Countries › Peru › Guide › 13. Regulation › Regulation in Peru: merger control, cartels and competition fines, personal data, corporate liability for corruption and anti money laundering

Regulation in Peru: merger control, cartels and competition fines, personal data, corporate liability for corruption and anti money laundering

Argentina. For full detail on Argentina, go to The Argentine Thread.

Last verified: 2026-10-28 · Status: Changing

Since 2021 Peru requires INDECOPI clearance before closing any merger or acquisition of control where the parties' combined Peruvian sales or assets reach 118,000 UIT (S/ 649 million, about US$188 million) and at least two parties each reach 18,000 UIT (S/ 99 million). Closing early makes the acts void. Price fixing, output limits, market sharing and bid rigging between competitors are banned outright, with fines of up to 12 percent of the offender's group sales. The data protection regulation in force since 30 March 2025 reaches foreign companies that target people in Peru, requires breach notice within 48 hours and phases in a data protection officer. Companies, including foreign ones active in Peru, answer for bribery, money laundering, tax and customs crimes with fines of up to six times the benefit or 10,000 UIT, unless they had an adequate prevention model. Banks, notaries, realtors and other obligated subjects must run an AML system and report suspicious operations to the UIF within 24 hours.

USD figures use S/ 3.452 per US dollar, the banking system selling rate published by the Superintendencia de Banca, Seguros y AFP for 27 October 2026, from the Banco Central de Reserva del Perú statistics series PD04640PD. UIT based amounts use the 2026 UIT of S/ 5,500 set by Decreto Supremo Nº 301-2025-EF, as cited in SUNAT Resolución de Superintendencia Nº 000016-2026/SUNAT. Competition fines are computed at the UIT in force on the date of payment. Conversions are for orientation only.

Key facts

Merger notification threshold, combined Peruvian sales or assets of the parties	118,000 UITLey Nº 31112 art. 6.1 a), as of 2026-10-28 · in force
Merger notification threshold, Peruvian sales or assets of each of at least two parties	18,000 UITLey Nº 31112 art. 6.1 b), as of 2026-10-28 · in force
Reportable mergers must wait for clearance before closing	Yes textLey Nº 31112 art. 23, as of 2026-10-28 · in force
INDECOPI phase 1 review period	30 business daysLey Nº 31112 art. 21.4, as of 2026-10-28 · in force
INDECOPI phase 2 maximum review period, extendable by 30	90 business daysLey Nº 31112 art. 21.8, as of 2026-10-28 · in force
Maximum competition fine, very serious infringement, as share of group sales	12 %TUO DL 1034 (DS Nº 111-2024-PCM) art. 46.1 c), as of 2026-10-28 · in force
Maximum fine on each responsible director or representative	100 UITTUO DL 1034 (DS Nº 111-2024-PCM) art. 46.3, as of 2026-10-28 · in force
Hard core horizontal cartels are absolute prohibitions	Yes textTUO DL 1034 (DS Nº 111-2024-PCM) art. 11.2, as of 2026-10-28 · in force
Limitation period for anticompetitive conduct	5 yearsTUO DL 1034 (DS Nº 111-2024-PCM) art. 45, as of 2026-10-28 · in force
Current data protection regulation in force from	2025-03-30 dateDS Nº 016-2024-JUS, First Final Complementary Provision, as of 2026-10-28 · in force
Maximum data protection fine	100 UITLey Nº 29733 art. 39, as of 2026-10-28 · in force
Data protection fine cap as share of prior year gross income	10 %Ley Nº 29733 art. 39, as of 2026-10-28 · in force
Applies to foreign controllers targeting or profiling people in Peru	Yes textDS Nº 016-2024-JUS art. VI, as of 2026-10-28 · in force
Deadline to notify a qualifying security incident to the Authority	48 hoursDS Nº 016-2024-JUS art. 34.1, as of 2026-10-28 · in force
Companies answer in the criminal process for listed corruption and economic crimes	Yes textLey Nº 30424 art. 1 and 3, as amended by Ley Nº 31740, as of 2026-10-28 · in force
Maximum corporate fine where the benefit cannot be determined	10,000 UITLey Nº 30424 art. 7, as amended by Ley Nº 31740, as of 2026-10-28 · in force
Maximum corporate fine as multiple of the benefit	6 times benefitLey Nº 30424 art. 7, as amended by Ley Nº 31740, as of 2026-10-28 · in force
Default threshold to record a single operation in the AML register	10,000 USDDS Nº 020-2017-JUS art. 24.4 a), as of 2026-10-28 · in force
Retention period for the AML operations register	10 yearsDS Nº 020-2017-JUS art. 24.2, as of 2026-10-28 · in force
Maximum time to report a suspicious operation to the UIF after classifying it	24 hoursDS Nº 020-2017-JUS art. 25.1, as of 2026-10-28 · in force
Unidad Impositiva Tributaria 2026	5,500 PENDS Nº 301-2025-EF, as of 2026-10-28 · in force

