Through Resolution JM-98-2025, the Monetary Board approved a new Regulation for the Management of Technological Risk (the “Regulation”), designed to strengthen security standards and information protection within the Guatemalan financial system. This regulation repeals Resolution JM-104-2021 and seeks to address global technological developments, the rise in cyber threats, and the increasing use of artificial intelligence systems within financial institutions.
The Regulation introduces enhanced obligations for banks, financial companies, and financial service providers belonging to financial groups, including:
- Updating IT policies and procedures.
- Comprehensive management of technological risk.
- Strict oversight of infrastructure, information systems, and databases.
- Implementation of advanced security, cybersecurity, and continuous monitoring mechanisms.
It also establishes rules for the responsible use of artificial intelligence systems, requiring transparency controls, human oversight, and enhanced data protection measures.
In terms of operational continuity, the Regulation strengthens disaster recovery requirements, including periodic testing and the obligation to maintain a geographically separate backup data center.
Additionally, the Regulation imposes strict rules on the processing and storage of information—both locally and internationally—as well as on the engagement of third parties and subcontractors, particularly when critical services are involved.
Finally, it establishes transitional deadlines for institutions to update inventories, manuals, and contracts in accordance with the new regulatory framework.