Resolution SBS No. 6523-2013: Approves the Credit and Debit Card Regulations

Los Laureles Nº 214 - Lima 27 - Perú Telf. : (511)6309000 Fax: (511) 6309239 Lima, October 30, 2013 Resolution S.B.S.
No. 6523-2013
The Superintendent of Banks, Insurance and Private Pension Fund Administrators CONSIDERING:
That, Article 221, numeral 34 of the General Law of the Financial System and the Insurance System and Organic Law of the Superintendence of Banks and Insurance, Law No. 26702 and its modifying norms, hereinafter General Law, authorizes financial system companies to issue and administer credit and debit cards, in accordance with what is provided in Chapter I of Title III of the Second Section of the General Law; That, the Credit Card Regulations, approved by SBS Resolution No. 264-2008 and its modifying norms, establishes norms regarding contractual conditions, information reporting and applicable security measures, with special emphasis on the verification of the identity of the holder or user and the establishment of liability limits in the fraudulent use of said cards; That, credit and debit cards constitute a means of payment, a substitute for cash, which has stimulated the intensification of their use, for which reason it is necessary to approve provisions that reinforce the established measures, with respect to the issuance and administration of credit cards and establish similar measures in the case of debit cards; That, likewise, it is necessary to adapt and issue provisions on credit and debit cards, in accordance with what is provided by the Regulations on Transparency of Information and Contracting with Users of the Financial System approved by SBS Resolution No. 8181-2012 and its modifying norms; That, for the purpose of collecting the opinions of users and the general public regarding the proposed modifications to the financial system regulations, the prepublication of the draft resolution on the matter was ordered on the electronic portal of the Superintendence, under the protection of what is provided in Supreme Decree No. 001-2009-JUS; Having the approval of the Adjunct Superintendencies of Banking and Microfinance, Risks and Legal Advice, as well as the User Products and Services Management;

2/19
Los Laureles Nº 214 - Lima 27 - Perú Telf. : (511)6309000 Fax: (511) 6309239 In exercise of the powers conferred by numerals 7, 9 and 19 of Article 349 of the General Law; RESOLVES:
Article First.- approve the Credit and Debit Card Regulations, as indicated below: 1

“CREDIT AND DEBIT CARD REGULATIONS
CHAPTER I
GENERAL ASPECTS
Article 1°.- Scope
This Regulation is applicable to multiple-operation companies, referred to in letter A of Article 16 of the General Law, authorized to issue and administer credit and debit cards, hereinafter companies.

Article 2°.- Definitions
For the purposes of this Regulation, the following definitions shall be considered:

1. Automated Teller Machine (ATM): in accordance with the definition in the Regulations on Opening, Conversion, Transfer or Closure of Offices, Use of Shared Premises, Automated Teller Machines and Correspondent ATMs, approved by SBS Resolution No. 6285-2013 and its modifying norms.
2. Channel: any physical or virtual medium to which the user accesses to carry out monetary operations (internet banking, ATMs, point-of-sale terminals, among others).
3. Minimum Payment Circular: Circular that establishes the provisions regarding the methodology for calculating the minimum payment in credit card credit lines and other revolving modalities for small business, micro-enterprise and consumer credits, Circular No. B- 2206-2012, F- 546-2012, CM-394-2012, CR-262-2012, EDPYME-142-2012.
4. Code: Consumer Protection and Defense Code, approved by Law No. 29571 and its modifying norms.
5. User's habitual consumption behavior: refers to the type of operations that each user usually carries out with their cards, considering various factors, such as the country of consumption, types of commerce, frequency, channel used, among others, which can be determined from the historical information of each user's operations recorded by the company.
6. Contract: document containing all the rights and obligations corresponding to the holder and the companies, including the annexes that establish specific stipulations proper to the financial operation that is the subject of the pact, and which has been duly celebrated by the intervening parties.
7. Days: calendar days.
8. EMV: Europay, Mastercard and Visa card interoperability standard.
   1 As stated in Article Nine of SBS Resolution No. 5570-2019 of 27/11/2019: “For legal purposes, references to regulations or provisions repealed on information transparency, contained in the Credit and Debit Card Regulations approved by SBS Resolution No. 6523-2013, are understood to be replaced by the corresponding provisions of the Market Conduct Management Regulations of the Financial System, approved by SBS Resolution No. 3274-2017.”

