BCB Resolution No. 294 — Amends BCB Resolution No. 32 of October 29, 2020, establishing technical requirements and operational procedures for the implementation of Open Finance in Brazil

BCB RESOLUTION NO. 294, OF FEBRUARY 23, 2023

Amends BCB Resolution No. 32, of October 29, 2020, which establishes the technical requirements and operational procedures for the implementation in the Country of the Open Finance System.

The Collegiate Board of the Central Bank of Brazil, in a session held on February 23, 2023, based on arts. 9 of Law No. 4.595, of December 31, 1964, 9, item II, of Law No. 12.865, of October 9, 2013, and 51, items I, II and IX, of Joint Resolution No. 1, of May 4, 2020, and having in view the provision of art. 1º-A of Circular No. 4.032, of June 23, 2020,

RESOLVES:

Art. 1 The summary of BCB Resolution No. 32, of October 29, 2020, shall be effective with the following alteration:

"Establishes the technical requirements and operational procedures for the implementation in the Country of the Open Finance System." (NR)

Art. 2 BCB Resolution No. 32, of 2020, shall be effective with the following alterations:

"Art. 1 This Resolution establishes the technical requirements and operational procedures for the implementation in the Country of the Open Finance System to be observed by the participating institutions specified in art. 6 of Joint Resolution No. 1, of May 4, 2020.

................................................................................................................" (NR)

"Art. 2 ............................................................................................................

I - participation modality in Open Finance: each of the participation cases in Open Finance provided for in Joint Resolution No. 1, of 2020, namely:

.........................................................................................................................

II - Application Programming Interface (API): interface dedicated to sharing between participating institutions of data and services within the scope of Open Finance; and

III - participant directory: structure that manages the repository of participants referred to in art. 44, item VI, of Joint Resolution No. 1, of 2020, responsible for managing the registration, credentials, and information of participating institutions, as well as for carrying out compliance tests and the registration of APIs of participating institutions, among other activities that may be established by the Central Bank of Brazil." (NR)

"Art. 3 The detailing of the technical requirements and operational procedures for the implementation of Open Finance shall be provided for in:

I - Data and Services Scope Manual of Open Finance;

II - Open Finance APIs Manual;

III - Manual of Services Provided by the Structure Responsible for Open Finance Governance;

IV - Open Finance Security Manual; and

V - Open Finance Customer Experience Manual.

................................................................................................................" (NR)

"Art. 4 The Data and Services Scope Manual of Open Finance will detail the data and services subject to sharing within the scope of Open Finance, observed the minimum scope of data and services set forth in Circular No. 4.015, of May 4, 2020." (NR)

"Art. 7 The Open Finance APIs Manual will establish standards for the development of APIs by participating institutions of Open Finance, in particular:

................................................................................................................" (NR)

"Art. 8 Participating institutions must make available administrative APIs dedicated exclusively to sharing with the directory referred to in art. 13, for the purpose of monitoring and disclosing information referred to in art. 15-B." (NR)

"CHAPTER VI

OF PARTICIPATION IN OPEN FINANCE" (NR)

"Art. 9 The institutions referred to in art. 1 must register their participation in Open Finance in the participant repository, through the participant directory referred to in art. 13.

§ 1 The registration referred to in the main text must be observed:

I - by the mandatory participating institutions referred to in art. 6, items I, letter "a", II, letter "a", and III, of Joint Resolution No. 1, of 2020, within ten business days counted from the date of the beginning of their classification;

II - before the beginning of data sharing within the scope of Open Finance, by the voluntary participating institutions referred to in art. 6, item I, letter "b", of Joint Resolution No. 1, of 2020; and

III - before the beginning of payment transaction initiation service sharing, by payment transaction initiating institutions covered by art. 6, item II, letter "b", of Joint Resolution No. 1, of 2020." (NR)

"Art. 10 ...........................................................................................................

.........................................................................................................................

II - the provision of information by the institution regarding the participation modality(ies) in Open Finance; and

III - the adherence of the institution to the rights and obligations of the participant, as disclosed by the Structure Responsible for Open Finance Governance, referred to in art. 44, § 1, of Joint Resolution No. 1, of 2020.

