meta_id 3324745

On July 14, 2026, Peru's National Institute for the Defense of Competition and Protection of Intellectual Property (Indecopi) confirmed a sanction against Banco BBVA Perú S.A. for failing to adopt necessary security measures to prevent an unauthorized transaction that harmed a consumer. In a second administrative instance decision, Indecopi's Regional Commission in Puno determined that the bank had not implemented adequate monitoring and alert systems to identify that a transfer of 10,000 Peruvian soles (S/10,000) to a third party deviated from the consumer's typical spending patterns. The bank's failure to detect this unusual operation violated its duty of suitability under Article 19 of the Consumer Protection and Defense Code. Indecopi imposed a fine of 3.78 Unidad Impositiva Tributaria (UIT), equivalent to S/20,790 (approximately 20,790 Peruvian soles). Additionally, the regulator ordered BBVA to reimburse the consumer for the unauthorized transaction amount, associated commissions, expenses, and other costs incurred as a result within fifteen business days. During proceedings, BBVA argued that the transaction complied with its established authentication and security mechanisms for digital channels. However, Indecopi determined that compliance with authentication protocols did not exempt the bank from its obligation to maintain effective monitoring systems capable of detecting unusual operations and taking timely action to prevent consumer harm. The final resolution (Resolution Final Nº024-2026/CPC-INDECOPI-PUN) is publicly available and establishes precedent regarding financial institutions' responsibilities to implement proactive fraud detection measures beyond standard authentication protocols.