3/19
Los Laureles Nº 214 - Lima 27 - Perú Telf. : (511)6309000 Fax: (511) 6309239
9. Authentication Factor: in accordance with the definition indicated in letter j) of Article 2 of the Regulations for the Management of Information Security and Cybersecurity. 2
10. General Law: General Law of the Financial System and the Insurance System and Organic Law of the Superintendence of Banks and Insurance, Law No. 26702 and its modifying norms.
11. Micropayment: operations for insignificant amounts and with a maximum limit, which do not require reinforced user authentication.
3
12. Affiliated businesses: companies or persons who accept credit or debit cards as a means of payment for the products and/or services they offer.
13. Regulations: Credit and Debit Card Regulations.
14. Market Conduct Management Regulations: Market Conduct Management Regulations of the Financial System, approved by SBS Resolution No. 3274-2017 and its modifying norms.
4
15. Superintendence: Superintendence of Banks, Insurance and Private Pension Fund Administrators.
16. Card: credit and/or debit card, as applicable.
5
17. Point-of-sale terminals: access devices such as computer terminals, mobile phones and computer programs, operated by affiliated businesses or users to carry out card operations.
18. Holder: natural or legal person to whom, as a consequence of the celebration of a contract with the companies, a card is delivered.
19. User: natural person who is authorized to use the card.
20. Installment debt: in accordance with the definition of the Minimum Payment Circular. 6
21. Revolving debt: in accordance with the definition of the Minimum Payment Circular. 1
22. Statement date: date on which a billing period closes. On the statement date, the total revolving debt recorded up to that date is determined, the sum of the installments to be paid in the period, the commissions, the expenses, the compensatory interest generated by the revolving debt in the billing period and the default interest applicable in case of non-payment within the period established in the statement of the previous billing period.
17
23. Present card operations: Operations in which the payment instrument interacts with the information capture device. 8
24. Non-present card operations: Operations in which the payment instrument does not interact with the information capture device. 9
25. Cybersecurity Regulations: Regulations for the Management of Information Security and Cybersecurity, approved by SBS Resolution No. 504-2021 and its modifying norms. 10

Article 3°.- Credit card 11
The credit card is a payment instrument that may have physical support or electronic or digital representation and that is associated with one (1) credit line, granted by the issuing company. In accordance with what is established in the respective contract, through the credit card, the holder (or user) can make payment for goods, services or obligations, as well as make use of additional services in accordance with what is established in this regulation.

Article 3-A°.- Types of credit lines 12
The credit line can be:

1. Revolving: That credit line in which amortized amounts are allowed to be reused by the debtor.
2. Non-revolving: That credit line in which amortized amounts are not allowed to be reused by the debtor.

Article 4°.- Debit card 13
The debit card is a payment instrument that may have physical support or electronic or digital representation, which allows carrying out operations charged to previously constituted deposits in the issuing company. Through the debit card, the holder can make payment for goods, services or obligations, make cash withdrawals or make transfers, through the channels made available by the issuing company or other associated services, within the limits and conditions agreed.

CHAPTER II
GENERAL PROVISIONS APPLICABLE TO CREDIT CARDS
Article 5°.- Minimum content of the contract
The credit card contract must contain, as a minimum, the following information:

1. The conditions applicable for the reduction or increase of the credit line and the mechanisms applicable to require the prior consent of the user in case an increase in the line is sought as provided by the Market Conduct Management Regulations, when applicable.
2. Procedures and responsibilities of the parties in case of loss, theft, robbery or burglary of the card, in any of its supports or representations. 14
3. Rights of users to block the card and to terminate the contract; and cases in which companies may proceed to block the card and credit line and to terminate the contract. 15
4. Conditions applicable to the renewal of the contract, if applicable.
5. Frequency with which statements will be made available or delivered.
6. In whose name statements will be issued, holder or user, if applicable.
7. General conditions for the issuance and sending or making available, as applicable, of the statement in physical or electronic form. 16
8. The order of application applicable for the payment of the credit line must be clear and, in the case of contracts celebrated with users under the protection of the Code, it cannot entail a disproportionate worsening of the amount owed by the holder. For this purpose, the application of the payment must consider the guidelines established in article 5-A. 17

For this purpose, the application of the payment must consider the following:
9.1 First it must be applied to cover the minimum payment, considering the components of said concept provided in the Minimum Payment Circular.
9.2 Payment for amounts less than the minimum payment is applied in the manner determined by the companies in accordance with article 87 of the Code. With respect to capital, the payment is applied first to the installment debt, starting with those obligations to which a higher interest rate corresponds, until reaching those to which a lower interest rate corresponds, and subsequently, to the resulting balances of the capital of each revolving debt, divided by the revolving factor, following the descending order described.
9.3 If the amount subject to payment exceeds the minimum payment made in accordance with numeral 9.1, the excess is applied as follows:
(i) First, to the existing revolving debt at the time of payment. In this case, the application is made starting with those obligations to which a higher interest rate corresponds, until reaching those to which a lower interest rate corresponds.
(ii) If the debt indicated in the preceding subsection (i) is fully covered, and there is still a balance to apply, the following must be considered:
a. If the balance is greater than two future installments of that installment operation to which a higher interest rate corresponds, the amount is applied as an advance payment, proceeding to reduce the number of installments with the consequent reduction of the credit term. In case there are two or more future installments with the same interest rate, priority is given to the payment of the oldest one, otherwise, it starts with those obligations to which a higher interest rate corresponds, until reaching those to which a lower interest rate corresponds.

b. If the balance is less than or equal to the equivalent of two future installments of that installment operation to which a higher interest rate corresponds, the amount is applied to the revolving debt incurred, to the interest on said debt and to other charges generated (commissions or expenses), if applicable. If there is no revolving debt, or in case the balance exceeds the revolving debt on the statement date, it is applied to the installments included in the new minimum payment, starting with those obligations to which a higher interest rate corresponds, until reaching those to which a lower interest rate corresponds. 18
9.4 The order of payment application established in the preceding numeral is not applicable when:
18 Numeral 9.3 modified by SBS Resolution No. 6617-2016 published on 12/25/2016, grants an adaptation period until June 30, 2017.

