Developments in the Past 12 Months

In recent years, Peru has witnessed significant regulatory and market developments in the fintech sector, aimed at fostering financial inclusion, digital transformation, and regulatory oversight. Key trends and changes include the following.

• Expansion of digital banking – amendments to the Banking Law (Ley General del Sistema Financiero y del Sistema de Seguros y Orgánica de la Superintendencia de Banca y Seguros) have enabled financial institutions to operate entirely digitally. This shift allows for the emergence of 100% digital banks, reducing costs and increasing accessibility for consumers.
• Creation of credit companies – a new category of financial entities, known as Empresas de Créditos, has been introduced, allowing specialised financial institutions to engage in activities such as factoring, financial leasing, and guarantees.
• Interoperability in digital payments – regulations promoting interoperability between financial service providers have been implemented to enhance competition and financial inclusion. This move allows users to transfer funds across different digital wallets and banks seamlessly.
• Regulation of card payment agreements – the Central Reserve Bank of Peru (BCRP) has established new rules for payment agreements involving financial institutions and card issuers to increase transparency and competition in electronic payments.

Key Issues Impacting the Next 12 Months

Several factors will shape the Peruvian fintech landscape in the coming year, including regulatory advancements, technological integration, and market competition. The most pressing issues include the following.

• Potential cryptocurrency regulation – a bill introduced in 2021 proposes a framework for cryptocurrency regulation, defining virtual assets and establishing registration requirements for crypto-related businesses.
• Progress in open finance – a proposed bill to implement open finance models remains under discussion. The Superintendencia de Banca, Seguros y AFP (SBS) has suggested expanding the initiative beyond traditional banking to include all supervised financial sectors, facilitating secure data-sharing mechanisms.
• Consumer protection in digital lending – with the rise in identity fraud cases involving digital loans, authorities such as Instituto Nacional de Defensa de la Competencia y de la Protección de la Propiedad Intelectual (INDECOPI) and the SBS may introduce stricter consumer protection measures, requiring enhanced KYC and fraud prevention mechanisms. Recently, a bill has been introduced to regulate the concept of the digital consumer, aiming to establish clearer protections for individuals engaging in financial transactions through digital platforms.
• Potential Fintech Law implementation – discussions continue around a comprehensive Fintech Law, which would provide a more structured framework for the industry, aligning with international standards and addressing regulatory gaps.

Integration of Artificial Intelligence in Fintech

AI is increasingly being incorporated into financial services and fintech products in Peru. Areas where AI is gaining traction include the following.

• Fraud detection and risk management – AI-driven machine learning models are being used to detect fraudulent transactions in real time and identify suspicious activities.
• Personalised financial services – AI-powered chatbots and virtual assistants are improving customer interactions by providing instant support and financial advice tailored to user behaviour.
• Credit scoring and alternative lending – fintech lenders are using AI-based credit scoring models to assess borrowers’ creditworthiness using alternative data sources, expanding access to credit for underbanked populations.
• Regtech solutions – AI is also playing a role in regulatory compliance, assisting financial institutions in automating KYC/AML checks and ensuring adherence to evolving regulations.

According to the 2024/2025 Fintech Business Guide published by EY, the most predominant fintech verticals in Peru are payments and remittances, lending, Fintech as a Service (FaaS), and financial management. These sectors have experienced significant growth due to the increasing demand for digital financial solutions, the expansion of financial inclusion initiatives, and the evolution of regulatory frameworks.

Lending platforms have expanded as individuals and small businesses face challenges accessing credit from traditional financial institutions. The adoption of alternative credit scoring methods and digital onboarding has streamlined the loan approval process, enabling greater access to financial services.

Lending platforms have seen the most substantial growth within Peru’s fintech ecosystem, representing nearly 25% of all fintechs in the country, according to Statista. This expansion has been driven by the financing needs of individuals and small businesses that struggle to access credit from traditional banks. However, despite this growth, over 40% of Peruvian fintechs reported annual revenues of less than USD500,000 in 2023, indicating a landscape still dominated by smaller players. The use of open finance, APIs, and cloud computing has been instrumental in shaping the industry, with nearly half of fintechs leveraging these technologies, while AI adoption is also rising, with 30% of fintechs integrating it into their operations.

Foreign exchange services remain a key part of the fintech ecosystem, facilitating digital currency exchanges and offering competitive rates that reduce dependency on traditional financial entities.

Payments and remittances continue to drive fintech growth, with digital payment platforms processing millions of transactions daily. Regulatory advancements in interoperability have played a crucial role in enhancing the efficiency and accessibility of these services.

Fintech as a Service (FaaS) has emerged as an essential component of financial innovation, providing technological infrastructure for digital banking, embedded finance, and automation of financial services. This segment enables both fintech start-ups and traditional institutions to offer financial products more seamlessly.

Other fintech verticals, such as crowdfunding, insurtech, trading and capital markets, digital banking, credit scoring and fraud prevention, and wealth management, are present but have demonstrated more moderate growth. Crowdfunding, in particular, faces regulatory constraints that have limited its adoption despite its potential to support alternative financing models.

