BCB Normative Instruction No. 637

Open Finance - Customer Experience - IN

BCB NORMATIVE INSTRUCTION No. 637, OF 13 JUNE 2025

Normative document revoked by BCB Normative Instruction No. 760, of 9/7/2026.

Discloses version 8.0 of the Customer Experience Manual in Open Finance.

The Heads of the Department of Regulation of the Financial System (Denor) and of the Department of Information Technology (Deinf), in the exercise of the attributions conferred upon them by art. 23, item I, subitem "a", of the Internal Rules of the Central Bank of Brazil, annexed to BCB Resolution No. 340, of 21 September 2023, based on art. 3, item V, of BCB Resolution No. 32, of 29 October 2020,

R E S O L V E :

Art. 1 This Normative Instruction discloses version 8.0 of the Customer Experience Manual in Open Finance, which must be observed by participating institutions, as per the Annex.

Sole paragraph. The manual referred to in the caput, in its most recent version, will be accessible on the Open Finance page of the Central Bank of Brazil's website on the internet and on the Open Finance Portal in Brazil, maintained by the financial institutions and payment institutions that are part of the Open Finance Governance Structure referred to in art. 44, § 1, of Joint Resolution No. 1, of 4 May 2020.

Art. 2 BCB Normative Instruction No. 559, of 4 December 2024, published in the Official Gazette of the Union of 5 December 2024, is revoked.

Art. 3 This Normative Instruction enters into force on the date of its publication.

MARDILSON FERNANDES QUEIROZ CAIO MOREIRA FERNANDES Head of Denor Head of Deinf

ANNEX TO BCB NORMATIVE INSTRUCTION No. 637, OF 13 JUNE 2025

Customer Experience Manual in Open Finance Version 8.0

Summary of changes

Date

Version

Description of changes

13/6/2025

8.0

Subsection 3.4: additions to the Transparency principle.

Subsections 4.1.1; 4.1.2; 4.1.3: addition of exceptionality in the step of selecting data transmitting institutions and account holding institutions.

Subsection 4.1.4: inclusion of the journey for initiating successive payment transactions of Automatic Pix.

Terms of Use

This manual defines the basic principles of the customer experience in Open Finance, complementing the current regulations on the subject.

This manual will be reviewed and updated periodically in order to preserve compatibility with the regulations, as well as to incorporate improvements arising from the evolution of Open Finance.

More detailed information and examples of the application of this manual can be found on the Open Finance Portal in Brazil (https://openfinancebrasil.org.br/), maintained by the financial institutions and payment institutions that are part of the Open Finance Governance Structure referred to in art. 44, § 1, of Joint Resolution No. 1, of 2020.

Suggestions, criticisms or requests for clarification of doubts regarding the content of this document can be sent to the Central Bank of Brazil through the institutional channels of this autarchy.

References

The specifications contained in this manual are based on, reference and complement, when applicable, the following documents:

• I - Joint Resolution No. 1, of 4 May 2020, which provides for the implementation of Open Finance, in which concepts, objectives, principles and other obligations for participating institutions are established;

• II - Circular No. 4.015, of 4 May 2020, which provides for the scope of data and services of Open Finance;

• III - BCB Resolution No. 1, of 12 August 2020, which establishes the Pix payment arrangement and approves its Regulation.

• IV - BCB Resolution No. 32, of 29 October 2020, which establishes the technical requirements and operational procedures for the implementation of Open Finance;

• V - BCB Resolution No. 406, of 2 August 2024, which provides for the sharing of the payment transaction initiation service without redirection to other environments; and

• VI - Law No. 13.709, of 14 August 2018 (General Personal Data Protection Law - LGPD).

The normative acts within the competence of the National Monetary Council or the Central Bank of Brazil can be accessed on the Central Bank of Brazil's website on the internet (www.bcb.gov.br), through the "Search for norms" option.

1. Introduction

This manual aims to ensure that the customer experience when sharing data and services among participating institutions of Open Finance is secure, agile, accurate and convenient. Consumers of financial products and services will only have confidence to authorize the sharing of data and services if their experience matches their expectations and if the information about the process is presented to them in a clear and intuitive manner, allowing their consent for sharing data and services to be unequivocal and well-informed. For this to happen, it is essential that the sharing journey occurs in a secure environment, with as few frictions as possible.

Throughout this manual, some expressions will be frequently used, including:

• I - simple journey of sharing data and services: sequence of steps of sharing data or services performed by a single customer, natural person or legal entity;

• II - multiple journey of sharing data and services: sequence of steps of sharing data or services when the authorization of more than one customer is required, such as accounts of legal entities, in which the requesting customer initiates the sharing of data or services and approving customers (representatives or attorneys of the legal entity) need to authorize it; and

• III - consent management environment: environment made available by participating institutions on their electronic channels so that the customer can view and manage consents already granted or pending, including for the purpose of revoking them.

The expressions mentioned are used to facilitate understanding of this manual and do not necessarily need to be used during the stages of the sharing request.

2. General provisions on the customer experience in Open Finance

Participating institutions are prohibited from creating obstacles or adopting mechanisms that, in any way, impair the fluidity of the customer's journey or encourage them, voluntarily or involuntarily, to give up sharing data or services within the scope of Open Finance. Such obstacles or mechanisms include, for example, offering products and services to the customer during any Open Finance journeys, inserting unnecessary, duplicated or redundant screens, steps or information, or using language that may create uncertainty or negatively affect, directly or indirectly, the customer's perception of the credibility and security of Open Finance or of the other participating institutions.

