Payment cards and aggregators are regulated: minimum capital, risk, and cybersecurity

The Financial and Monetary Policy and Regulation Board issued resolution JPRFM-2026-048-T, which reforms the Codification of Monetary, Financial, Securities, and Insurance Resolutions and incorporates a single regulation for the operation of payment cards in Ecuador. The decision was adopted in ordinary session No. 023-2026 on November 6, 2026, and was published in the Fifth Supplement of the Official Registry No. 405 on Monday, November 9, 2026. The new framework applies to issuers, financial and non-financial acquirers, affiliated establishments, and payment aggregators.

The resolution repealed Chapter III of Title II of Book I of the Codification, which regulated credit, debit, and payment cards issued by entities under the control of the Superintendency of Banks, and Section X of Chapter XXXVI referring to the Popular and Solidarity Financial Sector. In its place, it incorporated Title V “Regulation governing the operation of payment cards in Ecuador,” consisting of six chapters and 61 articles covering issuance, acquiring, acceptance, processing, clearing, and settlement. The Central Bank of Ecuador assumes the control, registration, vigilance, and operational and technological supervision of the system.

The regulation was based on Technical Report No. BCE-GSIMP-2026-047, dated October 29, 2026, and Legal Report No. BCE-GJ-020-2026, submitted via Memorandum No. BCE-BCE-2026-0515-M. The instrument was signed by the president of the Board, Gustavo Estuardo Camacho Dávila, and certified by the technical secretary, Ninoska Geovanna Ceballos Pin. The same bulletin includes resolution JPRFM-2026-049-M, which reviewed the quarterly report on liquidity reserves, reserve requirements, and the domestic liquidity ratio for the second quarter of 2026.

Aggregators with minimum capital and segregated accounts

Article 58 requires non-financial legal entities requesting authorization as payment aggregators to comply, in addition to general requirements, with the following:

• Be incorporated as corporations (sociedades anónimas) or limited liability companies in Ecuador, with subscribed and paid-in capital in cash equal to or greater than USD 250,000.00, fully paid at the time of the application.
• Maintain capital of no less than 2% of the average monthly amount of operations processed and settled in the last fiscal year, with a floor of USD 250,000.00.
• Hold funds destined for the settlement of operations to affiliated establishments in segregated accounts within authorized financial entities.

For non-financial acquirers, Article 8 increases the subscribed and paid-in capital to USD 500,000.00; from the second year onwards, they must prove at least 5% of the monthly average of processed and settled transactions, with the same floor of USD 500,000.00. They are also required to have a corporate purpose and economic activity registered with the Internal Revenue Service linked to payments or transfers, corporate governance with a board of directors, PCI DSS certification, an Acquiring Operating Manual, and a current license from at least one card brand.

Risks, cybersecurity, and authentication

Article 59 obliges aggregators to implement a comprehensive risk management framework proportional to their volume of operations, with explicit coverage of operational, liquidity, legal, fraud, cybersecurity, and systemic risk. Issuers, for their part, must apply adaptive multi-factor authentication in all transactions, with at least two independent factors: one during card activation and another during its use. The enrollment of cards in applications and online payments without prior linking must also be authenticated, at no cost to the holder.

Notifications to the cardholder must be sent in real-time and simultaneously through at least two independent electronic means, with an option for immediate blocking if the operation is not recognized. Customer service must operate 24 hours a day, seven days a week. The issuer will be liable for transactions occurring after the report of theft or loss and for computer fraud resulting from failures in its systems.

Interoperability and merchant protection

Acquirers must process, transmit, and clear payment orders within a period not exceeding one day, and settle funds to affiliated merchants in a maximum of five business days; for deferred consumption, the period runs from the date the installment becomes due. Acceptance points, terminals, and electronic channels must admit cards from different brands and issuers, and aggregators, gateways, and processors may not impose unjustified technical restrictions.

The regulation prohibits exclusivity clauses in contracts with affiliated establishments and mandates maintaining the same price and the same discounts applicable to cash payments for card payments. It also prohibits forcing the individual or mass migration of cards, except for authorized technological security updates.

Adaptation periods

• Six months for the Superintendency of Banks, the Superintendency of Popular and Solidarity Economy, and the Central Bank of Ecuador to adjust their regulations.
• One year, from the date of publication, for payment aggregators to establish the subscribed and paid-in capital of USD 250,000.00.
• Current rates remain in effect until the Board resolves the corresponding matters.
• The resolution is effective from its issuance on November 6, 2026, without prejudice to its publication.

The impact falls directly on banks, cooperatives, neobanks, acquiring and aggregation fintechs, and merchants that accept cards: the new capital floors and the requirements for segregated accounts organize a segment that until now had no rules of its own, while the interoperability obligation and the prohibition of exclusivity aim to reduce acceptance barriers and provide users with a more open and competitive payment offering.

Source: Official Registry, Fifth Supplement No. 405, November 9, 2026, Section I (Executive Branch), p. 2 (official reference: JPRFM-2026-048-T).