Insurtech remains one of the least developed fintech verticals in Peru, despite the country’s low insurance penetration. This represents an opportunity for both new and traditional players to leverage technology to expand microinsurance solutions, making financial protection more accessible to underserved populations.

Overall, while some fintech verticals dominate the market, others still have untapped potential. The ongoing evolution of regulatory policies, technological advancements, and increased consumer adoption will continue to shape the future trajectory of Peru’s fintech ecosystem.

Fintech business models in Peru do not have specific regulations, unlike in countries like Mexico or Chile with dedicated fintech laws. Instead, different regulations may apply depending on the business model.

In general, fintech companies are not subject to regulation unless they conduct activities that need prior authorisation, such as financial intermediation, which requires authorisation from the Peruvian banking regulator (Superintendencia de Banca, Seguros y AFP – SBS), or securities intermediation, which requires authorisation from the Peruvian securities market regulator (Superintendencia del Mercado de Valores – SMV).

Financial intermediation, as defined by the Banking Law, involves collecting funds in any form and placing them through transactions permitted by law. Securities intermediation, as per the Securities Market Law (Ley del Mercado de Valores), involves regularly performing operations such as purchasing, selling, placing, distributing, or negotiating securities on behalf of others. It also includes acquiring securities for one’s account with the intention of later placing them with the public and receiving a price differential.

Some fintech business models require registration with the Peruvian financial intelligence unit (Unidad de Inteligencia Financiera – Perú – UIF-Perú) to comply with anti-money laundering and counter-terrorism financing regulations, such as exchange houses or online lending platforms. Additionally, digital wallets using quick-reference (QR) codes must register with the Peruvian central bank (Banco Central de Reserva del Perú – BCRP).

Certain fintech models, like financial leasing or factoring, do not require SBS authorisation, provided they don’t exceed established regulatory thresholds. In the case of factoring and financial leasing, companies conducting these activities are not subject to the Banking Law, as long as their accounting balance remains below PEN800 million, and they do not belong to a financial or mixed conglomerate, which includes at least one multiple operations company or insurance company. However, these companies must register with the SBS and submit periodic reports on their operations’ accounting balance, among other requirements.

The following is a general description of the applicable regulation for the main fintech verticals in Peru.

Currency Exchange

In accordance with the Political Constitution of Peru, free possession and disposal of foreign currency is guaranteed. Thus, the free possession, use and internal and external disposition of foreign currency by individuals and legal entities residing in the country is allowed. Likewise, it is established that the exchange rate for foreign currency transactions is fixed by supply and demand.

Considering this, any person may engage in the purchase and sale of foreign currency. However, in applying the provisions on the prevention of money laundering and counter-terrorism financing, natural persons with businesses or legal entities engaged in the purchase and sale of foreign currency or foreign currency are required to register in the “Register of Companies and Persons Engaged in Financial or Currency Exchange Operations”.

This registry is unique, mandatory, and public; and is administered by the SBS. Registration is valid for seven years, counted from the date of registration, after which it will expire, unless it is renewed within 30 days prior to the expiration date.

It should be noted that failure to comply with the registration will result in the closing of the premises until the registration is regularised. Likewise, the Regulation of Infractions and Sanctions for the Prevention of Money Laundering and Financing of Terrorism establishes sanctions that may be imposed for the commission of a minor infraction, a serious infraction, or a very serious infraction, which range from a sanction to a fine of up to 100 UIT.

Lending/Online Lending

In the case of companies that grant loans and do not collect savings from the public (ie, do not engage in financial intermediation), they do not require authorisation from the SBS (except in the case of credit companies, which is a type of company in the financial system that grants loans with its own capital). However, such companies must register in the “Register of Companies and Persons Engaged in Financial or Currency Exchange Operations”.

Failure to comply with the registration is subject to the same sanctions that apply for currency exchange companies.

Likewise, such companies must observe the provisions on maximum interest rates applicable to them, since they are not companies of the financial system, as further explained in 2.4 Variations Between the Regulation of Fintech and Legacy Players.

Crowdfunding

In Peru, crowdfunding is regulated by the SMV through Resolution SMV No 021-2017-SMV/01. This regulation establishes the requirements for crowdfunding platforms to operate legally in Peru and sets out the obligations of both the platforms and the issuers seeking funding through them.

Under the regulation, crowdfunding platforms must register with the SMV and meet certain requirements related to their corporate governance, risk management, and operational procedures. They must also provide investors with clear and accurate information about the investment opportunities available on the platform, including the risks associated with investing in them.

Issuers seeking funding through crowdfunding platforms must also comply with certain requirements, including the disclosure of relevant information about their business and the investment opportunity, as well as the use of funds raised through the platform.

Overall, the crowdfunding regulation in Peru seeks to promote the development of alternative sources of financing for small and medium-sized enterprises, while protecting investors from fraud and other risks associated with investing in these types of opportunities.

Digital Banking

Digital banking activities are subject to the same provisions as traditional banking. As a result of an amendment introduced to the Banking Law in 2022, companies in the financial system (which includes banks) are allowed to carry out digitally any of the operations for which they are authorised.

