Choosing a credit bureau in Peru
Peru's credit data is held in one public register, the SBS Central de Riesgos, and a set of private bureaus including Equifax, Sentinel and others. The private bureaus need no licence, and the SBS says it does not supervise them. Their default records also follow a different clock: private bureaus must remove a default five years after payment, while the SBS register has no time limit. You decide what each register adds to the credit decision before comparing bureau prices.
The SBS and private bureaus show different histories
The SBS Central de Riesgos consolidates information reported by supervised lenders. Private credit bureaus, called CEPIRS in Peru, hold information from their own sources. Because the two types of register keep defaults for different periods, the same applicant can have different records in each.
| Register | Run by | Supervised by | Defaults kept |
|---|---|---|---|
| Central de Riesgos | SBS | SBS | No time limit |
| Equifax (formerly Infocorp) | Equifax Perú S.A. | Not the SBS | 5 years after payment |
| Sentinel | Experian Perú S.A.C. | Not the SBS | 5 years after payment |
| DataCrédito | Experian Perú S.A.C. | Not the SBS | 5 years after payment |
| Xchange | Not found | Not the SBS | 5 years after payment |
A private CEPIR must remove a default five years after payment or after the claim has prescribed. The Central de Riesgos has no time limit for publishing information, according to the SBS. An older default therefore remains in the SBS register after it has left a private report.
If you are supervised by the SBS, read the Central de Riesgos to weigh the applicant’s total debt in the system, and the spouse’s where relevant, as part of the affordability check. SBS Res. 6941-2008 art. 5 sets out this requirement.
Check each bureau’s sources and oversight
The SBS annex names Equifax, Sentinel, Experian and Xchange among the private CEPIRS. Equifax Perú S.A. was formerly called Infocorp, and Experian Perú S.A.C. operates Sentinel and DataCrédito.
Private CEPIRS can be established without a licence, and the SBS’s oversight covers its own Central de Riesgos. Ley 27489 sets requirements for private bureaus, with enforcement by INDECOPI’s consumer protection commission.
Ask each provider to describe the sources behind its reports, its complaint process and the controls it uses. Then check those descriptions against reports on your own applicants. A familiar name cannot tell you whether the information will be useful for your book.
Set policy for old defaults in SBS records
Write the policy for a disagreement before an application reaches the cut-off. Information reported by supervised lenders appears in the SBS register, which has no time limit. A private report follows the retention period for defaults. Those records can therefore differ even when both are correctly reflecting the information they hold.
For example, suppose an applicant’s paid default is more than five years old. The private report no longer includes it, and the SBS register still shows it. Decide whether that record changes approval, the cut-off or a further review, and make the same rule apply to comparable applicants. Otherwise, the source that happened to be read can change who enters the book and which risk you accept.
Build applicant duties into lending decisions
The duties around credit data and decisions apply whichever private bureau you choose. Under Ley 29733, you may use creditworthiness data and data needed to prepare, enter into or perform a contractual relationship, and need not obtain consent. For decisions with legal or significant effect, the law requires a person to have the possibility of defending their view when solely automated evaluation is used. That restriction has an exception for decisions within the negotiation, conclusion or performance of a contract. Separately, the rules require informing people about automated decisions, including profiling.
| Step | The duty | Where |
|---|---|---|
| Before the pull | No consent needed for credit data | Ley 29733 art. 14.3 |
| The decision | A route to give their view on an automated decision | Ley 29733 art. 23 |
| A denial | The reasons, in writing, within 7 business days of the request | Res. SBS 01689-2025 |
| After you lend | Report to the Central de Riesgos, if you are supervised | Ley 26702 art. 159 |
For a denial, provide the reasons in writing within seven business days if the applicant requests them. If the denial is tied to prudential rules such as over-indebtedness or an AML profile, state that instead. If you are supervised by the SBS, include reporting to the Central de Riesgos in your post-loan process.
Measure the value of a second bureau
Compare bureau options on your own applicants before paying for a second report. Before pulling a report, you can verify an applicant’s identity through RENIEC, which offers firms fingerprint and facial biometric verification web services under a signed convenio. Start with the first bureau, then call the second only for applicants with no file at the first. Record what the second returns and whether that information changes the decision. A no-file result measures additional coverage.
Count the additional files, the good and bad applicants each source flags, and the resulting changes to approvals, losses and profit. Set those outcomes against the price per call. Buy the second source only if the additional information changes decisions enough to justify the cost.
The data source waterfall tool compares one source, both sources and calling the second only when the first has no hit, weighing hit rates, flagged good and bad applicants, call prices, losses and profit. Decisimo’s data source documentation describes how a data source connects to any REST API or SOAP web service within decision logic, and how a failed call routes to a fallback branch.
Put bureau proposals through your decision flow
Before signing, settle what each register contributes and what a private bureau must add to the decisions on your book. Use this sequence to evaluate the registers and bureau options.
- Define what you need from the SBS Central de Riesgos and what a private bureau should add. For businesses outside SBS supervision, confirm whether and how they can obtain the register’s information before relying on it.
- Identify the named private CEPIRS in the SBS annex. Note that Experian operates both Sentinel and DataCrédito.
- Have each bureau state where its files come from, how it handles complaints and what controls it uses. Check those answers against reports on your own applicants.
- Write the policy for an old default when the records diverge, taking account of the different retention periods.
- Prepare to give denial reasons in writing within seven business days of a request, or to state when the denial is tied to a prudential rule or AML profile.
- Tell applicants when decisions are automated and give them a route to put their view. Build the restriction on solely automated decisions with legal or significant effects into the decision process.
- Compare a second bureau on your own applicants, calling it only when the first has no file. Buy it only if the additional information changes decisions enough to justify its cost.
Questions lenders ask about Peru’s credit bureaus
How many credit bureaus are there in Peru?
The SBS annex names four private CEPIRS: Equifax, Sentinel, Experian and Xchange. It is not a fixed total because private CEPIRS can be established freely. The SBS also runs the public Central de Riesgos.
Is Infocorp the same as Equifax?
Yes. Equifax Perú S.A. was formerly called Infocorp.
Who supervises credit bureaus in Peru?
Private CEPIRS fall under enforcement by INDECOPI’s consumer protection commission, and the SBS oversees its own Central de Riesgos.
What is the difference between the SBS Central de Riesgos and a private bureau?
Supervised lenders report to the SBS Central de Riesgos, which has no time limit for publishing information. Private CEPIRS hold information from their own sources and must remove defaults after the statutory retention period.
How long does a default stay on a Peruvian credit report?
A private CEPIR may hold a default for up to five years after payment or after the claim has prescribed. The SBS Central de Riesgos has no time limit.
Do I need the applicant’s consent to pull a credit report in Peru?
No, not for creditworthiness data or data needed to prepare, enter into or perform a contractual relationship under the law.
What must I tell an applicant I decline?
On request, provide the reasons in writing within seven business days. If the denial is tied to prudential rules such as over-indebtedness or the AML profile, state that instead.
Can I verify an applicant’s identity before pulling a credit report?
Yes. RENIEC offers firms fingerprint and facial biometric verification web services under a signed convenio.
