VOVE ID Compliance Research

Pérou KYC, KYB & AML compliance checklist

Une checklist pratique et sourcée pour mettre en œuvre les exigences KYC, KYB et AML en Pérou.

Dernière revue: Dernière revue: 1 August 2026
Version: Version 1.2

Pérou KYC, KYB and AML compliance checklist cover

Réponse directe

Que couvre la checklist de conformité pour Pérou ?

La checklist pour Pérou traduit les principales règles KYC, KYB et AML en 11 domaines de contrôle et 46 contrôles d’implémentation, avec les autorités, obligations de déclaration et preuves à conserver.

Faits réglementaires clés

National FIU: UIF-Peru within the SBS
Core framework: Law 27693, Law 29038 and Supreme Decree 020-2017-JUS, plus sector rules
Suspicious reports: File with UIF-Peru through the compliance officer immediately and no later than 24 hours after the operation is classified as suspicious
Default operations register: Where no sector threshold applies: USD 10,000 individual or USD 50,000 aggregated in a calendar month
Retention: Operations register generally 10 years from the operation; a sector rule may set a shorter period, never below 5 years
Beneficial owner filing test: At least 10% capital, control by other means, then senior managing official fallback under Legislative Decree 1372
Privacy authority: Autoridad Nacional de Proteccion de Datos Personales (ANPD)
Payment oversight: BCRP authorization or registration under the 2025 National Payments System regulation, as applicable
Virtual assets: PSAVs are UIF-Peru reporting entities under Supreme Decree 006-2023-JUS and SBS Resolution 02648-2024
FATF status: GAFILAT member; not named on FATF call-for-action or increased-monitoring lists reviewed 1 August 2026

Détail d’implémentation

Exigences et actions de conformité pour Pérou

Ouvrez chaque domaine pour consulter l’exigence, l’action recommandée, les preuves à conserver et la source primaire utilisée.

01Scope, authorities and licensingPeru's control framework is activity- and supervisor-specific. Resolve the exact legal entity, regulated activity and local nexus before applying any threshold or timetable.4 éléments+

Only persons within Law 29038, Supreme Decree 020-2017-JUS or a later designation are reporting entities to UIF-Peru.
Action d’implémentation
Map every product and activity to the statutory reporting perimeter and identify the competent supervisor; document why non-Peruvian activity is or is not in scope.
Preuves à conserver
Perimeter memorandum, entity chart, activity inventory, legal nexus analysis and supervisor matrix.
Source primaire
Law 29038 art. 3; Supreme Decree 020-2017-JUS art. 2
A reporting entity must implement the AML/CFT prevention system and designate a compliance officer under its applicable sector rule.
Action d’implémentation
Obtain required registrations and approvals before operating, appoint the officer and deputy where required, and provision the live UIF reporting channel.
Preuves à conserver
Registration, appointment, approval, role description, portal access test and governance minutes.
Source primaire
Law 27693 arts. 3 and 9-A; Supreme Decree 020-2017-JUS arts. 13-16
Financial, securities, money-transfer and electronic-money activities may require SBS or SMV authorization independently of AML status.
Action d’implémentation
Complete a product-by-product licensing analysis and do not accept funds, issue e-money, transfer value or provide regulated securities services before authorization.
Preuves à conserver
Authorization opinion, application, regulator decision, public-register extract, conditions and launch approval.
Source primaire
Law 26702; Securities Market Law; Law 29985; applicable SBS and SMV rules
Payment-arrangement administrators register before operating under article 17. An ESP participating directly or indirectly in a Payment System or Prominent Payment Arrangement requires prior BCRP authorization; other ESPs are subject to informational registration under article 35 and the transition schedule.
Action d’implémentation
Classify each payment role and infrastructure, determine whether article 17 registration, article 35 authorization or article 35 registration applies, and complete the applicable process and transition plan.
Preuves à conserver
Payments perimeter analysis, authorization or registration, transition plan, operating rules and BCRP correspondence.
Source primaire
Circular 0022-2025-BCRP arts. 17 and 31-37; First and Second Final and Complementary Provisions

02Governance and risk assessmentThe prevention system must be tailored to the subject's sector, size, products, channels, customers and geographic exposure.4 éléments+