The prohibition applies to all stages of the customer's journey in Open Finance relating to data and services already typified or that may become so within the scope of the ecosystem, as well as to information relating to the sharing journey disclosed in the different communication channels of the participating institutions with their customers.

Participating institutions must ensure that their customers experience the best experience in Open Finance journeys. In order to achieve this objective, participating institutions that also offer access to their products and services through an application must offer the Open Finance journeys also through that channel.

The provisions set forth herein must be expressly included in the Customer Experience Guide, the subject of section 4 of this manual.

3. Principles of the customer experience in Open Finance

Based on the provisions of Joint Resolution No. 1, of 2020, the following are considered principles of the customer experience in Open Finance:

• I - security and privacy;

• II - agility;

• III - convenience and control; and

• IV - transparency and clarity.

3.1 Security and privacy

The sharing of data and services in Open Finance must be carried out in a secure environment that guarantees the privacy of the customer's personal data, in compliance with current legislation and regulations, especially the normative acts that deal with security and privacy of personal data.

During the sharing journeys, the customer must be adequately informed about the security of the process, with the aim of obtaining consent for the sharing of their registration and transactional data, as well as the payment transaction initiation service.

3.2 Agility

The process of sharing data and services in Open Finance must have a duration compatible with its objectives and level of complexity, ensuring the necessary conditions for free choice and decision-making by the customer. An unnecessarily long process may cause the customer to give up, while any precariousness in the provision of information does not allow for adequate decision-making.

The process of sharing data and services must occur successively and uninterruptedly. Therefore, the stages of the sharing request must not be interrupted until their completion, nor must they require unnecessary actions on the part of the customer.

In cases of multiple sharing journeys of data and services, confirmation of the sharing will only occur after the process is completed by all customers involved in the sharing, who will not need to do so simultaneously or immediately, subject to ensuring the security and transparency of the process, including with regard to the deadlines necessary for its completion.

3.3 Convenience and control

The sharing of data and services in Open Finance must be carried out for specific purposes and in a manner convenient and accessible to the customer, including with regard to the access channels of the participating institutions. The customer must be assured the necessary conditions for exercising control over their personal data shared in Open Finance. In this sense, the sharing journey must be customer-centered, taking into account their profile, needs, objectives and expectations, with the provision of information and consent management environments, including for the revocation of consent when they deem it timely and appropriate, respecting the deadlines defined in current regulations.

Participating institutions in Open Finance may not create additional steps or use more rigorous authentication and confirmation methods to confirm the sharing of data and services within the scope of Open Finance.

In multiple-authority journeys of legal entities, the powers and authorities already constituted and defined for account transactions in their internal policies, such as articles of association, articles of incorporation or other related documents, must be used for the purposes of sharing data and services, so that transmitting institutions and account-holding institutions are prohibited from requiring the constitution of specific powers and authorities for the purposes of sharing data and services within the scope of Open Finance.

Additionally, data transmitting institutions and account holding institutions that provide, in their channels, mechanisms so that legal representatives duly constituted before the institutions themselves can authorize or delegate powers to other persons, must include, in these mechanisms, the possibility of authorization or delegation of powers for data and service sharing within the scope of Open Finance.

3.4 Transparency and clarity

The customer must receive clear, objective and adequate information in their interactions related to Open Finance, from the moment of consent to the provision of information afterwards and in the consent management environment.

The data receiving institution must inform the customer clearly and in a timely manner about which data will be shared, including those referring to products or services that may be contracted by the customer or commercialized by the data transmitting institution in the future, and the reasons why this data will be necessary for the purposes in question, in addition to other mandatory information provided for in current regulations. In the case of service sharing, it must always be transparent to the customer during the journey which participating institution is responsible for providing that service, as well as the conditions of the service being provided.

Unnecessary or excessively complex information can generate doubts and insecurities for the customer, who may give up sharing due to a lack of understanding of the process. Thus, the information provided to the customer must be sufficient and accurate so that their decision-making is unequivocal and well-informed.

The language used must be simple, inclusive and understandable, regardless of the customer's level of prior knowledge about financial products and services. The use of technical terms should be avoided. The terms and expressions used in this manual and in the other normative acts issued by the Central Bank of Brazil related to Open Finance may be replaced by others considered more appropriate for the understanding of all Open Finance customers, provided that their meanings are maintained.

The interface must be intuitive, have organization and elements that facilitate the readability and understanding of the information and must maintain communication standards consistent with the institution's other services. Participating institutions must observe the principles of accessibility, in accordance with current legislation.

The institution must provide feedback to the customer about their actions throughout the journeys to increase their confidence, facilitate understanding of the steps and prevent errors. In the case of errors, the customer must be informed, clearly and specifically, about the problem that occurred and guidance on how to proceed.

4. Customer Experience Guide

In accordance with BCB Resolution No. 32, of 2020, the Structure Responsible for Open Finance Governance must make available to participating institutions and the general public the Customer Experience Guide, which will bring together operational procedures and mandatory requirements for all participating institutions in their interaction with their customers during the sharing journey, observing the principles and other provisions of this manual and the current regulations on Open Finance. The availability of this document, in its most current version, must be carried out through the Open Finance Portal in Brazil.

