Over the past year and a half, Peru has implemented several regulatory changes that have had a significant impact on the fintech industry. These changes are designed to modernise the legal framework applicable to financial system companies and allow for greater digital operations. Key regulatory changes impacting fintech companies in Peru are as follows.

• Digital operations and digital banks – changes to the Banking Law (Ley General del Sistema Financiero y del Sistema de Seguros y Orgánica de la Superintendencia de Banca y Seguros) now allows financial system companies to carry out all authorised activities digitally. This change enables the establishment of 100% digital banks in Peru, reducing costs and increasing convenience for users of financial services.
• Empresas de créditos – a new financial system company called “credit companies” was introduced, specialising in granting financing in various modalities. These companies can offer services like factoring, financial leasing, granting letters of guarantee, or acting as trustees in trust.
• Regulation of payment agreements with cards – the Central Reserve Bank of Peru (BCRP) has issued a new regulation establishing the rules for payment agreements made with cards issued by financial institutions. The regulation promotes transparency, efficiency, and competition in the market for card payment agreements.
• Interoperability – Peru has taken significant steps towards promoting interoperability in the payments sector by enacting new regulations in 2022. The new regulation seeks to facilitate financial inclusion and competition by allowing customers to transfer funds seamlessly between different payment service providers.
• Changes to e-money regulations – Peru has implemented modifications to the regulations governing the use of e-money to enhance supervision and control of e-money operations and foster the development of the digital economy.

While these regulatory changes are already in place, there are potential changes that could impact the fintech industry in Peru. Two such changes are the following.

• Crypto-currencies, virtual assets and tokens – a bill aiming to regulate the commercialisation of cryptocurrencies was presented in 2021. The proposed legislation would define cryptocurrencies as a digital representation of value that can be used as a means of exchange, unit of account, and store of value. Companies involved in the commercialisation of cryptocurrencies would be required to register with the relevant authorities and comply with certain requirements related to security, transparency, and consumer protection.
• Open banking or open finance – a bill was presented in 2022 that seeks to declare of national interest and public necessity the implementation of a policy that promotes the massification of open banking. The SBS has recommended that the bill be expanded to include the implementation of an open finance model, covering all the systems under its supervision. Implementing an open finance model involves various activities that require the participation of other regulators in Peru.

According to the report “Fintech Ecosystem: promoting innovation for sustainable and inclusive supervised systems”, the predominant vertical is that of credit platforms, which have experienced the greatest growth, probably because of the greater financing needs of individuals and micro and small enterprises as a result of the pandemic.

Other verticals that predominate in the market are foreign exchange, digital banking (with legacy players now offering digital banking services, considering digital banking is subject to the same requirements as traditional banking), payments (with several companies now offering online and mobile payment solutions), and corporate and personal finance management. To a lesser extent, there are crowdfunding platforms (whose limited growth is due, in part, to a regulation that needs to be reviewed), factoring, and wealth management.

Despite the potential it may represent in a country like Peru, the insurtech vertical is perhaps the least predominant and the one that has received the least attention. Considering the low adoption of insurance in Peru, this presents an opportunity to make insurance more accessible and affordable to a wider population. New and legacy players can also focus on microinsurance, which can help increase insurance penetration in Peru and provide financial protection to those who need it the most. Under an insurtech business model, new and legacy players can leverage technology to make microinsurance more affordable and accessible to low-income individuals.

Fintech business models in Peru do not have specific regulations, unlike in countries like Mexico or Chile with dedicated fintech laws. Instead, different regulations may apply depending on the business model.

In general, fintech companies are not subject to regulation unless they conduct activities that need prior authorisation, such as financial intermediation, which requires authorisation from the Peruvian banking regulator (Superintendencia de Banca, Seguros y AFP – SBS), or securities intermediation, which requires authorisation from the Peruvian securities market regulator (Superintendencia del Mercado de Valores – SMV).

Financial intermediation, as defined by the Banking Law, involves collecting funds in any form and placing them through transactions permitted by law. Securities intermediation, as per the Securities Market Law (Ley del Mercado de Valores), involves regularly performing operations such as purchasing, selling, placing, distributing, or negotiating securities on behalf of others. It also includes acquiring securities for one’s account with the intention of later placing them with the public and receiving a price differential.

Some fintech business models require registration with the Peruvian financial intelligence unit (Unidad de Inteligencia Financiera – Perú – UIF-Perú) to comply with anti-money laundering and counter-terrorism financing regulations, such as exchange houses or online lending platforms. Additionally, digital wallets using quick-reference (QR) codes must register with the Peruvian central bank (Banco Central de Reserva del Perú – BCRP).

Certain fintech models, like financial leasing or factoring, do not require SBS authorisation, provided they don’t exceed established regulatory thresholds. In the case of factoring and financial leasing, companies conducting these activities are not subject to the Banking Law, as long as their accounting balance remains below PEN800 million, and they don’t belong to a financial or mixed conglomerate, which includes at least one multiple operations company or insurance company. However, these companies must register with the SBS and submit periodic reports on their operations’ accounting balance, among other requirements.

The following is a general description of the applicable regulation for the main fintech verticals in Peru.

Currency Exchange

In accordance with the Political Constitution of Peru, free possession and disposal of foreign currency is guaranteed. Thus, the free possession, use and internal and external disposition of foreign currency by individuals and legal entities residing in the country is allowed. Likewise, it is established that the exchange rate for foreign currency transactions is fixed by supply and demand.

