BCB Normative Instruction No. 666 — Waiver of the Limit for Issuing TEDs of R$15,000 or More via IT Service Providers

BCB NORMATIVE INSTRUCTION NO. 666, OF SEPTEMBER 22, 2025

Regulates the waiver of compliance with the limit for issuing Electronic Available Transfer – TED of value equal to or greater than R$15,000.00 (fifteen thousand reais) by institutions that connect to the National Financial System Network – RSFN through an Information Technology Service Provider – ITSP.

The Head of the Information Technology Department – Deinf, the Head of the Strategic Management and Specialized Supervision Department – Degef and the Head of the Banking Operations and Payment Systems Department – Deban, in the exercise of their powers, having in view the provisions of art. 23, item I, letter “a”, art. 70, item I, letter “a”, and art. 112, item IV, letters “a” and “b”, all of the Internal Regulations of the Central Bank of Brazil, annexed to BCB Resolution No. 340, of September 21, 2023, and art. 3º-A, § 3º, item II, of BCB Resolution No. 256, of November 1, 2022,

R E S O L V E:

Art. 1º
This Normative Instruction regulates the temporary waiver referred to in art. 3º-A, §§ 2º and 3º, of BCB Resolution No. 256, of 2022, applicable to the limit for issuing Electronic Available Transfer – TED of value equal to or greater than R$15,000.00 (fifteen thousand reais) by institutions that connect to the National Financial System Network – RSFN through an Information Technology Service Provider – ITSP.

Art.
2º To obtain a waiver, for a period of ninety days, of the maximum limit referred to in art. 1º, the institution must file a request accompanied by a formal document demonstrating the constitution of the guarantee referred to in art. 3º and describing the measures adopted for the implementation of information security controls described in arts. 4º and 5º, and it must also be accompanied by the reasonable assurance report referred to in art. 6º.

Sole Paragraph. The temporary waiver referred to in the caput will only take effect from the formal communication to the participant of the joint decision of the Banking Operations and Payment Systems Department (Deban), the Information Technology Department (Deinf) and the Strategic Management and Specialized Supervision Department (Degef), after analysis of the documentation presented by the institution.

Art.
3º The requesting institution, as a guarantee, must maintain, at minimum, capital surplus in the amount of 100% (one hundred percent) on the maximum daily volume of TEDs made in favor of customers from its Banking Reserves Account or its Settlement Account, depending on the case, in the period between August 1, 2025 and August 29, 2025.

§
1º The capital surplus, whose value, for the purposes of the guarantee referred to in this Normative Instruction, will correspond, at minimum, to the amount provided in the caput, is defined as:

I

• for conglomerates and type 1 and type 3 institutions belonging to
  segments S1 to S4, the smallest capital excess relative to the requirements for minimum Principal Capital, Tier I and Reference Equity, calculated in accordance with current regulation;

II

• for conglomerates and type 1 and type 3 institutions belonging to segment
  S5, the capital excess relative to the minimum requirement for S5 Reference Equity (PRS5), calculated in accordance with current regulation; and

III

• for type 2 conglomerates and institutions, the capital excess relative to
  the minimum requirement for IP Reference Equity (PRIP), calculated in accordance with current regulation.

§
2º The requirement referred to in the caput will be cumulative with the guarantee presented based on BCB Normative Instruction No. 667, of September 22, 2025.

§
3º The Central Bank of Brazil may request the presentation of additional guarantee if the maximum daily volume of TEDs made in favor of customers from the Banking Reserves Account or the Settlement Account of the institution, depending on the case, presents, during the time the waiver lasts, a value higher than that of the amount referred to in the caput.

Art.
4º In the case where data processing services related to the issuance of TEDs and connectivity for access to the RSFN provided by ITSPs are used, the institution must attest that:

I

• it does not share with the ITSP, or store in the provider's environment, the private keys,
  related to the digital certificates registered with the Central Bank of Brazil, which are used for signing messages;

II

• the digital certificates, related to the private keys used for
  signing messages that were in the ITSP's environment or to which the ITSP had access, were revoked by the respective certifying authority and replaced in the Reserve Transfer System – STR, operated by the Central Bank of Brazil, and in the Fund Transfer System – SITRAF, operated by Núclea;

III

• it uses distinct digital certificates for different environments;

IV

• it implements periodic and timely review of access permissions, in
  particular, of third-party collaborators with access to the institution's computational environment and to reserve operations;

V

• regarding fraud management:

a) validates the integrity of transactions before their signature, ensuring that the information has not been fraudulently generated, corrupted or manipulated during the message generation process; and

b) performs monitoring on business days from 6:00 a.m. to 7:00 p.m. for real-time identification, based on historical and behavioral patterns, of atypical or fraudulent transactions, evaluating deviations from expected parameters regarding, among other things:

1. transaction values;

2. transaction volume; and

3. number of transactions per unit of time; and

VI

• has mechanisms for interrupting transaction processing in case of suspicion of serious compromise of its systems or of the contracted ITSP's systems.