6/19
Los Laureles Nº 214 - Lima 27 - Perú Telf. : (511)6309000 Fax: (511) 6309239 (i) There is effective negotiation; that is, when the holder has been informed about the economic consequences and implications of the negotiated payment allocation rule and the clause containing it does not constitute a mass condition that is part of the adhesion contract and conditions its signing; and it is allowed to evidence that the holder has influenced the content of the clause; or, (ii) The client, on each occasion that payment is made, requests its application in a different order, in which case the company must keep a record of said decision; or, as an advance payment, for which the indication in letter a. of subsection (ii) of numeral 9.3 is applicable. 19
10. The general conditions under which the authorization of the credit line excess operates, which must be fixed up to a reasonable amount that responds, among other criteria, to the holder's payment capacity, as well as to the ordinary profile of this consumption amounts.
11. Information on the provision of the services associated with credit cards indicated in article 7 of the Regulations.
12. General conditions under which the incorporation of the services indicated in article 7 of the Regulations operates, when applicable.
20
12-A. General conditions for carrying out micropayments and associated responsibilities, if this possibility is offered, including the channels in which the maximum amount will be disseminated. 21
13. Others established by the company or the Superintendence, by multiple letter.

Article 5-A°.- Order of payment application 22
The order of payment application must consider the following:

1. First it must be applied to cover the minimum payment, considering the components of said concept provided in the Minimum Payment Circular.
2. Payment for amounts less than the minimum payment is applied in the manner determined by the companies in accordance with article 87 of the Code. With respect to capital, the payment is applied first to the installment debt, starting with those obligations to which a higher interest rate corresponds, until reaching those to which a lower interest rate corresponds, and subsequently, to the resulting balances of the capital of each debt that is paid by applying a revolving factor, divided by the revolving factor, following the descending order described.
3. If the amount subject to payment exceeds the minimum payment made in accordance with numeral 1, the excess is applied as follows:
   (i) First, to the debt that is paid by applying an existing revolving factor at the time of payment. In this case, the application is made starting with those obligations to which a higher interest rate corresponds, until reaching those to which a lower interest rate corresponds. (ii) If the debt indicated in the preceding subsection (i) is fully covered, and there is still a balance to apply, the following must be considered:
   19 Numeral 9.4 modified by SBS Resolution No. 6617-2016 published on 12/25/2016, grants an adaptation period until June 30, 2017.
   20 Numeral substituted by SBS Resolution No. 5570-2019 of 27/11/2019, effective from 01/01/2021.
   21 Numeral incorporated by SBS Resolution No. 5570-2019 of 27/11/2019, effective from 01/01/2021.
   22 Article incorporated by SBS Resolution No. 5570-2019 of 27/11/2019, effective from 01/01/2021.

7/19
Los Laureles Nº 214 - Lima 27 - Perú Telf. : (511)6309000 Fax: (511) 6309239 a. If the balance is greater than two future installments of that installment operation to which a higher interest rate corresponds, the amount is applied as an advance payment, proceeding to reduce the number of installments with the consequent reduction of the credit term. In case there are two or more future installments with the same interest rate, priority is given to the payment of the oldest one, otherwise, it starts by applying the payment to those obligations to which a higher interest rate corresponds, until reaching those to which a lower interest rate corresponds.

b. If the balance is less than or equal to the equivalent of two future installments of that installment operation to which a higher interest rate corresponds, the amount is applied to the debt that is paid by applying a revolving factor incurred, to the interest on said debt and to other charges generated (commissions or expenses), if applicable. If there is no debt that is paid by applying a revolving factor, or in case the balance exceeds the debt that is paid by applying a revolving factor on the statement date, it is applied to the installments included in the new minimum payment, starting with those obligations to which a higher interest rate corresponds, until reaching those to which a lower interest rate corresponds.
4. The order of payment application established in the preceding numeral is not applicable when:
(i) There is effective negotiation; that is, when the holder has been informed about the economic consequences and implications of the negotiated payment allocation rule and the clause containing it does not constitute a mass condition that is part of the adhesion contract and conditions its signing; and it is allowed to evidence that the holder has influenced the content of the clause; or, (ii) The client, on each occasion that payment is made, requests its application in a different order, in which case the company must keep a record of said decision; or, as an advance payment, for which the indication in letter a. of subsection (ii) of numeral 3 is applicable.

Article 6°.- Minimum information, conditions and validity applicable to the credit card 23
Credit cards with physical or digital support are issued as non-transferable and must include as a minimum the following information:

1. Corporate name of the company issuing the credit card.
2. Trade name that the company assigns to the product.
3. Identification of the credit card system (brand) to which it belongs, if applicable.
   The validity period of credit cards cannot exceed five (5) years, shorter expiration periods may be agreed.
   23 Article substituted by SBS Resolution No. 2286-2024, effective from 29/06/2024, with an adaptation period in accordance with article seven of the same SBS Resolution No. 2286-2024.