Payments

The BCRP has instituted a range of rules and guidelines to ensure the proper operation and security of payment systems in Peru, including the Payment System and Securities Settlement Law (Ley de los Sistemas de Pagos y de Liquidación de Valores) and its accompanying regulations.

The Payment System and Securities Settlement Law applies to Payment and Securities Settlement Systems, System Administrators, Participants, Settlement Agents, guarantees within the system’s framework, as well as entities providing technological support. Additionally, it applies to Payment Agreements and Settlement Agreements and Securities Settlement Agreements that have not been recognised as Payment or Securities Settlement Systems.

This law empowers the BCRP to establish rules, regulations, principles, and standards applicable to payment agreements and payment service providers, as well as oversee their compliance. The law defines payment agreements as arrangements or procedures for transferring funds among participants, involving at least three entities, with a minimum of one being a part of the financial system.

Payment agreements include the Electronic Money Payment Agreement, which is a set of agreements or procedures for processing electronic money transfer orders and carrying out electronic money clearing, as well as settling obligations between electronic money issuers resulting from the clearing process. Additionally, the BCRP has established the card payment agreement, which is a collection of agreements or procedures for executing card payment services under the rules and regulations set by payment networks, encompassing both issuing and acquiring activities.

Insurtech

Insurance activities such as those that may be carried out by insurtech business models are subject to the same provisions that are applicable to insurance companies, as well as to insurance intermediaries and auxiliaries. Also, because of an amendment introduced to the Banking Law (which is also applicable to insurance companies) in 2022, insurance system companies are allowed to digitally perform any of the operations for which they are authorised.

In Peru, there is no specific regulation for fintech compensation models. Fintech companies in Peru can use various compensation models to charge their customers, depending on the services they provide.

However, fintech companies that provide credit services and are not part of the financial system (ie, that are not institutions supervised by the SBS) must observe the interest rate limits applicable to transactions between companies that are not part of the financial system.

Likewise, and no less important, the Código de Protección y Defensa del Consumidor (Consumer Protection and Defence Code) also contains provisions that are applicable to companies that provide credit services and that are not supervised by the SBS. Among these provisions are those referring to the determination of the interest rate, as well as the obligation to publicise the annual effective cost rate (Tasa de Costo Efectivo Annual – TCEA), in accordance with the parameters established by the SBS. Likewise, it is established that the charging of commissions and expenses must imply the rendering of an effective service, duly justified, and be supported by a real and demonstrable expense for the service provider.

Additionally, the regulation recently published by the BCRP regarding the interoperability of payment services establishes that the criteria for charging fees and commissions for offering interoperable payment services must be transparent, non-discriminatory and reflect a real and demonstrable cost in order not to limit the access and use of these services. Likewise, the regulation of card payment agreements, also published by the BCRP, establishes, as one of its principles, the dissemination and transparency of commissions and fees, so that card payment agreement participants and end users understand the commissions and costs associated with the card payment service.

Regulation of fintech and legacy players (traditional financial institutions) can vary significantly. As mentioned in 2.2 Regulatory Regime, fintech business models in Peru are not subject to regulation unless they engage in activities such as financial intermediation or securities intermediation. However, the regulations applicable to them are scattered across various regulations, as Peru does not have a specific regulation applicable to fintech companies, as is the case in other jurisdictions.

Due to the type of activity, companies engaged in financial intermediation or securities brokerage are subject to greater regulation, including those related to the treatment and mitigation of risks or capital requirements.

From a tax point of view, income received by banking companies, finance companies and other financial institutions authorised to operate by the SBS, for commissions and interest, are not subject to general sales tax.

It should also be noted that financial system companies may freely set the interest rates they charge for their operations, except in the case of consumer loans, low consumer loans (those whose amount is equal to or less than 2 UIT) and loans for small and micro-enterprises, for which they must observe the maximum interest rates set by the BCRP, following a regulatory amendment introduced in 2021 (previously, there were no interest rate limits for financial system companies). In the case of fintech companies, they must observe the maximum interest rates set by the BCRP.

Likewise, as described in 2.5 Regulatory Sandbox, the sandbox is only available to financial system companies, insurance companies and specialised companies (which are companies that carry out a specific activity of all those that can be carried out by financial system companies), as well as those companies undergoing incorporation that have an organisation authorisation to become a financial system company, insurance company or specialised company. Consequently, fintech companies cannot apply to the regulatory sandbox, unless they even have an organisational authorisation granted by the SBS.

Peru has a regulatory sandbox, as provided in the Banking Law and the Reglamento para la realización temporal de actividades en modelos novedosos (the “Sandbox Regulation”), issued by the SBS.

The Banking Law allows the SBS to establish, within the scope of its supervisory functions, the temporary performance of any operation or activity through innovative models, being able to grant exceptions to the regulation that applies to natural or legal persons who carry out such operations or activities, as well as regarding the other necessary provisions for their development.

As provided in the Sandbox Regulation, companies of the financial system (which includes banks and other financial institutions), insurance companies, specialised companies, and private pension fund administrators may apply to the sandbox. Companies undergoing incorporation that have an organisation authorisation granted by the SBS may apply to the sandbox.

The Sandbox Regulation allows companies to carry out pilot tests, temporarily, of innovative models based on activities contemplated in the current regulatory framework, and for which they are authorised by the SBS.