Considering this, any person may engage in the purchase and sale of foreign currency. However, in applying the provisions on the prevention of money laundering and counter-terrorism financing, natural persons with businesses or legal entities engaged in the purchase and sale of foreign currency or foreign currency are required to register in the “Register of Companies and Persons Engaged in Financial or Currency Exchange Operations”.

This registry is unique, mandatory, and public; and is administered by the SBS. Registration is valid for seven years, counted from the date of registration, after which it will expire, unless it is renewed within 30 days prior to the expiration date.

It should be noted that failure to comply with the registration will result in the closing of the premises until the registration is regularised. Likewise, the Regulation of Infractions and Sanctions for the Prevention of Money Laundering and Financing of Terrorism establishes sanctions that may be imposed for the commission of a minor infraction, a serious infraction, or a very serious infraction, which range from a sanction to a fine of up to 100 UIT.

Lending/Online Lending

In the case of companies that grant loans and do not collect savings from the public (ie, do not engage in financial intermediation), they do not require authorisation from the SBS (except in the case of credit companies, which is a type of company in the financial system that grants loans with its own capital). However, such companies must register in the “Register of Companies and Persons Engaged in Financial or Currency Exchange Operations”.

Failure to comply with the registration is subject to the same sanctions that apply for currency exchange companies.

Likewise, such companies must observe the provisions on maximum interest rates applicable to them, since they are not companies of the financial system, as further explained in 2.4 Variations Between the Regulation of Fintech and Legacy Players.

Crowdfunding

In Peru, crowdfunding is regulated by the SMV through Resolution SMV No 021-2017-SMV/01. This regulation establishes the requirements for crowdfunding platforms to operate legally in Peru and sets out the obligations of both the platforms and the issuers seeking funding through them.

Under the regulation, crowdfunding platforms must register with the SMV and meet certain requirements related to their corporate governance, risk management, and operational procedures. They must also provide investors with clear and accurate information about the investment opportunities available on the platform, including the risks associated with investing in them.

Issuers seeking funding through crowdfunding platforms must also comply with certain requirements, including the disclosure of relevant information about their business and the investment opportunity, as well as the use of funds raised through the platform.

Overall, the crowdfunding regulation in Peru seeks to promote the development of alternative sources of financing for small and medium-sized enterprises, while protecting investors from fraud and other risks associated with investing in these types of opportunities.

Digital Banking

Digital banking activities are subject to the same provisions as traditional banking. As a result of an amendment introduced to the Banking Law in 2022, companies in the financial system (which includes banks) are allowed to carry out digitally any of the operations for which they are authorised.

Payments

The BCRP has instituted a range of rules and guidelines to ensure the proper operation and security of payment systems in Peru, including the Payment System and Securities Settlement Law (Ley de los Sistemas de Pagos y de Liquidación de Valores) and its accompanying regulations.

The Payment System and Securities Settlement Law applies to Payment and Securities Settlement Systems, System Administrators, Participants, Settlement Agents, guarantees within the system’s framework, as well as entities providing technological support. Additionally, it applies to Payment Agreements and Settlement Agreements and Securities Settlement Agreements that have not been recognised as Payment or Securities Settlement Systems.

This law empowers the BCRP to establish rules, regulations, principles, and standards applicable to payment agreements and payment service providers, as well as oversee their compliance. The law defines payment agreements as arrangements or procedures for transferring funds among participants, involving at least three entities, with a minimum of one being a part of the financial system.

Payment agreements include the Electronic Money Payment Agreement, which is a set of agreements or procedures for processing electronic money transfer orders and carrying out electronic money clearing, as well as settling obligations between electronic money issuers resulting from the clearing process. Additionally, the BCRP has established the card payment agreement, which is a collection of agreements or procedures for executing card payment services under the rules and regulations set by payment networks, encompassing both issuing and acquiring activities.

Insurtech

Insurance activities such as those that may be carried out by insurtech business models are subject to the same provisions that are applicable to insurance companies, as well as to insurance intermediaries and auxiliaries. Also, because of an amendment introduced to the Banking Law (which is also applicable to insurance companies) in 2022, insurance system companies are allowed to digitally perform any of the operations for which they are authorised.

In Peru, there is no specific regulation for fintech compensation models. Fintech companies in Peru can use various compensation models to charge their customers, depending on the services they provide.

However, fintech companies that provide credit services and are not part of the financial system (ie, that are not institutions supervised by the SBS) must observe the interest rate limits applicable to transactions between companies that are not part of the financial system.

Likewise, and no less important, the Código de Protección y Defensa del Consumidor (Consumer Protection and Defence Code) also contains provisions that are applicable to companies that provide credit services and that are not supervised by the SBS. Among these provisions are those referring to the determination of the interest rate, as well as the obligation to publicise the annual effective cost rate (Tasa de Costo Efectivo Annual – TCEA), in accordance with the parameters established by the SBS. Likewise, it is established that the charging of commissions and expenses must imply the rendering of an effective service, duly justified, and be supported by a real and demonstrable expense for the service provider.

