BCB Resolution No. 304 — Approves the Regulation Governing Settlement Systems, Financial Asset Registration and Centralized Deposit Activities, and Liens on Financial Assets within the Brazilian Payments System

RESOLUTION BCB NO. 304, OF MARCH 20, 2023

Approves the Regulation that disciplines, within the scope of the Brazilian Payments System, the operation of settlement systems, the exercise of activities related to the registration and centralized deposit of financial assets, and the establishment of liens and encumbrances on registered or deposited financial assets, and consolidates norms on the subject.

The Collegiate Board of the Central Bank of Brazil, in a session held on March 15 and 16, 2023, considering the provisions of Art. 2, sole paragraph, and Art. 10 of Law No. 10,214, of March 27, 2001, Arts. 22, item II, 26, § 4º, and 28, item II, of Law No. 12,810, of May 15, 2013, and Art. 12 of CMN Resolution No. 4,952, of September 30, 2021,

R E S O L V E:

Art. 1º The Annexed Regulation is hereby approved, which disciplines, within the scope of the Brazilian Payments System, the following matters:

I - the operation of settlement systems operated by clearinghouses and providers of clearing and settlement services, as provided for in Art. 2, sole paragraph, of Law No. 10,214, of March 27, 2001;

II - the exercise of the activity of registering financial assets, as provided for in Art. 28 of Law No. 12,810, of May 15, 2013;

III - the exercise of the activity of centralized deposit of financial assets, as provided for in Art. 22 of Law No. 12,810, of 2013; and

IV - the establishment of liens and encumbrances on registered or deposited financial assets, as provided for in Art. 26 of Law No. 12,810, of 2013.

Art. 2º Financial Market System Operators (IOSMFs) must, within a period of 1 (one) year from the date of entry into force of this Resolution, promote adaptations in their structures and in the financial market systems (SMFs) operated by them necessary to comply with the provisions of the Annexed Regulation.

§ 1º IOSMFs must send to the Central Bank of Brazil, within a period of 30 (thirty) days after the deadline established in the caput, a document signed by a representative designated in the articles of association or social contract that summarizes the adaptations carried out for the purpose of complying with the provisions of the Annexed Regulation.

§ 2º Requests for authorizations referred to in Art. 4 of the Annexed Regulation filed prior to the effectiveness of this Resolution will continue to be governed by the regulations in force at the time of filing, without prejudice, once approved, to compliance by the IOSMF with the provisions of the caput and § 1º, within the deadlines established in these provisions or within 3 (three) months from the date the request is approved, whichever is longer.

Art. 3º The following are hereby revoked:

I - Circular No. 3,057, of August 31, 2001;

II - Circular No. 3,116, of April 18, 2002;

III - Circular No. 3,437, of February 13, 2009;

IV - Circular No. 3,439, of March 2, 2009;

V - Circular No. 3,469, of September 29, 2009;

VI - Circular No. 3,539, of June 2, 2011;

VII - Circular No. 3,695, of December 27, 2013;

VIII - Circular No. 3,709, of July 18, 2014;

IX - Circular No. 3,743, of January 8, 2015;

X - Circular No. 3,772, of December 1, 2015;

XI - Circular No. 3,773, of December 1, 2015;

XII - Circular No. 3,838, of June 27, 2017;

XIII - Circular No. 3,912, of September 5, 2018;

XIV - Circular No. 3,968, of October 31, 2019;

XV - Circular No. 3,980, of January 30, 2020;

XVI - Circular No. 4,038, of July 28, 2020;

XVII - BCB Resolution No. 73, of February 18, 2021;

XVIII - BCB Resolution No. 94, of May 6, 2021;

XIX - BCB Resolution No. 106, of June 17, 2021;

XX - BCB Resolution No. 174, of December 14, 2021;

XXI - BCB Resolution No. 267, of November 25, 2022; and

XXII - Circular Letter No. 3,229, of March 17, 2006.

Art. 4º This Resolution enters into force on May 2, 2023.

Renato Dias de Brito Gomes Otávio Ribeiro Damaso

Director of Financial System Organization Acting Director of Monetary Policy and Resolution

ANNEXED REGULATION TO BCB RESOLUTION NO. 304, OF MARCH 20, 2023

Disciplines, within the scope of the Brazilian Payments System, the operation of settlement systems, the exercise of activities related to the registration and centralized deposit of financial assets, and the establishment of liens and encumbrances on registered or deposited financial assets.

TITLE I

SCOPE OF APPLICATION

Art. 1º The provisions of this Regulation apply to financial market system operators (IOSMFs) whose financial market systems (SMFs) or whose exercise of activity is under the supervision of the Central Bank of Brazil within the scope of the Brazilian Payments System.

Sole paragraph. Banco do Brasil S.A., operator of the Check Clearing Centralizer (Compe), in accordance with specific regulation applicable, is subject only to the provisions of Chapters III, IV, and VI of Title IV; Chapter I of Title V; and Title VI of this Regulation.

TITLE II

DEFINITIONS

Art. 2º For the purposes of this Regulation, the following are considered:

I - administrator: natural person elected or appointed to an administrative position in general, whether of the board of directors, the executive board, or another administrative body defined in the articles of association or social contract;

II - competent foreign authority: foreign authority responsible for regulating, authorizing, and supervising, in its jurisdiction of origin, the activities of foreign central counterparties;

III - clearing and settlement house: legal entity that primarily operates a settlement system, in accordance with item I of Art. 2 of CMN Resolution No. 4,952, of September 30, 2021;

IV - clearing: process of extinguishing obligations involving the calculation of net position (credits minus debits) of each participant;

V - bilateral clearing: process of extinguishing obligations through the calculation of net positions of participants in pairs;

VI - multilateral clearing: process of extinguishing obligations through the calculation of the sum of bilateral debtor and creditor positions of each participant in relation to the others, the result of which also corresponds to the result of each participant in relation to the settlement system;

VII - extreme but plausible market conditions: comprehensive set of hypothetical conditions and historical conditions, including periods of highest volatility experienced by markets relevant to settlement systems;

VIII - conglomerate: group of companies subject to participation or control links with the IOSMF, direct or indirect, through shareholding or effective operational control, characterized by common administration or management, or by acting in the market under the same brand or trade name, which is integrated by financial institutions, payment institutions, and other institutions authorized to operate by the Central Bank of Brazil, as well as companies that carry out acquisition of credit operations, including real estate, or credit rights, such as commercial development companies, securitization companies, and single-purpose companies, in addition to other legal entities headquartered in the Country whose corporate purpose is exclusively the equity participation in the previously mentioned entities;