Pilot tests that require the relaxation of normative requirements under the SBS’s competence for their development or that are referred to innovative models based on activities not contemplated in current regulations may be carried out with prior authorisation from the Superintendence, through one of the following regimes:

• flexibility – for pilot tests of innovative models based on activities contemplated in the current regulatory framework that require the temporary relaxation of one or more normative requirements; and
• extraordinary – for pilot tests of innovative models based on activities not contemplated in the current regulatory framework.

Likewise, companies undergoing incorporation may carry out pilot tests under the Flexibility Regime, with prior authorisation from the SBS.

Furthermore, companies may carry out any activity for which they are authorised in the SBS regulatory framework digitally. Additionally, the performance of pilot tests can help, but it is not a precondition, to the development of regulatory adaptations that may be necessary to allow and facilitate innovation.

The fintech industry in Peru is regulated by multiple authorities, each with specific areas of responsibility. The SBS and SMV are the primary regulators for fintech companies, while INDECOPI and BCRP play complementary roles in the sector.

Superintendencia de Banca, Seguros y AFP

The SBS is responsible for regulating and supervising financial institutions, insurance companies, and pension fund administrators. Its main objectives include protecting the public interest, ensuring the financial stability of the institutions it oversees, enforcing the Ley General del Sistema Financiero y del Sistema de Seguros y Orgánica de la Superintendencia de Banca y Seguros (the “Banking Law”) and its regulations, and leading and supervising the anti-money laundering system.

Superintendencia del Mercado de Valores

The SMV regulates and supervises the securities market in Peru, including the activities of stock exchanges, brokerage firms, and other participants. Fintech companies involved in the securities market, such as crowdfunding platforms, are subject to SMV’s oversight. The regulator aims to ensure transparency, protection of investors, and the proper functioning of the securities market.

Banco Central de Reserva del Perú

BCRP is the central bank of Peru, responsible for conducting monetary policy, managing foreign reserves, and ensuring the stability of the country’s financial system. While BCRP does not directly regulate fintech companies, it is involved in the development of policies and regulations that may affect the fintech sector, such as guidelines for payment systems.

Instituto Nacional de Defensa de la Competencia y de la Propiedad Intelectual

INDECOPI is responsible for promoting and protecting free competition, intellectual property rights, and consumer protection across various industries in Peru. While it does not specifically regulate the fintech sector, it has jurisdiction over fintech companies in matters related to unfair competition, consumer protection, and intellectual property.

Unidad de Inteligencia Financiera-Perú

The Unidad de Inteligencia Financiera – Perú (UIF-Perú) is the financial intelligence unit of Peru, responsible for preventing and detecting money laundering and terrorist financing activities in the country. The UIF-Perú plays an important role in fintech activities by supervising and regulating the compliance of fintech companies with AML and CFT regulations. In addition, the UIF-Perú provides guidance and training to fintech companies to help them understand and comply with AML and CFT regulations. This guidance can include best practices for customer due diligence, transaction monitoring, and reporting of suspicious activities.

Autoridad de Protección de Datos Personales

The Autoridad de Protección de Datos Personales (APDP) is another important regulator in the context of the fintech industry in Peru. The APDP is responsible for overseeing the protection of personal data and ensuring compliance with data protection laws and regulations.

The APDP enforces the Personal Data Protection Law (Ley de Protección de Datos Personales) and its regulations, aiming to guarantee the privacy and protection of personal data of individuals. In the fintech industry, companies often collect, store, process, and share large amounts of personal data. As a result, fintech companies must comply with the data protection regulations set forth by the APDP.

Depending on the specific services offered by a fintech company, other regulators or government agencies may be involved, such as the Ministry of Communications and Transport for issues related to telecommunications or the Ministry of Foreign Trade and Tourism (MINCETUR) for fintech activities related to the gambling industry.

Regulators in Peru do not commonly issue no-action letters in the same manner as regulatory agencies in jurisdictions such as the United States. However, the Superintendencia del Mercado de Valores (SMV) and the Superintendencia de Banca, Seguros y AFP (SBS) may provide informal guidance or clarifications regarding regulatory matters upon request. These responses do not carry the legal certainty of a no-action letter but may help industry participants understand regulatory expectations. Companies seeking formal regulatory clarity typically engage in direct consultations or regulatory sandbox programmes to test their business models in a controlled environment.

Generally, financial system and capital market companies may outsource several of the functions and responsibilities established in the applicable regulations; however, they assume full responsibility for the results of those processes outsourced to third parties and may be sanctioned for non-compliance.

Entities Subject to the Supervision of the SBS

Financial institutions may outsource several functions to third-party vendors. However, this activity is regulated by the SBS, which must be informed of such arrangements and, in certain cases, authorise them (eg, in case of outsourcing of the internal audit service or data processing abroad) and may carry out inspections of the premises and activities of the vendors. Despite this, the outsourcing of regulated functions does not release a financial institution from its obligations vis-à-vis its clients and the SBS.