§ 1 The rights and obligations of the participant referred to in item III of the main text must cover, among other aspects, issues related to privacy and data use, to the handling and resolution of disputes within the scope of Open Finance, as well as the contribution to the funding of the activities of maintenance of the Structure Responsible for Open Finance Governance, if such a system is approved by the Deliberative Council of that structure, in consonance with art. 15 of the Regulation Annexed to Circular No. 4.032, of June 23, 2020, and art. 45 of Joint Resolution No. 1, of 2020.

................................................................................................................" (NR)

"Art. 10-A. The institutions referred to in art. 1 that, exceptionally, are not able to comply, within the period provided for in art. 9, § 1, item I, with the obligations for the exercise of the participation modalities in Open Finance must elaborate an adaptation plan.

§ 1 The adaptation plan referred to in the main text must be signed by the Director responsible for Open Finance and sent to the Central Bank of Brazil within the period referred to in art. 9, § 1, item I.

§ 2 The Central Bank of Brazil will evaluate the adaptation plan referred to in the main text, regarding which it may determine adjustments.

§ 3 In the evaluation of the adaptation plan referred to in § 2, the Central Bank of Brazil will assess, among other aspects, the compatibility between the complexity of the concrete situation and the period provided for adaptation.

§ 4 The execution of the adaptation plan referred to in the main text must be subject to monthly monitoring by the internal audit of the institutions, and the respective reports must be kept available to the Central Bank of Brazil.

§ 5 If the adaptation plan referred to in the main text is not being complied with, the Central Bank of Brazil must be notified within two business days after the non-compliance is identified by the internal audit.

§ 6 The procedures for sending the adaptation plan referred to in the main text to the Central Bank of Brazil, according to § 1, and for communication in case of non-compliance, according to § 5, will be contained in a specific normative instruction." (NR)

"Art. 11 ...........................................................................................................

.........................................................................................................................

IV - others, at the discretion of the Central Bank of Brazil, with a view to preserving the adequate functioning of Open Finance.

§ 1 The provision in the main text is excepted from the withdrawal of a voluntary participating institution referred to in art. 6, item I, letter "b", of Joint Resolution No. 1, of 2020, provided that the institution communicates its withdrawal from Open Finance to the participant directory referred to in art. 13, at least one year before its effective implementation.

.........................................................................................................................

§ 3 Prior consent of the Central Bank of Brazil is necessary for the exclusion of a certain modality registered by participating institutions in the participant directory in the case referred to in § 1." (NR)

"Art. 12 The Manual of Services Provided by the Structure Responsible for Open Finance Governance will establish the technical requirements and operational procedures for the implementation of:

.........................................................................................................................

III - Open Finance portal in Brazil;

.........................................................................................................................

V - Open Finance dispute resolution platform.

................................................................................................................" (NR)

"Art. 13 The Structure Responsible for Open Finance Governance in the Country, referred to in art. 44, § 1, of Joint Resolution No. 1, of 2020, must include a participant directory with the following attributions:

I - management of identity and access to the directory by participating institutions and their representatives, observing the provision of arts. 8 to 10;

II - management of the identity and authorization of the applications of participating institutions, which covers the identification, authorization, and revocation of certificates used in the sharing of data and services within the scope of Open Finance, observing the current regulation;

III - management of directory information, which covers data regarding participants and modification history, as well as listing, by participant, of APIs and endpoints accessible to the public; and

................................................................................................................" (NR)

"Art. 14 The Structure Responsible for Open Finance Governance referred to in art. 44, § 1 of Joint Resolution No. 1, of 2020, must make available a free and available customer service channel, uninterrupted, for twenty-four hours a day and seven days a week, responsible for, at minimum:

.........................................................................................................................

II - forwarding to participating institutions the demands received from clients, the public, and other participants regarding Open Finance, according to art. 35, item II, of Joint Resolution No. 1, of 2020.