Reporting entities must identify and manage AML/CFT risks through policies, procedures and internal controls required by the applicable sector rule.
Action d’implémentation
Document an enterprise risk assessment covering customers, products, channels, geography, delivery technology and TF/PF exposure; obtain governing-body approval.
Preuves à conserver
Risk assessment, methodology, data sources, approval, action plan and annual review calendar.
Source primaire
Supreme Decree 020-2017-JUS arts. 17-20; applicable sector rule
The compliance officer must operate independently, preserve confidentiality and report through the governance line required for the sector.
Action d’implémentation
Protect the officer's authority, resources, access and escalation rights; prohibit retaliation and manage absence and succession.
Preuves à conserver
Charter, appointment, budget, access matrix, committee minutes, reports and succession record.
Source primaire
Law 27693 art. 10-A; Supreme Decree 020-2017-JUS arts. 14-16
Training, internal review and independent or internal audit obligations vary by sector but form part of the prevention system.
Action d’implémentation
Map the exact cadence and audience, train before access to controlled processes and test both design and operating effectiveness.
Preuves à conserver
Training plan, attendance, assessments, audit plan, findings, remediation and closure evidence.
Source primaire
Supreme Decree 020-2017-JUS arts. 17-20; SBS Resolution 2660-2015; applicable sector rule
New technologies and remote channels must be risk-assessed before launch and monitored after release.
Action d’implémentation
Assess impersonation, document fraud, synthetic identity, mule, cyber, outsourcing, sanctions and privacy risks and define measurable launch gates.
Preuves à conserver
Product risk assessment, threat model, control tests, approval, monitoring dashboard and change log.
Source primaire
Supreme Decree 020-2017-JUS arts. 17-21; applicable SBS, SMV and BCRP rules

03Natural-person KYC and representativesCDD consists of identification, verification and ongoing monitoring. The sector rule determines the exact data, evidence and permitted remote method.4 éléments+

A reporting entity must identify the customer using reliable data and verify identity under the applicable risk and sector procedure.
Action d’implémentation
Collect required identity, address, occupation, purpose and source information; authenticate evidence and bind it to the applicant before activation unless a lawful delayed-verification case applies.
Preuves à conserver
Customer file, document images, authenticity results, timestamps, reviewer and exception record.
Source primaire
Supreme Decree 020-2017-JUS arts. 17-21; applicable sector rule
The person acting for a customer must be identified and their authority verified.
Action d’implémentation
Verify the representative as a natural person, validate the power or mandate against reliable evidence and limit access to the authorized scope.
Preuves à conserver
Representative KYC, power, registry or notarial validation, authority analysis, expiry and approval.
Source primaire
Supreme Decree 020-2017-JUS arts. 17-21; applicable sector rule
CDD must be updated and transactions monitored for consistency with the customer's profile and risk.
Action d’implémentation
Set risk-based refresh events, reconcile identity and profile changes, and investigate material deviations before continuing the relationship.
Preuves à conserver
Refresh schedule, event triggers, updated evidence, alerts, investigations and approval history.
Source primaire
Supreme Decree 020-2017-JUS arts. 17-21
If required CDD cannot be completed, the reporting entity must not start, must not execute, or must terminate the relationship as applicable and assess a suspicious report.
Action d’implémentation
Block completion, preserve the failed or attempted transaction, escalate to the compliance officer and document the reporting decision without tipping off.
Preuves à conserver
System block, failed-CDD record, escalation, analysis, filing receipt if applicable and restricted communication log.
Source primaire
Supreme Decree 020-2017-JUS art. 21.3-21.4

04KYB, registries and beneficial ownershipCustomer KYB, SUNARP corporate records, AML beneficial-owner diligence and the SUNAT beneficial-owner declaration are distinct controls.5 éléments+