IX - financial accounts maintained at the Central Bank of Brazil: accounts at the Central Bank of Brazil, such as Bank Reserves Account, Settlement Account, or Instant Payments Account, in which funds are maintained, as regulated by specific regulation;

X - central counterparty: clearinghouse or provider of clearing and settlement services that assumes the position of contracting party, in relation to the original counterparties of a transaction, for the purpose of settling obligations of transactions accepted in accordance with the requirements established in the regulation of a settlement system operated by it;

XI - foreign central counterparty: legal entity incorporated and domiciled abroad contracted by a clearinghouse or provider of clearing and settlement services to assume the position of contracting party, for the purpose of settling obligations, of transactions accepted in accordance with the requirements established in the regulation of a settlement system;

XII - central securities depository: legal entity that primarily or accessarily operates a centralized deposit system;

XIII - centralized deposit: activity comprising:

a) centralized custody of fungible and non-fungible financial assets;

b) storage of additional information regarding deposited financial assets, when required by specific regulation;

c) maintenance and movement of financial asset accounts, encompassing the transfer and control of their effective ownership;

d) provision of balances and account statements of financial assets;

e) constitutive registration of issuance of financial assets; where applicable; and

f) handling of incidental events regarding financial assets;

XIV - registrar entity: legal entity that primarily or accessarily operates a financial asset registration system;

XV - credit exposure: amount at risk of not being fully settled by a participant on the due date or on any subsequent date;

XVI - settlement failure: the non-occurrence of settlement or partial settlement of a transaction on the expected date, regardless of the underlying cause;

XVII - collateral: resources in national or foreign currency, gold, financial assets, securities, and other modalities of real or personal guarantee provided by law, made available to the clearinghouse or provider of clearing and settlement services with the objective of ensuring compliance with obligations assumed within the scope of a settlement system, in accordance with the regulation of that system;

XVIII - collateral abroad: collateral deposited in a custody account or on demand deposit outside Brazil;

XIX - economic group: legal entities that are under common control, de facto or de jure, and legal entities in which any of the legal entities under common control is the holder, directly or indirectly, of at least 20% (twenty percent) of the share capital or voting rights;

XX - availability index: index that expresses percentage-wise the degree of availability of the SMF for participants;

XXI - clearing institution: legal entity with a financial account in a central bank or in a clearinghouse or provider of clearing and settlement services that performs currency settlement services for participants of a settlement system or for the system operator;

XXII - financial market system operator (IOSMF): clearing and settlement house, provider of clearing and settlement services, central securities depository, or registrar entity;

XXIII - interconnection: set of contractual arrangements between IOSMFs or operational arrangements between SMFs that connect SMFs directly or through an intermediary;

XXIV - interoperability: interconnection between settlement systems with a central counterparty, between centralized deposit systems, or between registration systems;

XXV - jurisdiction of origin: country in which the foreign central counterparty is incorporated or territory in which it is authorized to exercise its activities by the competent foreign authority;

XXVI - settlement: process of extinguishing obligations carried out through the processing, clearing, and settlement of transactions involving the transfer of funds, financial assets, and securities;

XXVII - final settlement: settlement that occurs on an irrevocable and unconditional basis;

XXVIII - margin: collateral required, within the scope of a settlement system, to cover exposures in the event of default by a participant of the settlement system;

XXIX - transaction: unless specified otherwise, any and all transactions commanded in a settlement system that may result in settlement;

XXX - accepted transaction: transaction admitted by the settlement system for settlement purposes, after verification of requirements previously established in the regulation;

XXXI - confirmed transaction: transaction in which the counterparties agree on its elements;

XXXII - direct participant: legal entity that, in accordance with the SMF regulation:

a) assumes the position of contracting party for settlement purposes; or

b) deposits or registers financial assets directly;

XXXIII - indirect participant: natural or legal person, investment fund, or collective investment entity that settles transactions, deposits, or registers financial assets through a direct participant with whom it maintains a contractual or equivalent link;

XXXIV - financial position: balance of a participant in a settlement system in national currency and in each of the foreign currencies settled by a system, at a given moment;

XXXV - position in financial assets and securities: balance of a participant in a settlement system in each of the financial assets and securities settled by a system, at a given moment;

XXXVI - provider of clearing and settlement services: legal entity that accessarily operates a settlement system, in accordance with item IV of Art. 2 of CMN Resolution No. 4,952, of 2021;

XXXVII - qualified liquid resources: own resources in national and foreign currency deposited in central banks or in solvent financial institutions with accounts in central banks, and also:

a) own investments with low market risk and monetizable on the same day with a high degree of confidence;

b) collateral with low market risk and monetizable on the same day with a high degree of confidence and through previously established procedures;

c) resources to be obtained through liquidity mechanisms, repurchase agreements, and swaps, with or without collateral, previously made available by solvent financial institutions;

d) resources to be obtained through currency swaps, through previously established procedures; and

e) resources to be obtained through central bank liquidity lines, if the clearinghouse or provider of clearing and settlement services has direct access to liquidity lines routinely offered by central banks;

XXXVIII - registration: activity comprising the storage of information regarding financial assets that are not the object of centralized deposit, their transactions, and the collateral linked to them;

XXXIX - SMF regulation: set of rules and procedures that discipline the activities exercised within the scope of an SMF;

XL - cyber resilience: ability of an IOSMF to anticipate, resist, contain, and quickly recover from a cyberattack;

XLI - unfavorable correlation risk: risk resulting from exposure to a counterparty or issuer when the collateral provided by the former or issued by the latter is highly correlated with its credit risk;

XLII - credit risk: risk that the counterparty does not settle an obligation in full when due and does not do so in the future;

XLIII - custody risk: risk of financial loss derived from assets held in custody in cases of insolvency, negligence, fraud, inadequate administration, or inadequate record keeping by a custodian;

XLIV - issuer risk: risk that a commitment related to the issuance or redemption of the principal and accessories of the financial asset or security is not honored;

XLV - investment risk: risk of financial loss faced by an IOSMF when investing its own resources or those of its participants;

XLVI - liquidity risk: risk that the counterparty does not have sufficient funds or foreign currency to meet its obligations when due, even if it may be able to do so in the future;

XLVII - market risk: risk of losses resulting from fluctuations in market prices;