The rule

1. Any act that transfers or changes control of a company or part of it is a concentration: a merger of independent agents, the direct or indirect acquisition of rights giving sole or joint control, a full function joint venture, or the acquisition of control over another agent's operating productive assets. Intra group reorganisations, internal growth, deals without effects in Peru and temporary holdings by financial entities for resale are excluded. Acts between the same parties within two years count as one deal. Prior control applies when both tests are met in the fiscal year before notification: (a) the parties' combined annual sales or gross income, or assets, in Peru reach 118,000 UIT, and (b) at least two parties each reach 18,000 UIT. The thresholds can only be changed by a law. Below them, notification is voluntary, but the INDECOPI Technical Secretariat may act on its own initiative where there are reasonable signs of harm to competition.
Cost to do it: The filing pays a processing fee (derecho de tramitación) set by supreme decree and listed in the INDECOPI TUPA (art. 19); the amount was not verified this session, so check the current TUPA. The main cost is preparing the filing, which is a sworn statement (art. 31), with local competition counsel.
Example: 118,000 UIT is S/ 649,000,000 and 18,000 UIT is S/ 99,000,000 at the 2026 UIT. A foreign buyer with S/ 560 million of Peruvian sales acquiring control of a Peruvian company with S/ 120 million passes both tests (combined S/ 680 million; both parties at least S/ 99 million) and must file before closing. / The combined threshold is about US$188.0 million and the individual threshold about US$28.7 million. In the example the buyer has about US$162.2 million and the target about US$34.8 million of Peruvian sales, so the deal is reportable.Ley Nº 31112, Ley que establece el control previo de operaciones de concentración empresarial (El Peruano, 7 January 2021), Art. 5 and art. 6, 2021-01-07 official text · verified 2026-10-28

2. A reportable deal cannot be executed until INDECOPI's Commission for the Defence of Free Competition rules or the procedure ends. Executing it without filing or before the decision makes the resulting acts void and without legal effect, on top of fines. Where control is acquired through a tender offer (OPA), clearance must come before the SMV tender procedure. After admission, phase 1 lasts 30 business days, in which the Commission clears the deal or finds serious concerns and opens phase 2, which lasts up to 90 business days, extendable by 30 more. The Commission can clear, clear with conditions or prohibit. If it misses the legal deadline, positive administrative silence applies and the deal is cleared. Appeals go to the INDECOPI Tribunal within 15 business days, which rules within 90 business days. Failing to file is a minor infringement, closing before clearance a serious one, and closing after a prohibition or breaching conditions a very serious one, fined under the DL 1034 scale in the next rules. Infringements lapse four years after the last act.
Cost to do it: Timeline cost: admission review of up to 10 business days for corrections, then 30 business days in phase 1 and up to 120 business days in phase 2, plus up to 15 business days if hearings are requested (art. 24). Closing early risks nullity of the closing acts and a fine for a serious infringement of up to 1,000 UIT (S/ 5.5 million, about US$1.59 million), capped at 10 percent of group sales.
Example: A deal admitted on 2 November 2026 with no phase 2 could be cleared within 30 business days, around mid December 2026 once public holidays are counted; a phase 2 can push clearance well into 2027. / For a US$200 million acquisition, build roughly two months for a clean phase 1 and up to about eight further months for a full phase 2 into the signing to closing period.Ley Nº 31112 (El Peruano, 7 January 2021), Art. 21, art. 23, art. 25, art. 26, art. 27, art. 28 and art. 30, 2021-01-07 official text · verified 2026-10-28

