservation buffers, countercyclical buffers and market concentration risk buffers, above the minimum requirements established by the Peruvian Banking Law. The conservation buffer must represent at least 2.5% of RWAs and may be utilised under conditions set by the SBS. Furthermore, the SBS establishes additional Ordinary Tier 1 Capital requirements associated with countercyclical and market concentration risk buffers through general regulations.

Liquidity Requirements

In December 2023, the SBS approved a new Regulation for Liquidity Risk Management, which incorporated the net stable funding ratio (NSFR) to promote improved liquidity risk management and to continue aligning the regulatory framework with Basel III standards.

It is worth noting that previous liquidity risk management regulations already included provisions related to the liquidity coverage ratio (LCR) to ensure that financial institutions maintain an adequate level of high-quality liquid assets (HQLAs). The new regulation requires institutions to manage liquidity risks in a manner consistent with their size, operational complexity, risk levels and systemic importance.

Under this framework, financial institutions are responsible for implementing robust governance practices. These include daily calculations of liquidity ratios and liquid investment ratios and assigning specific responsibilities to their governance bodies to oversee liquidity risk management effectively.

Peruvian banks are not subject to the regime of insolvency and bankruptcy otherwise applicable to Peruvian corporations in general. The legal and regulatory framework governing insolvency, recovery and resolution of banks and other financial institutions is primarily outlined in the Peruvian Banking Law and the Reglamento de los Regímenes Especiales y de la Liquidación de las Empresas del Sistema Financiero y del Sistema de Seguros. Such regulatory framework is designed to maintain stability in the financial system while providing adequate protection to depositors.

Pursuant to the Peruvian Banking Law, the SBS has the power to interrupt the operations of a bank in order to prevent it from, or to control and reduce the effects of, a bank failure.  Accordingly, the SBS may intervene in a bank’s business by adopting either a temporary surveillance regime (“Surveillance”) or a definitive intervention regime (“Intervention”) depending on how critical the situation is deemed to be by the SBS.  Either of these actions, depending on the event, must be taken upon the occurrence of certain events, including:

• suspension of payments;
• repeated failure to comply with instructions from the SBS or the Peruvian Central Bank;
• repeated violation of the Peruvian Banking Law or the bank’s by-laws;
• unauthorised or unsound management; or
• deficit of regulatory capital (to the extent that if it is in excess of 50%, then an Intervention is mandatory).

Less drastic measures, such as (i) placing additional requirements, (ii) ordering a capital increase or an asset divesture, or (iii) imposing a financial restructuring plan, may be adopted by the SBS when the situation allows for them.

An Intervention may halt a bank’s operations up to 45 days, which may be extended for a second period of up to 45 additional days, during which time the SBS may institute measures such as (i) cancelling losses by reducing reserves, capital and subordinated debt; and (ii) segregating certain assets and liabilities for transfer to another financial institution.  After an Intervention, the SBS will proceed to dissolve and liquidate the bank unless the bank merges with another acquiring institution or another recovery measure is adopted.

Beginning on the date on which a resolution of the SBS subjecting a bank to an Intervention regime is issued, and continuing until such Intervention is concluded (which period ends when the liquidation process begins), the Peruvian Banking Law prevents any creditor of the bank from:

• initiating any judicial or administrative procedure for the collection of any amount owed by the bank;
• enforcing any judicial decision rendered against the bank to secure payment of any of its obligations;
• constituting a lien or attachment over any of the assets of the bank to secure payment of any of its obligations; or
• making any payment, advance or netting payment obligations or assuming any obligation on behalf of the bank, with the funds or assets that may belong to it and are held by third parties, except for:
1. the netting of payment obligations that are made between regulated entities of the Peruvian financial system and insurance systems; and
2. under certain circumstances, the netting of payment obligations arising from repurchase agreements and derivatives transactions entered into with local or foreign financial and insurance institutions.

During the liquidation of a bank, creditor claims are ranked in the following order.

• First Order ‒ Labour Claims: these include (i) employee remunerations, and (ii) social benefits, contributions to private and public pension systems, and other labour claims accrued until the declaration of dissolution, as well as retirement pensions or the capital required to redeem those pensions or secure them through annuities.
• Second Order ‒ Claims for Deposits and Savings Instruments: this includes claims for bank deposits and other savings instruments covered by the Peruvian Banking Law, in the portion not insured by the Deposit Insurance Fund, along with claims by the Deposit Insurance Fund for its contributions.
• Third Order ‒ Taxes: these consist of (i) claims by EsSalud (Peruvian social security administration) related to health care benefits for which the bank is responsible as an employer, and (ii) taxes owed by the bank.
• Fourth Order ‒ Unsecured and Non-Privileged Claims: these include (i) all unsecured and non-privileged claims, ranked by the date they were assumed or incurred by the bank (earlier obligations take precedence, while those with undeterminable dates are junior and pari passu among themselves), (ii) legal interests on the bank’s obligations accrued during liquidation, and (iii) subordinated debt.

Except for unsecured and non-privileged claims (unless otherwise agreed in such instances amongst creditors), all claims within an order will be ranked pari passu among themselves.  Each category of creditors will collect in the order indicated above, whereby distributions in one order will be subject to completing full distribution in the prior order.

