Peru

PE · PER · Americas

3 regulators · 2 laws & regulations · 4 obligations · 12 enforcement actions

Obligation	Timing	Regulator	Arises from	Source
All industries
Lawful basis, privacy notice and data subject rights	—	—	—	official
Art. 13.5 requires prior, informed, express and unequivocal consent unless a law provides otherwise, Art. 13.6 requires written consent for sensitive data and Art. 14 lists cases where consent is not needed. Art. 18 gives the right to information, Arts. 19 and 20 give access, rectification and deletion, Art. 21 the right to prevent data supply and Art. 22 opposition. 2025 ANPD decisions apply Arts. 13.5 and 18.
Crypto / VDA
Customer due diligence for virtual asset service providers	At onboarding + ongoing	UIF-Perú	Resolución SBS N° 02648-2024, Norma para la prevención del lavado de activos y del financiamiento del terrorismo aplicable a los proveedores de servicios de activos virtuales (SBS Resolution 02648-2024, AML/CFT rule for virtual asset service providers)	source
Arts. 14 to 16 of Resolución SBS 02648-2024 require identification, verification and monitoring of customers, including beneficial owners, under general, simplified and enhanced regimes; enhanced due diligence applies to higher-risk clients such as politically exposed persons and non-residents. The equivalent bank rule (Resolución SBS 2660-2015) could not be opened.
Report suspicious transactions through ROSEL (virtual asset service providers)	Deadline No later than 24 hours after classification as suspicious	UIF-Perú	Resolución SBS N° 02648-2024, Norma para la prevención del lavado de activos y del financiamiento del terrorismo aplicable a los proveedores de servicios de activos virtuales (SBS Resolution 02648-2024, AML/CFT rule for virtual asset service providers)	source
Art. 27.1 of Resolución SBS 02648-2024 says the suspicious transaction report must in no case be made later than 24 hours after the operation is classified as suspicious, and Art. 27.3 requires it to be filed through the ROSEL system using its template.
Retain suspicious transaction records for five years (virtual asset service providers)	Retention period 5 years	UIF-Perú	Resolución SBS N° 02648-2024, Norma para la prevención del lavado de activos y del financiamiento del terrorismo aplicable a los proveedores de servicios de activos virtuales (SBS Resolution 02648-2024, AML/CFT rule for virtual asset service providers)	source
Art. 27.4 of Resolución SBS 02648-2024 requires suspicious transaction report information and supporting documentation to be kept for five years. Art. 26 requires a transaction register (Registro de Operaciones) kept up to date, recorded the same day and backed up.
No obligations match these filters.