Additionally, the regulation recently published by the BCRP regarding the interoperability of payment services establishes that the criteria for charging fees and commissions for offering interoperable payment services must be transparent, non-discriminatory and reflect a real and demonstrable cost in order not to limit the access and use of these services. Likewise, the regulation of card payment agreements, also published by the BCRP, establishes, as one of its principles, the dissemination and transparency of commissions and fees, so that card payment agreement participants and end users understand the commissions and costs associated with the card payment service.

Regulation of fintech and legacy players (traditional financial institutions) can vary significantly. As mentioned in 2.2 Regulatory Regime, fintech business models in Peru are not subject to regulation unless they engage in activities such as financial intermediation or securities intermediation. However, the regulations applicable to them are scattered across various regulations, as Peru does not have a specific regulation applicable to fintech companies, as is the case in other jurisdictions.

Due to the type of activity, companies engaged in financial intermediation or securities brokerage are subject to greater regulation, including those related to the treatment and mitigation of risks or capital requirements.

From a tax point of view, income received by banking companies, finance companies and other financial institutions authorised to operate by the SBS, for commissions and interest, are not subject to general sales tax.

It should also be noted that financial system companies may freely set the interest rates they charge for their operations, except in the case of consumer loans, low consumer loans (those whose amount is equal to or less than 2 UIT) and loans for small and micro-enterprises, for which they must observe the maximum interest rates set by the BCRP, following a regulatory amendment introduced in 2021 (previously, there were no interest rate limits for financial system companies). In the case of fintech companies, they must observe the maximum interest rates set by the BCRP.

Likewise, as described in 2.5 Regulatory Sandbox, the sandbox is only available to financial system companies, insurance companies and specialised companies (which are companies that carry out a specific activity of all those that can be carried out by financial system companies), as well as those companies undergoing incorporation that have an organisation authorisation to become a financial system company, insurance company or specialised company. Consequently, fintech companies cannot apply to the regulatory sandbox, unless they even have an organisational authorisation granted by the SBS.

Peru has a regulatory sandbox, as provided in the Banking Law and the Reglamento para la realización temporal de actividades en modelos novedosos (the “Sandbox Regulation”), issued by the SBS.

The Banking Law allows the SBS to establish, within the scope of its supervisory functions, the temporary performance of any operation or activity through innovative models, being able to grant exceptions to the regulation that applies to natural or legal persons who carry out such operations or activities, as well as regarding the other necessary provisions for their development.

As provided in the Sandbox Regulation, companies of the financial system (which includes banks and other financial institutions), insurance companies, specialised companies, and private pension fund administrators may apply to the sandbox. Companies undergoing incorporation that have an organisation authorisation granted by the SBS may apply to the sandbox.

The Sandbox Regulation allows companies to carry out pilot tests, temporarily, of innovative models based on activities contemplated in the current regulatory framework, and for which they are authorised by the SBS.

Pilot tests that require the relaxation of normative requirements under the SBS’s competence for their development or that are referred to innovative models based on activities not contemplated in current regulations may be carried out with prior authorisation from the Superintendence, through one of the following regimes:

• flexibility – for pilot tests of innovative models based on activities contemplated in the current regulatory framework that require the temporary relaxation of one or more normative requirements; and
• extraordinary – for pilot tests of innovative models based on activities not contemplated in the current regulatory framework.

Likewise, companies undergoing incorporation may carry out pilot tests under the Flexibility Regime, with prior authorisation from the SBS.

Furthermore, companies may carry out any activity for which they are authorised in the SBS regulatory framework digitally. Additionally, the performance of pilot tests can help, but it is not a precondition, to the development of regulatory adaptations that may be necessary to allow and facilitate innovation.

The fintech industry in Peru is regulated by multiple authorities, each with specific areas of responsibility. The SBS and SMV are the primary regulators for fintech companies, while INDECOPI and BCRP play complementary roles in the sector.

Superintendencia de Banca, Seguros y AFP

The SBS is responsible for regulating and supervising financial institutions, insurance companies, and pension fund administrators. Its main objectives include protecting the public interest, ensuring the financial stability of the institutions it oversees, enforcing the Ley General del Sistema Financiero y del Sistema de Seguros y Orgánica de la Superintendencia de Banca y Seguros (the “Banking Law”) and its regulations, and leading and supervising the anti-money laundering system.

Superintendencia del Mercado de Valores

The SMV regulates and supervises the securities market in Peru, including the activities of stock exchanges, brokerage firms, and other participants. Fintech companies involved in the securities market, such as crowdfunding platforms, are subject to SMV’s oversight. The regulator aims to ensure transparency, protection of investors, and the proper functioning of the securities market.

Banco Central de Reserva del Perú

BCRP is the central bank of Peru, responsible for conducting monetary policy, managing foreign reserves, and ensuring the stability of the country’s financial system. While BCRP does not directly regulate fintech companies, it is involved in the development of policies and regulations that may affect the fintech sector, such as guidelines for payment systems.

Instituto Nacional de Defensa de la Competencia y de la Propiedad Intelectual

INDECOPI is responsible for promoting and protecting free competition, intellectual property rights, and consumer protection across various industries in Peru. While it does not specifically regulate the fintech sector, it has jurisdiction over fintech companies in matters related to unfair competition, consumer protection, and intellectual property.

