Peru: technology regulation at a glance

Framework: Supreme Decree 006-2023-JUS (VASP AML registration); SBS Resolution 02648-2024 (SPLAFT for PSAVs); pending Bill 1204/2021-CR (Framework Law for Commercialization of Cryptoassets); supervised by SBS/UIF-Perú for AML and SMV for securities

Crypto assets are legal to own and trade in Peru but operate largely without a comprehensive licensing or consumer-protection framework. The primary binding regulation is SBS Resolution 02648-2024, which subjects domestically incorporated Virtual Asset Service Providers (PSAVs) to full AML/CFT compliance (SPLAFT) and UIF-Perú reporting. A draft Framework Law for the Commercialization of Cryptoassets (Bill 1204/2021-CR) that would establish a licensing regime and a unified registry (RUPIC) remains pending in Congress as of mid-2026, with regulators having flagged technical objections.

Framework: Law No. 31814 (Ley que promueve el uso de la inteligencia artificial en favor del desarrollo económico y social del país, 2023) and its implementing regulation Supreme Decree No. 115-2025-PCM (published 9 September 2025, in force 22 January 2026); overseen by the Secretariat of Government and Digital Transformation (SGTD) of the Presidency of the Council of Ministers (PCM).

Peru enacted Law No. 31814 in 2023 establishing a general AI framework, then approved its full implementing regulation (DS 115-2025-PCM) on 9 September 2025, making it the first Latin American country with a comprehensive, cross-sectoral AI regulation. The regulation, in force from 22 January 2026, adopts a risk-based approach inspired by the EU AI Act and applies to public entities, private companies, academia, and civil society within the National Digital Transformation System. Peru additionally approved a National AI Strategy 2026-2030 (ENIA, Ministerial Resolution No. 152-2026-PCM, 1 May 2026) setting governance obligations for all public entities.

Framework: Ley N° 29733, Ley de Protección de Datos Personales (2011), as re-regulated by Supreme Decree N° 016-2024-JUS (in force 30 March 2025); supervised by the Autoridad Nacional de Protección de Datos Personales (ANPDP), under the Ministry of Justice and Human Rights

Peru has a comprehensive personal data protection regime anchored in Law 29733 of 2011. A fully revised implementing regulation (Supreme Decree 016-2024-JUS, published 30 November 2024) entered into force on 30 March 2025, replacing the 2013 rules and introducing GDPR-adjacent obligations including mandatory Data Protection Officers, 48-hour breach notification, and extraterritorial scope covering foreign entities that target or profile Peruvian residents. The ANPDP is the dedicated supervisory authority with investigation, sanction, and corrective-order powers.

Framework: Law No. 29985 (Electronic Money Law, 2013) and its regulation (Supreme Decree 090-2013-EF), plus SBS Resolution 6284-2013 governing Electronic Money Issuing Companies (EEDE), supervised by the Superintendencia de Banca, Seguros y AFP (SBS); payment systems and immediate-payment rails are regulated by the Banco Central de Reserva del Perú (BCRP) under the National Payment System Regulation.

Peru has an in-force licensing regime for e-money: since 2013, Law 29985 lets the SBS authorize and prudentially supervise Electronic Money Issuing Companies (EEDE), and the BCRP regulates payment systems and instant-payment interoperability (a new services-based National Payment System Regulation took effect 1 April 2026, formalizing PSP/acquirer/payment-initiation authorizations). However, Peru has NO single comprehensive 'fintech law', open finance is only at the roadmap stage (SBS Hoja de Ruta, Feb 2026, with third-party providers still outside the regulatory perimeter), and BNPL has no dedicated framework, so non-deposit fintech activities are largely covered by sectoral/registration rules rather than one unified statute.

Framework: Decreto Legislativo N° 1582 (14 Nov 2023), amending Decreto Legislativo N° 1350 (Ley de Migraciones, 2017); administered by Superintendencia Nacional de Migraciones (Migraciones)

Peru legislated a dedicated 'nómada digital' (digital nomad) migration category in November 2023 via Decreto Legislativo 1582, but as of May 2026 the visa remains unavailable in practice: Migraciones' administrative procedures register (TUPA), last updated September 2025, contains no entry for it. Remote workers have no clearly sanctioned alternative pathway, as the Rentista visa requires lifetime guaranteed passive income (not remote-work earnings), and tourist status does not legally authorise remote work.

Framework: Ministry of Transport and Communications (MTC) and OSIPTEL (telecom regulator) exercise principal authority; no comprehensive online-safety statute exists. Key instruments: Supreme Decree No. 035-2019-MTC (executive platform-blocking); Law No. 29733 / Supreme Decree No. 016-2024-JUS (personal data protection); ISP child-safety obligations under CSEA-related law; Proyecto de Ley No. 10880/2024-CR (proposed children's digital-wellbeing law, in legislative process as of 2025).

Peru's online-safety and content-moderation framework is fragmented: it relies on sector-specific decrees, consumer-protection enforcement, and data-protection rules rather than a comprehensive platform-safety law. A 2019 executive decree empowers the MTC to order ISPs to block apps and websites without judicial oversight, upheld by the Supreme Court in April 2025, raising civil-liberties concerns. Significant proposed legislation on children's online protection was advancing through Congress in 2025 but had not yet been enacted into a standalone online-safety law.

Framework: Decreto de Urgencia N° 007-2020 (Digital Trust Framework / Marco de Confianza Digital); Ley N° 30999 (Ley de Ciberdefensa); Decreto Supremo N° 016-2024-JUS (Personal Data Protection Regulation); National Center for Digital Security / PECERT (CSIRT)

Peru does not have a single comprehensive NIS2-style cybersecurity statute. Instead, it operates through overlapping instruments: the 2020 Digital Trust Framework (DU 007-2020) mandates incident notification to a National Center for Digital Security for public entities and key private-sector operators; Law 30999 (2019) and its 2024 Regulation govern military cyberdefense; and the 2024 personal-data-protection regulation (DS 016-2024-JUS, in force March 2025) adds a 48-hour breach-notification duty. Together these create sector-differentiated obligations rather than a unified framework.

Framework: Ley General de Sociedades (Ley 26887); Decreto Legislativo 757 (Ley Marco para el Crecimiento de la Inversión Privada); Decreto Legislativo 662 (Ley de Fomento y Garantías a la Inversión Extranjera); administered by SUNARP, SUNAT, and ProInversión

Foreign nationals may own up to 100% of a Peruvian company and receive legally equal treatment to domestic investors under Constitutional Article 63 and Decree Laws 662 and 757. Company formation requires 6-7 sequential steps including notarization, SUNARP registration, SUNAT tax ID, and mandatory FDI registration with ProInversión, with a typical timeline of 2-4 weeks. There is no statutory minimum share capital for most entity types, but a Peru-domiciled legal representative is required.