Entities Subject to the Supervision of the SMV

For entities under the supervision of the SMV, outsourcing regulations exist, requiring them to establish formal policies and procedures for assessing risk levels and implementing control mechanisms throughout the entire outsourcing period. It is important to note that these entities assume full responsibility for all outsourced services, activities, and related management decisions.

In the case of significant cloud outsourcing, entities must possess access and audit rights and implement data and system security measures. They should also consider aspects related to data location, data processing location, chain outsourcing (when the outsourced provider subcontracts parts of the service to other providers) and develop well-defined business continuity plans and exit strategies.

Fintech providers in Peru are under no specific legal obligation to act as gatekeepers for the activities conducted on their platforms. However, they must comply with AML regulations, which may require them to monitor transactions and report suspicious activities.

When the scope of the services provided by fintech companies is not well defined or fintech companies engage in activities that fall within the scope of the Banking Law or the Securities Market Law, without the corresponding authorisations, both the SBS and the SMV may initiate investigations which could give rise to the imposition of administrative and criminal sanctions.

In the case of data protection regulations, enforcement actions by the APDP may include fines, sanctions, or orders to implement corrective measures for failing to comply with data protection requirements, such as obtaining consent from data subjects, implementing adequate security measures, or providing notification of data breaches.

In the case of INDECOPI, enforcement actions against fintech companies may include fines, sanctions, or orders to cease and desist from engaging in unfair competition, deceptive advertising, or violations of intellectual property rights.

In the case of BCRP, enforcement actions against fintech companies that fail to comply with the regulations issued by such governmental authority may include fines.

Personal Data Protection

Personal data protection provisions in Peru are primarily governed by the Personal Data Protection Law and its regulations. This law establishes the legal framework for the protection of personal data, including the processing, use and transfer of such data by individuals and entities.

The law requires that personal data be collected and processed in a lawful, fair and transparent manner, and that individuals be informed of the purpose for which their data is being collected and used. It also establishes the rights of individuals to access, correct and delete their personal data, and to object to its processing in certain circumstances.

In addition, the law requires that entities that process personal data implement appropriate technical and organisational measures to ensure the security of such data and prevent its unauthorised access, use or disclosure. Entities are also required to obtain the consent of individuals for the processing of their personal data in most cases.

The National Authority for the Protection of Personal Data (Autoridad Nacional de Protección de Datos Personales or ANPD) is the regulatory agency responsible for overseeing compliance with the Personal Data Protection Law and enforcing its provisions. The ANPD is authorised to impose sanctions and fines for non-compliance with the law.

Consumer Protection

Consumer protection in Peru is governed by the Consumer Protection Code (Código de Protección y Defensa del Consumidor) and its regulations. This law establishes the legal framework for consumer protection in Peru and provides a set of rights for consumers.

The Consumer Protection Code requires that businesses provide consumers with clear and accurate information about products and services, including pricing, terms and conditions, and any limitations or restrictions. It also requires that businesses not engage in deceptive or misleading practices, and that they provide adequate after-sales support and customer service.

Digital and Electronic Signature

Digital and electronic signatures in Peru are governed by the Electronic Signature Law (Ley de Firmas y Certificados Digitales) and its regulations. This law establishes the legal framework for the use of electronic signatures in the country and provides guidelines for their use and recognition.

In addition to regulators, other key players are actively involved in the sector. The most important fintech companies are grouped into different industry associations, some of which focus on specific verticals, such as lending (Perú Lending) and payments (Perú Payments), while others have a broader scope, such as the Asociación Fintech del Perú.

The interests of various financial institutions are represented by organisations like the Asociación de Bancos del Perú (ASBANC), the Asociación de Instituciones de Microfinanzas del Perú (ASOMIF), the Federación Peruana de Cajas Municipales de Ahorro y Crédito (FEPCMAC), and the Federación Nacional de Cooperativas de Ahorro y Crédito del Perú (FENACREP).

Additionally, several organisations promote the adoption and development of blockchain technology in its various applications.

In Peru, companies authorised to operate by the SBS or the SMV are allowed to carry out only those activities for which they have received proper authorisation. As a result, even if these companies conduct some activities digitally or develop business models that align with various fintech verticals, it does not imply that their overall operations are exempt from regulation for products and services without specific regulations.

On the other hand, fintech companies that do not possess authorisation to operate granted by a governmental authority may offer a combination of regulated and unregulated products and services. The regulatory framework for fintech companies in Peru continues to evolve, and some services may not be covered under the current regulatory scope, while others might be subject to regulations from the SBS or other regulatory bodies.

Fintech companies providing both regulated and unregulated services might adopt different approaches to structuring their businesses. Some may opt to operate under a single legal entity that offers all products and services (and secures relevant registrations for verticals where registration is mandatory), while others may decide to establish separate legal entities for distinct types of services to manage risks or comply with specific regulatory requirements (for instance, by creating separate legal entities for verticals that require registration).

AML and sanctions rules significantly impact both regulated and unregulated fintech companies, imposing compliance obligations that affect their business models.

In Peru, the AML and sanctions rules follow the standards imposed by the Financial Action Task Force (FATF).

Peru allows foreign financial service providers to offer otherwise regulated products and services to local clients without triggering domestic regulations, provided that the engagement is genuinely initiated by the client without any form of active marketing, solicitation, or promotion in the country.

