Apolo Blogs
New Organic Statute of the Superintendency of Banks: 10 Key Changes in Banking Supervision That Banks Should Know About — by Danilo Icaza
Dear clients and contacts in the financial sector,
On August 19, 2026, Resolution No. SB-2026-02293, issued by the Superintendent of Banks on July 23, 2026, was published in the Eighth Supplement to Official Gazette No. 350. Through this resolution, the new Organic Statute for Organizational Management by Processes of the Superintendency of Banks was enacted. This resolution fully repeals Resolution No. SB-2017-893 of October 16, 2017, and all subsequent amendments, including those issued in February and June 2026, which until then governed the organization and operation of the supervisory authority.
Below, we summarize for banks and other entities within the financial system the ten most relevant differences between the repealed statute and the new one, with a particular focus on their impact on banking supervision.
1. Unified banking supervision under a single Intendancy
The new Statute establishes “Banking Management,” headed by a single National Banking Intendancy, which assumes oversight of private banking, public banking, and financial groups through five National Directorates (Banks I through IV and Public Banking V). The previous statute maintained two separate intendancies, one for the private financial sector and another for the public financial sector, each with its own directorates. For banks, this means having a single technical point of contact and a unified chain of command for all supervisory, control, and sanctioning decisions.
2. The financial safety net becomes an express function of banking supervision
For the first time, the Statute expressly assigns the National Banking Intendancy responsibility for the comprehensive assessment of the Deposit Insurance Trust and the Liquidity Fund of the private financial sector, as well as oversight of the Credit Guarantee System. The 2017 framework did not include these functions within its process-based organizational structure. Banks should anticipate greater coordination between their prudential supervisor and the system’s deposit insurance and liquidity mechanisms.
3. “Bank resolution” is formally introduced
The new National Sub-Directorate for Financial Risks and Bank Resolution is expressly empowered to propose, direct, and monitor bank resolution processes, as well as assess the viability of entities’ resolution plans. This mechanism was absent from the 2017 statute and is aligned with international standards for managing banking crises, including recovery and resolution planning. It is foreseeable that the Superintendency of Banks will begin requiring banks to provide information and resolution plans as part of their ordinary supervisory activities.
4. Sanctioning powers decentralized across each supervisory unit
Under the new Statute, each Intendancy and National Directorate responsible for supervision—including Banking Management, Risk Management, Auxiliary Services, Pension Funds, Social Security, and others—is directly empowered to “issue the resolution initiating the administrative sanctioning proceeding” within its respective area of responsibility. Under the 2017 statute, this authority was more concentrated within Technical Management (General Intendancy), based on reports issued by the supervisory areas. This decentralization facilitates and accelerates the initiation of sanctioning proceedings against supervised entities, including banks.
5. Cybersecurity and technology risks established as a separate area
The Statute creates the Non-Financial Risk and Cybersecurity Control Management unit, with express authority to assess technological and cyber risks, monitor key risk indicators (KRIs), and manage incidents. It also establishes an Information Security Directorate and an Information Security Committee at the institutional level. The previous statute only contemplated a general “Operational Risk Management” function. This reflects the Organic Law on Digital Transformation and the Government Information Security Framework (EGSI), and anticipates greater cybersecurity requirements for supervised banks.
6. New Fintech and regulatory sandbox unit
Within Auxiliary Services and Other Supervised Entities, the Statute creates the Fintechs and Sandboxes Management unit, with powers to classify Fintech companies according to their level of risk, implement regulatory testing environments (sandboxes), and coordinate with the Superintendency of Companies, Securities and Insurance. This unit did not exist in 2017 and responds to the 2022 Fintech Law. It is particularly relevant for banks developing partnerships, making investments, or launching business lines involving Fintech companies.
7. Decentralized Regional Intendancies eliminated
The 2017 statute provided for decentralized management levels with Regional Intendancies in Guayaquil and Cuenca/Portoviejo, each with its own regional banking supervision directorates. The new Statute eliminates this structure and replaces it with “multidisciplinary operational teams” in Guayaquil, Portoviejo, Cuenca, and other cities, which report directly to the national units. Ongoing regional proceedings will be handled by the competent national units. In practice, banking supervisory decision-making is centralized in Quito.
8. Superintendent of Banks’ powers are more detailed and explicit
The new Statute sets out 22 express powers of the Superintendent of Banks (Article 11), including ordering special processes such as intervention, the exclusion and transfer of assets and liabilities, and compulsory liquidation; expressly protecting the interests of depositors and users of the financial system; and establishing administrative, civil, and criminal responsibility for the exercise of his or her functions. The 2017 statute referred more generally to the Organic Monetary and Financial Code without providing this level of detail. For banks, this provides greater predictability regarding the scope of the Superintendency of Banks’ intervention powers.
9. Internal corporate governance formalized through ten institutional committees
Article 6 of the new Statute consolidates ten institutional committees into a single list, including the Supervision and Control Committee, Regulatory Committee, Business Continuity Committee, and Personal Data Protection Committee. Under the previous statute, references to committees were scattered across different units, without a unified provision. These collegiate bodies influence how supervisory and regulatory policy decisions affecting banks are coordinated internally.
10. Explicit focus on risk-based, proportional supervision and early warning mechanisms
The new institutional strategic objectives (Article 5) seek to “increase risk-based, prudential, and proportional supervision,” “reduce the regulatory gap by aligning with international standards,” and “increase early warning methodologies.” The 2017 statute was limited to a general objective of “effectiveness of the risk-based supervision model” within a balanced scorecard framework. Banks should expect more granular supervision, proportionate to their risk profile, together with increased use of early warning mechanisms and information requirements.
Our Banking and Fintech Law team is available to review the specific impact of this reform on your institution’s operations and to assist you in your dealings with the Superintendency of Banks.
Note: This bulletin is provided for informational purposes only and is based on Resolution No. SB-2026-02293 (Official Gazette, Eighth Supplement No. 350 of August 19, 2026) and Resolution No. SB-2017-893, as amended. It does not constitute legal advice regarding any specific matter.