XLVIII - general business risk: risk related to the management of the enterprise and associated with the potential impact on the financial condition of the business, with negative repercussions on the longevity of the entity, which may materialize in various forms, such as poor execution of business strategy, competition, losses in other lines of business of the institution, among other factors;

XLIX - legal risk: risk associated with inadequacy or deficiency in contracts entered into or regulations established by the IOSMF, sanctions for non-compliance with legal provisions, and compensation for damages to third parties resulting from activities developed by the entity;

L - operational risk: risk that deficiencies in technological systems or internal processes, human errors, management failures, or disruptions caused by external events result in the reduction, deterioration, or interruption of services provided within the scope of an SMF;

LI - settlement optimization routine: procedure for optimizing settlement of orders kept in a waiting queue, which may involve, among others, offsetting among them, provided that the registration of the settlement of the orders in the participants' accounts is done one by one and considers as settled concomitantly with each other and in relation to the acceptance of optimized orders;

LII - cloud computing service: provision to the IOSMF, on demand and in a virtual manner, of at least one of the following services:

a) data processing, data storage, network infrastructure, and other computational resources that allow the contracting IOSMF to deploy or execute software, which may include operating systems and applications developed by the IOSMF or acquired by it;

b) deployment or execution of applications developed by the contracting IOSMF, or acquired by it, using computational resources of the service provider; or

c) execution of applications deployed or developed by the service provider, using computational resources of the service provider itself;

LIII - relevant services: those considered relevant for the conduct of the IOSMF's activities and directly related to critical business processes;

LIV - centralized deposit system: set of rules, procedures, and operational structure aimed at allowing the exercise of the centralized deposit activity, including the performance of the activity of establishing liens and encumbrances on deposited financial assets, operated by a central securities depository;

LV - issuing centralized deposit system: centralized deposit system that receives a request for access to its services presented by another centralized deposit system through an interoperability mechanism between centralized deposit systems;

LVI - investor centralized deposit system: centralized deposit system that presents a request for access to the services of another centralized deposit system through an interoperability mechanism between centralized deposit systems;

LVII - settlement system: set of rules, procedures, and operational structure for settlement purposes, through which the processing, clearing, and settlement of transactions involving the transfer of funds, financial assets, and securities are carried out, with at least 3 (three) direct participants, in accordance with item V of Art. 2 of CMN Resolution No. 4,952, of 2021;

LVIII - real-time gross settlement system: settlement system in which accepted or validated transactions are settled one by one, in real time, which may involve settlement optimization routines;

LIX - foreign currency settlement system: settlement system for obligations related to transactions associated with different currencies;

LX - funds transfer settlement system: settlement system for orders of transfer of monetary resources in national currency that are not consideration for obligations related to transactions with foreign currencies, financial assets, and securities;

LXI - deferred net value settlement system: settlement system in which settlement, preceded by clearing, occurs at the net value at the end of a pre-defined settlement cycle;

LXII - hybrid settlement system: system that combines characteristics of deferred net value settlement systems and real-time gross settlement systems;

LXIII - payment system: funds transfer settlement system or foreign currency settlement system;

LXIV - registration system: set of rules, procedures, and operational structure aimed at allowing the exercise of the registration activity, with the option to perform the activity of establishing liens and encumbrances on registered financial assets, operated by a registrar entity;

LXV - financial market system (SMF): settlement system, centralized deposit system, or registration system;

LXVI - a posteriori verification test (backtesting): a posteriori comparison of observed values with values expected by credit and liquidity risk calculation models, in order to assess their adequacy;

LXVII - stress test: estimation of credit and liquidity risks incurred by the clearinghouse or provider of clearing and settlement services under extreme market conditions, in order to assess their adequacy; and

LXVIII - reverse stress test: estimation of scenarios, including market conditions, number of near-term defaults, and concentration of positions, that would exhaust the credit risk safeguard structure and qualified liquid resources of the clearinghouse or provider of clearing and settlement services.

TITLE III

AUTHORIZATIONS

CHAPTER I

REQUESTS FOR AUTHORIZATION

Art. 3º The requirements for the authorizations referred to in this Resolution are the aspects:

I - provided for in Title IV:

a) Chapter I - On Legal Risk;

b) Chapter II - On Corporate Governance;

c) Chapter III - On Risk Management Structure, Internal Controls, and Compliance;

d) Chapter IV - On General Business Risk;

e) Chapter V - On Custody and Investment Risks;

f) Chapter VI - On Operational Risk;

g) Chapter VII - On Efficiency and Effectiveness;

h) Chapter VIII - On Communication Procedures and Standards; and

i) Chapter IX - On Disclosure of Rules, Procedures, and Market Data;

II - provided for in Title V:

a) Chapter I - On General Aspects;

b) Chapter II - On the Regulation of the Financial Market System;

c) Chapter III - On Access to Financial Market Systems;

d) Chapter IV - On Settlement Systems;

e) Chapter V - On Centralized Deposit Systems; and

f) Chapter VI - On Registration Systems;

III - provided for in specific regulation applicable to the financial assets subject to centralized deposit or registration.

Sole paragraph. In addition to the requirements cited in the main text, authorizations shall be granted by the Central Bank of Brazil observing, furthermore, the legal and regulatory norms applicable within the Brazilian Payments System, the Principles for Financial Market Infrastructures (PFMI), originally published by the Committee on Payment and Settlement Systems of the Bank for International Settlements (CPSS/BIS) and the Technical Committee of the International Organization of Securities Commissions (TC/IOSCO), applicable to the activities performed by FMIs through the financial market infrastructures (FMIs) operated by them.

Art. 4º

Authorization from the Central Bank of Brazil is required for:

I - the operation of a settlement system, including its regulations, conditioned on compliance with the requirements set forth in item I and items “a” to “d” of item II of Art. 3º;

II - the exercise of the activity of centralized deposit of financial assets, including the system regulations, conditioned on compliance with the requirements set forth in item I, items “a” to “c” and “e” of item II, and item III of Art. 3º;

III - the exercise of the activity of financial asset registration, including the system regulations, conditioned on compliance with the requirements set forth in item I, items “a” to “c” and “f” of item II, and item III of Art. 3º;

IV - changes to the system regulations that provide for the inclusion of financial assets in the list of objects of centralized deposit, conditioned on compliance with the requirements set forth in item I, items “a” to “c” and “e” of item II, and item III of Art. 3º;

V - changes to the system regulations that provide for the inclusion of financial assets in the list of objects of registration, conditioned on compliance with the requirements set forth in item I, items “a” to “c” and “f” of item II, and item III of Art. 3º;

VI - changes to the system regulations that provide for the exclusion of financial assets from the list of objects of centralized deposit;

VII - changes to the system regulations that provide for the exclusion of financial assets from the list of objects of registration;

VIII - the cancellation of the authorization for the operation of a settlement system;

IX - the cancellation of the authorization for the exercise of the activity of centralized deposit of financial assets;

X - the cancellation of the authorization for the exercise of the activity of financial asset registration; and

XI - changes to FMIs and their regulations that represent relevant risk to their safety and efficiency, or to the solidity and normal operation of the Brazilian Payments System or the National Financial System, conditioned on compliance with the requirements set forth in items I, II, and III of Art. 3º.

