SBS Resolution No. 00814-2025: Amending the Business Continuity Management Regulation and the Regulation of Infractions and Sanctions

Los Laureles Nº 214 - Lima 27 - Peru Tel.: (511) 6309000 Lima, March 04, 2025

S.B.S. RESOLUTION No. 00814-2025

The Superintendent of Banking, Insurance and Private Pension Fund Administrators

CONSIDERING

That by SBS Resolution No. 877-2020, the Regulation for Business Continuity Management was approved, which establishes provisions that companies must comply with for the adequate management of business continuity;

That, likewise, the Regulation for Business Continuity Management establishes that companies must report to the Superintendency the occurrence of an operational interruption event;

That, given the context of high digitalization of services offered by companies in the financial system, it is necessary to establish new provisions in the Regulation for Business Continuity Management with the objective of strengthening operational resilience, understood as the capacity of companies to ensure the continuity of their critical operations even in the face of interruptions, for which they must identify and adopt preventive measures against possible threats, have plans to respond and adapt to disruptive events, and be able to recover quickly by learning from these situations, which also includes adjustments in the deadlines for reporting operational interruption events to the Superintendency;

That, for the purpose of collecting public opinions on what is proposed, by SBS Resolution No. 4276-2024, the publication of the draft regulation was ordered on the Superintendency's digital platform, under the provisions of the Thirty-Second Final and Complementary Provision of the General Law of the Financial System and the Insurance System and Organic Law of the Superintendency of Banking and Insurance - Law No. 26702 and its modifying norms, hereinafter General Law, as well as Supreme Decree No. 009-2024-JUS;

Having the approval of the Adjunct Superintendencies of Banking and Microfinance, Risks, and Legal Advice; and;

In exercise of the powers conferred by items 7 and 9 of Article 349 of the General Law,

Los Laureles Nº 214 - Lima 27 - Peru Tel.: (511) 6309000

RESOLVES:

Article First. Modify the Regulation for Business Continuity Management, approved by SBS Resolution No. 877-2020 and its amendments, according to the following:

1. Repeal item i) of paragraph 4.2 of Article 4 referred to Credit and/or Debit Card Issuing Companies.

2. Incorporate item l) of paragraph 4.2 of Article 4, according to the following text:

“Article 4. Proportionality of the business continuity management system (...) j) Electronic Money Issuing Company; k) The National Bank; l) Credit Company authorized to operate with electronic money, credit cards, or provide interoperable payment services.”

3. Substitute item b) of paragraph 4.3 of Article 4, according to the following text:

“Article 4. Proportionality of the business continuity management system (...) b) Credit Company; (...)”

4. Substitute item a) of paragraph 14.1 of Article 14, according to the following text:

“Article 14. Company with market concentration (...) a) Consider for the design of continuity strategies, the fulfillment of business recovery objectives, the POR and the TOR. In the case of passive products, a TOR not greater than three (3) hours must be ensured in contingency situations that affect the company individually; (...)”

5. Substitute paragraphs 15.2 and 15.3 of Article 15, as well as modify its heading, according to the following texts:

“Article 15. Information on significant operational interruption events (...) 15.2 Additionally, and without prejudice to the foregoing, banking companies, financial companies, CMACs, CMCPs, and CRACs must inform the Superintendency of the occurrence of the following events:

a) The suspension in the delivery of prioritized products and services for a time equal to or greater than four hours. b) The interruption in any of the attention channels that lasts for a period equal to or greater than four hours. In the case of in-person channels, the unavailability of 25% of the attention points nationwide must be considered. The information on these events must be sent within a maximum period of 5 hours from their start, provided it occurs between 07:00 am and 04:00 pm. If the incident occurs outside this time frame, the report must be made no later than the start of the next business day. 15.3 In the case of companies with market concentration, as described in Article 14, these must inform the Superintendency of the occurrence of the following events: a) The suspension in the delivery of prioritized products and services for a time equal to or greater than 1 hour. b) The interruption in any of the attention channels that lasts for a period equal to or greater than 1 hour. In the case of in-person channels, the unavailability of 25% of the attention points nationwide must be considered. The information on these events must be sent within a maximum period of 2 hours from their start, provided it occurs between 07:00 am and 04:00 pm. If the incident occurs outside this time frame, the report must be made no later than the start of the next business day. (...)”

6. Incorporate Subchapter V in Chapter II, according to the following text:

“SUBCHAPTER V OPERATIONAL RESILIENCE PROVISIONS IN DIGITAL CHANNELS OF MULTIPLE OPERATION COMPANIES

Article 17. Scope The provisions described in this subchapter apply to the companies indicated in items a), b), c), d), e) and k) of paragraph 4.2 that have implemented digital channels.

Article 18. Business continuity management in digital channels 18.1. As part of the “understanding of the organization” stage described in Article 7, the company must: a) Identify the prioritized products and services offered through digital channels and establish a TOR for each of them. b) Specifically and detailedly manage the risks that could interrupt operations in their digital channels. This evaluation must include the identification of technological components whose failure could significantly affect the continuity of the prioritized products and services offered through said channels.

