The SBS supervises financial system lenders in Peru
The Superintendencia de Banca, Seguros y AFP (SBS) authorises and supervises the companies of the financial system. Ley 26702 sets out the main types: banks, financieras (finance companies), cajas municipales and cajas rurales de ahorro y crédito (municipal and rural savings and credit institutions) and empresas de créditos, formerly EDPYME. In July 2025 the SBS supervised 49 such companies: 19 banks, 7 financieras, 11 cajas municipales, 5 cajas rurales, 5 empresas de créditos, and Banco de la Nación and Agrobanco.
Its market conduct regulation, Resolución SBS 3274-2017 as amended, governs how these companies offer products, disclose information and handle complaints. It covers the companies in literals A and B of article 16 of Ley 26702, plus Banco de la Nación and Banco Agropecuario.
| Instrument | What it covers | Who enforces |
|---|---|---|
| Ley 26702 and SBS conduct rules | Supervision of banks, financieras, cajas and other credit companies, and how they offer products. | SBS |
| Ley 29571 article 58, amended by Ley 32323 | Call centres, calling systems, text messages, mass electronic messages and telemarketing to promote products: allowed only to a consumer who contacted the provider first and consented. | Indecopi |
| Decreto Supremo 018-2026-MTC | The 500 number series, exclusive to commercial calls and text messages; telecom operators assign it. | MTC for operators; Indecopi for consumer law |
| Ley 29733 and Decreto Supremo 016-2024-JUS | Consent, transfers, cross-border flows, advertising use and security incidents. | Ministry of Justice |
Indecopi enforces consent rules for commercial contact
The Consumer Protection and Defence Code (Ley 29571) is enforced by Indecopi, the national competition and consumer agency. Article 58 bans aggressive commercial methods. Since Ley 32323, published on 9 May 2025, it prohibits call centres, telephone calling systems, text messages and mass electronic messages used to promote products and services, and telemarketing. There is one exception: a consumer who contacts the provider directly, on their own initiative, and gives free, prior, informed, express and unequivocal consent to be contacted.
Consent can be withdrawn at any time, with immediate effect and without giving a reason. Breaching the ban or a withdrawal is a very serious infringement, and Indecopi has said fines can reach 450 UIT (tax units), which it put at S/ 2,407,500 (Peruvian soles) in May 2025.
By then Indecopi's enforcement directorate had been analysing about seven million audio recordings since 2024, in investigations of banking, insurance and telecoms companies. In April 2026 an Indecopi consumer commission fined a bank S/ 1,116,280 (202.96 UIT) at first instance, subject to appeal, for commercial calls made without the consumers' prior authorisation.
Decreto Supremo 018-2026-MTC, published on 15 September 2026, makes the 500 series the exclusive range for calls and text messages with a commercial or advertising purpose. It binds telecom operators, who have up to 180 calendar days to adapt and may not assign other numbering to providers for that use. Its definition of commercial communication covers calls and text messages made by third parties acting for the provider or in its interest, including to attract consumers, so those a partner makes for a lender fit that definition. The decree governs numbering, not consent.
Data protection law governs how applicant data moves
Ley 29733 makes the Ministry of Justice the national data protection authority and requires the holder's consent for processing personal data, with exceptions in article 14, such as data needed for a contract. Its regulation, Decreto Supremo 016-2024-JUS, was published on 30 November 2024, replaced the 2013 regulation and entered into force 120 calendar days after publication. It also reaches controllers established outside Peru that use means located in Peru, including where they offer goods or services directed at people in Peru or analyse their behaviour and build profiles (article VI), and such controllers must appoint a representative for Peru (article VII).
Four provisions matter most for acquisition:
- Every transfer of personal data needs the holder's consent, unless the law provides an exception, and it must be informed. The consent an applicant gives therefore has to cover the handoff to the lender (article 13 of the regulation).
- Using personal data for advertising and commercial prospecting is lawful with consent obtained directly from the holder. Responsibility is presumed to sit with the party in whose interest the processing is done. The holder can refuse, revoke or object through a simple, free channel, and the request must be handled within 10 business days (article 26 of the regulation).
- A security incident that meets the regulation's criteria (large volumes of data, many people affected, sensitive data or evident harm) must be notified to the authority within 48 hours of becoming aware of it (article 34 of the regulation).