§ 1º For the purposes of the authorization provided for in item XI of the main text, the Central Bank of Brazil shall publish which types of changes to FMIs and their regulations represent relevant risk to their safety, their efficiency, or the solidity and normal operation of the Brazilian Payments System or the National Financial System.

§ 2º Requests for changes to FMIs and their regulations referred to in item XI of the main text must be supported by an analysis prepared by the FMIs regarding their potential effect on the safety and efficiency of the FMI and the FMI itself, and on the solidity and normal operation of the Brazilian Payments System or the National Financial System.

§ 3º If the request for changes referred to in item XI of the main text implies a significant qualitative change in the activities performed within the FMI, the Central Bank of Brazil may demand conversion to the request for authorization referred to in items I, II, or III of the main text.

§ 4º For the purposes of the authorizations provided for in items I to III and VIII to X of the main text, an institution that does not operate at least one FMI shall not be considered an FMI.

§ 5º For the purposes of the authorizations provided for in the items of the main text, it shall be considered that:

I - a settlement system that settles obligations through bilateral transfers of financial assets and securities cannot operate without settling at least one financial asset or security;

II - a centralized deposit system for financial assets cannot operate without providing for the centralized deposit of at least one financial asset; and

III - a financial asset registration system cannot operate without providing for the registration of at least one financial asset.

§ 6º For the purposes of the authorizations provided for in items II and III of the main text, the authorization request may or may not include the corresponding exercise of the activity of constituting liens and encumbrances.

§ 7º In the authorization requests provided for in items II to V of the main text, the Central Bank of Brazil may, considering any existing similarities between the financial assets or between the centralized deposit or registration methodologies, establish simplified analysis and authorization procedures, in which authorization may be granted for each class of financial assets.

§ 8º The requests provided for in items VIII to X of the main text do not apply to the extinction of the institution resulting from merger, spin-off, or incorporation, provided that the resulting or successor institution is authorized by the Central Bank of Brazil to exercise the same activity as the predecessor.

Art. 5º The authorization requests provided for in Art. 4º shall be prepared and analyzed in two phases, as follows:

I - Phase 1 - analysis of the proposal: comprises the evaluation of the adequacy of the interested parties' proposal; and

II - Phase 2 - analysis of the implementation of the proposal: presupposes a favorable manifestation from the Central Bank of Brazil after the analysis of Phase 1 and comprises the presentation, by the interested parties, of documents and information that prove compliance with the measures and actions provided for in the proposal and that allow the Central Bank of Brazil to evaluate their compatibility, effectiveness, and adequacy.

Sole paragraph. The Central Bank of Brazil may dispense with, based on the evaluation of the risks involved, the phase referred to in item II of the main text.

Art. 6º The Central Bank of Brazil shall publish the procedures, documents, and information required for the preparation of authorization requests provided for in Art. 4º, as well as the corresponding deadlines, in view of compliance with the provisions of this Title.

Sole paragraph. The Central Bank of Brazil may, based on the evaluation of the risks involved, establish simplified preparation procedures for the requests governed by this Title.

Art. 7º The Central Bank of Brazil, during the process regarding any of the authorization requests referred to in Art. 4º, may:

I - demand documents and information;

II - convene meetings or interviews with the interested parties;

III - demand the presentation of a business plan; and

IV - conduct tests, inspections, or other types of action to verify the measures implemented by the institution.

Sole paragraph. If incompatibility is found between the implemented measures and actions and those provided for in the proposal presented by the interested parties, or their ineffectiveness or inadequacy, the Central Bank of Brazil shall set a deadline for correction, after which, in case of non-compliance, it shall deny the request.

CHAPTER II

ON THE ARCHIVING, DENIAL, AND REVIEW OF AUTHORIZATIONS

Art. 8º

Regarding the authorization requests referred to in this Regulation, the Central Bank of Brazil may:

I - archive them, without assessing the merits of the request, when:

a) it verifies that the object or elements serving as the basis for the request were altered during the process;

b) there is non-compliance with the deadlines provided for in the current regulation;

c) it identifies that the requirements to complement the preparation of the process were not met within the established deadline;

d) the interested parties fail to attend the summons by the Central Bank of Brazil for meetings or interviews; or

e) the preparation is in disagreement with the format required by the current regulation;

II - deny them, if it is found:

a) falsity or omission in declarations, information, or documents presented in the preparation of the process, or discrepancy between them and the facts or data found in the analysis; or

b) non-compliance with requirements or conditions established by the Central Bank of Brazil, or failure by the interested parties to prove compliance with these requirements or conditions.

Sole paragraph. In the cases referred to in item II of the main text, the Central Bank of Brazil, before the decision, may grant a deadline to the interested parties to manifest their position.

Art. 9º The Central Bank of Brazil may review the authorization decision, considering the relevance of the facts, based on the circumstances of each case and the public interest, if it verifies:

I - falsity or omission in the declarations, information, or documents presented in the preparation of the processes or discrepancy between them and the facts or data found in the analysis;

II - circumstances pre-existing to the decision capable of affecting the evaluation regarding compliance with the requirements and conditions for the authorizations;

III - circumstances subsequent to the decision capable of characterizing, directly or indirectly, that the documents and declarations considered in the evaluation did not meet the requirements and conditions for the authorizations;

IV - operation of a settlement system or exercise of the activity of centralized deposit or registration of financial assets in a manner inconsistent with the terms of the authorization granted, not duly justified or not regularized after the deadline established for such; and

V - non-start of the operation of a settlement system or exercise of the activity of centralized deposit or registration of financial assets within a period of up to 180 (one hundred and eighty) days, or another deadline granted by the Central Bank of Brazil, from the date of the authorization.