There are no specific regulations governing robo-advisers. The existing legal framework for legacy players focuses on human-provided investment advice, which does not imply that robo-advisers are restricted.

Legacy players operate within the existing legal framework, and while robo-advisers are gaining popularity among investors, the adoption of robo-adviser solutions by traditional players has not yet become widespread.

At present, there are no specific rules or guidance pertaining to robo-advisers regarding the best execution of customer trades.

In the case of fiat currency loans granted by financial system companies (authorised by the SBS) or fintech companies (required only to be registered with the SBS), the primary distinction lies in the fact that loans classified as consumer and small business loans for individuals are subject to maximum interest rate limits imposed by the lender. Financial system companies, when offering loans not subjected to these maximum interest rates, can independently determine the interest rate to be charged, while fintech companies must still adhere to the maximum rates established by the BCRP, as outlined in 2.4 Variations Between the Regulation of Fintech and Legacy Players.

Additionally, companies within the financial system face more extensive regulations and must comply with provisions related to the establishment of provisions, debtor credit classification, and other requirements applicable to them as entities supervised by the SBS.

Lastly, as discussed in 2.4 Variations Between the Regulation of Fintech and Legacy Players, there are notable differences in the tax treatment applied to loans provided by financial system companies compared to those not part of the financial system. It is important to highlight that this discrepancy (whereby credit services offered by financial system companies are not subject to general sales tax) carries financial significance and has led some companies to consider the advantages of becoming a credit company (Empresa de Créditos). As a type of financial system company that does not take public savings, credit companies are exposed to a lesser regulatory burden.

There is no specific regulation that dictates the underwriting processes used by industry participants. In general, online lenders in Peru use a variety of underwriting processes to assess the creditworthiness of potential borrowers. These may include the use of credit scoring models, analysis of financial statements, and review of other relevant data, such as employment history or educational background.

Some online lenders may also use alternative data sources, such as social media activity or mobile phone usage patterns, to supplement traditional credit data in their underwriting processes.

The specific underwriting process used by online lenders may vary depending on the lender’s business model and target market. However, regardless of the process used, online lenders are expected to comply with relevant consumer protection laws and regulations, including those related to fair lending practices and data privacy.

In Peru, the fintech industry has several sources of funds for loans, including peer-to-peer (P2P) lending, lender-raised capital, taking deposits, and securitisations. Each of these sources has its own legal and regulatory issues associated with it.

• P2P lending – P2P lending platforms connect borrowers with individual or institutional lenders. These platforms are required to comply with regulations set by the SBS. The SBS has specific guidelines for P2P lending platforms, which include registration, reporting requirements, and disclosure of information. Additionally, P2P platforms should comply with AML and CFT regulations, as well as consumer protection and data protection laws.
• Lender-raised capital – fintech lending companies have the option to raise capital from investors such as venture capital firms, private equity funds, or other institutional investors. However, if they choose to do so through a public offering, they must comply with securities regulations set by the SMV. These regulations include disclosure requirements and filing the necessary documentation.
• Taking deposits – financial institutions authorised to enter financial intermediation activities are allowed to take deposits from the public in Peru. Fintech companies that want to accept deposits need to obtain a licence from the SBS and comply with its regulations, including capital requirements, risk management, and reporting obligations.
• Securitisations – fintech companies have the option to use securitisation as a source of funds by pooling loans into securities and selling them to investors. However, if they choose to do so through a public offering, securitisations are subject to regulations set by the SMV. These regulations include registration and disclosure requirements.

Each source of funds for loans in the Peruvian fintech industry comes with its own set of legal and regulatory challenges. Fintech companies must comply with the regulations set by various authorities, such as SBS, SMV, INDECOPI, BCRP, and the APDP, depending on the type of services they provide and the source of funds they use. Compliance with these regulations is essential for maintaining a stable, transparent, and competitive fintech lending market in Peru.

While not representing traditional loan syndication, crowdlending platforms (which facilitate loans funded by multiple investors via the platform) can be considered a form of loan syndication. See 2.2 Regulatory Regime.

Also, while not a syndication per se, it is not uncommon for fintech companies that provide loans to transfer all or part of their loan portfolio to investment funds that invest in this asset class. In addition, there has recently been a growing interest in asset securitisation structures, which allow fintech companies that make loans to transfer the risk derived from the placement of such loans to investors, typically through private offerings.

Payment processors are generally expected to use existing payment rails but can also create or implement new payment rails.

There are no explicit provisions in Peru that prohibit cross-border payments or remittances.

In the context of remittances, the Banking Law categorises funds transfer companies as complementary and related service companies. These companies are required to secure authorisation from the SBS to establish and operate in the country. Complementary and related service companies offer services that support or are connected to those provided by entities within the financial system.

Funds transfer regulations identify “funds transfer companies” as businesses that, according to their bylaws, primarily aim to offer the public the service of receiving fund transfer orders based on the payer’s instructions and/or making funds accessible to beneficiaries. Funds transfer activities can be performed either as a representative of international companies or independently via agreements with foreign correspondent companies.