The Guide must be reviewed and updated periodically by the Structure Responsible for Open Finance Governance, which must maintain transparent control of the published versions. The publication of new versions of the document must be accompanied by usability tests with customers representative of the Open Finance target audience, as well as communicated in a timely manner to participating institutions and the Central Bank of Brazil, which may determine adjustments and corrections.

It is accepted that the Guide establishes principles and requirements additional to those contained in this manual. However, its content must be in compliance with the provisions of current legislation and regulations.

4.1 Content of the Customer Experience Guide

The Customer Experience Guide must provide for, at a minimum:

4.1.1 Simple data sharing journey

The content of this journey must cover, at a minimum:

• I - the identification of the customer

At this stage, the data receiving institution must identify the customer, as required by current regulations.

• II - the determined purposes of consent

At this stage, the data receiving institution must inform the customer of the purpose(s) and the service(s) associated with the data sharing.

• III - the selection of the data subject to sharing at the data receiving institution

The customer must be able to select the data they wish to share, observing the data groupings defined based on art. 11 of Joint Resolution No. 1, of 2020.

The customer must be informed about which data are necessary for the purpose of the sharing and, as applicable, which would be optional. The optional data must correspond to a determined purpose, even if secondary to the main purpose. The customer must also be informed about the reasons why this data is necessary for the purpose(s) in question.

The presentation of a "Terms and Conditions" resource, or similar, is permitted, provided that no additional action by the customer is required to accept the terms.

• IV - the selection of the data sharing term

The customer must be able to select the term for which they wish to share the selected data, observing the purpose and other aspects established in the specific Open Finance regulations.

• V - the selection of the data transmitting institution

The customer must be able to select the data transmitting institution. A search mechanism must be made available that provides an agile and clear selection of the desired institution. All participating institutions for the purpose of data sharing in Open Finance duly registered in the Participants Directory maintained by the Open Finance Governance Responsible Structure must be listed.

In cases where there are bilateral tickets that refer to blocking errors during or after the journey, exceptionally, the data transmitting institution may be disabled for selection and the customer must be clearly informed about this temporary restriction. This exceptionality is valid only during the period in which the ticket is in progress in the Service Desk maintained by the Open Finance Governance Structure.

• VI - the redirection to the environment of the data transmitting institution

The customer must be informed that they are being securely redirected to the environment of the selected data transmitting institution. It must be clear to the customer that the sharing is not yet complete and that additional steps are necessary for it to take effect.

The redirection cannot involve any action by the customer, being merely informative, and must include the following:

• a) journeys initiated at the data receiving institution on a desktop device: the redirection must occur, preferably, to the same device; and

• b) journeys initiated at the data receiving institution on a mobile device:

  • 1. in the case of data transmitting institutions belonging to conglomerates subject to customer journey monitoring, as per the Open Finance Monitoring Manual, the redirection must occur directly to the transmitting institution's application without passing through browsers; and

  • 2. the other data transmitting institutions not covered by customer journey monitoring, as per the Open Finance Monitoring Manual, must observe, preferably, the redirection to their applications.

The conglomerates falling under item 1 may submit to the Central Bank of Brazil substantiated requests for the exemption of specific institutions or brands where mandatory redirection to the application could harm their customers' journey.

Exceptionally, if the customer does not have the transmitting institution's application installed on the mobile device, the redirection must be made to the institution's environment in the browser or to the application store, always on the same device.

• VII - the authentication of the customer at the data transmitting institution

The customer must authenticate at the data transmitting institution. The customer must be able to recognize that they are in the environment of the institution with which they already have a relationship and that the credentials used for authentication are not visible and will not be shared with the data receiving institution.

As established by Joint Resolution No. 1, of 2020, the procedures and controls for customer authentication must be compatible with those applicable to access to electronic service channels already made available by the transmitting institution. This compatibility covers, among others, the authentication factors, the number of steps and the duration of the procedure.

• VIII - the confirmation of sharing by the customer at the data transmitting institution

The customer must confirm the sharing at the data transmitting institution. At a minimum, the identification of the data receiving institution, the validity period of the consent and the data that will be subject to sharing must be presented to the customer for review.

All origins or groupings of data presented to the customer must be pre-selected, so that customer action is only required if they wish to exclude one or more items from the scope to be shared (opt-out).

The selection of data groupings for sharing cannot be changed in the environment of the transmitting institution. Selections in the environment of the transmitting institution must be restricted to the origin of the data.

Exceptionally in the case of credit, investment and foreign exchange operations, the data must be presented in single groupings that encompass all the different modalities of existing products or services, including modalities not contracted by the customer or that are not yet commercialized by the institution, and the possibility of selection by the customer of the origin of the data (modalities, submodalities, or specific contracts) for sharing is prohibited.

Any detailed breakdown of the data subject to sharing must be hidden by default. A resource (button, link, among others) must be made available so that the customer, if they wish, can access the detailed breakdown of the data that will be shared.

The data sharing journey in the environment of the data transmitting institution must not contain a "Terms and Conditions" resource, or similar. The aforementioned resource may, at the institution's discretion, be included in the transmitting institution's Consent Management environment, referred to in subsection 4.1.5 of this manual.

