Region

Jurisdiction

Regulator

2019-12-03

CVM Instruction No. 617 of December 5, 2019: Prevention of Money Laundering and Terrorist Financing in the Securities Market

The Brazilian Securities and Exchange Commission (CVM) issued Instruction No. 617 to mandate anti-money laundering and counter-terrorist financing (AML/CFT) compliance across the securities market. The regulation requires covered entities to establish risk-based AML/CFT policies, conduct internal risk assessments, implement robust internal controls, and maintain continuous staff training. It further mandates strict client identification, beneficial ownership verification, ongoing monitoring, and mandatory reporting of suspicious activities to the Financial Intelligence Unit.

Brazil

Comissão de Valores Mobiliários

THE PRESIDENT OF THE SECURITIES COMMISSION OF BRAZIL - CVM makes public that the Board, in a meeting held on September 4, 2019, in view of Laws No. 6,385 of December 7, 1976, 9,613 of March 3, 1998, 13,260 of March 16, 2016, and 13,810 of March 8, 2019, as well as Decree No. 5,640 of December 26, 2005, APPROVED the following Instruction:

CHAPTER I – SCOPE, DEFINITIONS, AND PURPOSE Art. 1. This Instruction governs: I – the establishment of an anti-money laundering and terrorist financing prevention policy – AML/CFT, internal risk assessment, and rules, procedures, and internal controls; II – client identification and registration, as well as ongoing due diligence aimed at collecting supplementary information and, in particular, identifying their respective beneficial owners; III – monitoring, analysis, and communication of operations and situations mentioned in this Instruction; IV – operation recording and file maintenance; and V – implementation, within the securities market: a) measures aimed at the unavailability of assets, rights, and values resulting from resolutions of the United Nations Security Council – UNSC; and b) requests for international legal cooperation arising from other jurisdictions in accordance with current national legislation and other legal provisions. Art. 2. For the purposes of this Instruction, the following are considered:

SECURITIES COMMISSION OF BRAZIL (CVM) Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686 Rua Cincinato Braga, 340/2nd, 3rd and 4th Floors, Bela Vista, São Paulo/SP – ZIP: 01333-010 – Brazil - Tel.: (11) 2146-2000 SCN Q.02 – Bl. A – Corporate Financial Center Building, S.404/4th Floor, Brasília/DF – ZIP: 70712-900 – Brazil - Tel.: (61) 3327-2030/2031 www.cvm.gov.br CVM INSTRUCTION NO. 617, OF DECEMBER 5, 2019 2 I – senior management: the supreme decision-making body or individuals comprising the administration, responsible for directing its strategic affairs as provided in the AML/CFT policy; II – foreign central authority: a body, entity, or public agent of a foreign jurisdiction responsible, according to its own legislation or international agreements, for centralizing communication with other jurisdictions regarding the adoption of cooperation measures in matters of prevention and combat against terrorism, its financing, or related practices; III – beneficial owner: a natural person or natural persons who, collectively, own, control, or significantly influence, directly or indirectly, a client on whose behalf a transaction is being conducted or from which it benefits; IV – registry: a record, in physical or electronic media, of the information and identification documents of clients with whom the institution maintains a direct relationship due to the provision of services in the securities market; V – client: an investor who maintains a direct commercial relationship with the persons mentioned in Article 3 of this Instruction; VI – active client: the client who, in the last 12 (twelve) months has: a) carried out movements in their checking account or custody position; b) executed an operation in the securities market; or c) held a balance in their custody position; VII – self-regulatory entity: an entity responsible for the self-regulation of the organized markets referred to in the regulation governing regulated securities markets; VIII – financial market infrastructure operator: an entity that carries out, cumulatively or separately, the processing and settlement of operations, as well as the central registration and deposit of securities;