Unidad de Inteligencia Financiera-Perú

The Unidad de Inteligencia Financiera – Perú (UIF-Perú) is the financial intelligence unit of Peru, responsible for preventing and detecting money laundering and terrorist financing activities in the country. The UIF-Perú plays an important role in fintech activities by supervising and regulating the compliance of fintech companies with AML and CTF regulations. In addition, the UIF-Perú provides guidance and training to fintech companies to help them understand and comply with AML and CTF regulations. This guidance can include best practices for customer due diligence, transaction monitoring, and reporting of suspicious activities.

Autoridad de Protección de Datos Personales

The Autoridad de Protección de Datos Personales (APDP) is another important regulator in the context of the fintech industry in Peru. The APDP is responsible for overseeing the protection of personal data and ensuring compliance with data protection laws and regulations.

The APDP enforces the Personal Data Protection Law (Ley de Protección de Datos Personales) and its regulations, aiming to guarantee the privacy and protection of personal data of individuals. In the fintech industry, companies often collect, store, process, and share large amounts of personal data. As a result, fintech companies must comply with the data protection regulations set forth by the APDP.

Depending on the specific services offered by a fintech company, other regulators or government agencies may be involved, such as the Ministry of Communications and Transport for issues related to telecommunications or the Ministry of Foreign Trade and Tourism (MINCETUR) for fintech activities related to the gambling industry.

Generally, financial system and capital market companies may outsource several of the functions and responsibilities established in the applicable regulations; however, they assume full responsibility for the results of those processes outsourced to third parties and may be sanctioned for non-compliance.

Entities Subject to the Supervision of the SBS

Financial institutions may outsource several functions to third-party vendors. However, this activity is regulated by the SBS, which must be informed of such arrangements and, in certain cases, authorise them (eg, in case of outsourcing of the internal audit service or data processing abroad) and may carry out inspections of the premises and activities of the vendors. Despite this, the outsourcing of regulated functions does not release a financial institution from its obligations vis-à-vis its clients and the SBS.

Entities Subject to the Supervision of the SMV

For entities under the supervision of the SMV, outsourcing regulations exist, requiring them to establish formal policies and procedures for assessing risk levels and implementing control mechanisms throughout the entire outsourcing period. It is important to note that these entities assume full responsibility for all outsourced services, activities, and related management decisions.

In the case of significant cloud outsourcing, entities must possess access and audit rights and implement data and system security measures. They should also consider aspects related to data location, data processing location, chain outsourcing (when the outsourced provider subcontracts parts of the service to other providers) and develop well-defined business continuity plans and exit strategies.

Fintech providers are under no specific legal obligation to act as gatekeepers.

When the scope of the services provided by fintech companies is not well defined or fintech companies engage in activities that fall within the scope of the Banking Law or the Securities Market Law, without the corresponding authorisations, both the SBS and the SMV may initiate investigations which could give rise to the imposition of administrative and criminal sanctions.

In the case of data protection regulations, enforcement actions by the APDP may include fines, sanctions, or orders to implement corrective measures for failing to comply with data protection requirements, such as obtaining consent from data subjects, implementing adequate security measures, or notifying data breaches.

In the case of INDECOPI, enforcement actions against fintech companies may include fines, sanctions, or orders to cease and desist from engaging in unfair competition, deceptive advertising, or violations of intellectual property rights.

In the case of BCRP, enforcement actions against fintech companies that fail to comply with the regulations issued by such governmental authority may include fines.

Personal Data Protection

Personal data protection provisions in Peru are primarily governed by the Personal Data Protection Law and its regulations. This law establishes the legal framework for the protection of personal data, including the processing, use and transfer of such data by individuals and entities.

The law requires that personal data be collected and processed in a lawful, fair and transparent manner, and that individuals be informed of the purpose for which their data is being collected and used. It also establishes the rights of individuals to access, correct and delete their personal data, and to object to its processing in certain circumstances.

In addition, the law requires that entities that process personal data implement appropriate technical and organisational measures to ensure the security of such data and prevent its unauthorised access, use or disclosure. Entities are also required to obtain the consent of individuals for the processing of their personal data in most cases.

The National Authority for the Protection of Personal Data (Autoridad Nacional de Protección de Datos Personales or ANPD) is the regulatory agency responsible for overseeing compliance with the Personal Data Protection Law and enforcing its provisions. The ANPD is authorised to impose sanctions and fines for non-compliance with the law.

Consumer Protection

Consumer protection in Peru is governed by the Consumer Protection Code (Código de Protección y Defensa del Consumidor) and its regulations. This law establishes the legal framework for consumer protection in Peru and provides a set of rights for consumers.

The Consumer Protection Code requires that businesses provide consumers with clear and accurate information about products and services, including pricing, terms and conditions, and any limitations or restrictions. It also requires that businesses not engage in deceptive or misleading practices, and that they provide adequate after-sales support and customer service.

Digital and Electronic Signature

Digital and electronic signatures in Peru are governed by the Electronic Signature Law (Ley de Firmas y Certificados Digitales) and its regulations. This law establishes the legal framework for the use of electronic signatures in the country and provides guidelines for their use and recognition.

In addition to regulators, there are other relevant players actively involved in the sector. The most important fintech companies are grouped in the Asociación Fintech del Perú, while interests of different financial institutions are represented in several Asociación de Bancos del Perú (ASBANC), the Asociación de Instituciones de Microfinanzas del Perú (ASOMIF), the Federación Peruana de Cajas Municipales de Ahorro y Crédito (FEPCMAC) and the Federación Peruana de Cajas Municipales de Ahorro y Crédito (FENACREP).