Exchanges and trading platforms are subject to SMV regulation, as provided in the Securities Market Law. Apart from the conventional exchanges and markets that are regulated by the Securities Market Law, there has been a rise in the formation of crowdfunding platforms where individuals in need of financing are linked with those willing to provide it. Additionally, a considerable number of crypto-asset exchanges have emerged in recent times. For crypto-asset exchanges, see 6.3 Impact of the Emergence of Cryptocurrency Exchanges.

See 6.1 Permissible Trading Platforms.

The rise of cryptocurrency exchanges has pushed Peruvian regulators to consider AML/KYC requirements for crypto service providers. The Decree Supreme 006-2023-JUS has already designated cryptocurrency-related businesses as subjects to AML oversight. However, the absence of a formal licensing framework for crypto exchanges means they operate with limited regulatory clarity. There are ongoing discussions on whether to integrate them into Peru’s financial ecosystem under the supervision of the SMV or SBS.

No listing standards for crypto-assets or virtual assets are provided by Peruvian regulation.

Absent of specific regulation for crypto-assets or virtual assets, no order handling rules apply for crypto-assets or virtual assets.

No regulation regarding peer-to-peer trading platforms exists in Peru.

There are no specific rules permitting or prohibiting payment for order flow in Peru.

In Peru, the Securities Market Law establishes the fundamental principles of market integrity and market abuse that regulate trading. These principles include the quality of information, market transparency, and publicity, and prohibit any acts, omissions, practices, or conduct that could undermine the integrity or transparency of the market.

It is important to note that these provisions only apply to public securities offerings and their issuers, as defined by the Securities Market Law. Currently, no specific regulations apply to crypto-assets or virtual assets in Peru.

There is currently no specific regulation governing the creation and use of High-Frequency and Algorithmic Trading, and the SMV does not provide a specific definition for regulatory purposes. While it appears that High-Frequency and Algorithmic Trading is not currently being practised in Peru, in the absence of specific regulations, High-Frequency and Algorithmic Trading would be subject to general regulatory oversight.

Since there is no specific regulation that applies to High-Frequency and Algorithmic Trading, there are no specific rules requiring traders who use these strategies to register as market makers when functioning in a principal capacity.

There is currently no specific regulation that applies to the creation or use of High-Frequency and Algorithmic Trading. As a result, there is no regulation that distinguishes between funds and dealers who engage in these types of transactions.

In Peru, there is no specific regulation that applies to programmers who create trading algorithms and other trading tools. However, computer programs are considered protected works under the Copyright Law (Ley de Derechos de Autor). According to this law, computer programs are protected in the same way as literary works, and this protection extends to all forms of expression, including both operating systems and applications, whether in the form of source code or object code.

Each distinct type of insurance, such as life, property and casualty, is subject to its own unique regulations. These regulations are governed by the Banking Law, which encompasses provisions applicable to insurance companies, as well as any supplementary regulations established under the same law.

Each distinct type of insurance, such as life, property and casualty, is subject to its own unique regulations. These regulations are governed by the Banking Law, which encompasses provisions applicable to insurance companies, as well as any supplementary regulations established under the same law.

Regtech providers are not regulated by Peruvian law. Regtech providers are commonly hired by financial entities to help them comply with regulatory requirements. See 2.8 Outsourcing of Regulated Functions.

While contract terms can be freely negotiated with regtech suppliers, there are legal provisions governing subcontracting processes. See 2.8 Outsourcing of Regulated Functions.

Numerous traditional players in Peru are employing or contemplating the implementation of blockchain technology to enhance information processing, management and storage. Additionally, they aim to automate specific procedures, conduct cross-border transactions, and tokenise and exchange financial instruments.

Peru has not implemented specific regulations or proposals related to blockchain. However, the government and regulators have shown interest in leveraging the potential benefits of blockchain for various sectors of the economy.

The BCRP has been closely observing developments in the blockchain and cryptocurrency space. While they have not imposed strict regulations on the use of blockchain, they have issued warnings about the risks associated with cryptocurrencies. The BCRP has also been studying central bank digital currencies (CBDCs) and their potential role in the financial system.

The Peruvian government is exploring the use of blockchain technology to enhance transparency and efficiency in public administration. For instance, there have been discussions about implementing blockchain-based solutions for public procurement processes and property registration.

It is worth mentioning that the PERÚ COMPRAS (Peru’s public procurement central) implemented the registration of digital purchase orders on a blockchain. Through the tokenisation of purchase orders, PERÚ COMPRAS aimed to ensure transparency and fight corruption in public procurement.

The topic of the application of blockchain technology in property registration was explored during the Annual Congress of Registry Law. This event, organised by SUNARP (the National Superintendence of Public Registries), serves as an academic platform aiming to foster research, reflection, analysis and the exchange of knowledge and experiences within the realm of registry practices.

In addition, the government has chosen to launch initiatives like Cadena, which concentrates on the authorised economic operator certificates’ exchange, with the aim of validating procurement orders and tendering documents from Peru Compras and the OSCE (Organismo Supervisor de las Contrataciones del Estado, which is the supervisory body for state contracting).

