Operational resilience in the Peruvian financial system

What it is about

Oscar Basso Winffel, risk manager at Peru's SBS, explained at the Third Annual Risk Conference (September 2025) how digitalization changes operational risk and what the Peruvian supervisor is doing to strengthen operational resilience.

The 36 slides start from the new context of business and technologies, review the risk of services provided by third parties and their life cycle, operational resilience in the face of unforeseen changes and cybersecurity management (regulation, supervision, incident reporting and the financial sector's national strategy), and close with conclusions.

Objectives

• Explain how digitalization modifies operational risk, cybersecurity and business continuity.
• Present the supervisory approach to third-party risks and the resilience of digital channels.
• Share the Peruvian cybersecurity strategy for the financial sector.

Key takeaways

1. Demand and supply of digital financial services are growing, calling for comprehensive risk management that combines operational risk, cybersecurity and business continuity.
2. The international regulatory context is adapting, for example with the European Digital Operational Resilience Act (DORA).
3. Dependence on third parties offers flexibility, scalability and specialization, but creates supervisory challenges; more intensive management of critical providers is expected throughout the service life cycle.
4. The proportion of interruption time caused by failures of technology components and providers has increased, so prioritized services in digital channels and their tolerance to interruption are identified.
5. The national cybersecurity strategy for the financial sector brings together the Ministry of Economy, the Central Bank, the SMV and the SBS, with a public-private forum.