3. Horizontal collusion between competitors that is not ancillary to a lawful agreement and that aims to fix prices or other commercial terms, limit output or sales (in particular by quotas), share customers, suppliers or territories, or set bids or abstentions in public procurement, tenders and auctions, is an absolute prohibition: it is unlawful without proof of effects. Other horizontal practices, vertical practices (which need prior dominance of at least one party) and abuse of dominance are relative prohibitions, judged on their effects. The law applies to conduct with effects in Peru even if it originated abroad, and to persons outside the market who plan, broker or facilitate an absolutely prohibited practice.
Cost to do it: No filing exists for agreements; the cost is an antitrust review of distribution, pricing and information sharing arrangements and of tender conduct by local counsel.
Example: Two cement distributors in Lima agree to keep prices at S/ 30 per bag: this is an absolute prohibition, and the fact that prices then fell does not help them. / A regional sales manager of a US group who swaps bid prices with a competitor before a public works tender exposes both companies, and the manager personally, to the fines in the next rule.Texto Único Ordenado de la Ley de Represión de Conductas Anticompetitivas, Decreto Legislativo Nº 1034, approved by Decreto Supremo Nº 111-2024-PCM (published 12 October 2024; numeral 11.2 as amended by Decreto Legislativo Nº 1205), Art. 2.4, art. 4, art. 10, art. 11 and art. 12, 2024-10-12 official text · verified 2026-10-28 · changed: Decreto Supremo Nº 111-2024-PCM (12 October 2024) approved a new consolidated text of DL 1034 that replaces the one approved by Decreto Supremo Nº 030-2019-PCM; it keeps the original article numbering in notes, so check which text a cited article number refers to.

4. INDECOPI's Commission fines anticompetitive conduct in UIT: minor infringements up to 500 UIT, capped at 8 percent of the offender's or its economic group's sales or gross income from all activities in the year before the decision; serious ones up to 1,000 UIT, capped at 10 percent; and very serious ones above 1,000 UIT, capped at 12 percent. Professional associations and agents that started business after 1 January of the previous year are capped at 1,000 UIT. Legal representatives and directors found responsible can each be fined up to 100 UIT. Reoffending is aggravating, the UIT used is the one in force on the date of payment, and paying before the appeal term ends without appealing gives a 15 percent discount. Obstructing the investigation or giving false information is fined up to 1,000 UIT, capped at 10 percent of sales. Infringements lapse five years after the last act.
Cost to do it: Fines of up to 500 UIT (S/ 2,750,000, about US$796,640) for minor, up to 1,000 UIT (S/ 5,500,000, about US$1.59 million) for serious and above that, within 12 percent of group sales, for very serious infringements; up to 100 UIT (S/ 550,000, about US$159,328) per responsible director or representative.
Example: A group with S/ 400 million of sales found guilty of a very serious cartel faces a fine above S/ 5.5 million and up to S/ 48 million (12 percent); paying without appeal would cut the amount by 15 percent. / On about US$115.9 million of group sales the 12 percent cap is about US$13.9 million; each director held responsible can be fined up to about US$159,328 more.TUO del Decreto Legislativo Nº 1034, Decreto Supremo Nº 111-2024-PCM (published 12 October 2024), Art. 45, art. 46 and art. 47, 2024-10-12 official text · verified 2026-10-28