8/19
Los Laureles Nº 214 - Lima 27 - Perú Telf. : (511)6309000 Fax: (511) 6309239
Article 6-A°.- Contractual termination of the credit card at the cardholder's request 2425
In the event of contractual termination at the request of the credit cardholder, the credit card associated with the account will be cancelled at the time the request is submitted.
Once the card has been cancelled, no new charges may be made, except for those corresponding to transactions in transit prior to the request for contractual termination.
The company must not establish conditions or limitations for the exercise of the right to contractual termination. If it is not possible to effect the termination at the time the request is submitted, the company must block the credit line and inform the user of the procedure to be followed and other applicable aspects. Among these, it must inform the estimated timeframe and channel through which it will communicate: (i) the definitive cancellation of the product; or, (ii) the possibility or impossibility of terminating the contract due to the existence of debt; in which case, payment corresponding to the debt will be requested to proceed with the termination. The credit card contract shall be understood as terminated upon payment of the total debt. Contractual conditions, such as fees, expenses, and interest rates, will remain in effect until the debt is cancelled and the contract is consequently terminated. Upon cancellation of the card, the annual membership fee cannot be charged, unless the annual membership period has elapsed prior to the request for contractual termination made by the cardholder.
Article 7°.- Services associated with credit cards 26
Companies may offer the following additional services:

1. Cash disbursement, giving the cardholder the option to choose, for each operation, whether the disbursement will be financed in installments, and if so, to decide the number of installments.
2. Operations carried out through the internet, from web pages and/or mobile device applications, among others, distinct from those provided by the company.
3. Operations carried out abroad in person.
4. Overdraft or excess of the credit line.
   The possibility of incorporating these services must be informed prior to the celebration of the contract, and the cardholder must be able to enable them at the time of contracting or subsequently, and disable them whenever required, an aspect that must also be informed. The mechanisms for disabling the services cannot be more complex than those used for enabling them. Companies cannot incorporate additional services without the prior consent of the cardholder. Companies that offer the described services must inform users of the applicable conditions and risks associated with their use, including the security measures that users must observe for the use of such services in any of the media or channels, such as ATMs, web pages, mobile devices, among others, as applicable. 24 Article incorporated by Resolution SBS No. 5570-2019 of 27/11/2019. 25 Paragraph modified by Resolution SBS No. 3748-2020 of 10/12/2021. 26 Article replaced by Resolution SBS No. 5570-2019 of 27/11/2019, effective from 01/01/2021.

9/19
Los Laureles Nº 214 - Lima 27 - Perú Telf. : (511)6309000 Fax: (511) 6309239
Article 8°.- Additional credit card
The additional credit card is issued to a user, at the request and under the responsibility of the cardholder, under the contract celebrated with the cardholder and from the same credit line granted to them or part thereof.
The additional credit card to the main card may only be issued when there is express authorization from its cardholder, using the means established by the companies for this effect.
Only the cardholder of the credit line can choose the additional services associated with the additional credit card requested, in accordance with the provisions of Article 7 of this Regulation. The additional services of the additional card, with the exception of overdraft, must be able to be enabled or disabled by the cardholder independently of the additional services of the main card. 27
Article 9°.- Charges associated with credit cards 28
Companies will charge the amount of goods, services, and obligations that the credit card user acquires or pays, as well as the services described in Article 7 of the Regulation, in accordance with the current legislation on the matter, the contract signed between the parties, and the authorization of the credit card user.
Article 10°.- Minimum content of the credit line statement 29
The credit line statement must contain as a minimum the following:

1. Name of the cardholder or user of the credit line.
2. Credit card identification number, understood as, at a minimum, the last four (4) digits of the credit card.
3. Billing period and maximum payment date.
4. Total amount of the credit line and amount available to carry out operations.
5. Total debt balance as of the statement date, for each currency.
6. Nominal annual default interest rate applicable in case of default.
   30
7. Total payment for the period and minimum payment, for each currency.
8. Payments made during the billing period, indicating the date on which they were made and the amount, in each currency, if applicable.
9. List of all operations recorded in the billing period, indicating the type of operation carried out, as well as the date and amount in each currency and the name of the establishment, when applicable. In the case of installment operations, indicate the number of agreed installments, and the number of the installment that corresponds to be paid in the billing period.
10. Amounts of the installments of the installment operations that correspond to be paid in the billing period, broken down indicating the amount corresponding to principal, interest, fees, and expenses, if applicable.
11. Effective annual compensatory interest rate applicable to each operation, whether paid through the application of a revolving factor or in installments. The information will be presented disaggregated by each operation in those cases where the company offers differentiated rates.
12. Date of charging for membership renewal, the period to which it corresponds, and the amount, if charges are made for this concept.
    27 Paragraph modified by Resolution SBS No. 2286-2024, effective from 29/06/2024.
    28 Article replaced by Resolution SBS No. 2286-2024, effective from 29/06/2024, with an adaptation period in accordance with article seven of the same Resolution SBS No. 2286-2024.
    29 Article replaced by Resolution SBS No. 5570-2019 of 27/11/2019, effective from 01/01/2021.
    30 Subparagraph modified by Resolution SBS No. 3748-2020 of 10/12/2021.