There are also important organisations that promote the use of blockchain technology in its various forms.

In Peru, companies authorised to operate by the SBS or the SMV are allowed to carry out only those activities for which they have received proper authorisation. As a result, even if these companies conduct some activities digitally or develop business models that align with various fintech verticals, it does not imply that their overall operations are exempt from regulation for products and services without specific regulations.

On the other hand, fintech companies that do not possess authorisation to operate granted by a governmental authority may offer a combination of regulated and unregulated products and services. The regulatory framework for fintech companies in Peru continues to evolve, and some services may not be covered under the current regulatory scope, while others might be subject to regulations from the SBS or other regulatory bodies.

Fintech companies providing both regulated and unregulated services might adopt different approaches to structuring their businesses. Some may opt to operate under a single legal entity that offers all products and services (and secures relevant registrations for verticals where registration is mandatory), while others may decide to establish separate legal entities for distinct types of services to manage risks or comply with specific regulatory requirements (for instance, by creating separate legal entities for verticals that require registration).

In Peru, AML rules have a significant impact on fintech companies, both regulated and unregulated. The country has been taking steps to strengthen its AML and CTF regulations in accordance with international standards.

For regulated fintech companies that fall under the purview of the SBS or the SMV, AML and CTF rules are particularly relevant. These companies are required to comply with various AML and CTF regulations, including:

• customer due diligence (CDD) – fintech companies must implement CDD processes to identify and verify the identity of their customers, assess their risk profiles, and monitor their transactions;
• suspicious transaction reporting (STR) – fintech companies are obligated to report suspicious transactions or activities to the Unidad de Inteligencia Financiera (UIF-Perú), the country’s financial intelligence unit;
• record keeping – companies must maintain detailed records of customer identification data, transaction history, and other relevant information for a specified period;
• AML/CTF compliance programme – fintech companies need to develop and implement an internal AML/CTF compliance programme, which includes appointing a compliance officer, providing regular training to employees, and conducting periodic audits; and
• sanctions and politically exposed persons (PEPs) screening – fintech companies must also comply with international sanctions lists and screen customers against PEPs lists to mitigate the risks associated with money laundering and terrorist financing.

For unregulated fintech companies (companies that do not require authorisation from the SBS or the SMV or do not require registration, as explained in 2.2 Regulatory Regime), the impact of AML rules might be less direct.  However, given the increasing focus on AML and CTF compliance globally, it is likely that these companies will also face growing scrutiny and pressure to adopt AML/CTF best practices. Additionally, unregulated fintech companies may find it challenging to establish partnerships with regulated entities or access banking services if they do not demonstrate adequate AML/CTF controls.

There are no specific regulations governing robo-advisers. The existing legal framework for legacy players focuses on human-provided investment advice, which doesn’t imply that robo-advisers are restricted.

Legacy players operate within the existing legal framework, and while robo-advisers are gaining popularity among investors, the adoption of robo-adviser solutions by traditional players has not yet become widespread.

At present, there are no specific rules or guidance pertaining to robo-advisers regarding the best execution of customer trades.

In the case of loans granted by financial system companies (authorised by the SBS) or fintech companies (required only to be registered with the SBS), the primary distinction lies in the fact that loans classified as consumer and small business loans for individuals are subject to maximum interest rate limits imposed by the lender. Financial system companies, when offering loans not subjected to these maximum interest rates, can independently determine the interest rate to be charged, while fintech companies must still adhere to the maximum rates established by the BCRP, as outlined in 2.4 Variations Between the Regulation of Fintech and Legacy Players.

Additionally, companies within the financial system face more extensive regulations and must comply with provisions related to the establishment of provisions, debtor credit classification, and other requirements applicable to them as entities supervised by the SBS.

Lastly, as discussed in 2.4 Variations Between the Regulation of Fintech and Legacy Players, there are notable differences in the tax treatment applied to loans provided by financial system companies compared to those not part of the financial system. It is important to highlight that this discrepancy (whereby credit services offered by financial system companies are not subject to general sales tax) carries financial significance and has led some companies to consider the advantages of becoming a credit company (Empresa de Créditos). As a type of financial system company that does not take public savings, credit companies are exposed to a lesser regulatory burden.

There is no specific regulation that dictates the underwriting processes used by industry participants. In general, online lenders in Peru use a variety of underwriting processes to assess the creditworthiness of potential borrowers.  These may include the use of credit scoring models, analysis of financial statements, and review of other relevant data, such as employment history or educational background.

Some online lenders may also use alternative data sources, such as social media activity or mobile phone usage patterns, to supplement traditional credit data in their underwriting processes.

The specific underwriting process used by online lenders may vary depending on the lender’s business model and target market. However, regardless of the process used, online lenders are expected to comply with relevant consumer protection laws and regulations, including those related to fair lending practices and data privacy.

In Peru, the fintech industry has several sources of funds for loans, including peer-to-peer (P2P) lending, lender-raised capital, taking deposits, and securitisations. Each of these sources has its own legal and regulatory issues associated with it.