A legal-person customer must be identified through reliable constitutional, registry, tax, address, purpose and activity evidence.
Action d’implémentation
Obtain current constitutive documents, RUC and SUNARP records, identify directors and representatives and reconcile discrepancies before approval.
Preuves à conserver
Constitutional documents, RUC, certified registry record, governance list, purpose and discrepancy log.
Source primaire
Supreme Decree 020-2017-JUS arts. 17-21; applicable sector annex
AML CDD requires the natural person who ultimately owns or controls the customer or on whose behalf the transaction occurs to be identified and reasonably verified.
Action d’implémentation
Trace every ownership layer, examine control by other means and document the fallback used by the applicable sector rule when no natural owner or controller is found.
Preuves à conserver
Ownership chart, cap tables, agreements, control memorandum, identity evidence and sign-off.
Source primaire
Law 27693 art. 3; Supreme Decree 020-2017-JUS arts. 17-21
Legislative Decree 1372 separately identifies a beneficial owner at at least 10% capital, control by other means, then the senior managing official.
Action d’implémentation
Maintain a separate SUNAT beneficial-owner analysis and declaration calendar; apply the current phased filing resolution and update supporting records.
Preuves à conserver
Tax BO register, direct and indirect calculations, control analysis, fallback rationale, declaration and receipt.
Source primaire
Legislative Decree 1372 arts. 3-6; Supreme Decree 003-2019-EF; current SUNAT filing resolutions
In-scope legal persons and legal arrangements must identify, obtain, update, declare, retain and provide beneficial-owner information and supporting documents, submit Form 3800 to SUNAT by the applicable phased deadline, and file an updated declaration within 30 business days after a reportable change. Under RS 000168-2025/SUNAT, the 2026 tranches include July for more than 25 through 50 UIT, September for more than 10 through 25 UIT, and November for up to 10 UIT and specified other or new entities.
Action d’implémentation
Determine the entity's RS 000168-2025/SUNAT tranche and status, calendar the RUC-based due date, submit Form 3800, monitor ownership or control changes and refile within 30 business days.
Preuves à conserver
Tranche analysis, RUC calendar, Form 3800 data, filing receipt, change log, updated declaration and supporting-document archive.
Source primaire
Legislative Decree 1372 arts. 3-7; Supreme Decree 003-2019-EF; RS 000168-2025/SUNAT
A public or registry search does not replace beneficial-owner verification.
Action d’implémentation
Use SUNARP and SUNAT information as corroboration, obtain source documents and resolve opaque nominees, foreign layers, trusts and inconsistent ownership.
Preuves à conserver
Search extracts, source documents, certified foreign records, trust parties, discrepancy investigation and escalation.
Source primaire
Legislative Decree 1372 arts. 4-6; Supreme Decree 020-2017-JUS arts. 17-21

05PEPs, enhanced diligence and remote onboardingPEP status and other heightened-risk conditions require enhanced measures under the controlling sector rule; PEP status alone is not proof of crime.4 éléments+

Reporting entities must identify PEPs using the SBS definition and current functions list, including the January 2025 update.
Action d’implémentation
Screen customers, representatives and beneficial owners at onboarding and continuously; verify the role, dates and relevant family or close-associate exposure required by the sector rule.
Preuves à conserver
PEP search, role evidence, relationship analysis, review date and disposition.
Source primaire
SBS Resolution 4349-2016 as amended by SBS Resolution 00199-2025; applicable sector rule
Higher-risk PEP relationships require senior approval, enhanced source-of-wealth and source-of-funds work and intensified monitoring where the sector rule provides.
Action d’implémentation
Obtain approval before opening or continuing, corroborate wealth and funds and configure risk-proportionate review and monitoring.
Preuves à conserver
Approval, wealth narrative, supporting documents, funds trail, monitoring plan and periodic review.
Source primaire
Supreme Decree 020-2017-JUS arts. 17-21; applicable sector rule
Remote onboarding must use the identity, authentication and evidence methods permitted for the exact regulated sector and product.
Action d’implémentation
Map the remote flow to the applicable annex, test liveness and impersonation resistance, provide accessible fallback and retain reconstructable results.
Preuves à conserver
Legal map, vendor assessment, biometric or liveness tests, device signals, exception flow and monitoring.
Source primaire
Applicable SBS or SMV remote-identification rule; Supreme Decree 020-2017-JUS arts. 17-21
Outsourcing identity checks does not transfer the reporting entity's responsibility.
Action d’implémentation
Contract for evidence access, audit, incidents, data protection and exit; independently test the service and control material changes.
Preuves à conserver
Contract, due diligence, control mapping, sample tests, incidents, change approvals and exit plan.
Source primaire
Supreme Decree 020-2017-JUS arts. 17-21; applicable outsourcing rule

06Monitoring, suspicious reports and confidentialityThe compliance officer decides whether an operation is suspicious and files the ROS through ROSEL. The operation must be reported immediately and no later than 24 hours after it is classified as suspicious; the time used to classify it depends on its nature and complexity.4 éléments+