5. Peruvian data protection law applies to processing in an establishment in Peru, to processors anywhere acting for a controller established in Peru, and to controllers outside Peru that use means located in Peru, including those that offer goods or services to people in Peru or analyse or profile their behaviour. Those foreign controllers must designate a representative in or for Peru, either in their privacy policy or by notice to the Autoridad Nacional de Protección de Datos Personales. A security incident that exposes large volumes of data, affects many people, involves sensitive data or clearly harms other rights must be notified to the Authority within 48 hours of becoming aware of it, with reasons if later, and the affected people must be told within 48 hours where their rights are affected. A data protection officer is mandatory for controllers and processors handling large volumes or sensitive data, or whose core business involves sensitive data; for private companies this duty is phased in by annual sales. The regulation entered into force 120 calendar days after publication on 30 November 2024, that is on 30 March 2025, and replaced Decreto Supremo Nº 003-2013-JUS.
Cost to do it: Designating a representative and an officer (internal or outsourced) and updating privacy policies and breach procedures; no registration fee was verified this session. One officer can serve a whole business group if easily reachable from each establishment (art. 37.2).
Example: A medium company with S/ 11 million of annual sales (2,000 UIT) that processes large volumes of customer data must have a data protection officer appointed and published by 30 November 2026. / A US e commerce platform with no Peruvian office that sells to consumers in Peru is covered and must name a representative for Peru; the 2,300 UIT tier threshold equals S/ 12.65 million, about US$3.66 million of annual sales.Reglamento de la Ley Nº 29733, Ley de Protección de Datos Personales, approved by Decreto Supremo Nº 016-2024-JUS (El Peruano, 30 November 2024), Art. VI, art. VII, art. 34, art. 37 and First Final Complementary Provision, 2024-11-30 official text · verified 2026-10-28 · changed: New regulation in force from 30 March 2025 (replacing DS Nº 003-2013-JUS): extraterritorial reach, a local representative for foreign controllers, 48 hour breach notice and a mandatory data protection officer phased in by company size. The officer becomes mandatory for companies with annual sales above 2,300 UIT one year after publication (30 November 2025), above 1,700 and up to 2,300 UIT after two years (30 November 2026), above 150 and up to 1,700 UIT after three years (30 November 2027) and for micro companies up to 150 UIT after four years (30 November 2028). Data portability (art. 76) applies six months after entry into force.

6. The Data Protection Authority fines minor infringements from 0.5 UIT to 5 UIT, serious ones from more than 5 UIT to 50 UIT and very serious ones from more than 50 UIT to 100 UIT. In no case may a fine exceed 10 percent of the offender's gross annual income in the previous year. Coercive fines can be added for failing to comply with orders, doubling successively up to 100 UIT under the 2024 regulation. Since Decreto Legislativo Nº 1353 (2017), the infringements themselves are typified in the regulation.
Cost to do it: Fines of S/ 2,750 to S/ 27,500 (minor), up to S/ 275,000 (serious) and up to S/ 550,000 (very serious), about US$797, US$7,966, US$79,664 and US$159,328, each within 10 percent of prior year gross income.
Example: If an infringement is classified as very serious under the regulation, the fine can reach 100 UIT, S/ 550,000, but never more than 10 percent of the offender's prior year gross income. / For a start up with US$300,000 of gross income, the 10 percent cap limits any fine to about US$30,000 even for a very serious infringement.Ley Nº 29733, Ley de Protección de Datos Personales (El Peruano, 3 July 2011), art. 38 as amended by Decreto Legislativo Nº 1353; Reglamento DS Nº 016-2024-JUS, Art. 39 of Ley Nº 29733; art. 130 of the Reglamento, 2011-07-03 official text · verified 2026-10-28