Sole paragraph. In the hypotheses referred to in this article, the Central Bank of Brazil shall notify the institution to manifest its position regarding the irregularity found.

CHAPTER III

ON THE EXCLUSION OF FINANCIAL ASSETS AND CANCELLATION OF AUTHORIZATION

Art. 10.

In requests for exclusion of financial assets from the list of assets subject to centralized deposit or registration and in requests for cancellation of authorization, provided for in items VI to X of the main text of Art. 4º, the FMI must guarantee, at a minimum, the closure or transfer:

I - of pending obligations regarding participants, FMIs, and regulatory bodies;

II - of open operations related to the operation of a settlement system or the exercise of centralized deposit or registration of financial assets; and

III - of the centralized deposit or registration of each financial asset in the case where the request involves centralized deposit or registration systems for financial assets.

§ 1º The Central Bank of Brazil may condition the approval of the requests referred to in the main text to the transfer of the activities exercised or of the financial assets deposited or registered to other FMIs.

§ 2º The Central Bank of Brazil shall publish, with a view to enabling the manifestation of the general public regarding any objections, the requests provided for in the main text.

§ 3º The deadline for presenting objections to the Central Bank of Brazil by the general public as a result of the publication of the requests referred to in the main text shall be 15 (fifteen) days counted from the date of publication.

§ 4º The FMI must notify its participants, through its website and other available means, that it intends to file the requests referred to in the main text, with a minimum advance notice of 30 (thirty) days from the date of said request.

Art. 11. The Central Bank of Brazil may cancel, ex officio, the authorizations referred to in items I to IV of Art. 4º, when one or more of the following situations are found:

I - non-compliance with the business plan during its period of coverage, insufficiently justified, at the discretion of the Central Bank of Brazil;

II - non-location of the FMI at the address informed to the Central Bank of Brazil;

III - non-operation of a settlement system or non-exercise of the activity of centralized deposit or registration of financial assets for at least 12 (twelve) months, without due justification; and

IV - non-exercise of the activity of centralized deposit or registration of a specific financial asset among those present in the list of financial assets contained in the regulation authorized by the Central Bank of Brazil for at least 12 (twelve) months, without due justification.

§ 1º Within the scope of the activities of centralized deposit and registration of financial assets, the ex officio cancellation may occur both for the exercise of the activity as a whole and for each financial asset.

§ 2º The Central Bank of Brazil, prior to the cancellation referred to in the main text, must:

I - publish to the public its intention to cancel the respective authorization, with a view to eventual presentation of objections within a period of 30 (thirty) days; and

II - notify the FMI to manifest its position regarding the intention to cancel.

TITLE IV

ON FINANCIAL MARKET INFRASTRUCTURE OPERATING INSTITUTIONS

CHAPTER I

ON LEGAL RISK

Art. 12. FMIs must assess whether the applicable legislation, in all relevant jurisdictions, provides a high level of certainty and supports all significant aspects of the activities of the respective FMI.

§ 1º FMIs must establish rules and procedures regarding the FMI and enter into contracts that are clear and compatible with the applicable legislation in all relevant jurisdictions.

§ 2º FMIs must clearly and understandably indicate the applicable legislation, rules, procedures, and contracts regarding the operation of the FMI to the competent authority, to participants, and, if applicable, to the participants' clients.

§ 3º FMIs must take measures to ensure that their rules, procedures, and contracts can be applied in all relevant jurisdictions and that the acts they perform under these rules, procedures, and contracts cannot be annulled or cancelled and that their application cannot be suspended.

§ 4º FMIs that exercise activities in different jurisdictions must identify and mitigate risks arising from possible conflicts of laws.

CHAPTER II

ON CORPORATE GOVERNANCE

Section I

On General Aspects

Art. 13. FMIs must establish, clearly and objectively, their strategic objectives.

§ 1º The objectives must prioritize the safety and efficiency of the FMI and expressly support the stability of the Brazilian Payments System and the National Financial System and other relevant public interests.

§ 2º FMIs must structure a process that monitors and ensures compliance with the established strategic objectives.

Art. 14. FMIs must structure corporate governance compatible with their nature, size, complexity, structure, and risk profile.

Sole paragraph. The corporate governance structure of the institution must:

I - be aligned with good corporate governance practices and their principles, such as transparency, equity, accountability, and corporate responsibility;

II - be aligned with the institution's strategic objectives;

III - be widely disclosed to the general public on the institution's website; and

IV - be subject to periodic evaluations and reviews.

Art. 15. FMIs must possess adequate and sufficient organizational, technical, operational, and financial capacity and structure to support all activities they perform without imposing additional significant risks to the realization of typical FMI activities.

Art. 16. FMIs must have personnel technically and administratively qualified, enabling them to fully meet their corporate purpose.

Art. 17. FMIs must establish adequate conditions for their professionals to exercise their duties with impartiality, diligence, integrity, and professional ethics.

Art. 18. FMIs must widely disclose decisions that may affect the market in which they operate, the Brazilian Payments System, or the National Financial System.

Section II

On Policies

Art. 19. FMIs must institute a corporate governance policy that contains, among other guidelines, clear and direct provisions for the assignment of responsibilities and accountability, ensuring compliance with the principles and best practices of corporate governance.

§ 1º The policy referred to in the main text must be documented and periodically revised, in addition to being published on the institution's website with information regarding version control, as well as other information possibly required by the Central Bank of Brazil.

§ 2º If the institution belongs to a conglomerate, the adoption of a single conglomerate policy is admitted, provided that the peculiarities associated with the institution are observed.

§ 3º The corporate governance policy must be approved by the board of directors or, if nonexistent, by the executive board provided for in the bylaws or articles of association.

Art. 20. FMIs must institute a remuneration policy that contains, at a minimum, the guidelines for the remuneration of administrators and members of corporate bodies, in such a way as to avoid conflicts of interest.

§ 1º The guidelines referred to in the main text must be compatible with the functions and risks inherent to each position and aligned with the organization's interests.

§ 2º The policy referred to in the main text must be documented and periodically revised.

Section III

On Responsibilities

Art. 21. FMIs must define, clearly and objectively, the responsibilities of their controllers, administrators, and members of corporate bodies.

Sole paragraph. The definition of responsibilities referred to in the main text must have as its objective, among others, to inhibit potential conflicts of interest, establish clear and direct reporting lines, preserve the independence of bodies and positions, allow for performance evaluations and eventual accountability.

