# Cybersecurity in the financial sector: what the BCU requires.

> Plain-text version for machine reading (LLMs). Original page: https://damian.dearce.com.uy/en/compliance/bcu-sistema-financiero/

Uruguay's Central Bank (BCU) requires supervised entities to run an information security function independent from IT, periodic technical testing, continuous monitoring and incident reporting. Since October 2026, strong customer authentication is also mandatory.

_Updated: 2026-10-20_

## At a glance

- **Core rule:** Minimum Management Standards (EMG), 1 Jan 2026 version
- **Applies to:** Financial intermediation institutions and larger credit administrators
- **Vulnerability scanning:** At least monthly (EMG 83.11)
- **Strong authentication:** Circular 2497, in force since 1 Oct 2026
- **Reference framework:** AGESIC Cybersecurity Framework

## Security governance

- The Board approves an information security strategy and governance framework that includes cybersecurity (EMG 6.9–6.13).
- The information security function must be functionally and budgetarily independent from IT (EMG 57.5). The rule does not say “CISO”, but an independent function.
- IT and cybersecurity processes must be audited regularly by independent people.


## Technical requirements (EMG 83)

- MFA for all remote access, identity and privileged account management, and annual access reviews.
- Automated vulnerability scans at least monthly, with remediation deadlines by criticality.
- Penetration testing of critical applications based on risk and exposure.
- Tamper-proof logs, SIEM with continuous monitoring and threat intelligence.
- Incident drills at least once a year.

In addition, the incident response plan is tested at least once a year and the continuity plan must cover cyberattack scenarios and outsourced services (EMG 61 and 62). Cloud use requires controls equivalent to or stronger than internal ones (EMG 82.13).


## Incident reporting

- Entities supervised by the SSF: emerging events are reported to the Superintendency “as soon as possible”, including those at outsourced providers (Communication 2021/105).
- Payment system players (acquirers, processors, e-money issuers, among others): initial report within 4 hours at most, follow-up every 48 hours and closure within 15 days (Communication 2024/018).

Decree 66/025 lists banking and finance among the critical sectors, so the 24-hour reporting obligation to CERTuy should also be reviewed.


## Strong customer authentication

Circular 2497 requires, from 1 October 2026, at least two authentication factors from different categories to access digital channels, make transfers or payments, request remote loans and change sensitive data, together with transaction monitoring and user notifications. It also covers credit administrators, exchange houses, financial services companies, money transfer companies and peer-to-peer lending platforms.

## Deadlines and frequencies

| Deadline | What | Rule |
|---|---|---|
| Monthly | Automated vulnerability scanning | EMG 83.11 |
| Annual | Incident plan test and drills | EMG 61 and 83.17 |
| Annual | User and permission recertification | EMG 63 |
| 4 hours | Initial incident report (payment system) | Communication 2024/018 |
| 1 Oct 2026 | Strong authentication in force | Circular 2497 |

## How I help

- Assessment against the BCU information security and cybersecurity standards.
- Security function independent from IT as a vCISO, reporting to the Board.
- Pentesting of critical applications and vulnerability management with criticality-based deadlines.
- SIEM use case design, annual drills and SSF reporting procedure.

## FAQ

### Does the BCU require a CISO?

It requires an information security function that is functionally and budgetarily independent from IT (EMG 57.5). It does not use the term CISO, but in practice that is the role.

### How often are vulnerability scans required?

At least once a month, automated (EMG 83.11). Penetration tests on critical applications depend on risk and exposure.

### Since when is strong authentication mandatory?

Since 1 October 2026, under BCU Circular 2497.

## Official sources

- [Minimum Management Standards, 1 Jan 2026 version (BCU)](https://www.bcu.gub.uy/Servicios-Financieros-SSF/Documents/EMG_010126.pdf)
- [Guide to the information security standards (BCU)](https://www.bcu.gub.uy/Servicios-Financieros-SSF/Documents/guia%20emg%20seguridad%20de%20la%20informacion.pdf)
- [Incident reporting, RR-SSF-2021-353 (BCU)](https://www.bcu.gub.uy/Servicios-Financieros-SSF/Resoluciones_SSF/RR-SSF-2021-353.pdf)
- [Communication 2024/018, payment system (BCU)](https://www.bcu.gub.uy/Comunicados/seggco24018.pdf)
- [Circular 2497, strong authentication (BCU)](https://www.bcu.gub.uy/Circulares/seggci2497.pdf)

_General information, verified against official sources on the date shown. It does not replace legal advice for your case._

## Contact

- WhatsApp: +598 99 231 327 (https://wa.me/59899231327)
- Email: damian.de.arce@gmail.com
- LinkedIn: https://www.linkedin.com/in/damiandearce/