10/19
Los Laureles Nº 214 - Lima 27 - Perú Telf. : (511)6309000 Fax: (511) 6309239
13. Breakdown of the minimum payment (in each currency, if applicable), in accordance with the Minimum Payment Circular, showing the amount corresponding to principal, interest, fees, and any other applicable concept. Following this information, it must be indicated in a prominent and easily identifiable manner, that if the customer only makes the minimum payment, they will make a higher payment for the concept of interest, fees, and expenses.
The statement must highlight the information from subparagraphs 3, 4, 5, 6, and 7, as applicable.
The statement may only include information on operations carried out against the credit line.
Article 11°.- Making available or sending and receiving the statement and complaint procedure 31
Companies must send or make available to the holders of the credit line the statement, at a minimum, monthly, through electronic means (by presenting this information through the website, email, among others). Customers may request that the statement be sent through physical means (delivery to the address indicated by the customer), for which companies must maintain a record that allows accrediting this decision. 32 Companies must comply with this requirement within a period of no less than five (5) business days prior to the maximum payment date. If cardholders do not receive the statements in a timely manner, they have the right to request them from the companies and these have the obligation to provide a copy of them, under the conditions established in the contracts, even in those cases where the non-sending was due to the provisions in the following paragraph. Companies and cardholders may agree that the statement will not be sent or made available in the following cases:

1. When there is no debtor balance.

2. In case of default on payment, the obligation of companies to send statements ceases, provided that four (4) consecutive months of default have elapsed. Companies and cardholders may agree on a shorter period than that indicated above.
   Cardholders may observe the content of the statements. The foregoing does not negate the rights of cardholders established in the current legal framework to resort to the corresponding administrative, judicial, and/or arbitral instances.
   CHAPTER III
   PROVISIONS APPLICABLE TO DEBIT CARDS
   Article 12°.- Minimum information, conditions, and validity applicable to debit cards 33
   Debit cards with physical or digital support are issued as non-transferable and must include as a minimum the following information:

3. Corporate name of the company issuing the debit card.
   31 Article modified by Resolution SBS No. 3274-2017-SBS published on 21/08/2017.
   32 Paragraph replaced by Resolution SBS No. 5570-2019 of 27/11/2019, effective from 01/01/2021.
   33 Article replaced by Resolution SBS No. 2286-2024, effective from 29/06/2024, with an adaptation period in accordance with article seven of the same Resolution SBS No. 2286-2024.

11/19
Los Laureles Nº 214 - Lima 27 - Perú Telf. : (511)6309000 Fax: (511) 6309239
2. Trade name that the company assigns to the product.
3. Identification of the debit card system (brand) to which it belongs, if applicable.
The validity period of debit cards cannot exceed five (5) years, and shorter expiration periods may be agreed upon.
Article 13°.- Additional services associated with debit cards 34
Companies may offer the following additional services:

1. Operations carried out through the internet, from web pages and/or mobile device applications, among others, distinct from those provided by the company.
2. Operations carried out abroad in person.
   The possibility of incorporating these services must be informed prior to the celebration of the contract, and the cardholder must be able to enable them at the time of contracting or subsequently, and disable them whenever required, an aspect that must also be informed. The mechanisms for disabling the services cannot be more complex than those used for enabling them. Companies cannot incorporate additional services without the prior consent of the cardholder. Companies that offer the described services must inform users of the applicable conditions and risks associated with their use, including the security measures that users must observe for the use of such services in any of the media or channels, such as ATMs, web pages, mobile devices, among others, as applicable.
   Article 14°.- Charges associated with debit cards 35
   Companies will charge the user's deposit account the amount of goods, services, and obligations that they acquire or pay, as well as the services described in Article 13 of the Regulation, in accordance with the current legislation on the matter, the contract signed between the parties, and the authorization of the debit card user.
   CHAPTER IV
   OTHER ASPECTS APPLICABLE TO CREDIT AND DEBIT CARDS SUBCHAPTER I SECURITY MEASURES APPLICABLE TO CREDIT AND DEBIT CARDS
   Article 15°.- Security measures incorporated in cards
   Cards must have an integrated circuit or chip that allows storing and processing user information and their operations, complying with international interoperability standards for the use and verification of cards, as well as for payment authentication; for which it must comply as a minimum with the security requirements established in the EMV standard, issued by EMVCo. Regarding this, companies must apply, among others, the following measures:
3. Security rules defined in the chips of physical support cards, which must be used to verify the authenticity of the card and validate the user's identity in accordance with the minimum requirements indicated in Article 16 of this Regulation. 36
4. Apply cryptographic procedures on critical data and keys stored in the card chips, as well as on those existing in messages exchanged between cards, point-of-sale terminals, ATMs, and issuing companies.
5. If issuing companies allow offline operation authorization, they must apply a data authentication method that provides adequate security conditions, without affecting the quality and performance of the service provided to the user. Such operations will be carried out in accordance with the limits and conditions agreed with the client, which will include, for example, limits on the number of consecutive offline operations processed.
6. Have mechanisms to apply instructions on the card chips in response to an online transaction, in order to modify established limits according to risk profiles, as well as to block or disable cards that have been lost or stolen.
   The processing of online transactions using the card chip or other mechanisms must include as a minimum the request for authorization made, the response to the request, which must be generated from the company's authorizer system, as well as the indication of having approved or declined the generated transaction; this except in the case of a contractual exception, where approval by the brand is required. When the operation is carried out using the chip or another contactless mechanism, card authentication must use dynamic cryptography, so that it can be verified that there was no alteration of the transaction between the card and the terminal. When using another support other than the physical card, in addition to ensuring authentication mechanisms, it must avoid exposing the card number. 37
   Article 16°.- Security measures regarding users
   Companies must adopt, as a minimum, the following security measures regarding users:
7. Deliver the card and, if applicable, additional cards to the cardholder, except when they have expressly instructed that they be delivered to a different person, after verifying their identity and leaving a record of receipt.
8. If the company generates the first card key or secret number, it must be delivered according to the conditions of the previous subparagraph, obligating its change before carrying out the first operation that requires the use of said key.
9. If the key is used as an authentication method, allow the user to change said key or secret number, as many times as required.
10. For operations carried out against the credit line or previously constituted deposits, the company must enable and provide a notification service for all users so that they are informed of operations carried out with their cards immediately after being registered by the company, through the use of one of the following direct communication mechanisms such as text messages, email, calls, among others, which can be agreed upon with cardholders; this service must be active from the moment of contracting the product. For this service, companies may establish mechanisms through which users can configure or limit notifications based on thresholds or variables such as minimum amounts, among others. Cardholders can request the enablement or disablement of this service at any time, through the mechanisms established by the companies, which cannot be more complex than those offered at the time of the celebration of the contract.
    38
11. Make available to users the possibility to inform the company that they will carry out operations with their card from abroad, before carrying out these operations.
12. In the case of micropayments, operations must be subject to a maximum amount.
    39
13. 40The user authentication process to carry out card operations must be carried out as established in Article 19 of the Cybersecurity Regulation, through factors categorized in letter j) of article 2 of said regulation, and following the technical recommendations of the EMV standards issued by EMVCo, according to the type of operation in question:
    7.1. For present card operations, two factors are required, where the first is the card chip or its digital representation. The second factor can be a secret key (PIN) or another established by the Superintendence.
    7.2. For non-present card operations, two factors are required, where the first are the data contained in the physical or digital representation of the card. The second factor can be a dynamic verification code of the card or another factor verifiable online required from the user within the framework of the EMV 3DS standard, except for exemption cases provided in Article 20 of the Cybersecurity Regulation.
    7.3. For operations with third-party mobile wallets based on card tokenization, the affiliation of the card for the use of this service in accordance with subparagraph 7.2 and the subsequent operations carried out must be authenticated through card tokenization and a second factor of a different nature.
    7.4. The control required in letter b) of article 19 of the Cybersecurity Regulation, against man-in-the-middle attacks, is satisfied through the adoption of EMV 3DS and EMV Tokenization standards for subparagraphs 7.2 and 7.3 of this article, as applicable.
    7.5. For operations where the second factor is not validated due to limitations outside their control, the company must establish acceptance or rejection rules, based on the level of fraud risk, according to the transaction monitoring system described in Article 17 of this regulation. These limitations may be associated with the service terminal, merchant practices, or the technology used by the user.
    Article 17°.- Security measures regarding the monitoring of operations 41
    17.1 Companies must adopt, as a minimum, the following security measures regarding the monitoring of card operations carried out by users:
14. Have operation monitoring systems, distinct from the operation authentication mechanisms established in subparagraph 7 of Article 16 of the Regulation, which have as their objective to detect those operations that do not correspond to the user's usual consumption behavior.
15. Implement procedures to manage alerts generated by the operation monitoring system, which include the scope of this system, the type of information considered as
    38 Subparagraph replaced by Resolution SBS No. 5570-2019 of 27/11/2019, effective from 01/01/2021 39 Subparagraph modified by Resolution SBS No. 3240-2023 of 03/10/2023.
    40 Subparagraph incorporated by Resolution SBS No. 2286-2024, effective from 29/06/2024, with an adaptation period in accordance with article seven of the same Resolution SBS No. 2286-2024.
    41 Subparagraph modified by Resolution SBS No. 3289-2025 of 19/09/2025.

14/19
Los Laureles Nº 214 - Lima 27 - Perú Telf. : (511)6309000 Fax: (511) 6309239 fraud patterns, the circumstances that determine when an operation is atypical, the application of amount limits per operation, additional authentication methods for high-risk operations, among others.
3. Identify fraud patterns, through the systematic analysis of historical operation information, which must be incorporated into the operation monitoring system.
4. Establish limits and controls in the various service channels, to mitigate the risk of losses due to fraud.
17.2 The security measures that companies implement as a result of operation monitoring are part of their risk management. Monitoring is not part of the operation authentication process, nor does it alone determine the validity of an operation. The liability of financial system companies for operations carried out by users is determined in accordance with the provisions of Article 23 of the Regulation.
Article 18.- Information Security Measures
The current standards issued by the Superintendency on information security and business continuity management are mandatory for companies.
Likewise, regarding the storage, processing, and transmission of card data they issue, companies must implement the following specific security controls:

1. Implement and maintain the configuration of firewalls, routers, and similar equipment that make up the internal network, adopting standardized configurations and restricting permissions to prevent unauthorized access.
2. Implement policies to avoid the use of default secret keys and security parameters provided by technology service providers.
3. Implement data storage, retention, and deletion policies, as well as cryptographic key management policies, to limit the amount of data to be stored and the retention time to what is strictly necessary according to legal, regulatory, and business requirements.
4. Implement encryption mechanisms for the transmission of user data over public networks.
5. Implement and update antivirus software and programs on computers and servers.
6. Maintain secure computer systems and applications; for software provided by third parties, establish procedures to identify vulnerabilities and apply updates; for own system developments, adopt practices that allow reducing the security vulnerabilities of such systems.
7. Implement policies that restrict access to user data only to authorized personnel, reducing it to the strictly necessary.
8. Implement policies assigning a unique identifier to each person who accesses user data through software.
9. Implement physical access controls to protect user data, restricting it only to authorized personnel, whether internal or third-party.
10. Record and monitor all accesses to network resources and user data.
11. Conduct periodic vulnerability analyses of the internal network and external and internal penetration tests, as well as after significant changes in the network or computer systems.
12. Implement specific information security guidelines and procedures, including a formal information security training program, based on staff responsibilities, controls applicable to service providers, and a security breach response plan that is tested annually.