Section IV

On Administrators and Other Members of Corporate Bodies

Subsection I

On Technical Competence

Art. 22. The administrators and members of corporate bodies of FMIs must be professionals of recognized technical and strategic competence in the matter, capable of performing their multiple roles in the pursuit of fulfilling strategic objectives.

§ 1º FMIs must structure a retention and succession strategy that enables the identification and continuous development of people capable of assuming the position of administrator and member of corporate bodies in the institution.

§ 2º The technical capacity referred to in the main text involves the competencies and qualifications necessary for the exercise of functions acquired through certifications, academic training, specialized training, or professional experience compatible with the nature, size, complexity, structure, and risk profile of the institution.

Art. 23. The FMI must designate directors, established in the bylaws or articles of association, technically qualified, to answer to the Central Bank of Brazil:

I - for the monitoring, supervision, and compliance with the accounting rules and procedures provided for in the current regulation; and

II - for risk management, as well as for the implementation and maintenance of an internal control environment compatible with the size, complexity, and risks to which the FMI is exposed.

§ 1º The designated directors are responsible for the information provided and for the occurrence of situations indicating fraud, negligence, recklessness, or incompetence in the exercise of their functions, and, in the case of item II of the main text, for the observance of the established internal controls.

§ 2º The accountability of directors does not prejudice the application of penalties provided for in the current legislation.

Subsection II

On Prohibitions

Art. 24. The positions of chairman of the board of directors, if any, and chief executive officer of FMIs cannot be held cumulatively.

Art. 25. The administrators of FMIs must not cumulatively exercise, in another FMI or institution with which they have a conflict of interest, the following positions:

I - administrator, including in entities that are part of the same economic group as the institutions referred to in the main text;

II - member of advisory committees to the board of directors, if any; and

III - member of the fiscal council.

Section V

On Bodies

Art. 26. The bodies provided for in the bylaws or articles of association of FMIs must exercise their duties according to guidelines based on good corporate governance practices, defining functions and responsibilities that must be clearly specified, and with documented procedures regarding their operation, including those for identifying, addressing, and managing conflicts of interest.

Sole paragraph. FMIs must create adequate conditions for the operation of the bodies mentioned in the main text.

Art. 27. The board of directors must have an internal regulations document that gathers the responsibilities, composition, and manner of operation of the body in a clear, objective, and concise manner in a single document, without prejudice to what is established in the bylaws or articles of association.

Sole paragraph. The regulations referred to in the main text must be periodically revised and published on the institution's website with information regarding version control, as well as other information possibly required by the Central Bank of Brazil.

Art. 28. The board of directors, regarding its composition, must guarantee diversity of knowledge, especially with regard to the services it proposes to provide and the disciplines of corporate governance, legal risk, credit risk, liquidity risk, general business risk, operational risk, business continuity, and information and cyber security.

§ 1º Members of the board of directors must have effective availability to dedicate themselves to the position.

§ 2º The function of member of the board of directors is non-delegable.

Art. 29. The board of directors must have its responsibilities established clearly and objectively, including, among others:

I - to safeguard the principles, values, corporate purpose, and governance system of the organization;

II - to set strategic objectives and guidelines;

III - to approve corporate policies and strategic guidelines for conducting the activities and business of the FMI;

IV - to ensure that the executive board, provided for in the bylaws or articles of association, properly manages the policies, objectives, and strategic guidelines;

V - to establish and promote standards of integrity and ethical conduct as part of the institution's culture;

VI - to prevent and manage situations of conflicts of interest;

VII - to promote a broad culture of risk management;

VIII - to establish risk appetite and tolerance;

IX - to ensure that the executive board, provided for in the bylaws or articles of association, properly manages risks, internal controls, compliance, and internal audit;

X - propose guidelines regarding the adoption of corrective measures in cases of identified internal control and compliance failures;

XI - take note of the results of business continuity tests;

XII - ensure the proper functioning of the board of directors and its advisory committees, if any;

XIII - evaluate its own performance and that of its members;

XIV - evaluate the performance of the advisory committees to the board of directors, if any, and of their members;

XV - approve reports issued by the advisory committees to the board of directors, if any;

XVI - supervise and evaluate the performance of the executive management;

XVII - elect and dismiss directors;

XVIII - approve retention and succession strategy;

XIX - appoint, designate, dismiss, or relieve directors responsible for risk management, internal controls, compliance, and internal audit;

XX - choose, replace, and dismiss independent auditors, as well as approve their remuneration;

XXI - safeguard the interest of participants in the SMPs operated by the institution and other stakeholders;

XXII - be the final responsible party for material changes to the models adopted for the calculation of credit and liquidity risks to which the clearinghouse or compensation and clearing service provider is exposed, including, where applicable, calculations related to collateral, required margins, and the minimum amount of qualified liquid resources;

XXIII - approve the financial statements, subject to the provisions of Article 122 of Law No. 6,404, of December 15, 1976;

XXIV - maintain records of its deliberations and decisions; and

XXV - others determined by the Central Bank of Brazil.

Sole Paragraph. Within the scope of the competence provided for in item XX of the caput, members of the board of directors of the IOSMF shall be held responsible for:

I - hiring an independent auditor who does not meet the requirements provided for in this Regulation; and

II - failing to act with diligence in the process of hiring an independent auditor, especially regarding the existence of penalties prohibiting the auditor from exercising their function.

Art. 30. The provisions contained in Articles 27 to 29 apply, insofar as applicable, to the executive management provided for in the bylaws or social contract, in the case where the IOSMF does not have a board of directors.

CHAPTER III

ON THE RISK MANAGEMENT, INTERNAL CONTROLS, AND COMPLIANCE STRUCTURE

Section I

General Aspects

Art. 31. IOSMFs must establish a risk management, internal controls, and compliance structure compatible with their nature, size, complexity, structure, and risk profile.