Peru has participated in regional discussions and initiatives around blockchain technology and its potential applications. Also, Peru participates in the Ministerial Conference on the Information Society in Latin America and the Caribbean, in which the Digital Agenda for Latin America and the Caribbean (eLAC) are approved, which includes areas of action such as the adoption of emerging technologies and digital transformation.

In addition, various private sector players in Peru have been experimenting with blockchain technology in different industries, such as agriculture, supply chain management and energy. These initiatives might prompt regulatory authorities to consider formulating specific regulations for blockchain in the future.

Peru has no specific regulation that explicitly classifies blockchain assets as regulated financial instruments. However, the SMV has issued press releases warning the public about the potential risks associated with acquiring virtual currencies, cryptocurrencies or tokens, which do not have the backing of any government entity or financial supervisor. The SMV cautions about the potential risks associated with these assets’ massive offering and promotion, including exposure to fraud and scams, possible use in financing illegal activities like money laundering and terrorism financing, and the high volatility and speculative nature of their prices.

To safeguard the interests of investors, the SMV urges the public to adequately inform themselves before investing in these assets, mainly when transactions are carried out through various electronic or digital communication channels, such as websites, emails, instant messaging services, social networks, and other mass communication channels. The SMV also emphasises the importance of caution and protection for investors, especially when acquiring financial instruments associated with these assets.

There is no specific regulation applicable to issuers of blockchain assets. See 10.5 Regulation of Blockchain Asset Trading Platforms.

There is no specific regulation applicable to blockchain asset trading platforms, such as cryptocurrency exchanges. However, by means of Supreme Decree No 006-2023-JUS, published on 27 July 2023, Virtual Asset Service Providers (VASPs) (which would include cryptocurrency exchanges) were incorporated as obligated subjects to report to the UIF-Peru for the purposes of preventing AML regulations.

In terms of secondary market trading of blockchain assets, there is no specific regulation in Peru. The Peruvian government has not yet established any rules for the purchase, sale or exchange of cryptocurrencies through intermediaries or peer-to-peer. As such, individuals engaging in secondary market trading of blockchain assets should be aware of the risks involved and take appropriate precautions.

There is no specific regulation governing staking services for cryptocurrencies in Peru.

There is no explicit regulation on lending services related to cryptocurrencies in Peru.

Currently, there is no specific regulation governing the offering of cryptocurrency derivatives in Peru.

There are no specific regulations governing DeFi in Peru.

Currently, there are no specific regulations in Peru on investment funds or collective investment schemes that invest in blockchain assets. In general terms, investment funds may invest in instruments, financial operations and other assets, in accordance with the provisions of their participation regulations and the contract signed with the respective participant.

There is no specific definition applicable to virtual currencies in Peru.

NFTs and NFT platforms are not currently regulated in Peru.

To date, there is no specific regulation on open banking or open finance in Peru. However, in March 2022, a bill to declare the implementation of a policy that promotes the massification of open banking as a matter of national interest and public need was presented in the congress.

During the consultation process for this bill, various institutions provided feedback. The SBS considered it important to implement an open finance model in the country, instead of just open banking, as it would be more beneficial for users of financial services in the long term. The BCRP, on the other hand, highlighted the potential benefits of open banking, including the empowerment of the end customer, promoting innovation and competition, potentially reducing interest rates (by allowing the exchange of customer information between banks and other agents), and expanding credit and financial inclusion. The banking sector, through ASBANC, welcomed the initiative, stating that it would promote greater access to financial services, increase financial inclusion, and provide customers with more opportunities to learn about different financial products and choose the one that best suits their needs, promoting market competitiveness.

Overall, while there is no specific regulation on Open Banking in Peru, there are ongoing discussions and initiatives towards its implementation. The feedback received from different institutions highlights the potential benefits of open banking or open finance and the need for effective regulation to support its growth and adoption in the country.

Some concerns raised by stakeholders in Peru regarding open banking include data privacy and security, as customers worry about the safety and privacy of their personal and financial information when shared with third-party providers. Additionally, concerns over customer consent highlight the need for transparent consent mechanisms to prevent unintentional data sharing. Market concentration is another issue, with some stakeholders fearing that open banking could reduce competition and negatively impact smaller financial institutions. Furthermore, implementation challenges may arise due to the significant technological and regulatory changes required, which could be particularly difficult for smaller institutions and start-ups. Additional barriers involve the expansion of the technological environment and the need for improved financial literacy and digital culture among banking service users.

Fraud in the financial services and fintech sectors in Peru generally involves deception, misrepresentation, or unlawful financial gain.

It is difficult to assess the full extent of regulatory efforts in fraud prevention, as there is no single authority overseeing fintech companies in Peru, except for those engaged in financial intermediation or securities market activities. However, in recent months, there has been a noticeable rise in identity theft cases, particularly involving digital loans, where fraudulent actors use stolen identities to obtain credit. These cases are typically reported to and handled by INDECOPI, the national consumer protection authority. Additionally, there are increasing instances of friendly fraud, where consumers dispute legitimate transactions to obtain refunds, presenting challenges for fintech service providers in distinguishing between genuine fraud and abusive chargebacks.

A fintech service provider’s liability for customer losses depends on the nature of the fraud and applicable consumer protection laws.