7. Legal persons, including foreign companies that operate in Peru directly or indirectly through any corporate, contractual or business form, are liable in the criminal process for listed crimes committed in their name or on their behalf and for their direct or indirect benefit by partners, directors, de facto or legal managers, representatives or attorneys, or by staff under their control, including where the crime was possible because supervisors failed to supervise. The list covers active bribery of national and foreign officials, influence peddling, collusion, private corruption, money laundering, customs crimes, tax crimes and terrorist financing. Parents are liable for acts of subsidiaries done under their orders, authorisation or consent. Liability survives renaming, mergers and other reorganisations, but an acquirer that ran adequate pre merger due diligence is not liable. Sanctions include a fine of two to six times the benefit obtained or expected or, if it cannot be determined, 10 to 10,000 UIT, payable within ten business days or in up to 36 monthly instalments; suspension of activities for six months to two years; temporary or permanent bans; a permanent ban on contracting with the State; cancellation of licences; closure of premises; and dissolution. A company is exempt if before the crime it had an adequate prevention model with, at a minimum, an autonomous prevention officer, risk mitigation, reporting channels, training and monitoring. The exemption does not apply where the crime was committed by people with control of the company, but the fine can then be cut by up to 90 percent. A prosecutor needs an SMV technical report on the model, issued within 90 days, before formalising charges.
Cost to do it: Fines of 10 UIT to 10,000 UIT (S/ 55,000 to S/ 55,000,000, about US$15,933 to US$15.93 million) where the benefit cannot be measured. A prevention model costs internal compliance time plus a risk assessment, policies, a reporting channel and training; MYPEs can have the board act as prevention officer.
Example: If a local manager pays a bribe to win a S/ 2 million permit benefit, the company faces a fine of S/ 4 million to S/ 12 million, plus a possible ban on State contracts, unless it proves an adequate prevention model was in place before the act. / On a benefit of about US$579,000 the fine ranges from about US$1.16 million to US$3.48 million. A US parent that ordered or consented to the subsidiary's act is liable too.Ley Nº 30424, Ley que regula la responsabilidad administrativa de las personas jurídicas en el proceso penal (El Peruano, 21 April 2016), as amended by Ley Nº 31740 (El Peruano, 13 May 2023), Art. 1, art. 2, art. 3, art. 5, art. 7, art. 12, art. 17 and art. 18, 2023-05-13 official text · verified 2026-10-28 · changed: Ley Nº 31740 (13 May 2023) rewrote articles 1, 2, 3, 5, 7, 12, 17 and 18, extending the list of crimes to customs and tax crimes and others (in force six months after publication), adding parent company liability, the due diligence defence in mergers, the 10 to 10,000 UIT fine range and the SMV technical report. Later amendments, if any, were not checked this session.

8. Obligated subjects under the UIF regime must implement an anti money laundering and counter terrorist financing system (SPLAFT), which in a company is the responsibility of the board and management, and appoint a compliance officer who is the contact with the supervisor and the UIF; entities with a reduced (acotado) system only need a part time compliance officer and suspicious operation reporting. Unless sectoral rules set a specific threshold, they must record each client operation of US$10,000 or more, and multiple operations in a calendar month for or by the same person that together reach US$50,000, keeping the record for ten years (at least five where sectoral rules allow). Suspicious operations, attempted or completed, must be reported to the UIF through the compliance officer regardless of amount, immediately and in no case later than 24 hours after being classified as suspicious, through the ROSEL system.
Cost to do it: Compliance officer salary or outsourced service, KYC systems and record keeping; supervisors (SBS, SMV or the sector supervisor) set further sectoral rules.
Example: A real estate broker that receives a S/ 40,000 cash payment (above US$10,000, which is about S/ 34,520) must enter it in the operations register; if it looks inconsistent with the client's profile, the officer must report it to the UIF within 24 hours of classifying it as suspicious. / Three transfers of US$20,000 by the same client in one month total US$60,000, above the US$50,000 multiple operation threshold, so they are recorded as one operation.Reglamento de la Ley Nº 27693, Ley que crea la Unidad de Inteligencia Financiera del Perú, approved by Decreto Supremo Nº 020-2017-JUS (El Peruano, 6 October 2017), text as published, Art. 13, art. 14, art. 24 and art. 25, 2017-10-06 official text · verified 2026-10-28

Regime	Main law	Authority	Trigger	Top sanction
Merger control	Ley Nº 31112	INDECOPI Commission for the Defence of Free Competition	Combined Peruvian sales or assets of 118,000 UIT and two parties with 18,000 UIT each	Nullity of closing acts plus fines on the DL 1034 scale
Cartels and abuse of dominance	TUO DL 1034 (DS Nº 111-2024-PCM)	INDECOPI Commission and Tribunal	Price fixing, output limits, market sharing, bid rigging (per se); other conduct on effects	Above 1,000 UIT, within 12 percent of group sales; 100 UIT per director
Personal data	Ley Nº 29733 and DS Nº 016-2024-JUS	Autoridad Nacional de Protección de Datos Personales (Ministry of Justice)	Processing in Peru or targeting or profiling people in Peru	100 UIT, within 10 percent of gross income
Corporate liability for corruption and economic crimes	Ley Nº 30424 as amended by Ley Nº 31740	Public prosecutor and criminal judge, SMV technical report	Listed crime committed for the company's benefit	Six times the benefit or 10,000 UIT, bans, dissolution
Anti money laundering	Ley Nº 27693 and DS Nº 020-2017-JUS	UIF Perú (within the SBS) and sector supervisors	Being an obligated subject	Supervisor sanctions under sectoral rules

Peru's five core cross sector compliance regimes, from the official texts cited in the rules (UIT 2026 = S/ 5,500).