Completed and attempted operations with indicators of ML or TF must be analyzed and, when suspicious, reported to UIF-Peru by the compliance officer.
Action d’implémentation
Escalate promptly, preserve the detection and decision timestamps, document facts and indicators and file through the live sector channel.
Preuves à conserver
Alert, investigation, decision memorandum, report, acknowledgement and case chronology.
Source primaire
Law 27693 art. 9-A; Supreme Decree 020-2017-JUS art. 25
A ROS must be communicated immediately and in no case later than 24 hours after the operation is classified as suspicious. The period used to classify an operation depends on its nature and complexity.
Action d’implémentation
Record the qualification timestamp, submit through ROSEL within 24 hours, preserve the acknowledgement and escalate any threatened or actual delay.
Preuves à conserver
Rule inventory, detection and qualification timestamps, report, acknowledgement, filing QA and breach escalation.
Source primaire
Supreme Decree 020-2017-JUS art. 25.1-25.3
The existence, content and filing of a ROS and UIF requests are confidential and must not be disclosed to the customer or unauthorized persons.
Action d’implémentation
Restrict access, use neutral customer communications and route disclosure requests to legal and compliance.
Preuves à conserver
Access log, confidentiality acknowledgements, communications, training and disclosure approvals.
Source primaire
Law 27693 arts. 12 and 13; Supreme Decree 020-2017-JUS art. 25
Where additional CDD would alert a suspicious customer, the entity should file without taking that additional step and document why.
Action d’implémentation
Stop the alerting action, preserve the rationale and file under the sector process while maintaining safe operational controls.
Preuves à conserver
Tipping-off assessment, compliance approval, filing, restricted notes and monitoring plan.
Source primaire
Supreme Decree 020-2017-JUS art. 21.4

07Payments, wires, thresholds and agentsRegister thresholds, payment authorization and transfer-data duties must be applied by sector and role; reporting a threshold operation does not itself make it suspicious.4 éléments+

Where no sector threshold applies, the operations register captures individual operations of at least USD 10,000 and multiple operations totaling at least USD 50,000 in a calendar month for or benefiting the same person.
Action d’implémentation
Confirm no sector threshold displaces the default, aggregate across offices and channels and record on the day of the operation.
Preuves à conserver
Threshold legal map, aggregation tests, daily register, exchange-rate source and QA results.
Source primaire
Supreme Decree 020-2017-JUS art. 24.4-24.5
The operations register must be chronological, precise, complete, confidential and available in the form and frequency required by UIF-Peru or the supervisor.
Action d’implémentation
Capture participants, roles, transaction details, accounts, value, currency and other sector fields and reconcile submissions to source systems.
Preuves à conserver
Data dictionary, register extracts, reconciliation, submission receipts, corrections and access logs.
Source primaire
Supreme Decree 020-2017-JUS art. 24
Financial transfers follow the applicable sector rule. From 1 August 2026, PSAVs participating in domestic or cross-border virtual-asset transfers must obtain, retain and securely transmit or make available the prescribed originator and beneficiary information, with additional controls for self-hosted wallets and missing information.
Action d’implémentation
For each rail, capture the controlling originator, beneficiary, account, wallet and traceability fields; transmit securely where required, block or withhold value when mandatory data is absent, document the disposition and assess a ROS.
Preuves à conserver
Transfer message, wallet addresses, identity fields, secure-transmission record, missing-data decision, monitoring and ROS assessment.
Source primaire
SBS Resolution 2660-2015 and applicable financial transfer rule; SBS Resolution 02648-2024 arts. 24-25 and Second Final Complementary Provision
Agents and outsourced payment providers do not remove the licensed or registered principal's responsibility.
Action d’implémentation
Approve agents before use, allocate CDD and reporting responsibilities, monitor performance and ensure immediate evidence access and termination rights.
Preuves à conserver
Agent due diligence, contract, register, training, monitoring, incidents and termination plan.
Source primaire
Law 29985; Supreme Decree 090-2013-EF; Circular 0022-2025-BCRP

08Targeted financial sanctions and freezingPeru implements UN terrorism and proliferation designations through the UIF-Peru administrative-freezing mechanism. Screening alone is not the legal endpoint.5 éléments+

