Joint Resolution No. 10 — Amends Joint Resolution No. 1 of May 4, 2020, Regarding the Implementation of Open Finance

JOINT RESOLUTION NO. 10, OF JULY 4, 2024

Amends Joint Resolution No. 1, of May 4, 2020, which provides for the implementation of Open Finance.

The Central Bank of Brazil, in accordance with Article 9 of Law No. 4.595, of December 31, 1964, makes public that its Collegiate Board, in a session held on June 20, 2024, and the National Monetary Council, in a session held on June 26, 2024, based on Articles 4, caput, item VIII, of the aforementioned law, 9-A, caput, item I, of Law No. 4.728, of July 14, 1965, and 9, caput, item II, of Law No. 12.865, of October 9, 2013,

HAVE RESOLVED:

Art. 1º Joint Resolution No. 1, of May 4, 2020, published in the Official Gazette of the Union on May 5, 2020, shall enter into force with the following alterations:

"Art. 2º ..........................................................................................................................

.......................................................................................................................................

XI - successive payment transactions: payment transactions carried out between the same payers and payees according to specific contracted periodicities or conditions; and

............................................................................................................................." (NR)

"Art. 6º ..........................................................................................................................

I - ...................................................................................................................................

a) in a mandatory manner:

1. institutions classified in Segments 1 (S1) and 2 (S2), as provided in Resolution No. 4.553, of January 30, 2017; and

2. individual institutions and institutions belonging to conglomerates with a number of clients exceeding five million, according to the database indicated by the Central Bank of Brazil; and

.......................................................................................................................................

II - in the case of sharing the payment transaction initiation service provided for in Article 5, caput, item II, letter 'a':

a) in a mandatory manner:

1. institutions that are mandatory participants in Pix;

2. account-holding institutions that are part of conglomerates that have mandatory participants in Pix; and

3. payment transaction initiating institutions; and

b) in a voluntary manner, the other account-holding institutions provided for in Article 1; and

.......................................................................................................................................

§ 5º The institutions referred to in Article 1 that exceed the limit provided for in item I, letter 'a', item 2, of the caput, or that qualify as mandatory participants in Pix, in accordance with item II, letter 'a', item 1, of the caput, shall have a period of six months to become Open Finance participant institutions.

§ 6º For the purposes of the provision in § 5º, it is considered that an institution has exceeded the limit provided for in item I, letter 'a', item 2, of the caput if it has remained above said limit for two consecutive quarters.

§ 7º If an institution opts to be a participant voluntarily, in accordance with item I, letter 'b', of the caput, the other institutions comprising its conglomerate must become Open Finance participants." (NR)

"Art. 9º ..........................................................................................................................

.......................................................................................................................................

Sole Paragraph. Sharing of the payment transaction initiation service provided for in Article 5, caput, item II, letter 'a' is permitted without redirection to other environments or electronic systems, including those of other institutions, as provided for in item III of the caput, observed the provisions of specific regulation." (NR)

"Art. 10. ........................................................................................................................

.......................................................................................................................................

§ 7º To alter the conditions provided for in items II, III, or V of § 1º, the data-receiving institution or the payment transaction initiating institution must inform the client of the content of the alteration, specifically, and obtain their consent, being exempted from the obligation of client authentication procedures and confirmation in the environment of the data-transmitting institution or the account-holding institution provided for in Articles 16 to 22.

............................................................................................................................." (NR)

"Art. 13-A. The provisions of Article 13 are excepted regarding consent related to payment transactions occurring in the manner of sharing provided for in Article 9, sole paragraph, which must include, at a minimum, the following information:

I - the payment method;

II - the validity period of the consent; and

III - the maximum values per transaction and per day that the client wishes to authorize.

Sole Paragraph. In the case of sharing provided for in the caput, the payment transaction initiating institution must request the client's consent only once, for as long as the validity of said consent lasts." (NR)

"Art. 16. ........................................................................................................................

.......................................................................................................................................

Sole Paragraph. ...........................................................................................................

I - in the case of client authentication, be carried out only once per consent or per payment transaction occurring in the manner of sharing provided for in Article 9, sole paragraph; and

............................................................................................................................." (NR)

"Art. 16-A. In the case of payment transactions occurring in the manner of sharing provided for in Article 9, sole paragraph, the payment transaction initiating institution must adopt procedures and controls to ensure the reliability, integrity, availability, security, and confidentiality of electronic environments and systems under its responsibility, when participating in the execution of the procedures and controls provided for in Article 16, caput, item I." (NR)

"Art. 17. ........................................................................................................................

.......................................................................................................................................

§ 2º The convention provided for in Article 44 may propose recommendations regarding standards related to the procedures and controls provided for in the caput, with a view to observance by participating institutions of the provisions in Article 8, sole paragraph, and Article 9, sole paragraph." (NR)

"Art. 19. The contracting of services for the execution of procedures and controls for authentication provided for in Articles 16 and 17 is permitted, observed the provisions in the regulation that provides for the cybersecurity policy and the requirements for the contracting of services for data processing and storage and cloud computing.

............................................................................................................................." (NR)

"Art. 20. ........................................................................................................................

Sole Paragraph. ...........................................................................................................

I - occur after the procedures for authentication provided for in Article 16; and

............................................................................................................................." (NR)

"Art. 20-A. The initiating institution must request confirmation of sharing from the client, in cases where payment transactions occur in the manner of sharing provided for in Article 9, sole paragraph." (NR)

"Art. 40. ........................................................................................................................

.......................................................................................................................................

§ 2º ...............................................................................................................................

.......................................................................................................................................

III - ensure that the other institutions involved in the sharing do not have access to the credentials used by the client for their identification and authentication, observed the provision in § 3º.

§ 3º In the case of sharing provided for in Article 9, sole paragraph, the provision in item III of § 2º shall be applied in the manner of specific regulation." (NR)

"Art. 43. ........................................................................................................................

I - by any interface calls regarding the payment transaction initiation services provided for in Article 5, caput, item II, letter 'a'; and

............................................................................................................................." (NR)

"Art. 46. ........................................................................................................................

I - establish guidelines for the establishment of the structure responsible for the governance of the Open Finance implementation process, based on the guidelines provided for in Article 44, § 1º;

II - participate in the process of elaborating the convention provided for in Article 44, in order to guarantee compliance with the objectives provided for in Article 3 and the observance of the principles provided for in Article 4;

III - establish guidelines for the development of technical and business specifications;

IV - define the schedule for the development of technical and business specifications and implementation by participating institutions; and

V - approve definitions and procedures discussed in the structure provided for in item I of the caput to meet the aspects of the convention provided for in Article 44.

............................................................................................................................." (NR)

Art. 2º Article 19, caput, items I and II, of Joint Resolution No. 1, of May 4, 2020, published in the Official Gazette of the Union on May 5, 2020, is hereby revoked.

Art. 3º This Joint Resolution enters into force:

I - on January 1, 2025, for the alterations promoted in Article 6, caput, item I, letter 'a', and §§ 5º and 6º, of Joint Resolution No. 1, of May 4, 2020, published in the Official Gazette of the Union on May 5, 2020;

II - on July 1, 2025, for the alterations promoted in Article 6, § 7º, of Joint Resolution No. 1, of May 4, 2020, published in the Official Gazette of the Union on May 5, 2020; and

III - on the date of its publication for the remaining alterations.

GABRIEL MURICCA GALÍPOLO Acting President of the Central Bank of Brazil