Worked example

A US manufacturer buys 60 percent of a Peruvian distributor. The buyer's Peruvian sales were S/ 560 million and the target's S/ 120 million in 2025, so the combined S/ 680 million exceeds 118,000 UIT (S/ 649 million, about US$188 million) and both exceed 18,000 UIT (S/ 99 million). The parties file with INDECOPI after signing, make closing conditional on clearance, and close only after the phase 1 resolution, at least 30 business days after admission. Closing first would make the transfer void and expose them to a fine of up to 1,000 UIT, S/ 5.5 million or about US$1.59 million.
After closing, the buyer extends its group prevention model to the target under Ley Nº 30424 (officer, risk map, reporting channel, training), checks whether the target is an obligated subject under the AML regime, and, because the target has about S/ 120 million of sales (over 2,300 UIT) and a large customer database, confirms that a data protection officer is already designated and published as required since 30 November 2025.

Step by step

Before signing any acquisition, joint venture or asset deal, test the prior year Peruvian sales or assets of each party and its group against 118,000 UIT combined and 18,000 UIT for at least two parties; aggregate deals between the same parties over two years.
If reportable, make closing conditional on INDECOPI clearance, consider the pre filing consultation (art. 17 of Ley Nº 31112) and plan 30 business days for phase 1 plus up to 120 business days if phase 2 opens; for a tender offer, obtain clearance before starting the SMV procedure.
Run an antitrust check on pricing, distribution, information exchange and tender practices, and train sales teams on the four absolute prohibitions.
Map personal data processing in Peru, name a representative if you serve Peru from abroad, set a 48 hour breach notification procedure, and appoint a data protection officer by your size deadline (30 November 2026 for companies with sales above 1,700 and up to 2,300 UIT).
Adopt a prevention model under Ley Nº 30424 before any incident: autonomous prevention officer, risk mitigation, whistleblowing channel, periodic training and monitoring, documented so it can be shown to the SMV.
Check whether the Peruvian business is an AML obligated subject; if so, appoint a compliance officer, keep the US$10,000 and US$50,000 operations register for ten years and report suspicious operations to the UIF within 24 hours.
Recheck every UIT based amount each January, when the new UIT is set by supreme decree.

Common traps

The merger thresholds count sales or assets in Peru of the whole economic groups involved, so a small target can still trigger a filing when the buyer is large; and closing early makes the acts void, not only fineable.
Silence counts in your favour: if INDECOPI misses its deadline the deal is deemed cleared, but only within the legal term after a complete filing; incomplete filings stop the clock.
Bid rigging and price fixing are per se offences, so arguments that prices did not rise do not help; the law also reaches facilitators outside the market and conduct abroad with effects in Peru.
Competition fines are computed at the UIT in force when you pay, so delaying payment while UIT values rise increases the bill; the 15 percent discount applies only if you pay before the appeal deadline and do not appeal.
Foreign online businesses are within the data protection law if they target or profile people in Peru, even with no Peruvian office.
The prevention model exemption under Ley Nº 30424 is lost when a person with control of the company commits the crime; only a fine reduction of up to 90 percent remains, so board level controls matter.
In an acquisition, the buyer inherits the target's exposure for past crimes unless it ran adequate pre merger due diligence, so anti corruption diligence is not optional.
Sectoral AML rules can lower the US$10,000 register threshold; check the rules of your supervisor (SBS, SMV or other) before relying on the default.
Regional deals that also cover Argentina need a separate analysis there; Peruvian clearance does not cover any other country's merger regime.

Sources

← Shipping and aviation in Peru: cabotage open to foreign carriers since 2024, and the 51 percent Peruvian ownership rule for domestic airlinesMerger control in Peru: when a deal needs INDECOPI clearance, the filing fee, the timetable and what gun jumping costs →

Get rule changes weekly

Free. One email a week from The LatAm Thread.

One more step after you press the button: we take you to Substack, where your email is already filled in. Confirm there to start. No spam, unsubscribe anytime, we never share your address. By subscribing you agree to the privacy policy.