................................................................................................................" (NR)

"Section IV

Of the Open Finance Portal in Brazil

Art. 15. The Structure Responsible for Open Finance Governance referred to in art. 44, § 1 of Joint Resolution No. 1, of 2020, must maintain a website on the internet to serve as the Open Finance portal in Brazil, which provides, in the same environment, updated information about its activities, interface standards, including its versioning, and other information related to the implementation of Open Finance, organized in specific areas intended for the following audiences:

.........................................................................................................................

§ 2 The website referred to in the main text must provide:

I - information about the unavailability and performance of the participant directory and the support channel for the directory and forwarding of demands to participating institutions, referred to in arts. 13 and 14, with the possibility of consulting consolidated or individualized information regarding each participating institution, as the case may be; and

II - updated information of interest to participants and developers regarding technical standards, regulatory requirements, and other information necessary for the implementation of APIs." (NR)

"Section V

Of the API Testing Environment

Art. 15-A. The Structure Responsible for Open Finance Governance referred to in art. 44, § 1 of Joint Resolution No. 1, of 2020, must maintain an API testing environment that allows participating institutions:

I - to submit, even in the development stage, their implementations of Open Finance APIs to automated functional and non-functional tests; and

II - to access example implementations of Open Finance APIs." (NR)

"Section VI

Of the Monitoring of Open Finance Technology Services

Art. 15-B. The Structure Responsible for Open Finance Governance referred to in art. 44, § 1 of Joint Resolution No. 1, of 2020, must monitor and disclose information about the unavailability and performance of processes for requesting sharing of data and services within the scope of Open Finance." (NR)

"Art. 16 The Open Finance Security Manual will detail:

I - the security standards and certificates that must be observed by financial institutions and other institutions authorized to operate by the Central Bank of Brazil for the sharing of data and services within the scope of Open Finance; and

II - the technical security requirements that must be observed by institutions in the APIs and in systems related to the implementation of Open Finance, in compatibility with the current regulation." (NR)

"Art. 16-A. The Open Finance Customer Experience Manual must contain:

I - the principles that must guide the customer experience in the process of requesting sharing of data and services in Open Finance; and

II - the requirements of the customer experience guide, including its content and structure of topics, with a view to harmonizing the stages of consent, authentication, and confirmation among the participating institutions of Open Finance.

Sole paragraph.
..............................................................................................

.........................................................................................................................

II - be elaborated, revised, and updated periodically by the Structure Responsible for Open Finance Governance referred to in art. 44, § 1 of Joint Resolution No. 1, of 2020; and

III - be made available, in its most updated version, to participating institutions and the general public, through the Open Finance Portal in Brazil, referred to in art. 15." (NR)

"Art. 16-C. For the purposes of the provision of art. 28 of Joint Resolution No. 1, of 2020, the offering by data-transmitting institutions and account-holding institutions of products and services to the client during the stages of the process of requesting sharing of data and of the payment transaction initiation service of Open Finance constitutes the creation of obstacles to the sharing of data and services in Open Finance." (NR)

"Art. 16-D. The Structure Responsible for Open Finance Governance referred to in art. 44, § 1 of Joint Resolution No. 1, of 2020, must maintain a platform for dispute resolution among participants within the scope of Open Finance.

................................................................................................................" (NR)

"CHAPTER IX

OF PARTICIPATION IN DISCUSSIONS ON TECHNICAL STANDARDS OF OPEN FINANCE" (NR)

"Art. 17. The Structure Responsible for Open Finance Governance referred to in art. 44, § 1 of Joint Resolution No. 1, of 2020, through its technical level, must maintain permanent discussion forums with experts and other stakeholders in the implementation in the Country of Open Finance that are not represented in the Technical Groups constituted at this level." (NR)

Art. 3 The following provisions of BCB Resolution No. 32, of 2020, are revoked:

I - §§ 2 and 3 of art. 9; and

II - item IV of art. 13.

Art. 4 This Resolution enters into force on April 1, 2023.

Paulo Sérgio Neves de Souza

Acting Director of Regulation