SUPERINTENDENCY OF BANKING, INSURANCE AND AFP Republic of Peru

Lima, 15 November 2023

S.B.S. Resolution No. 03797-2023

The Superintendent of Banking, Insurance and Private Administrators of Pension Funds

WHEREAS:

That, by SBS Resolution No. 504-2021, the Regulation for the Management of Information Security and Cybersecurity was approved;

That this Superintendency has identified that there is a relationship between the enrollment requirements set forth in said Regulation for the Management of Information Security and Cybersecurity and the measures required with respect to customer due diligence for money laundering and terrorist financing risk that companies must consider simultaneously, such as user identity verification, and that seek to find a balance between the needs for greater security and prevention of money laundering and terrorist financing risk;

That, by virtue of the foregoing, this Superintendency considers requiring the use of a single factor for user enrollment in services provided through digital channels when dealing with insurance products that are under the simplified customer due diligence regime in accordance with the provisions of article 31 of the Regulation for the Management of Money Laundering and Terrorist Financing Risks, approved by SBS Resolution No. 2660-2015 and its amending and supplementary rules such as Circular No. S-661-2016, Insurance products subject to the simplified customer due diligence regime;

That, in the case of life insurance with a savings, investment or surrender component and surety insurance, they must be excluded from the aforementioned exceptional treatment, because they are products whose level of exposure to the customer is considered high;

That, having determined that the exposure to money laundering and terrorist financing risks is high for life insurance with a savings, investment or surrender component, it is necessary to amend Circular No. S-661-2016, Insurance products subject to the simplified customer due diligence regime;

That, with respect to enhanced authentication for transactions through digital channels, this Superintendency considers it necessary to grant more alternatives regarding compliance with the generation of the unique code per transaction;

With the approval of the Deputy Superintendencies of Insurance, Risks, Market Conduct and Financial Inclusion, and Legal Affairs;

That, in order to gather public opinions on the proposal, the publication of the draft regulation was ordered on the Superintendency's electronic portal, under the provisions of Supreme Decree No. 001-2009-JUS and its amendments and with regard to the amendment of literal b) of article 19 of the Regulation for the Management of Information Security and Cybersecurity approved by SBS Resolution No. 504-2021, it is published on the basis of the exception conditions established in article 14 of Supreme Decree No. 001-2009-JUS and its amendments;

In use of the powers conferred by numerals 7 and 9 of article 349 of the General Law;

RESOLVES:

Article One.- Amend the Regulation for the Management of Information Security and Cybersecurity approved by SBS Resolution No. 504-2021, in accordance with the following:

1. Replace literal a) of paragraph 18.1 of article 18, with the following text:

"Article 18. User enrollment in services provided through digital channels

(…)

18.1 The enrollment of a user in a digital channel requires at least:

a) Verify the user's identity and take the necessary measures to reduce the possibility of identity impersonation, which includes the use of two biometric factors or the use of two factors of different and independent categories, according to literal j) of article 2 of this Regulation, except in the case of insurance products included in the simplified customer due diligence regime, in accordance with the provisions of article 31 of the Regulation for the Management of Money Laundering and Terrorist Financing Risks, approved by SBS Resolution No. 2660-2015 and its amending rules, in which case a single biometric factor may be used.

(…)

SUPERINTENDENCY OF BANKING, INSURANCE AND AFP
República del Perú

2. Replace literal b) of article 19, with the following text:
   (…)

b) Have a control against man-in-the-middle attacks, which may include a unique code generated by cryptographic methods, based on the specific data of each transaction, which must be used only once.

(…)"

Article Two.- Amend Circular No. S-661-2016, Insurance products subject to the simplified customer due diligence regime, in accordance with the following:

1. Replace literal c) of numeral 2, in accordance with the following text:

"c) Mass insurance: standardized insurance that does not require special underwriting requirements, that is, it does not require prior verifications in relation to the persons and/or insurable property, the simple acceptance of the policyholder or the insured being sufficient for the consent of the individual insurance or group or collective insurance, as applicable".

2. Replace numeral 3, with the following text:

"3. Products included in the simplified customer due diligence regime

Based on the evaluation carried out by the Superintendency, those insurance products that are included in one or more categories of the following list are included in the simplified customer due diligence regime referred to in article 31 of the Regulation:

1. Mandatory insurance.

2. Insurance taken out by natural or legal persons on behalf of and for the benefit of their workers.

3. Group or collective insurance.

4. Mass insurance.

5. School insurance.

6. Personal accident insurance and/or medical assistance insurance.

7. Funeral expense insurance.

8. Pension insurance and annuities associated with the SPP.

9. Microinsurance, registered as such with the Superintendency.

10. Extended warranty insurance.

11. Life insurance, without a savings or investment component.

12. Professional civil liability insurance.

Additionally, insurance products that are associated with a credit operation, -offered through bancassurance- and in which the financial system company is designated as the beneficiary of the insurance, are considered under this regime.”

Article Three. – This Resolution enters into force on the day following its publication in the Official Gazette El Peruano. Companies have an adaptation period until 30 June 2024, to adapt their internal regulations and procedures to comply with the provisions of numeral 2 of Article Two of this Resolution.

During the adaptation period referred to in the preceding paragraph and for the purposes of enrolling users of life insurance with a savings and investment component, the use of two biometric factors or the use of two factors of different and independent categories is maintained in accordance with literal j) of article 2 of the Regulation for the Management of Information Security and Cybersecurity approved by Resolution SBS N° 504-2021.

Register, communicate and publish.

MARIA DEL SOCORRO HEYSEN ZEGARRA
Superintendent of Banking, Insurance and
Private Pension Fund Administrators