• P2P lending – P2P lending platforms connect borrowers with individual or institutional lenders. These platforms are required to comply with regulations set by the SBS. The SBS has specific guidelines for P2P lending platforms, which include registration, reporting requirements, and disclosure of information. Additionally, P2P platforms should comply with AML and CFT regulations, as well as consumer protection and data protection laws.
• Lender-raised capital – fintech lending companies have the option to raise capital from investors such as venture capital firms, private equity funds, or other institutional investors. However, if they choose to do so through a public offering, they must comply with securities regulations set by the SMV. These regulations include disclosure requirements and filing the necessary documentation.
• Taking deposits – financial institutions authorised to enter financial intermediation activities are allowed to take deposits from the public in Peru. Fintech companies that want to accept deposits need to obtain a licence from the SBS and comply with its regulations, including capital requirements, risk management, and reporting obligations.
• Securitisations – fintech companies have the option to use securitisation as a source of funds by pooling loans into securities and selling them to investors. However, if they choose to do so through a public offering, securitisations are subject to regulations set by the SMV. These regulations include registration and disclosure requirements.

Each source of funds for loans in the Peruvian fintech industry comes with its own set of legal and regulatory challenges. Fintech companies must comply with the regulations set by various authorities, such as SBS, SMV, INDECOPI, BCRP, and the APDP, depending on the type of services they provide and the source of funds they use.  Compliance with these regulations is essential for maintaining a stable, transparent, and competitive fintech lending market in Peru.

While not representing traditional loan syndication, crowdlending platforms (which facilitate loans funded by multiple investors via the platform) can be considered a form of loan syndication. See 2.2 Regulatory Regime.

Also, while not a syndication per se, it is not uncommon for fintech companies that provide loans to transfer all or part of their loan portfolio to investment funds that invest in this asset class. In addition, there has recently been a growing interest in asset securitisation structures, which allow fintech companies that make loans to transfer the risk derived from the placement of such loans to investors, typically through private offerings.

Payment processors are generally expected to use existing payment rails but can also create or implement new payment rails.

There are no explicit provisions in Peru that prohibit cross-border payments or remittances.

In the context of remittances, the Banking Law categorises funds transfer companies as complementary and related service companies. These companies are required to secure authorisation from the SBS to establish and operate in the country. Complementary and related service companies offer services that support or are connected to those provided by entities within the financial system.

Funds transfer regulations identify “funds transfer companies” as businesses that, according to their bylaws, primarily aim to offer the public the service of receiving fund transfer orders based on the payer’s instructions and/or making funds accessible to beneficiaries. Funds transfer activities can be performed either as a representative of international companies or independently via agreements with foreign correspondent companies.

Investment funds are regulated by the Securities Market Law and the Investment Funds Law (Ley de Fondos de Inversión y sus Sociedades Administradoras). According to the Securities Market Law and the Investment Funds Law, investment funds are included within the scope of the aforementioned regulations, but their provisions do not extend to private offerings of securities (which includes the placement, through private offerings, of investment fund participation certificates).

In addition, the Regulation of Investment Funds and their Management Companies (Reglamento de Fondos de Inversión y sus Sociedades Administradoras) establishes the rules to which the investment funds whose quotas are placed or traded by public offering, their management companies, as well as the persons directly or indirectly related to them must abide, also pointing out that the private offering funds managed by management companies or by other entities are not supervised by the SMV.

Private offering funds managed by investment fund management companies authorised by the SMV are subject to the provisions of their own regulations and contracts and, to the extent applicable, to the Investment Funds Law and the Regulation of Investment Funds.

In Peru, certain aspects of the contracts between fund management companies and their advisers or service providers are regulated. The terms of these contracts tend to reflect and cover the obligations applicable to fund managers, seeking to ensure the performance and effectiveness of the operation of the investment fund.

Exchanges and trading platforms are subject to SMV regulation, as provided in the Securities Market Law. Apart from the conventional exchanges and markets that are regulated by the Securities Market Law, there has been a rise in the formation of crowdfunding platforms where individuals in need of financing are linked with those willing to provide it. Additionally, a considerable number of crypto-asset exchanges have emerged in recent times. For crypto-asset exchanges, see 7.3 Impact of the Emergence of Cryptocurrency Exchanges.

See 7.1 Permissible Trading Platforms.

To date, there is no specific regulation that applies to cryptocurrencies or cryptocurrency exchanges.

It is worth mentioning that in December 2021, a bill known as Ley Marco de Comercialización de Criptoactivos (Framework for the Commercialization of Crypto-assets) was filed in the Peruvian congress. The bill aims to regulate the trading of cryptocurrencies and other crypto-assets in Peru, establish a legal framework for their commercialisation, and provide regulatory oversight of crypto exchanges. The bill proposes that both banking and non-banking entities offer cryptocurrency services such as custody, exchange, and staking, among others, but it establishes specific security requirements to protect users. Among the most notable requirements is the registration with the SBS and enrolment in a registry of cryptocurrency exchange platforms. Additionally, the bill proposes that crypto exchanges report suspicious activity or unusual transactions to the UIF-Perú. It is worth noting that the bill is still in the proposal stage and it is not expected that it will be passed into law.

No listing standards for crypto-assets or virtual assets are provided by Peruvian regulation.

Absent of specific regulation for crypto-assets or virtual assets, no order handling rules apply for crypto-assets or virtual assets.

No regulation regarding peer-to-peer trading platforms exists in Peru.