Any security interest created before the issuance of the resolution declaring the bank’s dissolution and the initiation of the liquidation process shall subsist in order to guarantee the obligations it secures. The secured creditors shall retain the right to collect from the proceeds of the sale of the collateral, on a preferred basis (except with respect to labour claims and savings, which are privileged claims), subject to certain rules established under Article 119 of the Peruvian Banking Law.

In Peru, ESG  requirements for financial institutions are evolving as regulators and the financial sector increasingly prioritise sustainable practices. While there is no comprehensive ESG-specific regulation equivalent to those in some other jurisdictions, Peru’s framework is influenced by international standards, voluntary initiatives and sector-specific guidelines.

In 2015, through Resolution SBS No 1928-2015, the SBS approved the Reglamento para la Gestión del Riesgo Social y Ambiental (the “Regulation for the Management of Social and Environmental Risk”), applicable to banks and other financial institutions. The purpose of this regulation is to establish minimum requirements for managing social and environmental risks, promoting the implementation of good practices and prudent risk-taking within financial institutions.

The provisions in the regulation are applicable when financial institutions provide:

• advisory services for financing a project where the total estimated investment exceeds USD10 million;
• financing for a project with an estimated investment exceeding USD10 million;
• loans to non-retail clients related to a project phase, provided that:
1. the total amount of the client’s loans related to the project within the financial system is at least USD50 million; and
2. the total amount of the client’s loans related to the project within the institution is at least USD25 million;
• bridge loans for financing a project that requires an estimated total investment exceeding USD10 million; and;
• corporate loans above USD10 million to primary suppliers of a project.

The Regulation establishes that it is the responsibility of the board of directors to define the general policy for managing social and environmental risks, establishing the minimum aspects that the policy should include. This includes the approval of a manual for managing social and environmental risks that must cover at least the provisions set out in the Regulation for the Management of Social and Environmental Risk. Similarly, the general management is responsible for implementing the policy for managing social and environmental risks in accordance with the board’s provisions. Lastly, the risk management unit is tasked with proposing policies for managing social and environmental risks to the board and participating in the design and ongoing updates to the manual for managing social and environmental risks.

While Peru does not have a direct equivalent to DORA, the SBS has issued guidance on operational risk management and cybersecurity frameworks for financial institutions.

Provisions on operational risk management are primarily contained in the Reglamento para la Gestión del Riesgo Operacional (Operational Risk Management Regulation), approved by SBS Resolution No 2116-2009, which applies to banks and other entities in the financial system. This Regulation defines operational risk as the possibility of losses resulting from inadequate processes, failures in personnel or information technology or external events. This definition includes legal risk but excludes strategic and reputational risk.

Accordingly, financial system entities must appropriately manage risks associated with their internal processes, such as poorly designed processes or inadequate or non-existent policies and procedures, which could result in deficient operations and services or their suspension. This includes, among other things, the proper management of risks associated with the company’s personnel, risks related to external events beyond the company’s control, and risks tied to information technology. These IT risks may involve security failures, operational continuity issues, errors in the development and implementation of IT systems, compatibility and integration problems, poor data quality, insufficient technology investment and other related factors.

On the other hand, the provisions for managing information security and cybersecurity are set forth in the Reglamento para la Gestión de la Seguridad de la Información y la Ciberseguridad (Information Security and Cybersecurity Management Regulation), approved by SBS Resolution No 504-2021. This Regulation mandates that financial system entities implement an information security and cybersecurity management system proportional to the size, nature and complexity of their operations. It also outlines the responsibilities of the board of directors, management, and the risk committee concerning the information security and cybersecurity management system.

In December 2023, the SBS published its regulatory agenda, signalling significant reforms for financial institutions to enhance risk management, compliance and market transparency. The agenda outlines the following priority areas.

• Management and classification of commitments: the SBS has introduced definitions and criteria for the management, classification and accounting of commitments. This includes credit lines and other exposures, aiming to improve transparency and regulatory oversight of capital, provisions and liquidity requirements associated with these items.
• Update of the Regulation for Debtor Classification and Provisions: revisions to the debtor evaluation and classification framework aim to better align provisioning schemes with expected credit losses and international standards. This update seeks to ensure financial institutions are adequately calibrated to cover credit risks while maintaining long-term sustainability.
• New framework for foreign exchange credit risk: recognising the impact of currency depreciation on borrowers with obligations in foreign currencies but incomes in local currency, the SBS plans to replace the current framework with a standardised methodology. This approach will unify the criteria for identifying debtors exposed to foreign exchange credit risk, replacing the individual methodologies previously developed by supervised entities.
• Implementation of Basel III standards: the SBS intends to update credit risk capital requirements following the Basel III framework, to align with global standards. This will include a more robust and risk-sensitive treatment of credit exposures, tailored to Peru’s local market characteristics.
• Market discipline and disclosure: in line with Basel III’s Pillar 3, the SBS plans to enhance transparency by developing a disclosure framework for financial institutions. The goal is to provide stakeholders with better insights into financial conditions and risk profiles, promoting market discipline.