Los Laureles Nº 214 - Lima 27 - Peru Tel.: (511) 6309000 c) Expressly establish the characteristics and normal conditions under which the prioritized products and services are offered in each digital channel, which must be approved by the Board of Directors or Risk Committee. These characteristics must be defined and monitored for each prioritized product and service offered through digital channels. 18.2. The company must implement strategies and plans to prevent, mitigate the impact, and contain events that interrupt the provision of prioritized products and services through digital channels, as well as to restore said services within the established timeframes and conditions. These strategies must contemplate: a) Implement a monitoring system to supervise the functioning of digital channels offering prioritized products and services, so as to allow identifying any deviation from the normal levels established for each product or service. b) Implement alternative attention channels or schemes in case of interruption of the digital channels through which prioritized products and/or services are offered. c) As part of the information technology (IT) service recovery plan mentioned in paragraph 9.4, the company must develop protocols to address technological failures and the resulting interruptions in the provision of prioritized products and services in digital channels, ensuring their restoration to normal levels within the established TORs. d) As part of the communication guidelines referred to in item f) of paragraph 9.2, the company must develop provisions that guarantee the timely communication of: i) incidents or significant failures to stakeholders, including users; and ii) the alternative channels available to continue carrying out operations. 18.3. As part of the testing plan mentioned in Article 10, the company must perform annual tests to verify the effectiveness of the strategies established to guarantee the continuity of prioritized products and services through digital channels. 18.4. The company must maintain a centralized record of all events that have caused the interruption of the provision of prioritized products and services through digital channels for a period greater than 30 minutes, continuous or intermittent. This record must contain, at a minimum, the following fields: a) Date and time of the start of the event and of the restoration to normal operations. b) Description of the event, the failure, and its causes. c) Affected products and services. d) Affected channels. e) Involved providers, if applicable. f) Person responsible for incident management.

Article 19. Clarifications to ensure operational resilience of main digital channels 19.1. The provisions of this article apply to companies that have the following digital channels: internet banking, mobile application, or digital wallets; through which they offer services of intra-bank transfers, inter-bank transfers, interoperable payments, corporate payroll payments, or payments to suppliers.

Los Laureles Nº 214 - Lima 27 - Peru Tel.: (511) 6309000 19.2 The company must define the characteristics and conditions under which transfer services, interoperable payments, payroll payments, and payments to suppliers are offered through the digital channels indicated in the previous paragraph to individuals and companies, according to the structure of Reports CD-A and CD-B of Annex 2, respectively. The reports contain the names of the digital channels, general information about the normal conditions under which they operate (availability schedule, minimum daily availability, entry latency time, and scheduled interruptions) and under which products and/or services are offered through them (TOR, service schedule, minimum daily availability, operational latency time, scheduled interruptions), and the alternative channels in case of contingency. The formats of the reports indicated in this paragraph are attached to this regulation and published on the institutional portal (www.sbs.gob.pe), in accordance with the provisions of Supreme Decree No. 009-2024-JUS and its modifying norms. 19.3 Reports CD-A and CD-B must be approved and managed in accordance with the provisions of item c) of paragraph 18.1. The reports, along with the certificate of their annual approval or ratification, must be sent to the Superintendency through the Virtual Counter application located on the Supervised Portal, no later than March 31 of each year. In case of modifications, the reports must be sent within a maximum period of seven (07) days following the change made. The Superintendency may instruct via multiple letter the use of an alternative mechanism to the aforementioned one for the submission of information referred to in this paragraph. 19.4. The services of transfers, interoperable payments, payroll payments, and payments to suppliers provided through the following digital channels: internet banking, mobile application, and digital wallets, are services that require priority recovery in case of interruption. Therefore, they must consider a TOR not greater than three (03) hours for companies with market concentration and five (05) hours for other companies. 19.5. Companies must execute annual tests to verify compliance with the TORs of transfer services, interoperable payments, payroll payments, and payments to suppliers from internet banking, mobile application, or digital wallets. The result reports of these tests, which must include the lessons learned resulting from their execution, must be sent to the Superintendency as part of the annual operational risk management report (IG-ROp), mentioned in Article 15 of the Regulation for Operational Risk Management, approved by SBS Resolution No. 2116-2009 and its amendments. 19.6. The services of intra-bank transfers, inter-bank transfers, interoperable payments, corporate payroll payments, and payments to suppliers offered through the following digital channels: internet banking, mobile application, and digital wallets, cannot be interrupted, within the time frame between 06:00 am and 10:00 pm, for a period greater than three (03) hours for companies with market concentration, and five (05) hours for other companies. This maximum time applies to both continuous and accumulated interruptions within that time range on the same day. This requirement applies to unscheduled interruptions or those derived from operational failures. 19.7. Continuity strategies must contemplate the development of procedures that allow, in case of interruptions, to continue offering transfer services, interoperable payments, payroll payments, and payments to suppliers; and/or allow users to access the money in their deposits through other schemes or channels.”

7. Substitute the second final and complementary provision with the following text:

“FINAL AND COMPLEMENTARY PROVISIONS (...) Second.- In the case of the companies indicated in items a, b, c, d, e, j, k and l of Article 4.2, the design of continuity strategies must ensure that the information corresponding to the operations of all passive products complies with a POR equal to zero.”