§ 1º The structure referred to in the caput must:

I - be based on principles and best practices of risk management, internal controls, and compliance;

II - consider comprehensive risk management, including, among others, legal, credit, liquidity, general business, interconnection, and operational risks;

III - be aligned with the strategic objectives of the IOSMF;

IV - clearly and objectively define the responsibilities of involved parties, including when outsourced;

V - be capable of identifying, measuring, assessing, monitoring, reporting, controlling, and mitigating the risks to which the institution is subject;

VI - provide for a risk management policy;

VII - provide for risk appetite and tolerance;

VIII - provide for continuous assessments regarding internal and external risk factors that impact the institution and risk factors that the institution represents for other IOSMFs, for the market in which they operate, for the Brazilian Payments System, and for the National Financial System, considering, in particular, the development of appropriate tools for this purpose;

IX - guarantee effective internal controls by defining control activities for all levels of the institution's business;

X - provide for tests and periodic review of internal controls and contingencies;

XI - provide for tests and periodic review of communication strategies, ensuring their effectiveness;

XII - provide for reports, which must be brought to the attention of the administrators;

XIII - provide for mechanisms aimed at promoting high ethical standards and a broad organizational culture of risk management, internal controls, and compliance;

XIV - create incentive structures so that participants in its SMPs and their clients manage their exposure to the different risks incurred;

XV - provide for the management of conflicts of interest;

XVI - guarantee compliance with regulations governing the IOSMF, the SMPs operated by it, the activities it performs, and the financial assets or securities it settles, deposits, or registers, including regarding third-party contractors;

XVII - guarantee compliance with regulations regarding data confidentiality and personal data protection, including regarding third-party contractors;

XVIII - comply with recommendations and findings of the Central Bank of Brazil's supervision;

XIX - comply with findings of internal audit and independent auditors;

XX - guarantee compliance with the regulations of its SMPs, including regarding its own obligations;

XXI - guarantee coordination between risk management, internal controls, and compliance activities;

XXII - provide for a recovery and orderly winding-up plan for the activities performed by the IOSMF; and

XXIII - be subject to periodic assessments and reviews.

§ 2º The external risk factors referred to in item VIII of § 1º must cover the segment of activity to which the IOSMF belongs and include, among others, those arising from other IOSMFs, service and input providers, even within the same conglomerate, participants, and the risks that its operations may represent for other IOSMFs.

§ 3º The guidelines and provisions regarding risk management, internal controls, and compliance must be accessible to all IOSMF professionals to ensure they know their respective functions, as well as the responsibilities assigned to the various levels of the organization.

§ 4º The structure referred to in the caput must be proprietary.

Art. 32. IOSMFs must prepare an annual report on risk, internal controls, and compliance, to be approved by the board of directors or, if none exists, by the executive management provided for in the bylaws or social contract, and sent to the Central Bank of Brazil by the last business day of May of the following year.

Sole Paragraph. The report referred to in the caput must include at least:

I - the conclusions of the examinations conducted;

II - recommendations regarding any deficiencies, with the establishment of a remediation schedule, where applicable; and

III - the statement of those responsible for the corresponding areas regarding deficiencies found in previous verifications and the measures effectively adopted to remedy them.

Section II

Policies

Art. 33. IOSMFs must establish, at a minimum, policies addressing:

I - corporate risks;

II - internal controls;

III - compliance; and

IV - internal audit.

§ 1º The policies referred to in the caput must be reviewed periodically and published on the institution's website with information regarding version control, as well as others that may be required by the Central Bank of Brazil.

§ 2º The policies referred to in the caput must be approved by the board of directors or, if none exists, by the executive management provided for in the bylaws or social contract.

§ 3º The policies referred to in items I, II, and III of the caput may be treated in a single document, at the institution's discretion.

§ 4º If the IOSMF belongs to a conglomerate, the adoption of a single conglomerate policy is permitted, provided that peculiarities associated with the IOSMF are contemplated.

§ 5º The policy referred to in item IV of the caput may be treated within the regulations provided for in Article 40.

Section III

Responsible Parties

Art. 34. Those responsible for risk management, internal controls, compliance, and internal audit of IOSMFs must:

I - have their appointment, designation, dismissal, or relief approved by the board of directors or, if none exists, by the executive management provided for in the bylaws or social contract;

II - have their independence ensured, in order to guarantee effective management; and

III - be professionals of recognized technical competence in the subject matter, capable of adequately performing their responsibilities.

Art. 35. The remuneration policy of the members of the bodies responsible for risk management, internal controls, compliance, and internal audit of IOSMFs must be adequate to attract qualified and experienced professionals and must be determined independently of the performance of business areas, so as not to generate conflicts of interest.

Section IV

Bodies

Art. 36. IOSMFs must have bodies responsible for:

I - risk management, internal controls, and compliance; and

II - internal audit.

§ 1º The IOSMF may, at its discretion, opt to treat the subjects referred to in item I of the caput in distinct bodies, ensuring adequate coordination between these bodies.

§ 2º The bodies referred to in the caput must be proprietary.

§ 3º The bodies referred to in the caput must be guaranteed independence and a level of access, including with respect to outsourced services, in order to guarantee effective management by the institution.

Art. 37. The IOSMF must guarantee the allocation of necessary resources and personnel in sufficient quantity, adequately trained, and with the necessary experience to perform activities related to risk management, internal controls, compliance, and internal audit.

Art. 38. The IOSMF must establish permanent communication channels between the bodies referred to in Article 36 and the board of directors or, if none exists, the executive management provided for in the bylaws or social contract.

Subsection I

Bodies for Risk Management,
Internal Controls and
Compliance

Art. 39. The bodies responsible for risk management, internal controls, and compliance must, regarding the organizational structure:

I - be segregated from business units and the internal audit body; and

II - be structured in a manner compatible with the nature, size, complexity, structure, and risk profile of the IOSMF.

Sole Paragraph. The bodies referred to in the caput must, among other activities determined by the Central Bank of Brazil, propose and manage the risk management structure referred to in Article 31.

Subsection II

Internal Audit

Art. 40. The internal audit body must have an internal regulations document approved by the board of directors or, if none exists, by the executive management provided for in the bylaws or social contract, which brings together responsibilities, composition, and mode of operation clearly, evidently, and concisely in a single document, observing, in particular, best practices associated with the subject.

Sole Paragraph. The regulations referred to in the caput must:

I - be reviewed periodically and published on the institution's website with information regarding version control, as well as others eventually required by the Central Bank of Brazil;

II - provide for procedures for coordinating internal audit activities with independent audit activities.

Art. 41. The internal audit body must, regarding the organizational structure:

I - report to and be accountable to the board of directors or, if none exists, the executive management provided for in the bylaws or social contract;

II - be segregated from business units and bodies for risk management, internal controls, and compliance; and

III - be structured in a manner compatible with the nature, size, complexity, structure, and risk profile of the IOSMF.

Art. 42. It is prohibited for a member of the internal audit body to act in the audit of activities for which they had responsibility before at least 12 (twelve) months have elapsed.

