Regulatory Alerts2026-02-05 | A 8398Circular RUNOR 1-1946 CREFI 2-142: Minimum Requirements for the Management and Control of Information Technology and Security Risks. Expansion of Financial Entities. Amendments.
The Central Bank of the Argentine Republic (BCRA) has issued Communication “A” 8398 to amend the Minimum Requirements for Information Technology and Security Risk Management and the Expansion of Financial Entities regulations. The directive incorporates Payment Service Providers (PSPs) as obligated subjects, replaces PRISMA with NEWPAY in the regulatory text, and fully updates Sections 10 and 2 to establish comprehensive third-party management frameworks, prior notification procedures, formalization standards, and monitoring obligations. Financial entities must implement these amendments within 180 calendar days from the communication's publication, ensuring robust risk assessment, continuous supervision, and compliance with international anti-money laundering standards for cross-border outsourcing.