Reporting entities must monitor applicable UN Security Council designations and communicate detected funds or assets to UIF-Peru under the prescribed mechanism.
Action d’implémentation
Screen customers, beneficial owners, counterparties and transactions against current UN lists and escalate a true match without delay.
Preuves à conserver
List source and timestamp, screening configuration, match analysis, escalation and UIF communication.
Source primaire
SBS Resolution 3862-2016 arts. 2-4 as amended by SBS Resolution 2610-2021
After UIF-Peru orders administrative freezing, the reporting entity must execute and report it without delay.
Action d’implémentation
Freeze all in-scope funds or assets immediately on receipt, prevent making value available, notify UIF through the required route and preserve confidentiality.
Preuves à conserver
UIF order, receipt time, freeze timestamps, asset inventory, confirmation and access log.
Source primaire
SBS Resolution 3862-2016 arts. 4-6
When UIF-Peru issues an administrative-freezing measure, the reporting entity must review its operations records and customer, user and provider databases without delay and communicate to UIF-Peru without delay whether funds or other assets are identified, including a negative response when none exist.
Action d’implémentation
Run and evidence the directed search immediately, freeze any identified assets, and send either the asset report or the required no-assets response through the prescribed channel without delay.
Preuves à conserver
UIF measure, search scope and timestamps, systems queried, result, freeze record where applicable, positive or negative UIF communication and acknowledgement.
Source primaire
SBS Resolution 3862-2016 as amended
The freeze remains subject to judicial validation or revocation; release requires the authorized instruction.
Action d’implémentation
Maintain the block until a verified release instruction, then release only within the instruction's scope and retain the complete legal chain.
Preuves à conserver
Court and UIF notices, verification, release approval, timestamps and reconciliation.
Source primaire
Law 27693 art. 3; SBS Resolution 3862-2016 arts. 5-6
A reporting entity receiving a UIF-Peru national administrative-freezing order concerning funds or assets linked to extortion must execute the order immediately, keep it confidential and maintain the restriction for its legally authorized duration.
Action d’implémentation
Authenticate the UIF order, immediately prevent withdrawal, transfer, use, conversion, disposal or movement, preserve confidentiality, track judicial validation or revocation, and release only under article 10-A.7.
Preuves à conserver
UIF order, receipt and execution timestamps, restricted-asset inventory, access log, judicial notices, release authorization and reconciliation.
Source primaire
Law 27693 art. 3-B; Supreme Decree 020-2017-JUS arts. 8-A to 10-A, as inserted by Supreme Decree 007-2025-JUS

09Records and regulator accessRecords must allow UIF-Peru, the supervisor and competent authorities to reconstruct identity, risk, decisions and operations.4 éléments+

The general operations register and backup are retained for 10 years from the operation, unless a sector rule lawfully sets a shorter period that cannot be below 5 years.
Action d’implémentation
Map each record class to its legal trigger, apply a defensible hold process and test retrieval and backup restoration.
Preuves à conserver
Retention schedule, rule mapping, immutable archive, restore tests, legal holds and deletion approvals.
Source primaire
Supreme Decree 020-2017-JUS art. 24.2-24.3
CDD, beneficial-owner, monitoring, reporting and governance evidence must be retained for the period required by the applicable sector rule.
Action d’implémentation
Do not apply the operations-register period mechanically to every record; document each sector trigger and preserve linked decision evidence.
Preuves à conserver
Record inventory, sector schedule, customer closure dates, report links, holds and destruction certificates.
Source primaire
Applicable SBS, SMV or sector rule; Supreme Decree 020-2017-JUS arts. 17-25
UIF-Peru, supervisors, courts and competent authorities may require records within their legal competence.
Action d’implémentation
Authenticate the request, preserve privilege and confidentiality, collect reproducibly and log the exact production and deadline.
Preuves à conserver
Request, authority check, collection log, review, production index and receipt.
Source primaire
Law 27693 arts. 3 and 8-10; Supreme Decree 020-2017-JUS art. 24
Electronic evidence must remain complete, legible, secure and quickly retrievable throughout retention.
Action d’implémentation
Protect metadata, audit access, validate integrity and test that reports, links and source artifacts can be reconstructed.
Preuves à conserver
Integrity hashes, access logs, backup tests, sample retrieval and remediation.
Source primaire
Supreme Decree 020-2017-JUS arts. 24-25; applicable sector rule

10Privacy, biometrics and transfersAML duties provide specific processing purposes but do not displace Peru's personal-data principles, security, transparency and transfer requirements.4 éléments+

