Uruguay Central Bank Pushes Open Finance Law: ‘A Safe Highway for All Cars’

Inside Uruguay’s Open Finance Draft Bill

The Central Bank of Uruguay (BCU) has presented a draft law to create an Open Financial System, a framework that will allow individuals and businesses to share their financial data with authorised third parties — strictly with explicit consent. The move marks a fundamental shift from today’s model where banks hold data in silos, to one where the customer becomes the owner of their information and decides who can access it.

Vice-president Ana Claudia de los Heros framed the initiative as building a “safe highway” for all participants, not just the largest players. In an interview with Forbes Uruguay, she said, “We want to create a safe highway, but it must not only be used by Ferraris.” The metaphor signals the BCU’s intention to craft inclusive rules that enable fintechs, smaller institutions and traditional banks to compete on equal terms.

The proposal also includes regulatory sandboxes — controlled testing environments where innovative products can be trialled under the BCU’s supervision. De los Heros described them as a “win-win,” giving innovators a chance to validate ideas while allowing the regulator to learn about emerging risks and fine-tune its own rules. The BCU is already working with industry to design the governance, security standards and consent mechanisms that will underpin the new system.

The initiative is part of a broader transformation of Uruguay’s payment and financial infrastructure. The central bank envisions a future where payments operate like a modern public utility — silent when functioning well, resilient under stress, and open enough for others to build on.

Why the Central Bank Is Building a ‘Safe Highway’

From Data Silos to User Consent: A Paradigm Shift

Today, financial data lives in silos: the institution that stores it also controls its use. Open Finance flips that logic, making data portability a customer right. For Uruguay, this could lower the barriers that have protected incumbent banks. A fintech, for example, could use transaction history — with permission — to offer a small business a tailored loan, bypassing the rigid scoring of traditional lenders. The BCU’s challenge is to ensure that the “bridges” between institutions are built to the same security and privacy standards, preventing a fractured landscape of proprietary APIs.

Sandboxes: A Two-Way Street for Regulation

Regulatory sandboxes are not new in Latin America, but Uruguay’s approach integrates them into the same legal package as Open Finance. This signals that the BCU wants innovation and regulation to evolve in parallel. For a startup, a sandbox can mean a shorter path to market without the full compliance burden. For the regulator, it provides early warning of risks — such as algorithmic bias or data mishandling — before they scale. De los Heros noted that many firms are already eager to enter, but the effort is real for the central bank. The tangible output will depend on how quickly the sandbox processes can be set up and whether the BCU can staff them adequately.

Interoperability and the Infrastructure Challenge

The vision of a seamless, interoperable financial system requires more than a law. It demands technical standards, protocols for consent management, and a backbone that can withstand cyberattacks. De los Heros described the ideal infrastructure as “silent when everything goes well, resilient when there is tension.” For Uruguay, a small economy, building this might require collaboration with regional fintech hubs or international standards bodies. If successful, it could position the country as a test-case for Open Finance in smaller markets, but execution risk remains high given the need for both public and private investment.

What the Reform Means for Industry Players and Consumers

• Fintechs and challenger banks should begin mapping concrete use cases for open APIs — such as credit scoring based on cashflow data or multi-bank account aggregation — and prepare to engage with the BCU’s sandbox application process once it opens.
• Incumbent banks need to allocate resources for API infrastructure and consent management, as the shift will require a material IT overhaul. Early movers that build trust through transparent data practices could capture new fee-based services before new entrants do.
• Consumers and small businesses stand to gain more tailored products and potentially lower borrowing costs, but they should watch for the rollout of consent dashboards and invest time in understanding what data they are sharing and with whom.
• All stakeholders should contribute to the ongoing industry dialogue that the BCU is leading; the final shape of the regulation — including technical standards and liability rules — will be heavily influenced by feedback from the very companies that will operate under it.