15/19
Los Laureles Nº 214 - Lima 27 - Perú Telf. : (511)6309000 Fax: (511) 6309239 The aforementioned implementations must be carried out following the technical recommendations of the card industry standard, PCI DSS or equivalents. 42 The company must make available to third-party platforms mechanisms to replace card data with a unique identifier generated through cryptographic techniques (tokenization). 43
Article 19.- Security Measures in Affiliated Businesses
Companies must adopt appropriate security measures to determine the validity of the card, as well as to ensure compliance with the conditions of use indicated in the Regulation, by affiliated operators or establishments.
In this sense, when companies sign contracts with affiliated operators or establishments, they must ensure that they include as obligations of these, if applicable, the following aspects:

1. Have acceptance procedures for operations, including among others the verification of the card's validity, the user's identity, and the signature if applicable.
2. Do not keep or store in manual or computerized databases card information, beyond using it to request authorization for an operation.
3. Comply with the security requirements of this Regulation, insofar as they are applicable to them.
   Compliance with the provisions of this article does not exempt the company from liability for losses generated in unrecognized operations that have been carried out under any of the circumstances established in the second paragraph of Article 23 of the Regulation. 44
   Article 20.- Security Requirements in Case of Subcontracting
   In cases of subcontracting that companies carry out for the provision of card services, the current regulation on subcontracting applies; in particular, the need for compliance with international security standards applicable to card operation processing must be formalized in agreements with third parties for card acceptance. SUBCHAPTER II ADDITIONAL OBLIGATIONS OF COMPANIES
   Article 21.- Communication Mechanism Available to Users
   Companies must have infrastructure and service systems, own or third-party, that allow users to report the loss or theft of the card or its information, improper charges, and operations that users do not recognize. This infrastructure must be available twenty-four (24) hours a day, every day of the year. User communications must be recorded in such a way that it is possible to credibly prove their date, time, and content. For each communication, a registration code must be generated to be informed to the user as proof of receipt of said communication. Likewise, a copy of the record of the communication made must be sent to the cardholder, through physical or electronic means, according to the user's choice. 42 Paragraph incorporated by Resolution SBS No. 5570-2019 of 11/27/2019, effective from 07/01/2021 43 Paragraph incorporated by Resolution SBS No. 2286-2024, effective from 06/29/2024, with an adaptation period in accordance with article seven of the same Resolution SBS No. 2286-2024. 44 Paragraph incorporated by Resolution SBS No. 5570-2019 of 11/27/2019, effective from 01/01/2021

16/19
Los Laureles Nº 214 - Lima 27 - Perú Telf. : (511)6309000 Fax: (511) 6309239 The information regarding the communication mechanisms established by the company, to comply with the provisions in the preceding paragraphs, must be published at the beginning of the company's website, in the offices, and in any other medium at the company's discretion, provided it is easily identifiable. The foregoing in this article is applicable, without prejudice to the other requirements established by the current regulatory framework in matters of complaint handling.
Article 22.- Monitoring of Operations that May Correspond to Fraud Patterns
Companies must have procedures for monitoring operations that may correspond to fraud patterns, which must include at least the following aspects:

1. Mechanisms for immediate communication to the user regarding possible fraud operations.
2. Actions to proceed with temporary blocking or definitive cancellation of the card, if necessary. 45
   Article 23.- Liability for Unrecognized Operations 46
   In the event of a transaction rejection or a user's claim that it was executed incorrectly, the company is responsible for carrying out the corresponding evaluation and demonstrating that the operations were authenticated and recorded.
   The company is responsible for losses from operations carried out in the following cases:
3. Non-compliance with the provisions of Article 21 of the Regulation.
4. When the cards have been cloned.
5. Due to the defective functioning of the channels or systems made available to users to carry out operations.
6. Due to the manipulation of ATMs or the environments in which they operate, made available by the issuing company or by third parties with whom it has an agreement.
7. When user impersonation has occurred in the offices.
8. Micropayment. 47
9. Operations carried out after the blocking or cancellation of the credit line or card or when the card has expired.
10. Operations associated with services not requested or enabled by the holder in accordance with the provisions of Articles 7 and 13 of this Regulation.
11. When the client authentication scheme for carrying out these operations does not meet the minimum security requirements established in current regulations.
12. Operations carried out without the use of a second authentication factor, referred to in paragraph 7.5 of numeral 7 of Article 16 of this regulation. 48
    In the event that none of the above circumstances are met; and in the event of loss, theft, robbery, larceny, or unauthorized use of the card, or the information it contains, the company is responsible for operations carried out after the communication made to the company by the user to report such facts. 45 Numeral replaced by Resolution SBS No. 5570-2019 of 11/27/2019, effective from 01/01/2021. 46 Article replaced by Resolution SBS No. 5570-2019 of 11/27/2019, effective from 01/01/2021. 47 Numeral modified by Resolution SBS No. 3240-2023 of 10/03/2023. 48 Numeral incorporated by Resolution SBS No. 2286-2024, effective from 06/29/2024, with an adaptation period in accordance with article seven of the same Resolution SBS No. 2286-2024.