Personal data must have a lawful basis and be processed for specified, proportionate purposes with required notice and security.
Action d’implémentation
Map AML and other legal bases by field and purpose, give the required privacy information and restrict reuse and access.
Preuves à conserver
Processing inventory, legal-basis map, notices, access controls, security tests and retention alignment.
Source primaire
Law 29733 arts. 5-12 and 17-20; Supreme Decree 016-2024-JUS
Biometric data is sensitive personal data and remote identity processing requires heightened controls and the consent or other basis allowed by law.
Action d’implémentation
Document necessity and proportionality, minimize templates, test presentation-attack resistance, govern vendors and provide a lawful accessible alternative where required.
Preuves à conserver
Biometric assessment, consent or legal basis, architecture, vendor terms, test results and fallback records.
Source primaire
Law 29733 arts. 2 and 13; Supreme Decree 016-2024-JUS
When an incident exposes large volumes or types of personal data, may affect many people, involves sensitive data, or evidently prejudices another right or freedom, the data-bank holder or controller must notify ANPD no later than 48 hours after learning of it. If the incident affects the data subject's other rights, the controller must also notify that person within 48 hours and without undue delay.
Action d’implémentation
Start the 48-hour clock when the controller obtains knowledge or evidence of the incident; notify ANPD when article 34.1 applies, notify affected data subjects when article 34.3 applies, explain and evidence any delay, and retain the complete incident record.
Preuves à conserver
Incident record, knowledge time, impact assessment, ANPD notification, data-subject communication, delay reasons and remediation.
Source primaire
Supreme Decree 016-2024-JUS arts. 34-36
International transfers and processors require lawful safeguards, security, instructions and accountability; high-risk processing may warrant an impact assessment and designated data officer.
Action d’implémentation
Inventory transfers, execute appropriate clauses, assess destinations and processors, complete required impact work and track the phased data-officer rules.
Preuves à conserver
Transfer map, contract, destination assessment, processor audit, impact assessment and officer designation where applicable.
Source primaire
Law 29733 arts. 11 and 15; Supreme Decree 016-2024-JUS; ANPD transfer guidance

11Practical evidence packsLaunch and ongoing operations should be supported by evidence that can be reviewed without reconstructing the control after the event.4 éléments+

Each product needs an approved legal and regulatory perimeter pack.
Action d’implémentation
Record the entity, product, licenses, supervisor, reporting rule, threshold, timetable, data role and change owner in one controlled pack.
Preuves à conserver
Signed perimeter pack, source snapshots, authorization evidence, rule owner and review date.
Source primaire
Law 27693; Supreme Decree 020-2017-JUS; applicable sector rules
Each customer file must demonstrate identity, authority, beneficial ownership, risk and ongoing monitoring.
Action d’implémentation
Use a quality gate before activation and periodic sample testing after activation; remediate gaps to closure.
Preuves à conserver
Customer index, identity and KYB evidence, ownership chart, risk score, approvals, reviews and QA results.
Source primaire
Supreme Decree 020-2017-JUS arts. 17-21
Reporting controls must demonstrate detection, escalation, decision quality, timeliness and confidentiality.
Action d’implémentation
Test alerts through filing, threshold aggregation, portal continuity and restricted access at least annually and after material change.
Preuves à conserver
Scenario inventory, test cases, case files, receipts, metrics, access review and remediation.
Source primaire
Law 27693 arts. 9-A and 12-13; Supreme Decree 020-2017-JUS arts. 24-25
Legal and regulatory change must be monitored across SBS, UIF-Peru, SMV, BCRP, SUNAT, ANPD, FATF and GAFILAT.
Action d’implémentation
Assign owners, review official sources on a defined cadence and trigger impact assessment, versioning, training and control change.
Preuves à conserver
Source register, dated review log, impact assessments, approvals, releases and training.
Source primaire
Applicable laws and regulator publications listed in Sources

Registre des sources primaires

28 sources utilisées pour cette checklist

Utilisez ces liens pour vérifier la législation, les lignes directrices, les procédures de déclaration et les statuts internationaux.

Réponses directes

Questions KYC, KYB et AML pour Pérou

Who receives suspicious transaction reports in Peru?+

The compliance officer files the ROS with UIF-Peru through the channel prescribed for the reporting entity's sector.

What is the ROS deadline in Peru?+

A ROS must be communicated immediately and no later than 24 hours after the operation is classified as suspicious. The time required to classify the operation depends on its nature and complexity.

What threshold enters the general operations register?+

Only where no sector threshold displaces it: USD 10,000 for an individual operation or USD 50,000 in multiple operations during a calendar month for or benefiting the same person.

How is beneficial ownership determined and declared?+

AML CDD follows the applicable sector rule. Separately, Legislative Decree 1372 uses at least 10% capital, control by other means, and a senior managing official fallback. In-scope entities file Form 3800 under the current phased timetable and update a reportable change within 30 business days; RS 000168-2025/SUNAT places the remaining 2026 tranches in July, September and November according to UIT and entity status.

How long are records retained?+

The general operations register and backup are kept for 10 years from the operation. A sector rule may set a shorter period, but not below five years; other record classes follow their sector rule.

Do payment or e-money products require authorization?+

Often yes. BCRP, SBS or another sector process can apply independently of AML registration, depending on the precise payment, e-money, transfer or financial role.

Are virtual-asset service providers reporting entities?+

Yes. PSAVs within the Peruvian perimeter are UIF-Peru reporting entities under Supreme Decree 006-2023-JUS and SBS Resolution 02648-2024, but AML status should not be mistaken for a general financial license.

What happens on a UN sanctions match?+

Escalate immediately and follow the UIF-Peru mechanism. Once UIF-Peru orders administrative freezing, the reporting entity executes and confirms the freeze without delay.

What privacy rules matter for digital KYC?+

Law 29733 and Supreme Decree 016-2024-JUS govern lawful purpose, notices, sensitive biometric data, security, incidents, processors and international transfers.

Is Peru on a FATF public list?+

Peru was not named on the FATF call-for-action or increased-monitoring lists reviewed 1 August 2026. This does not remove the need for a risk-based country assessment.

Méthode de recherche et de revue

VOVE ID Compliance Research cartographie le périmètre réglementaire, traduit les obligations en contrôles opérationnels, relie les affirmations importantes aux sources et date chaque revue.

General regulatory information, not legal advice, an authorization decision or a substitute for the operative Spanish text, sector rules, current UIF-Peru forms or regulator instructions. Reviewed 1 August 2026. Confirm the entity, activity, customer, product, sector threshold, filing timetable, reporting channel, data role and later developments with qualified Peruvian counsel and the relevant authority before launch.

Pérou KYC, KYB & AML compliance checklist

Que couvre la checklist de conformité pour Pérou ?

Faits réglementaires clés

Exigences et actions de conformité pour Pérou

Only persons within Law 29038, Supreme Decree 020-2017-JUS or a later designation are reporting entities to UIF-Peru.

A reporting entity must implement the AML/CFT prevention system and designate a compliance officer under its applicable sector rule.

Financial, securities, money-transfer and electronic-money activities may require SBS or SMV authorization independently of AML status.

Reporting entities must identify and manage AML/CFT risks through policies, procedures and internal controls required by the applicable sector rule.

The compliance officer must operate independently, preserve confidentiality and report through the governance line required for the sector.

Training, internal review and independent or internal audit obligations vary by sector but form part of the prevention system.

New technologies and remote channels must be risk-assessed before launch and monitored after release.

A reporting entity must identify the customer using reliable data and verify identity under the applicable risk and sector procedure.

The person acting for a customer must be identified and their authority verified.

CDD must be updated and transactions monitored for consistency with the customer's profile and risk.

If required CDD cannot be completed, the reporting entity must not start, must not execute, or must terminate the relationship as applicable and assess a suspicious report.

A legal-person customer must be identified through reliable constitutional, registry, tax, address, purpose and activity evidence.

AML CDD requires the natural person who ultimately owns or controls the customer or on whose behalf the transaction occurs to be identified and reasonably verified.

Legislative Decree 1372 separately identifies a beneficial owner at at least 10% capital, control by other means, then the senior managing official.

A public or registry search does not replace beneficial-owner verification.

Reporting entities must identify PEPs using the SBS definition and current functions list, including the January 2025 update.

Higher-risk PEP relationships require senior approval, enhanced source-of-wealth and source-of-funds work and intensified monitoring where the sector rule provides.

Remote onboarding must use the identity, authentication and evidence methods permitted for the exact regulated sector and product.

Outsourcing identity checks does not transfer the reporting entity's responsibility.

Completed and attempted operations with indicators of ML or TF must be analyzed and, when suspicious, reported to UIF-Peru by the compliance officer.

A ROS must be communicated immediately and in no case later than 24 hours after the operation is classified as suspicious. The period used to classify an operation depends on its nature and complexity.

The existence, content and filing of a ROS and UIF requests are confidential and must not be disclosed to the customer or unauthorized persons.

Where additional CDD would alert a suspicious customer, the entity should file without taking that additional step and document why.

Where no sector threshold applies, the operations register captures individual operations of at least USD 10,000 and multiple operations totaling at least USD 50,000 in a calendar month for or benefiting the same person.

The operations register must be chronological, precise, complete, confidential and available in the form and frequency required by UIF-Peru or the supervisor.

Agents and outsourced payment providers do not remove the licensed or registered principal's responsibility.

Reporting entities must monitor applicable UN Security Council designations and communicate detected funds or assets to UIF-Peru under the prescribed mechanism.

After UIF-Peru orders administrative freezing, the reporting entity must execute and report it without delay.