SECURITIES COMMISSION OF BRAZIL (CVM) Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686 Rua Cincinato Braga, 340/2nd, 3rd and 4th Floors, Bela Vista, São Paulo/SP – ZIP: 01333-010 – Brazil - Tel.: (11) 2146-2000 SCN Q.02 – Bl. A – Corporate Financial Center Building, S.404/4th Floor, Brasília/DF – ZIP: 70712-900 – Brazil - Tel.: (61) 3327-2030/2031 www.cvm.gov.br CVM INSTRUCTION NO. 617, OF DECEMBER 5, 2019 3 IX – significant influence: a situation in which a natural person, whether a controller or not, exercises de facto influence over decisions or holds more than 25% (twenty-five percent) of the share capital of legal entities or the equity of investment funds and other entities covered by items II to V of Article 1 of Annex 11-A, without prejudice to the use of the simplified registry provided for in Annex 11-B; X – investor: a natural or legal person, fund, or collective investment vehicle, or a non-resident investor, on whose behalf operations with securities are conducted; XI – participant: a legal person, fund, or investment vehicle to which an organized market administrator has granted authorization to operate in the trading or registration environments or systems of the markets it administers. XII – trust or similar vehicle: any impersonalized entity constituted by assets held under fiduciary title and gathered in a segregated estate, separated from the general estate of the holder. Sole paragraph. For the purposes of this regulation, the proxies, attorneys-in-fact, or legal representatives of the beneficial owner are equivalent to the beneficial owner. Art. 3. The following are subject to the obligations set forth in this Instruction, within the limits of their responsibilities: I – natural or legal persons who provide, on a permanent or occasional basis, services related to distribution, custody, intermediation, or portfolio administration in the securities market; II – entities administering organized markets and financial market infrastructure operators; III – other persons referred to in specific regulation who provide services in the securities market, including: a) registrars; b) securities consultants; c) credit rating agencies; d) representatives of non-resident investors; and e) securitization companies; and IV – independent auditors within the securities market. § 1. This Instruction does not apply to securities analysts and publicly-held companies, provided they do not perform other activities covered by items I to IV of the main text. § 2. Institutions that are part of the securities distribution system must subject autonomous investment agents and other proxies affiliated with them to their respective AML/CFT policy, as well as to the rules, procedures, and internal controls established under this Instruction. § 3. The provisions of § 2 do not exempt institutions that are part of the securities distribution system from responsibility for complying with the directives set forth in this Instruction.

CHAPTER II – AML/CFT POLICY, INTERNAL RISK ASSESSMENT, AND RULES, PROCEDURES, AND INTERNAL CONTROLS Section I – Anti-Money Laundering and Terrorist Financing Prevention Policy Art. 4. The legal persons mentioned in items I to III of Article 3 of this Instruction must draft and implement an AML/CFT policy containing, at a minimum: I – governance related to compliance with the obligations set forth in this Instruction, including a detailed description of how senior management bodies are structured, when applicable, as well as the definition of roles and assignment of responsibilities of members at each hierarchical level of the institution regarding the drafting and implementation of the risk-based approach process, with special emphasis on the routines provided for in Articles 17, 18, 20, 21, 22, and 23 of this Instruction; II – a description of the methodology for addressing and mitigating identified risks, which must support the parameters established in the internal risk assessment, detailing the guidelines: a) that underpinned the adopted risk-based approach; b) to continuously know:

active clients, including verification, collection, validation, and updating procedures for registry information, as well as other applicable due diligence, in accordance with Articles 11 and 17; and
employees and relevant service providers; c) used to guide due diligence aimed at identifying the beneficial owner of the respective client, in accordance with items III and IX and the sole paragraph of Article 2, Articles 13 to 15, and item IV of Article 17; d) for monitoring and possible detection of atypicalities, in accordance with item III of Article 17 and Article 20, as well as the specification of other reinforced monitoring situations; and e) regarding the criteria used to obtain effectiveness indicators of the risk-based approach used for AML/CFT purposes; III – definition of criteria and periodicity for updating active client registries, in accordance with Article 11, observing a maximum interval of 5 (five) years; IV – if applicable, a description of routines guiding the due diligence covered by §§ 2 and 3 of Article 1 of Annex 11-B; and V – actions involving the identification of counterparties to operations conducted in registration environments, when applicable.

SECURITIES COMMISSION OF BRAZIL (CVM) Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686 Rua Cincinato Braga, 340/2nd, 3rd and 4th Floors, Bela Vista, São Paulo/SP – ZIP: 01333-010 – Brazil - Tel.: (11) 2146-2000 SCN Q.02 – Bl. A – Corporate Financial Center Building, S.404/4th Floor, Brasília/DF – ZIP: 70712-900 – Brazil - Tel.: (61) 3327-2030/2031 www.cvm.gov.br CVM INSTRUCTION NO. 617, OF DECEMBER 5, 2019 5 § 1. The policy referred to in the main text must be: I – documented; II – approved by senior management; and III – kept up to date. § 2. The persons mentioned in items I and III of Article 3 who belong to the same financial conglomerate must establish in the AML/CFT policy mechanisms for information exchange between their internal control areas to ensure compliance with their obligations provided for in this article, considering the relevance of the risk identified in each case, in their internal risk assessment. § 3. The information exchange referred to in § 2 may include, whenever applicable and necessary, information about the client profile held by companies subject to specific regulation that governs the duty to verify the suitability of products, services, and operations to the client's profile. § 4. The AML/CFT policy drafted and implemented by independent auditors must cover, at a minimum, the content defined in specific regulation issued by the Federal Accounting Council – CFC. Section II – Internal Risk Assessment Art. 5. The persons mentioned in items I to III of Article 3 of this Instruction must, within the limits of their responsibilities, identify, analyze, understand, and mitigate money laundering and terrorist financing – AML/CFT risks inherent to their activities performed in the securities market, adopting a risk-based approach to ensure that prevention and mitigation measures are proportional to the identified risks and to ensure compliance with this Instruction, and must: I – list all products offered, services provided, respective distribution channels, and trading and registration environments in which they operate, segmenting them minimally into low, medium, and high AML/CFT risk; and