• IX - the redirection to the environment of the data receiving institution

The customer must be informed that they are being securely redirected to the environment of the data receiving institution and that this step is necessary to complete the sharing. The redirection cannot involve any action by the customer, being merely informative, and must occur to the same electronic channel of the data receiving institution used by the customer in the initial step of the journey.

Institutions subject to the obligation of redirection to the application without passing through browsers, as set forth in item VI of this subsection, when acting as data receivers, must implement the redirection provided for in this step also without passing through browsers.

• X - the completion of the data sharing request

The customer must be informed by the data-receiving institution about the completion of the data-sharing request. The communication must include, at a minimum, the purpose(s), the term and the data of the sharing.

4.1.2 Simple payment transaction initiation service sharing journey with redirection

The content of this journey must cover, at a minimum:

• I - the identification of the customer

The payment transaction initiating institution must identify the customer, as required by current regulations.

• II - the selection of the account-holding institution

The customer must be able to select the institution at which they hold the account that will be used for payment. A search mechanism must be made available that provides an agile and clear selection of the desired institution. All participating institutions for the purposes of sharing the payment transaction initiation service in Open Finance must be listed, duly registered as account-holding institutions in the Participants Directory maintained by the Open Finance Governance Responsible Structure, with APIs published for offering the product.

In cases where there are bilateral tickets that refer to blocking errors during or after the journey, exceptionally, the account-holding institution may be disabled for selection and the customer must be clearly informed about this temporary restriction. This exceptionality is valid only during the period in which the ticket is in progress at the Service Desk maintained by the Open Finance Governance Structure.

• III - the information about the payment transaction or the configuration of a recurrence, in the case of successive payments

At a minimum, the following information must be requested from or presented to the customer:

• a) in the case of single payments:

  • 1. the payment amount;

  • 2. the payment method, in accordance with the payment services referred to in art. 6 of Circular No. 4.015, of 2020;

  • 3. the data of the payment recipient, in accordance with the parameters referring to the payment method;

  • 4. the payment date; and

  • 5. the amount of the fee charged for the payment transaction initiation service, where applicable; and

• b) in the case of configuration of recurrence for successive payments:

  • 1. the payment amount, where applicable, being optional in the case of successive payment transactions in which the agreed amount is variable;

  • 2. the payment method, in accordance with the payment services referred to in art. 6 of Circular No. 4.015, of 2020;

  • 3. the future payment dates, where applicable;

  • 4. the frequency of the transactions or the conditions that trigger them;

  • 5. the term of the consent, where applicable;

  • 6. limits, where applicable;

  • 7. the data of the payment recipient, in accordance with the parameters referring to the payment method; and

  • 8. the amount of the fee charged for the payment transaction initiation service, where applicable.

In addition to the minimum information for the initiation of a payment transaction set out above, the data set out in the regulations or instruments that govern the functioning of the payment arrangement referring to the respective payment transaction and other data established in the specifications available on the Open Finance Brazil Portal must be observed in general.

At this stage, the presentation of a "Terms and Conditions" resource, or similar, is permitted, provided that no additional action by the customer is required to accept the terms.

• IV - the redirection to the environment of the account-holding institution

The customer must be informed that they are being securely redirected to the environment of the selected account-holding institution. It must be clear to the customer that the payment is not yet completed and that additional steps are necessary for its completion. The customer must also be informed about the maximum time they have to confirm the transaction.

The redirection cannot require any action by the customer, being merely informative, and must include the following:

• a) journeys initiated at the payment transaction initiating institution on a desktop device: the redirection must occur, preferably, to the same device; and

• b) journeys initiated at the payment transaction initiating institution on a mobile device:

  • 1. in the case of account-holding institutions belonging to conglomerates subject to customer journey monitoring, in accordance with the Open Finance Monitoring Manual, the redirection must occur directly to the institution's application without passing through browsers; and

  • 2. the other account-holding institutions not covered by customer journey monitoring, in accordance with the Open Finance Monitoring Manual, must preferably redirect to their applications.

Exceptionally, if the customer does not have the account-holding institution's application installed on their mobile device, the redirection must be made to the institution's environment in the browser or to the application store, always on the same device.

It is emphasized that there is no obligation to develop an application for institutions that do not offer this channel to their customers. In the latter case, the institution's channel in the browser may be used.

• V - the authentication of the customer at the account-holding institution

The customer must authenticate at the account-holding institution. The customer must be able to recognize that they are in the environment of the institution with which they already have a relationship and that the credentials used for authentication are not visible and will not be shared with the payment transaction initiating institution.

As established by Joint Resolution No. 1, of 2020, the procedures and controls for customer authentication must be compatible with those applicable to access to the electronic service channels already made available by the account-holding institution. This compatibility covers, among others, the authentication factors, the number of steps and the duration of the procedure.

• VI - the confirmation of sharing by the customer at the account-holding institution

The customer must confirm the payment at the account-holding institution. If the customer holds more than one account associated with the credentials with which they authenticated, the customer must be able to select the account they wish to use for the payment transaction.

At a minimum, the information listed in items 1 to 4 of subparagraph "a" and 1 to 7 of subparagraph "b" of item III of this subsection, which deal with the payment transaction information stage, must be presented to the customer for confirmation. Additionally, the amount of the fee charged by the account-holding institution for carrying out the payment transaction, where applicable, must be presented to the customer.

The payment transaction initiation service sharing journey in the account-holding institution's environment must not contain a "Terms and Conditions" feature, or similar. The aforementioned feature may, at the institution's discretion, be included in the account-holding institution's Consent Management environment, addressed in subsection 4.1.5 of this manual.

• VII - the redirection to the payment transaction initiating institution's environment

The customer must be informed that they are being securely redirected to the payment transaction initiating institution's environment and that this step is necessary to complete the sharing. The redirection must not require any action from the customer, being merely informative, and must occur to the same electronic channel of the payment transaction initiating institution used by the customer in the initial stage of the journey.

Institutions subject to the obligation to redirect to the application without going through browsers, as set forth in item IV of this subsection, when acting as payment transaction initiators, must implement the redirection provided for in this stage also without going through browsers.

• VIII - the completion of the payment transaction

The payment transaction initiating institution must present the receipt of the completion of the payment transaction, whether single or successive. A receipt must be presented to the customer containing, at a minimum, the information listed in item III of this subsection, which deals with the payment transaction information stage.

4.1.3 Simple payment transaction initiation service sharing journey without redirection

The simple payment transaction initiation service sharing journey without redirection consists of two stages: the account linking stage and the payment transaction stage.

4.1.3.1 Account linking stage

The content of this journey must include, at a minimum:

• I - the identification of the customer

The payment transaction initiating institution must identify the customer, as required by current regulations.

• II - the selection of the account-holding institution

The customer must be able to select the institution at which they hold the account that will be linked for carrying out payment transactions. A search mechanism must be made available that provides an agile and clear selection of the desired institution. The account-holding institutions with mandatory implementation, in accordance with Resolution BCB No. 406 of 2024, art. 6, and those that optionally join the service, must be listed.

In cases where there are bilateral tickets referring to blocking errors during or after the journey, on an exceptional basis, the account-holding institution may be disabled for selection and the customer must be clearly informed about this temporary restriction. This exceptionality is valid only during the period in which the ticket is in progress at the Service Desk maintained by the Open Finance Governance Structure.

• III - the redirection to the account-holding institution's environment

The customer must be informed that they are being securely redirected to the environment of the selected account-holding institution. It must be clear to the customer that the account linking is not yet complete and that additional steps are necessary for its completion. The customer must also be informed about the maximum time they have to confirm the linking.

All provisions set forth in subsection 4.1.2, item IV, apply.

• IV - the authentication of the customer at the account-holding institution

All provisions set forth in subsection 4.1.2, item V, apply.

• V - the presentation of information about the account linking

Information about the account linking that will be carried out must be presented to the customer. The information must include, at a minimum:

• a) the identification of the user;

• b) the identification of the initiating institution;

• c) the five-year consent validity period, as required by current regulations, which the customer must be able to reduce or increase;

• d) the maximum amounts per transaction and per day:

  • 1. the field for the maximum amount per transaction of R$500.00 filled in, which the customer must be able to reduce; and

  • 2. the field for the maximum amount per day not filled in, for which the customer must have the option to enter an amount; and

• e) the identification of the source account.

The customer must be informed that the limits for Pix transactions established at the institution holding the linked account will be respected.

Participating institutions with bilateral contracts may present a higher per-transaction limit, in accordance with the sole paragraph of art. 7 of Resolution BCB No. 406 of 2024.

• VI - the confirmation of sharing by the customer at the account-holding institution:

The customer must confirm the account linking at the account-holding institution upon viewing the information listed in subparagraphs "a" to "e" of item V of subsection 4.1.3.1, which deals with information about the account linking.

If the customer holds more than one account associated with the credentials with which they authenticated, the customer must be able to select the account they wish to use for the linking.

The payment transaction initiation service sharing journey in the environment of the account-holding institution must not contain a "Terms and Conditions" resource, or similar. The aforementioned resource may, at the institution's discretion, be included in the Consent Management environment of the account-holding institution, addressed in subsection 4.1.5 of this manual.

• VII - the redirection to the environment of the payment transaction initiating institution

The customer must be informed that they are being securely redirected to the environment of the payment transaction initiating institution and that this step is necessary to complete the account linking. The redirection must occur to the same electronic channel of the payment transaction initiating institution used by the customer in the initial stage of the journey.

Institutions subject to the obligation of redirection to the application without passing through browsers, as set forth in item IV of subsection 4.1.2, when acting as payment transaction initiators, must implement the redirection provided for in this stage also without passing through browsers.

• VIII - the creation of keys on the electronic device

The customer must be informed that, to complete the account linking, they must validate the generation of security keys using their credentials registered on the device (biometrics, password, etc.).

• IX - the completion of the account linking

The payment transaction initiating institution must confirm the account linking.

The customer must be informed that the summary of the linking request will be available for consultation in the consent management environment (linked accounts) and that revocation can be done at any time, with indication of the location for this action.

4.1.3.2 Payment transaction stage

The content of this journey must cover, at a minimum:

• I - the identification of the customer

The payment transaction initiating institution must identify the customer, as required by current regulations.

• II - the request for payment transaction initiation with the linked account

The payment transaction initiating institution must present to the customer the possibility of making the payment using their previously linked account among the other payment options.

The payment arrangement being used must be clear to the customer.

• III - the selection of the institution holding the linked account

The customer must be able to select the institution with which they have already completed the account linking stage. A search mechanism must be made available that provides an agile and clear selection of the desired institution. All institutions with which the customer has already completed the account linking stage at that payment transaction initiating institution and on that device must be listed.

In cases where there are bilateral tickets referring to blocking errors during or after the journey, exceptionally, the account-holding institution may be disabled for selection and the customer must be clearly informed about this temporary restriction. This exceptionality is valid only during the period in which the ticket is in progress at the Service Desk maintained by the Open Finance Governance Structure.

• IV - The information about the single payment transaction

At a minimum, the following information must be requested from or presented to the customer:

• a) the payment amount;

• b) the payment method, in accordance with the payment services addressed in art. 6 of Circular No. 4.015, of 2020;

• c) the data of the payment recipient, in accordance with the parameters referring to the payment method;

• d) the payment date; and

• e) the amount of the fee charged for the payment transaction initiation service, when applicable.

In addition to the minimum information for payment transaction initiation set out above, the data set out in the regulations or instruments that govern the functioning of the payment arrangement referring to the respective payment transaction and other data established in the specifications available on the Open Finance Brazil Portal must be observed in general.

The presentation of a "Terms and Conditions" resource, or similar, is permitted, provided that no additional action by the customer is required to accept the terms.

• V - the confirmation of sharing by the customer at the payment transaction initiating institution

The customer must confirm the payment at the payment transaction initiating institution. The customer must be asked to confirm with their credentials registered on the device.

• VI - the completion of the payment transaction

The payment transaction initiating institution must present the receipt of the completion of the payment transaction. A receipt must be presented to the customer with, at a minimum, the information listed in item IV of subsection 4.1.3.2, which addresses the stage of information about the payment transaction.

4.1.4 Sharing journey for the payment transaction initiation service of successive Pix Automatic payments

This subsection specifically addresses the characteristics of the payment transaction initiation journeys for Pix Automatic, in addition to the provisions of the regulations and instruments that govern the payment arrangement.

The term "authorization" used in the payment arrangement for this service corresponds, in this Manual, to obtaining the customer's consent.

4.1.4.1 General information about the service

When using Pix Automatic for the first time at the payment transaction initiating institution, the customer must receive general information about the service and its rules, covering, at a minimum, the following aspects: what Pix Automatic is; advantages and applications; and general operation.

4.1.4.2 Consent parameter configuration stage

For the identification of the customer and the selection of the account-holding institution, the payment transaction initiating institution must observe the provisions of items I and II, respectively, of subsection 4.1.2.

• I - the information about the consent

The minimum information to be presented to the customer by the payment transaction initiating institution must follow what is specified for the payer's payment service provider (PSP) in the regulation of the payment arrangement for Pix Automático, including those referring to one-off payments, that is, initial payments that are not part of the recurrence, which may be immediate or scheduled. The customer must also be informed about the payment method - Pix Automático -, the payment transaction initiating institution and any amount of the fee charged for the payment transaction initiation service.

With regard to the maximum transaction amount, the payment transaction initiating institution is prohibited from allowing the payee access to information about amounts defined by the customer in this field, as well as changes made subsequently in the management environment.

In addition to the minimum information for the initiation of a payment transaction set out above, the data set out in other regulations or instruments that govern the operation of the payment arrangement referring to the respective payment transaction and other data established in the specifications available on the Open Finance Brazil Portal must be observed.

At this stage, the presentation of a "Terms and Conditions" resource, or similar, is permitted, provided that no additional action by the customer is required to accept the terms.

• II - the redirection to the account-holding institution's environment

The customer must be informed that they are being securely redirected to the environment of the selected account-holding institution. It must be clear to the customer that the configuration of the consent is not yet complete and that additional steps are necessary for it to take effect. The customer must also be informed about the maximum time they have to confirm the consent.

All provisions set out in subsection 4.1.2, item IV, apply.

• III - the authentication of the customer at the account-holding institution

All provisions set out in subsection 4.1.2, item V, apply.

• IV - the confirmation of sharing by the customer at the account-holding institution

At this stage, the account-holding institution must:

• a) allow the customer to select the account they wish to use for the configuration, if they hold more than one account associated with the credentials with which they authenticated;

• b) present the information in the form established in item I of this subsection, in addition to the amount of the fee charged by the account-holding institution when carrying out the payment transaction, if any;

• c) make clear the need for a one-off payment, immediate or scheduled, as well as the due date and its respective amount; and

• d) inform the maximum period for approval of the consent, in cases requiring multiple approvals, in accordance with the periods determined by the Open Finance Governance Structure.

At this stage, the account-holding institution's environment must not present "Terms and Conditions", or similar, to the customer, and it may be made available in the consent management environment of the account-holding institution, referred to in subsection 4.1.6 of this manual.

The account-holding institution is prohibited from allowing the editing of fields at this customer confirmation stage, except for choosing the debit account, when necessary.

• V - the redirection to the payment transaction initiating institution's environment

The customer must be informed that they are being securely redirected to the payment transaction initiating institution's environment and that this step is necessary for the consent to take effect. The redirection must occur to the same electronic channel of the payment transaction initiating institution used by the customer in the initial stage of the journey.

Institutions subject to the obligation to redirect to the application without going through browsers, as set out in item IV of subsection 4.1.2, when acting as payment transaction initiators, must implement the redirection provided for in this stage also without going through browsers.

• VI - the effectuation of the consent

At this stage, the payment transaction initiating institution must inform the customer about the effectuation of the consent. The guidelines that in the payment arrangement refer to the authorization for Pix Automático and the conclusion of one-off payments must be observed.

When there is a failure in the settlement or scheduling of the one-off payment, the payment transaction initiating institution must inform the customer whether or not the consent will be maintained, in accordance with what is provided by the payee, and guide them on how to proceed.

If there is a failure in processing the effectuation of the consent, but with settlement of the immediate payment, the payment transaction initiating institution must provide the customer with the payment or scheduling receipt and a clear message guiding them on how to proceed.

Additionally, the customer must be informed which actions regarding changes and cancellations are permitted in the management environment of the payment transaction initiating institution and of the account-holding institution, clarifying that the consent may be revoked at any time, in either of the two environments.

In cases where approval at other approval levels is necessary, inform the customer of the period for this confirmation.

4.1.4.3 Management environment

• I - General characteristics

The payment transaction initiating institutions and account holding institutions must have a management environment that allows the customer to perform queries, changes and revocation of consents related to Pix Automático, as well as the recurring payments associated with the service.

For the account holding institution, this environment must be the same one used for transactions carried out via the payer's PSP, in order to unify the customer experience.

• II - Queries to consents and payments

In the environments of the payment transaction initiating institution and the account holding institution, the customer must be allowed to query the history of consents for Pix Automático. The current status of each consent must be presented, for example: active, revoked, pending, etc., and the minimum information provided for in the payment arrangement according to each consent status. Likewise, for queries and revocation of scheduled payments and queries of already settled payments, the information defined by the payment arrangement for these cases must be presented to the customer, including regarding the provision of the receipt for these transactions.

• III - Other possible actions in each environment

In addition to the functionalities provided for in the previous item, the management environment must enable the customer to:

At the payment transaction initiating institution:

• a) view and edit, if permitted by the receiver, the consent term, including changing it to an indefinite term. In cases where there is a reduction in the consent term, the customer must be informed about the consequences of this action in relation to payments scheduled for days after the new expiration date;

• b) view and edit the maximum transaction amount, and in the case of editing this field, any minimum amount established by the receiver must be respected and the customer must be informed when the new amount will take effect;

• c) edit the date of the first payment, if permitted by the receiver;

• d) cancel the consent; and

• e) enable or disable notifications.

None of the above changes require redirecting the customer to the account holding institution.

With regard to the maximum amount, the payment transaction initiating institution is prohibited from allowing the receiver access to information about the maximum transaction amount defined by the customer, including its changes.

At the account holding institution:

• a) view the consent term;

• b) view and edit the maximum transaction amount, and in the case of editing this field, any minimum amount established by the receiver must be respected and the customer must be informed when the new amount will take effect;

• c) view and edit the possibility of using a credit limit, with the default being enabled;

  • d) cancel the consent; and

  • e) enable or disable notifications.

None of the above changes require redirecting the customer to the payment transaction initiating institution.

When revoking consents, in any of the environments, the customer must be warned about the impossibility of undoing the action, as well as its consequences in relation to future payments.

4.1.4.4 Notifications and error messages

The following is established for notifications related to Pix Automático within the scope of Open Finance.

For the payment transaction initiating institution:

    - I - notifications to the payer user related to consent are mandatory and cannot be disabled by the user; and

    - II - notifications to the payer user about scheduling and settlements are optional. If implemented, it must be allowed for them to be disabled by the user.

The payment transaction initiating institution is prohibited from forwarding to the receiver error messages and rejection reasons that specify that there was a payment failure due to insufficient balance or limits. In these cases, the payment transaction initiating institution must inform the receiver about the non-processing of the payment in a generic manner. The guidance for the customer must be to seek information from their account holding institution.

For the account holding institution:

    - I - notifications to the payer user related to scheduling and settlement of payments must be enabled by default at the account holding institution and follow the provisions of the payment arrangement for the payer's PSP;

    - II - only notifications of successful scheduling may be disabled by users at the account holding institution. The others will remain active, also following what is defined in the payment arrangement;

    - III - notifications related to consent are optional to send on the part of the account holding institution. In cases related to changes in the maximum amount, notification settings and use or non-use of the credit limit, the account holding institution must also mandatorily notify the customer in case of change; and

    - IV - the account holding institution must communicate all occurrences of success or failure of scheduling and payments to the payment transaction initiating institution, so that it can assess whether or not it also wishes to notify the customer.

Messages to the customer regarding errors that occurred during the consent process or settlement of payments must be clear and specific, so as to enable the customer to understand what the problem was, in accordance with the principle of transparency and clarity detailed in item 3.4 of this document.

4.1.5 Multiple approval journey for data and service sharing

The Guide must establish parameters for the customer experience in a multiple journey of data and service sharing, when applicable.

In this case, all customers involved in the sharing must be clearly informed about the procedures and steps necessary to carry out the sharing. Additionally, the approving clients must be promptly notified by the data-transmitting or account-holding institution about the need for action to effect the sharing of data or services initiated by the requesting client.

In particular, the Guide must establish, where applicable, the maximum deadlines for action by the approving clients, which must be applied uniformly by all participating institutions. Furthermore, the Guide must establish parameters for cases in which one or more approving clients do not authorize the sharing, covering at a minimum the notification to the other clients (requesting or approving) and the communication to the data-receiving or payment-transaction-initiating institution.

For the purpose of sharing data related to joint accounts of natural persons, the data-transmitting institution must ensure that the data-receiving institution has access to registration data only of the account holder responsible for the consent, and the sharing of registration data of the other holders of the respective account is not permitted.

The data-transmitting institution must require confirmation from all account holders to effect the sharing only if access to transactional information of the account depends on the authorization of all holders.

4.1.6 Consent management environment

The Guide must establish requirements for the consent management environment of the participating institutions. In this case, the said institutions must make available on their electronic channel a specific environment for the management of the sharings in which they were involved within the scope of Open Finance.

In this environment, the client must have simple, agile, accurate and convenient access to, at a minimum, information about consents and account links in force or pending effectuation in the multiple journey, with the possibility of searching based on criteria defined for homogeneous observance by all participating institutions.

Additionally, the client must have the option to consult and revoke consents, in compliance with the provisions of art. 15 of Joint Resolution No. 1, of 2020. The effectuation of revocation must be preceded by a confirmation screen with information about the consequences of the action.

4.1.7 Standardization of terminology used by participating institutions during the sharing journey

The Guide must standardize the terminology used by participating institutions in communication with their clients during the data and services sharing journey.

The terminology contained in the Guide must be adopted by all participating institutions, including in their communication processes to the general public associated with Open Finance, ensuring uniformity of the client experience and preventing the emergence of doubts or insecurity during the sharing of data and services.

4.2 Structure of the Customer Experience Guide

The Guide must be structured in a clear and cohesive manner, so that it is properly interpreted by interested parties. Additionally, the Guide must contain example screens that illustrate the stages of the data and services sharing journeys by the client.

In turn, the provisions of the Guide must be classified into, at a minimum:

    - I - requirements: provisions that must be mandatorily followed by the participating institutions; and

    - II - recommendations: provisions of non-mandatory observance by the participating institutions, but whose implementation is recommendable, considering good practices for the customer experience.

In this regard, the Guide must contain requirements and recommendations applicable to the various situations of data and services sharing, covering at a minimum:

    - I - sharing of data and services by natural persons;

    - II - sharing of data and services by legal persons;

    - III - sharing of data and services by natural persons holding joint accounts in which the consent of more than one account holder is required;

    - IV - sharing of data and services by legal persons in which the consent of more than one representative or attorney of the company is required; and

    - V - environment for managing consents granted by natural and legal persons at the participating institutions.

Brasília, 13 June 2025.

NOTE 371/2025-BCB/DENOR, OF 12 June 2025

It provides the basis for the proposed issuance of a normative instruction that establishes version 8.0 of the Open Finance Customer Experience Manual.

Mr. Heads of Denor and Deinf,

This Note provides the basis for the proposed issuance of a normative instruction by the Department of Regulation of the Financial System (Denor) and by the Department of Information Technology (Deinf), in the exercise of the attribution conferred in art. 23, item I, subitem "a", of the Internal Rules of the Central Bank of Brazil, annexed to BCB Resolution No. 340, of 21 September 2023, based on art. 3, item I, of BCB Resolution No. 32, of 29 October 2020.

2. In this regard, the proposal concerns the issuance of a normative instruction that establishes version 8.0 of the Open Finance Customer Experience Manual, revoking BCB Normative Instruction No. 559, of 4 December 2024, which disclosed version 7.0 of that manual.

3. The changes in the new version of the manual aim to detail guidelines for user experience: during the stage of selecting the data-transmitting or account-holding institution; in cases of successive payments of Automatic Pix; and what is expected of Open Finance participating institutions regarding transparency and clarity with their clients.

4. In this regard, it is highlighted that the customer experience plays an important role in building trust in the financial system, since it forms the basis of the population's interaction with financial services. The regulation of customer experience elements by this Central Bank aims to ensure a level playing field in this area, in order to curb practices that could affect public trust and to preserve the financial products and services sector as a safe and reliable environment.

5. It should be clarified that, by virtue of Decree No. 10.411 of 30 June 2020, the issuance of normative acts by bodies and entities of the direct, autarchic, and foundational federal public administration must be preceded by a Regulatory Impact Analysis (RIA), except in the cases of waiver of RIA provided for in its art. 4. It is understood, however, that, given what is set out in the previous paragraph, this proposal, as a normative act aimed at preserving liquidity, solvency, or soundness of financial markets and payment systems, falls within the waiver of RIA provided for in item V, subitems "b" and "c" of art. 4 of the aforementioned Decree.

For the consideration of Your Excellency.

JANAÍNA PIMENTA ATTIE VERUSKA ROCHA ARAGÃO Consultant of Denor Deputy Head of Deinf

Agreed.

MARDILSON FERNANDES QUEIROZ CAIO MOREIRA FERNANDES Head of Denor Head of Deinf