17/19
Los Laureles Nº 214 - Lima 27 - Perú Telf. : (511)6309000 Fax: (511) 6309239 The company is not obliged to assume losses associated with unrecognized operations, when it proves the user's responsibility. In the case of micropayment, the mere use of the card or its information does not prove the user's responsibility regarding the operation carried out. 49 If a claim is filed for unrecognized operations, whose liability has not been assumed by the company, it must respond to the user explaining the reasons supporting its position clearly, addressing the questioned facts.
Article 24.- Transfer of Costs for the Contracting of Insurance and/or Creation of Protection or Contingency Mechanisms
Companies may not transfer to users as an expense or commission, as applicable, the cost associated with the contracting of insurance policies and/or protection or contingency mechanisms, which aim to cover losses generated as a result of the carrying out of unrecognized operations, which are the responsibility of these companies in accordance with the provisions of Article 23 of the Regulation.
Article 25.- (Eliminated) 50
SUBCHAPTER III
IN MATTER OF SUPERVISION
Article 26.- Communication to Issue Cards
Authorized companies that decide to start issuing cards must communicate this to the Superintendency, no later than thirty (30) days prior to the start of said issuance.
Article 27.- Manuals Applicable for Card Issuance and Administration
Companies must have manuals related to the issuance and administration of cards, considering for this purpose the compliance with the obligations developed in the Regulation.
Additionally, these manuals must consider the procedures, deadlines, controls, and security measures used in the physical production, key assignment, transport, delivery, and custody of cards.
Article 28.- Treatment of Associated Products 51
The Superintendency, for prudential reasons, may apply the regulatory framework established in this Regulation to current and new products that show an operational model similar to the credit card.
FINAL AND TRANSITORY PROVISIONS
First.- Market Conduct Management Regulation
The provisions regulated in the Market Conduct Management Regulation are applicable. 52 49 Paragraph modified by Resolution SBS No. 3240-2023 of 10/03/2023.
50 Article eliminated by Resolution SBS No. 5570-2019 of 11/27/2019. effective from 01/01/2021.
51 Article incorporated by Resolution SBS No. 5570-2019 of 11/27/2019, effective from 01/01/2021.
52 Provision modified by Resolution SBS No. 2286-2024, effective from 06/29/2024.

18/19
Los Laureles Nº 214 - Lima 27 - Perú Telf. : (511)6309000 Fax: (511) 6309239 Second.- Basic Accounts Cards granted as a consequence of contracting a basic account, and exclusively for the use of said account, are not obliged to comply with the provisions contemplated in Article 15 of the Regulation on the use of cards with integrated circuit or chip, nor the obligations established in the final and transitory fourth provision of the Regulation associated with the implementation and making available of cards with integrated circuit or chip. This provision may be applied to other financial products with prior authorization from the Superintendency. Third.- Submission of Reports Companies must submit to the Superintendency, within fifteen (15) days following the close of each month, Report No. 7 "Credit Cards" of the Accounting Manual for Financial System Companies, via SUCAVE, in accordance with the instructions contained in the report. Fourth.- Adaptation Period To comply with the requirements contemplated in the Regulation, the following maximum deadlines will apply:

1. From December 31, 2014, all new debit and credit cards must be issued with a chip, as established in Article 15 of the Regulation. Likewise, from that date, companies must give users the possibility to change their magnetic stripe cards for chip cards.
2. To implement what is required in Articles 7°, 10°, 13°, numeral 4 of Article 16°, as well as what is stated in Article 17°, companies will have an adaptation period until December 31, 2014.
3. From December 31, 2015, companies must ensure that ATM networks, which provide to their customers for their operations (whether own networks or networks contracted with third parties in the national territory), can authenticate cards issued, through the use of the chip or integrated circuit, incorporated in the card to carry out the operations requested by customers.
4. From December 31, 2015, companies that allow the carrying out of operations, without using the integrated circuit or chip incorporated in the cards, must assume the risks and, therefore, the costs of said operations, in case they are not recognized by users.
5. To implement what is required in Article 18°, companies will have an adaptation period until December 31, 2015.
   Fifth.-
   53
   For those clients who, before the entry into force of Resolution SBS No. 3274-2017, accessed the periodic information indicated in Article 11° by physical means, companies must make all their service channels available so that clients communicate their email address and consent to sending by said means and/or the making available by other electronic means of said information, in order to comply with the provisions of Article 11° of the Regulation. Companies must maintain a record of the communication made by the client. 53 Provision incorporated by Resolution SBS No. 3966-2018 of 10/11/2018.

19/19
Los Laureles Nº 214 - Lima 27 - Perú Telf. : (511)6309000 Fax: (511) 6309239 Second Article.- The Credit and Debit Card Regulation, approved by the First Article of this Resolution, will enter into force on April 1, 2014, on which date the Credit Card Regulation, approved by Resolution SBS No. 264-2008 and its modifying norms, as well as Article 32° of the Regulation on Transparency of Information and Provisions Applicable to Contracting with Users of the Financial System, approved by Resolution SBS No. 1765-2005 and its modifying norms, will be repealed. Register, communicate, and publish. DANIEL SCHYDLOWSKY ROSENBERG Superintendent of Banks, Insurance, and Private Pension Fund Administrators ---