SECURITIES COMMISSION OF BRAZIL (CVM) Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686 Rua Cincinato Braga, 340/2nd, 3rd and 4th Floors, Bela Vista, São Paulo/SP – ZIP: 01333-010 – Brazil - Tel.: (11) 2146-2000 SCN Q.02 – Bl. A – Corporate Financial Center Building, S.404/4th Floor, Brasília/DF – ZIP: 70712-900 – Brazil - Tel.: (61) 3327-2030/2031 www.cvm.gov.br CVM INSTRUCTION NO. 617, OF DECEMBER 5, 2019 6 II – classify their respective clients by AML/CFT risk degree, segmenting them minimally into low, medium, and high risk. § 1. For the purposes of the main text of this article, the following factors must be considered, among others: I – the type of client and its legal nature, its activity, its geographic location, the products, services, operations, and distribution channels used by it, as well as other risk parameters adopted in the relationship with its clients; II – the relationship with other persons provided for in Article 3, considering, including, the AML/CFT policies of such persons; and III – the counterparty to operations conducted in the name of its client, in the case of operations conducted in registration environments. § 2. The AML/CFT risks inherent to the following categories of clients must consider their respective peculiarities and characteristics, as well as be subject to specific treatment within the AML/CFT policy and the periodic internal risk assessment process: I – politically exposed persons, as well as their family members, close collaborators, and legal entities they participate in, in accordance with Annex 5–I; and II – non-profit organizations, in accordance with specific legislation. § 3. The persons mentioned in items I to III of Article 3 of this Instruction who do not have a direct relationship with the investor must identify, analyze, understand, and mitigate AML/CFT risks inherent to their performed activities, considering the parameters established in §§ 1 and 2 of Article 17. Art. 6. The director referred to in the main text of Article 8 must prepare a report regarding the internal AML/CFT risk assessment, to be sent to the senior management bodies specified in the AML/CFT policy, by the last business day of April, containing, in addition to the information required in items I and II of Article 5, the following:

SECURITIES COMMISSION OF BRAZIL (CVM) Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686 Rua Cincinato Braga, 340/2nd, 3rd and 4th Floors, Bela Vista, São Paulo/SP – ZIP: 01333-010 – Brazil - Tel.: (11) 2146-2000 SCN Q.02 – Bl. A – Corporate Financial Center Building, S.404/4th Floor, Brasília/DF – ZIP: 70712-900 – Brazil - Tel.: (61) 3327-2030/2031 www.cvm.gov.br CVM INSTRUCTION NO. 617, OF DECEMBER 5, 2019 8 VII – the indication of the effectiveness of the recommendations adopted referred to in item VI in relation to the respective previous report, according to the methodology referred to in item II of Article 4, recording the results individually. § 1. The report referred to in the main text must: I – be prepared annually by the last business day of April, and its content must refer to the year prior to the delivery date; II – be available to the CVM and, if applicable, to the self-regulatory entity, at the institution's headquarters. § 2. The report referred to in the main text may be a single report or compose a comprehensive supervision report of rules, procedures, and internal controls for implementation and compliance with policies required by CVM regulation, observing the compatibility of delivery deadlines, as applicable. Section III – Rules, Procedures, and Internal Controls Art. 7. The legal persons mentioned in items I to III of Article 3 of this Instruction must: I – adopt and implement rules, procedures, and internal controls consistent with their size, as well as with the volume, complexity, and type of activities they perform in the securities market, in order to enable faithful compliance with the provisions of this Instruction, including: a) prior analysis for AML/CFT risk mitigation purposes of new technologies, services, and products; and b) selection and monitoring of administrators, employees, autonomous investment agents, and relevant service providers contracted, with the objective of guaranteeing high standards for their staff; and c) the manner in which the responsible director referred to in Article 8 will access the necessary information for the proper management of AML/CFT risks; and II – maintain a continuous training program for administrators, employees, autonomous investment agents, and relevant service providers contracted, aimed at disseminating their AML/CFT policy, as well as the respective rules, procedures, and internal controls.