The lack of any specific regulation may give rise to problems regarding the execution of customer trades or any other aspect related to the protection of customers.

There are no specific rules permitting or prohibiting payment for order flow in Peru.

In Peru, the Securities Market Law establishes the fundamental principles of market integrity and market abuse that regulate trading. These principles include the quality of information, market transparency, and publicity, and prohibit any acts, omissions, practices, or conduct that could undermine the integrity or transparency of the market.

It is important to note that these provisions only apply to public securities offerings and their issuers, as defined by the Securities Market Law. Currently, no specific regulations apply to cryptoassets or virtual assets in Peru.

There is currently no specific regulation governing the creation and use of High-Frequency and Algorithmic Trading, and the SMV does not provide a specific definition for regulatory purposes. While it appears that High-Frequency and Algorithmic Trading is not currently being practiced in Peru, in the absence of specific regulations, High-Frequency and Algorithmic Trading would be subject to general regulatory oversight.

Since there is no specific regulation that applies to High-Frequency and Algorithmic Trading, there are no specific rules requiring traders who use these strategies to register as market makers when functioning in a principal capacity.

There is currently no specific regulation that applies to the creation or use of High-Frequency and Algorithmic Trading. As a result, there is no regulation that distinguishes between funds and dealers who engage in these types of transactions.

In Peru, there is no specific regulation that applies to programmers who create trading algorithms and other trading tools. However, computer programs are considered protected works under the Copyright Law (Ley de Derechos de Autor). According to this law, computer programs are protected in the same way as literary works, and this protection extends to all forms of expression, including both operating systems and applications, whether in the form of source code or object code.

There are no specific regulations governing DeFi in Peru.

Financial research platforms, as technology-oriented tools that facilitate user access to, analysis of, and interpretation of financial data and market information, are not subject to registration or a singular regulatory framework. Nonetheless, their operations could be governed by various sets of rules and regulations.

In Peru, the spreading of rumours and unverified information, particularly in the context of financial markets, can be subject to regulations and sanctions. While there may not be a specific law that addresses the spreading of rumours in all contexts, certain provisions can be applied to prevent market manipulation, misinformation, and fraud.

The SMV oversees the financial markets and enforces regulations to maintain transparency, integrity and fairness in the market. The SMV has established rules to protect investors and prevent market abuse, such as insider trading, market manipulation, and the spreading of false or misleading information that could affect market prices or investor behaviour.

In the context of securities and public offerings, the Securities Market Law and its regulations can apply to the spreading of rumours and unverified information. These legal provisions set forth prohibitions regarding the use of privileged information, manipulation, and deception in the market.

Individuals or entities found to be spreading false or misleading information with the intent to manipulate the market or deceive investors could face sanctions, fines or other legal consequences.

As mentioned in 9.1 Registration, financial research platforms are not required to register or adhere to any regulations. Consequently, there are no specific rules governing the content of posts on these platforms. Nevertheless, inappropriate actions, such as divulging insider information, may be subject to penalties under the Securities Market Law, when applicable.

Each distinct type of insurance, such as life, property and casualty, is subject to its own unique regulations. These regulations are governed by the Banking Law, which encompasses provisions applicable to insurance companies, as well as any supplementary regulations established under the same law.

Each distinct type of insurance, such as life, property and casualty, is subject to its own unique regulations. These regulations are governed by the Banking Law, which encompasses provisions applicable to insurance companies, as well as any supplementary regulations established under the same law.

Regtech providers are not regulated by Peruvian law. Regtech providers are commonly hired by financial entities to help them comply with regulatory requirements. See 2.7 Outsourcing of Regulated Functions.

While contract terms can be freely negotiated with regtech suppliers, there are legal provisions governing subcontracting processes. See 2.7 Outsourcing of Regulated Functions.

Numerous traditional players in Peru are employing or contemplating the implementation of blockchain technology to enhance information processing, management and storage. Additionally, they aim to automate specific procedures, conduct cross-border transactions, and tokenise and exchange financial instruments.

Peru has not implemented specific regulations or proposals related to blockchain. However, the government and regulators have shown interest in leveraging the potential benefits of blockchain for various sectors of the economy.

The BCRP has been closely observing developments in the blockchain and cryptocurrency space. While they have not imposed strict regulations on the use of blockchain, they have issued warnings about the risks associated with cryptocurrencies. The BCRP has also been studying central bank digital currencies (CBDCs) and their potential role in the financial system.

The Peruvian government is exploring the use of blockchain technology to enhance transparency and efficiency in public administration. For instance, there have been discussions about implementing blockchain-based solutions for public procurement processes and property registration.

It is worth mentioning that the PERÚ COMPRAS (Peru’s public procurement central) implemented the registration of digital purchase orders on a blockchain. Through the tokenisation of purchase orders, PERÚ COMPRAS aimed to ensure transparency and fight corruption in public procurement.

The topic of the application of blockchain technology in property registration was explored during the Annual Congress of Registry Law. This event, organised by SUNARP (the National Superintendence of Public Registries), serves as an academic platform aiming to foster research, reflection, analysis and the exchange of knowledge and experiences within the realm of registry practices.

In addition, the government has chosen to launch initiatives like Cadena, which concentrates on the authorised economic operator certificates’ exchange, with the aim of validating procurement orders and tendering documents from Peru Compras and the OSCE (Organismo Supervisor de las Contrataciones del Estado, which is the supervisory body for state contracting).