- Personal data may in general cross borders only to a country with an adequate level of protection, or with the sender guaranteeing processing in line with the law, with exceptions such as the holder's consent (article 15 of Ley 29733). Each flow must also be reported to the authority and registered (article 21 of the regulation).
The regulation lets a controller make one first contact to ask for consent (article 26.2), while Ley 32323 allows commercial calls, text messages and mass messages only to consumers who contacted the provider first. How the two fit together is a question for Peruvian counsel, ideally settled before any outbound phone, SMS or messaging programme.
Settle these points before launch
- Which channels contact the applicant. Calls, text messages and mass electronic messages need the consumer's prior contact and consent under Ley 32323.
- Whether applying through a partner's page, portal or app counts as contacting the lender directly under Ley 32323, before anyone calls or messages the applicant.
- What the applicant is told, and agrees to, when their data passes to the lender and when device, identity and behaviour signals are read during screening.
- Which fields travel in the handoff and which stay out, and which outcome fields come back by postback.
- Where applicant data is processed, in light of the cross-border rule.
- Which party is the controller for application data and screening signals, and whether any party outside Peru needs a representative there.
- Who answers for a partner's outreach, given the presumption in article 26 of the regulation.
- How a withdrawal of consent reaches every party that holds the data, within the 10-business-day limit.
The regulatory content on this page is general information, not legal advice, and the current text of each rule should be confirmed with Peruvian counsel before launch.
CYBERTECH screens and delivers applicants to the lender
CYBERTECH provides borrower acquisition for lenders in Peru. Supply varies by product, and each launch is confirmed market by market. The lender defines the market, product criteria and capacity. Applicants are screened against those rules and only suitable applicants are routed to the lender, which keeps the final credit decision. Screening runs five checks: device integrity, network, identity, behaviour and velocity, and fit to the lender's criteria, read together. See anti-fraud screening.
Delivery is by referral, using a branded redirect or hosted portal with an S2S postback for outcomes (see referral and postback), or by direct API (see API delivery). Pricing is CPA or CPD on a billable event defined together before launch (see pricing).
In Peru, consent and the handoff matter most: the lender settles with its Peruvian counsel whether applying through a partner page counts as contacting the lender under Ley 32323, and what the applicant agrees to when their data passes on. Parameters and postback setup are agreed before launch. CYBERTECH is not a lender and not a bank partner; company details are on the about page. To discuss a Peruvian product, contact us.
Related guides
- Screen loan leads for fraud and fit before they reach youFive checks, including fit to your own criteria, screen applicants before handoff. No single signal decides, and a stopped applicant is not delivered to you.
- Loan leads reach you by referral or by direct APIReferral with a server-to-server postback and a direct API deliver the same screened applicants; this page helps you choose and walks through a launch.
- How CPL, CPA and CPD price loan leadsHow CPL, CPA and CPD differ on risk and reporting, and which terms to fix in writing: billable event, validation window, caps.
- Lending acquisition glossary, from CPA and CPD to DLG and DPDDefinitions of lending acquisition terms, from CPA, CPD and postbacks to NBFC, LSP, DLG, MFO and loan stacking, with links to the guides that go further.
Sources
- Congreso de la República: Ley 26702, Ley General del Sistema Financiero y del Sistema de Seguros y Orgánica de la SBS (1996)
- El Peruano: Resolución SBS 01158-2022, EDPYME renamed empresas de créditos under Decreto Legislativo 1531 (2022)
- SBS: Situación de los sistemas supervisados por la SBS (2025)
- Banco de la Nación (copy of the SBS text, amended to 2020): Resolución SBS 3274-2017, Reglamento de Gestión de Conducta de Mercado (2017)
- El Peruano: Ley 32323, amending article 58 of the Consumer Code (2025)
- Indecopi: press note on Ley 32323 and spam calls (2025)
- Indecopi: press note on a first-instance fine for spam calls by a financial entity (2026)
- Ministerio de Transportes y Comunicaciones: Decreto Supremo 018-2026-MTC (2026)
- Superintendencia del Mercado de Valores: Ley 29733, Ley de Protección de Datos Personales, consolidated text (2025)
- Ministerio de Justicia y Derechos Humanos: Decreto Supremo 016-2024-JUS, Reglamento de la Ley 29733 (2024)