8. Incorporate the third, fourth, and fifth final and complementary provisions, according to the following texts:

“FINAL AND COMPLEMENTARY PROVISIONS (...) Third.- Interruption in digital channels shall be understood as any impediment, whether total or partial, that affects the provision of products or prioritized services through them. The degradation of service levels in said channels, when it generates a significant impact on users, in some economic sector, in the fulfillment of legal or regulatory commitments, or in the company's reputation, is considered a partial impediment for the provision of services. Fourth.- The companies mentioned in paragraph 19.1 of Article 19, which offer interoperable payment services, must send to the Superintendency, through the Virtual Counter application located on the Supervised Portal, the following annexes, which are part of the Regulation of Quality Levels of Interoperable Payment Services provided by Providers, Agreements, Payment Systems, and Technological Providers, approved by Circular No. 0009-2024-BCRP or the norm that replaces it. These submissions must comply with formats established by the Central Reserve Bank of Peru and with the periodicity determined by this entity, including additional submissions derived from corrections: a) Annex 14 – Monthly Report of Executed Maintenance. b) Annex 15 – Monthly Incident Report. c) Annex 16 – ANS-RTO Report. d) Annex 17 – Service Quality Indicators Report. The Superintendency may instruct via multiple letter the use of an alternative mechanism to the aforementioned one for the submission of information referred to in this final and complementary provision. Fifth.- The first submission of Reports CD-A and CD-B of Annex 2 must be made by companies with market concentration no later than July 15, 2025.”

Los Laureles Nº 214 - Lima 27 - Peru Tel.: (511) 6309000

Article Second. Modify the Regulation of Infractions and Sanctions, approved by Resolution SBS No. 2755-2018 and its amendments, according to the following:

1. Modify grave infraction 85) and very grave infraction 26) of Annex 1, according to the following texts:

“ANNEX 1 COMMON INFRACTIONS (...) II. GRAVE INFRACTIONS (...) 85) Failure to comply with express requirements or mandates issued by this Superintendency that have an impact on the financial situation, results, or solvency of the company, with an impact on its results or solvency, less than or equal to 5% of effective equity. (...) III. VERY GRAVE INFRACTIONS (...) 26) Failure to comply with express requirements or mandates issued by this Superintendency that have an impact on the financial situation, results, or solvency of the company, with a material impact on its results or solvency, greater than 5% of effective equity. (...)”

2. Incorporate the following items into section II of Annex 2 referred to grave infractions, according to the following texts:

“ANNEX 2 SPECIFIC INFRACTIONS OF THE FINANCIAL SYSTEM AND COMPANIES OF COMPLEMENTARY AND RELATED SERVICES (...) II. GRAVE INFRACTIONS (...) 81) Presenting an interruption in the service of transfers, interoperable payments, for corporate payroll payments or payments to suppliers through digital channels: internet banking, mobile applications, and electronic wallets, for more than three (03) hours continuous or accumulated between 6:00 am and 10:00 pm, for companies with market concentration; and five (05) hours for other companies. 82) Failing to evaluate risks associated with technological components, whether under own administration or third-party administration, whose failure could significantly affect the continuity of their services or critical operations; and/or failing to implement, or partially implementing, measures to mitigate their occurrence or impact. 83) Losing information associated with operations in passive products as a consequence of an interruption event.”

Los Laureles Nº 214 - Lima 27 - Peru Tel.: (511) 6309000

Article Third. Approve Annex 2, Characteristics of prioritized products and services offered through digital channels, of the Regulation for Business Continuity Management, approved by Resolution SBS No. 877-2020 and its amendments, according to the format contained in the annex of this Resolution.

Article Fourth. This resolution enters into force in accordance with the following:

1. Items 1, 2, 3, and 5 of Article First and item 1 of Article Second of this resolution enter into force the day after its publication in the official newspaper “El Peruano”.

2. Articles 17 and 19 of Subchapter V of the Regulation for Business Continuity Management, incorporated by item 6, as well as items 4, 7, and 8 of Article First, and Article Third of this resolution, enter into force on June 1, 2025, for companies with market concentration, as established in Article 14 of the Regulation for Business Continuity Management, with the exception of the National Bank. For the National Bank and the rest of the companies, the effective date is January 1, 2026.

3. Article 18 of Subchapter V of the Regulation for Business Continuity Management, incorporated by item 6 of Article First of this resolution, enters into force on January 1, 2026.

4. Infractions 81) and 83), incorporated by item 2 of Article Second of this resolution, enter into force on June 1, 2025, for companies with market concentration, as established in Article 14 of the Regulation for Business Continuity Management, with the exception of the National Bank. For the National Bank and the rest of the companies, they enter into force on January 1, 2026.

5. Infraction 82), incorporated by item 2 of Article Second of this resolution, enters into force on January 1, 2026.

Register, communicate, and publish.

JORGE DAMASO MOGROVEJO GONZALEZ SUPERINTENDENT OF BANKING, INSURANCE AND AFP (A.I.)