The freeze remains subject to judicial validation or revocation; release requires the authorized instruction.

A reporting entity receiving a UIF-Peru national administrative-freezing order concerning funds or assets linked to extortion must execute the order immediately, keep it confidential and maintain the restriction for its legally authorized duration.

The general operations register and backup are retained for 10 years from the operation, unless a sector rule lawfully sets a shorter period that cannot be below 5 years.

CDD, beneficial-owner, monitoring, reporting and governance evidence must be retained for the period required by the applicable sector rule.

UIF-Peru, supervisors, courts and competent authorities may require records within their legal competence.

Electronic evidence must remain complete, legible, secure and quickly retrievable throughout retention.

Personal data must have a lawful basis and be processed for specified, proportionate purposes with required notice and security.

Biometric data is sensitive personal data and remote identity processing requires heightened controls and the consent or other basis allowed by law.

International transfers and processors require lawful safeguards, security, instructions and accountability; high-risk processing may warrant an impact assessment and designated data officer.

Each product needs an approved legal and regulatory perimeter pack.

Each customer file must demonstrate identity, authority, beneficial ownership, risk and ongoing monitoring.

Reporting controls must demonstrate detection, escalation, decision quality, timeliness and confidentiality.

Legal and regulatory change must be monitored across SBS, UIF-Peru, SMV, BCRP, SUNAT, ANPD, FATF and GAFILAT.

28 sources utilisées pour cette checklist

Questions KYC, KYB et AML pour Pérou

Méthode de recherche et de revue

Vérifiez une fois. Partout.

Pérou KYC, KYB & AML compliance checklist

Que couvre la checklist de conformité pour Pérou ?

Faits réglementaires clés

Exigences et actions de conformité pour Pérou

Only persons within Law 29038, Supreme Decree 020-2017-JUS or a later designation are reporting entities to UIF-Peru.

A reporting entity must implement the AML/CFT prevention system and designate a compliance officer under its applicable sector rule.

Financial, securities, money-transfer and electronic-money activities may require SBS or SMV authorization independently of AML status.

Reporting entities must identify and manage AML/CFT risks through policies, procedures and internal controls required by the applicable sector rule.

The compliance officer must operate independently, preserve confidentiality and report through the governance line required for the sector.

Training, internal review and independent or internal audit obligations vary by sector but form part of the prevention system.

New technologies and remote channels must be risk-assessed before launch and monitored after release.

A reporting entity must identify the customer using reliable data and verify identity under the applicable risk and sector procedure.

The person acting for a customer must be identified and their authority verified.

CDD must be updated and transactions monitored for consistency with the customer's profile and risk.

If required CDD cannot be completed, the reporting entity must not start, must not execute, or must terminate the relationship as applicable and assess a suspicious report.

A legal-person customer must be identified through reliable constitutional, registry, tax, address, purpose and activity evidence.

AML CDD requires the natural person who ultimately owns or controls the customer or on whose behalf the transaction occurs to be identified and reasonably verified.

Legislative Decree 1372 separately identifies a beneficial owner at at least 10% capital, control by other means, then the senior managing official.

A public or registry search does not replace beneficial-owner verification.

Reporting entities must identify PEPs using the SBS definition and current functions list, including the January 2025 update.

Higher-risk PEP relationships require senior approval, enhanced source-of-wealth and source-of-funds work and intensified monitoring where the sector rule provides.

Remote onboarding must use the identity, authentication and evidence methods permitted for the exact regulated sector and product.

Outsourcing identity checks does not transfer the reporting entity's responsibility.

Completed and attempted operations with indicators of ML or TF must be analyzed and, when suspicious, reported to UIF-Peru by the compliance officer.

A ROS must be communicated immediately and in no case later than 24 hours after the operation is classified as suspicious. The period used to classify an operation depends on its nature and complexity.

The existence, content and filing of a ROS and UIF requests are confidential and must not be disclosed to the customer or unauthorized persons.

Where additional CDD would alert a suspicious customer, the entity should file without taking that additional step and document why.

Where no sector threshold applies, the operations register captures individual operations of at least USD 10,000 and multiple operations totaling at least USD 50,000 in a calendar month for or benefiting the same person.

The operations register must be chronological, precise, complete, confidential and available in the form and frequency required by UIF-Peru or the supervisor.

Agents and outsourced payment providers do not remove the licensed or registered principal's responsibility.

Reporting entities must monitor applicable UN Security Council designations and communicate detected funds or assets to UIF-Peru under the prescribed mechanism.