Compliance · Peru

Peru's decree powers: the security package reaches your compliance program

October 13, 2026 4 min read

Most readers will file Peru’s decree-powers fight under security. Twenty items, ninety days, a president who wants to look tough on crime. Fair enough. But read the list, because one line on it is not about police at all.

On October 6, the Cámara de Diputados (Chamber of Deputies) sent the Senate a bill giving President Keiko Fujimori 90 days of decree authority over 20 of the 66 matters she asked for: six on citizen security, fourteen on El Niño, nothing on tax, labour or hydrocarbon investment. Item five updates the Cybercrime Law and, in the same breath, “the rules on administrative liability of legal persons linked to organized crime.” That is the sentence a general counsel in Lima, Houston or Madrid should circle.

What the cut tells us

The economy needed Congress and did not get it. The security agenda did not need Congress, and it is the part that writes to your legal department. President Fujimori has already stood up a unified armed-forces and police command by executive act. The Senate Constitution Committee, chaired by Carlos Mesía, resumes on October 14, and a floor debate is expected around October 19.

The count is tight. Changing the text takes 31 votes, and reported support sits near 30: 22 from Fuerza Popular and eight from Renovación Popular. The committee hearing on October 10 broke down when Interior Minister César Astudillo and Senator Iber Maraví squared up across the table. Nobody should plan around a calm Senate.

The honest counter-argument

It may come to nothing. The reporting describes the item as administrative liability, not criminal, and Ley 30424 already reaches organized crime through Decreto Legislativo 1106. A decree could simply tidy definitions. A company that pays under threat also has a defence: the law does not hold it liable when the person acted solely for their own benefit or a third party’s. And prosecutors in Peru have rarely gone after companies as such.

All true. And not the point. Peru recorded 13,892 extortion complaints between January and July, 5,635 of them in Lima and 1,625 in Trujillo. More than 80 drivers have been killed in Lima and Callao this year. Pressure like that does not produce a quiet decree. It produces the first test case, and the first test case gets decided on records, not on doctrine. If your people paid a cupo, a company with a victim story and no payment trail beats one with the reverse. The decree is not the risk. Your file is.

Five things to do before the Senate votes

First, read your Peru prevention model against organized-crime scenarios, not only bribery. Under Ley 31740 a company escapes liability if it adopted a model suited to its risks before the offence, with an autonomous prevention officer, reporting channels, training and monitoring. Most models in the region were drafted for corruption. Ask whether yours would survive a question about a transport contractor, a security vendor or a supplier near a mining corridor.

Second, write down what happens when someone demands a payment. Who may authorise it, who is told, how it is recorded. Silence here is the worst policy, because the first account of events will be the one in a prosecutor’s file.

Third, know what an exemption does and does not cover. The prevention-model defence does not protect a company when the offence was committed by partners, directors or others who control it; then the penalty is a fine, reducible by up to 90 percent. The SMV, the Superintendencia del Mercado de Valores (securities regulator), must also issue a technical report on the model before a prosecutor can formalise an investigation against a company that claims one. Sanctions go from suspension of activities to loss of licences and concessions, a permanent bar on State contracts, and dissolution. That is the downside to put in front of your board.

Fourth, check what geolocation and line blocking mean for you. Item two lets the Executive strengthen geolocation of mobile devices and the blocking of lines used illicitly, under OSIPTEL (the telecom regulator). If you run fleets, field crews or corporate lines in Peru, find out now how that reaches your contracts and your data-protection posture. We cannot say more until the text is published.

Fifth, use the next week. Industry associations can still reach Mesía’s committee. A short, specific note on how a liability clause would treat a victim company is worth more than a general statement of support for the fight against crime.

What moves the picture

Watch three dates. October 14, when the Senate committee resumes. Around October 19, when a floor vote is expected. And then the Executive’s decrees themselves, which can only legislate on what is expressly authorised and will take weeks. Each one narrows the guesswork.

Hold your Peru assumptions on the economy where they are. Move your compliance review forward.

The teams that read the list will be ready. The ones that read the headline will be reading the decree.


Further reading: