BCB Normative Instruction No. 664 — Establishes Deadlines for PSTI Adaptations to Resolution BCB No. 498

BCB NORMATIVE INSTRUCTION NO. 664, OF SEPTEMBER 11, 2025

Establishes deadlines for the Information Technology Service Provider – PSTI, operating on the date of entry into force of BCB Resolution No. 498, of September 5, 2025, to make the necessary adaptations to comply with the rules on information security policy and fraud management policy established in said Resolution.

The Head of the Information Technology Department (Deinf), in the exercise of its authority, in view of the provisions of Art. 71, item V, of the Internal Regulations of the Central Bank of Brazil, annexed to BCB Resolution No. 340, of September 21, 2023, and considering the provisions of BCB Resolution No. 498, of September 5, 2025,

RESOLVES:

Art. 1 This Normative Instruction establishes deadlines for the Information Technology Service Provider – PSTI, operating on the date of entry into force of BCB Resolution No. 498, of September 5, 2025, to make the necessary adaptations to comply with the rules on information security policy and fraud management policy established in said Resolution.

Art. 2 The PSTI referred to in Art. 1 must, within 15 (fifteen) days, counted from the entry into force of this Normative Instruction, implement the following aspects of the information security policy provided for in Art. 17 of BCB Resolution No. 498, of 2025:

I - adoption of transaction traceability mechanisms, including, at minimum:

a) audit trails of end-to-end data and information processing, including the definition and generation of logs that allow identifying processing failures or atypical behavior, as well as supporting analyses;

b) definition of information retention time according to the type of processing performed;

c) secure retention of audit trails; and

d) access to audit trails by institutions using the services provided by the PSTI, for reconciliation or risk management purposes;

II - adoption of access control, including, at least:

a) mechanisms to limit access to the corporate network to authorized users and devices;

b) periodic and timely review of access permissions, especially for third-party collaborators with access to the institution's computing environment;

c) the establishment of multiple authentication factors for access to the corporate network from external environments; and

d) use of multiple authentication factors for administrative access to Pix and STR environments;

III - management of digital certificates, executing, at minimum:

a) monitoring the use of digital certificates and controls for the storage of this information; and

b) validation of revoked certificates with certification authorities;

IV - promotion of cyber intelligence actions, including monitoring information of interest (clients, keys, credentials, vulnerabilities, etc.) on the Internet, Deep and Dark Web, as well as private communication groups;

V - adoption of network protection mechanisms, which must include, at minimum:

a) the establishment of firewall rules, as well as monitoring of connections, avoiding connection attempts with critical systems originating from technology assets located outside the institution's corporate network;

b) the definition of criteria for establishing and monitoring connections with external environments, especially during nighttime or unconventional hours;

c) mechanisms to identify and prevent improper connections with external environments from the PSTI's computing environment; and

d) the implementation and maintenance of processes and tools for identifying, analyzing, and treating atypical events in the PSTI environment, such as the opening of virtual private networks – VPN and attempts at privileged access, especially during nighttime or unconventional hours, as well as evaluating the implementation of more robust controls that mitigate risks of improper access on these occasions.

Sole Paragraph. The aspects of the information security policy provided for in Art. 17 of BCB Resolution No. 498, of 2025, and not referred to in the main text, must be implemented within 30 (thirty) days, counted from the entry into force of this Normative Instruction.

Art. 3 The PSTI referred to in Art. 1 must implement, within 30 (thirty) days, counted from the entry into force of this Normative Instruction, the fraud management policy referred to in Arts. 24 and 25 of BCB Resolution No. 498, of 2025.

Art. 4 The PSTI referred to in Art. 1 must send a reasonable assurance report prepared by an independent audit firm duly registered with the Securities and Exchange Commission (CVM), attesting to the full compliance by the PSTI with all procedures, requirements, and deadlines provided for in this Normative Instruction.

§1 The independent audit firm to be contracted and the technical persons responsible for preparing the report must possess recognized integrity and technical capacity.

§2 The report referred to in the main text is an integral part of the measures provided for in Arts. 2 and 3, and must be sent to the Central Bank of Brazil within 15 (fifteen) days after the implementation of the measures provided for in this Normative Instruction.

Art. 5 When filing the documents required by this Normative Instruction, institutions must select the subject "Diverse Documents – PSTI" in the Digital Protocol of the Central Bank of Brazil for destination to Deinf.

Art. 6 Non-compliance with the deadlines set in this Normative Instruction may subject the PSTI to the application of precautionary measures provided for in Art. 32 of BCB Resolution No. 498, of 2025.

Art. 7 This Normative Instruction enters into force on the date of its publication.

Caio Moreira Fernandes

Note:

The proposed Normative Instruction aims to establish deadlines for Information Technology Service Providers (PSTIs), already in operation on the date of entry into force of BCB Resolution No. 498, of September 5, 2025, to make the necessary adaptations for compliance with the regulatory requirements established by the Central Bank of Brazil.

BCB Resolution No. 498/2025 regulates, within the National Financial System (SFN) and the Brazilian Payments System (SPB), the requirements, procedures, and conditions for the accreditation of PSTIs, focusing on information security, cyber security, risk management, and governance. The proposed Normative Instruction regulates Articles 19 and 27 of said Resolution, detailing deadlines and mandatory technical measures, such as transaction traceability, access control, digital certificate management, and cyber intelligence actions.

In accordance with Art. 4, item V, items "b" and "c" of Decree No. 10.411, of June 30, 2020, which regulates Law No. 13.874, of September 20, 2019 (Economic Freedom Law), the preparation of a Regulatory Impact Analysis (AIR) may be waived when the normative act aims to preserve the liquidity, solvency, or soundness of the financial market and the payments system. The present norm falls under this hypothesis, as it aims to safeguard the integrity and confidence in the RSFN and the payment arrangements supported by it, preventing operational risks, fraud, and vulnerabilities.