Art.
5º In cases where only the connectivity service provided by ITSP for access to the RSFN is used, in addition to the requirements provided in art. 4º, the institution must attest that:

I

• it implements encryption mechanisms, intrusion prevention and detection,
  information leak prevention and protection against malicious software;

II

• it implements transaction traceability mechanisms that include, at minimum:

a) audit trails of end-to-end data and information processing, including the definition and generation of logs that allow identifying processing failures or atypical behavior, as well as supporting analyses;

b) definition of information retention time according to the type of processing performed; and

c) secure retention of audit trails;

III

• it implements data and information backup management;

IV

• it performs vulnerability assessment and correction that includes at minimum:

a) periodic tests and analyses to detect vulnerabilities in information systems;

b) periodic physical scans of the technological environment that allow identifying improperly connected devices to the corporate network that may establish connection with external technology assets;

c) periodic analyses of the technological environment with the objective of identifying vulnerabilities that may compromise the security of technology assets; and

d) periodic penetration tests.

V

• it implements an access control policy that includes, at minimum:

a) mechanisms to limit access to the corporate network to authorized users and devices;

b) periodic and timely review of access permissions, in particular, of third-party collaborators with access to the institution's computational environment;

c) establishment of multiple authentication factors for access to the corporate network from external environments; and.

d) administrative access with the use of multiple authentication factors, for the internal processing environments of the TED;

VI

• it has a process for the regular evaluation and application of security patches;

VII

• it deploys network protection mechanisms that include, at minimum:

a) establishment of firewall rules, as well as monitoring of connections, avoiding connection attempts to critical systems originating from technology assets located outside the institution's corporate network;

b) definition of criteria for the establishment and monitoring of connections with external environments, especially during nighttime or unconventional hours;

c) mechanisms to identify and prevent improper connections to external environments from the institution's computational environment; and

d) implementation and maintenance of processes and tools for identifying, analyzing and treating atypical events in the environment, such as the opening of virtual private networks – VPN and attempts at privileged access, especially during nighttime or unconventional hours, as well as analysis of the deployment of more robust controls that mitigate risks of improper access on these occasions.

VIII

• it segregates computational environments, limiting access to the production environment and to critical computational resources;

IX

• it physically and logically isolates the TED processing environment from other systems, maintaining a dedicated and separate instance from other environments in cases of public cloud usage;

X

• it performs digital certificate management that includes, at minimum:

a) monitoring the use of digital certificates and controls for the storage of this information; and

b) validation of revoked certificates with certifying authorities;

XI

• it implements a fraud management policy, adopting the following measures:

a) establishment of a channel for reporting signs of fraud; and

b) establishment of a system for identifying atypical or fraudulent transactions in real time, evaluating deviations from expected parameters.

Art.
6º The fulfillment of the requirements referred to in arts. 4º and 5º must be attested by a reasonable assurance report prepared by an independent audit firm registered with the Securities and Exchange Commission – CVM, which must be presented to the Central Bank of Brazil for the filing of the request referred to in art. 2º.

§
1º The independent audit firm contracted by the institution must possess technical, administrative and operational capacity compatible with the performance of the reasonable assurance work provided for in this Normative Instruction.

§
2º The Central Bank of Brazil may deny the temporary waiver request or adopt the measure referred to in art. 9º if it detects, at any time, that the contracted audit firm does not meet the requirements of § 1º and the norms and audit procedures determined by the CVM and the Federal Council of Accountancy.

Art.
7º The request referred to in art. 2º must be signed by a Statutory Director responsible for cybersecurity policy, designated by the institution in accordance with current regulation, who will commit to the veracity of the information presented to the Central Bank of Brazil, subjecting himself to the measures provided in Law No. 13.506, of November 13, 2017.

Art.
8º The temporary waiver referred to in art. 1º may be extended for successive periods of, at maximum, ninety days, until the institution meets the requirements provided in § 1º of art. 3º-A of BCB Resolution No. 256, of November 1, 2022, and provided that it has not presented deficiencies or serious operational failures during previous waiver periods.

Art.
9º The temporary waiver referred to in art. 1º may be revoked, at any time, if the institution:

I

• presents deficiencies or serious operational failures;

II

• maintains outdated information about its capital; or

III

• does not observe the provisions of art. 3º.

Art.
10. When filing the information and documents required in this Normative
Instruction, institutions must select, in the Central Bank of Brazil's Digital Protocol, the subject “Documents for evaluation of waiver of established limits – TED – ITSP” for destination to Degef.

Art.
11. This Normative Instruction enters into force on the date of its publication.

CAIO MOREIRA
FERNANDES ARISTIDES ANDRADE CAVALCANTE NETO

Head of Deinf Head of Degef

FABIO MARTINS TRAJANO
DE ARRUDA

Head of Deban