Peru has participated in regional discussions and initiatives around blockchain technology and its potential applications. Also, Peru participates in the Ministerial Conference on the Information Society in Latin America and the Caribbean, in which the Digital Agenda for Latin America and the Caribbean (eLAC) are approved, which includes areas of action such as the adoption of emerging technologies and digital transformation.

In addition, various private sector players in Peru have been experimenting with blockchain technology in different industries, such as agriculture, supply chain management and energy. These initiatives might prompt regulatory authorities to consider formulating specific regulations for blockchain in the future.

Peru has no specific regulation that explicitly classifies blockchain assets as regulated financial instruments. However, the SMV has issued press releases warning the public about the potential risks associated with acquiring virtual currencies, cryptocurrencies or tokens, which do not have the backing of any government entity or financial supervisor. The SMV cautions about the potential risks associated with these assets’ massive offering and promotion, including exposure to fraud and scams, possible use in financing illegal activities like money laundering and terrorism financing, and the high volatility and speculative nature of their prices.

To safeguard the interests of investors, the SMV urges the public to adequately inform themselves before investing in these assets, mainly when transactions are carried out through various electronic or digital communication channels, such as websites, emails, instant messaging services, social networks, and other mass communication channels. The SMV also emphasises the importance of caution and protection for investors, especially when acquiring financial instruments associated with these assets.

There is no specific regulation applicable to issuers of blockchain assets. See 12.5 Regulation of Blockchain Asset Trading Platforms.

There is no specific regulation applicable to blockchain asset trading platforms, such as cryptocurrency exchanges. However, by means of Supreme Decree No 006-2023-JUS, published on 27 July 2023, Virtual Asset Service Providers (VASPs) (which would include cryptocurrency exchanges) were incorporated as obligated subjects to report to the UIF-Peru for the purposes of preventing AML regulations.

In terms of secondary market trading of blockchain assets, there is no specific regulation in Peru. The Peruvian government has not yet established any rules for the purchase, sale or exchange of cryptocurrencies through intermediaries or peer-to-peer. As such, individuals engaging in secondary market trading of blockchain assets should be aware of the risks involved and take appropriate precautions.

Currently, there are no specific regulations in Peru on investment funds or collective investment schemes that invest in blockchain assets. In general terms, investment funds may invest in instruments, financial operations and other assets, in accordance with the provisions of their participation regulations and the contract signed with the respective participant.

There is no specific definition applicable to virtual currencies in Peru.

DeFi platforms are not expressly regulated in Peru.

NFTs and NFT platforms are not part of the fintech regulatory perimeter in Peru. Currently, there is no specific regulation in Peru that governs the offering and promotion of cryptocurrencies or tokens, which do not have the backing of any government entity or financial supervisor. Therefore, companies that make such offers and/or promotions are not under supervision.

The SMV has warned about the potential risks associated with the acquisition of virtual currencies, cryptocurrencies or tokens, as well as financial instruments associated with them. The SMV also warns about the potential risks associated with the massive offering and promotion of cryptocurrencies or tokens, such as the exposure to fraud and scams based on the use of new technologies, the possible use of these assets in the financing of illegal activities such as money laundering and terrorism financing, and the precautions that must be taken regarding the acquisition of these assets or financial instruments associated with them, due to the high volatility of their prices and speculative component, and the protection of investors.

Therefore, the SMV urges the public to adequately inform themselves before investing in these assets, especially when these transactions are carried out through various electronic or digital communication channels, such as websites, emails, instant messaging services, social networks, among others, as well as through public events, even educational ones, and other mass communication channels.

To date, there is no specific regulation on open banking or open finance in Peru. However, in March 2022, a bill to declare the implementation of a policy that promotes the massification of open banking as a matter of national interest and public need was presented in the congress.

During the consultation process for this bill, various institutions provided feedback. The SBS considered it important to implement an open finance model in the country, instead of just open banking, as it would be more beneficial for users of financial services in the long term. The BCRP, on the other hand, highlighted the potential benefits of open banking, including the empowerment of the end customer, promoting innovation and competition, potentially reducing interest rates (by allowing the exchange of customer information between banks and other agents), and expanding credit and financial inclusion. The banking sector, through ASBANC, welcomed the initiative, stating that it would promote greater access to financial services, increase financial inclusion, and provide customers with more opportunities to learn about different financial products and choose the one that best suits their needs, promoting market competitiveness.

Overall, while there is no specific regulation on Open Banking in Peru, there are ongoing discussions and initiatives towards its implementation. The feedback received from different institutions highlights the potential benefits of open banking or open finance and the need for effective regulation to support its growth and adoption in the country.

Some concerns raised by stakeholders in Peru regarding open banking include data privacy and security, as customers worry about the safety and privacy of their personal and financial information when shared with third-party providers. Additionally, concerns over customer consent highlight the need for transparent consent mechanisms to prevent unintentional data sharing. Market concentration is another issue, with some stakeholders fearing that open banking could reduce competition and negatively impact smaller financial institutions. Furthermore, implementation challenges may arise due to the significant technological and regulatory changes required, which could be particularly difficult for smaller institutions and startups. Additional barriers involve the expansion of the technological environment and the need for improved financial literacy and digital culture among banking service users.

No response provided for this section.

No response provided for this section.