CIRCULAR-CSB-REG-2026000021: Poner en vigencia el “Instructivo para la implementación del Reglamento de Riesgo Operacional”.

The circular is binding and signals closer supervisory focus on how firms identify, measure, control, report and govern operational risk. Compliance teams should treat this as a framework refresh rather than a document update: compare current policies, risk-assessment methods, incident capture, outsourcing and business-continuity arrangements against the new instruction; assign ownership and board oversight; and prepare evidence for supervisory review. The excerpt does not state a separate transition period, so firms should confirm the effective date and any reporting templates in the full annex.

Exchange intermediaries should assess whether their smaller-scale controls and reporting can meet the same expectations. Priority actions are a gap analysis, updated operational-risk appetite and KRIs, staff training, and remediation plans with timestamps. RegCanary expects implementation burden to be highest for firms with fragmented incident data or legacy manual controls; those investing early in integrated risk reporting may gain supervisory confidence and resilience benefits.