Art. 43. The internal audit body must have the necessary conditions for the independent evaluation of the quality and effectiveness of the institution's management information processes and systems, and of the risk management, internal controls, and compliance structures referred to in Article 31 and corporate governance structures referred to in Article 14.

§ 1º The evaluation referred to in the caput must consider all functions of the institution, including outsourced ones.

§ 2º Regarding the risk management, internal controls, and compliance structure, the scope of the internal audit activity must include the evaluation of the adequacy and effectiveness, at a minimum:

I - of relevant corporate risk policies;

II - of systems, routines, and procedures for risk management;

III - of risk management models, considering the premises, methodologies used, and their performance;

IV - of special assets, in accordance with Articles 153 to 156;

V - of the recovery and orderly winding-up plan prepared by the entity to address the risks to which it is exposed;

VI - of goal planning and capital needs, considering the institution's strategic objectives; and

VII - of other aspects subject to evaluation by internal audit as determined by current legislation and regulations issued by the Central Bank of Brazil.

Art. 44. In performing internal audit activities, the standards and procedures established by the Central Bank of Brazil must be observed, and, insofar as they are not conflicting with these, those established by the Federal Accounting Council and the Institute of Internal Auditors of Brazil.

§ 1º The Central Bank of Brazil may determine:

I - the inclusion of work in the scope of internal audit and the execution of specific work; and

II - the adoption of measures aimed at improving internal audit processes.

§ 2º The execution of internal audit activities must include the collection and analysis of information, as well as the performance of tests that adequately support conclusions and recommendations to the board of directors or, if none exists, the executive management provided for in the bylaws or social contract.

§ 3º The planning of internal audit activities must be carried out in accordance with guidelines established by the board of directors or, if none exists, the executive management provided for in the bylaws or social contract, considering all relevant risk factors related to the areas, activities, products, and processes subject to audit, and must materialize, at a minimum, in the following documents:

I - annual internal audit plan, based on audit risk assessment, containing, at least, the processes that will be part of the scope of internal audit activities, the classification of these processes by risk level, and the proposal for allocation of available resources;

II - for each specific work of the activity:

a) specific work plan, defining the scope, schedule, and relevant factors in the execution of the work, such as the nature, timing, and extent of internal audit procedures to be applied, the allocation of human resources, and the availability of appropriate budget for execution;

b) working papers, recording facts, information, and evidence obtained during the audit, in order to demonstrate examinations conducted and justify conclusions and recommendations; and

c) report of conclusions and recommendations resulting from internal audit work;

III - follow-up report on measures taken to comply with recommendations; and

IV - annual internal audit report, containing a summary of audit work results, main conclusions, recommendations, and measures taken by the entity's administration.

§ 4º The documents referred to in items I and IV of § 3º must be approved by the board of directors or, if none exists, the executive management provided for in the bylaws or social contract.

§ 5º IOSMFs must keep the documents referred to in § 3º available to the Central Bank of Brazil for a minimum period of 5 (five) years from their approval.

Section V

Independent Audit

Art. 45. The financial statements, including explanatory notes, of IOSMFs must be audited by independent auditors registered with the Securities and Exchange Commission (CVM).

Art. 46. IOSMFs must provide the independent auditor with all data, information, and conditions necessary for the effective performance of their services, as well as formal administrative representation, in accordance with the standards of the Federal Accounting Council.

Sole Paragraph. The responsibility of IOSMF administrators for the information contained in the financial statements or other provided does not exempt the independent auditor from the responsibility related to the preparation of the reports required by this Regulation or the audit opinion, nor does it relieve them of the adoption of adequate audit procedures.

Art. 47. The hiring and maintenance of an independent auditor by the IOSMF are prohibited if any of the following situations are established:

I - occurrence of any hypothesis of impediment or incompatibility for the provision of independent audit services provided for in standards and regulations of the Securities and Exchange Commission (CVM) or the Federal Accounting Council;

II - direct or indirect equity participation by the independent auditor, technical manager, director, manager, supervisor, or any other member with management functions in the team involved in audit work, in the audited IOSMF or in a legal entity linked to its economic group;

III - existence of active or passive operations with the audited IOSMF or a legal entity linked to its economic group, with responsibility or guarantee by the independent auditor, technical manager, director, manager, supervisor, or any other member with management functions in the team involved in audit work at the institution;

IV - participation of technical manager, director, manager, supervisor, or any other member with management functions in the audit work of a successor firm, within a period of less than 3 (three) complete fiscal years;

V - payment of fees and reimbursement of expenses of the independent auditor, related to the base year of the financial statements subject to audit, by the audited IOSMF, alone or together with its linked entities, with representativeness equal to or greater than 25% (twenty-five percent) of the total revenue of the independent auditor in that year.

§ 1º The establishment of the situations described in the caput, relative to the independent auditor's linked company, also implies a prohibition on hiring and maintaining this auditor.

§ 2º The provisions of this article do not dispense the IOSMF and independent auditors from verifying other situations that may affect the auditor's independence.

§ 3º If, at any time, a situation affecting the auditor's independence is found, the IOSMF must provide for its regularization, which may imply the replacement of the independent auditor, without prejudice to the provisions of Article 49.

§ 4º The prohibition referred to in item III of the caput does not apply to operations conducted under conditions compatible with market conditions.

Art. 48. It is prohibited for the IOSMF to hire a technical manager, director, manager, supervisor, or any other member with management functions from the team involved in audit work within the 12 (twelve) months prior to hiring for a position related to services that constitute an impediment or incompatibility for the provision of independent audit services, or that may influence the administration of the institution.

Art. 49. Independent auditors must prepare and adequately document their independence policy, which must be available to the Central Bank of Brazil and the IOSMF, evidencing, in addition to the situations provided for in this Regulation, others that, at their discretion, may affect their independence, as well as internal control procedures adopted to monitor, identify, and prevent its occurrence.

Art. 50. The IOSMF must proceed to replace the technical manager, director, manager, supervisor, and any other member with management functions from the team involved in independent audit work, after reports related to 5 (five) complete and consecutive fiscal years have been issued.

Sole Paragraph. The return of a technical manager, director, manager, supervisor, or any other member with management functions from the team involved in audit work may occur after 3 (three) complete fiscal years have elapsed, counted from the date of their replacement.

Art. 51. The hiring or maintenance of an independent auditor by the IOSMF is conditioned to the qualification of the technical manager, director, manager, supervisor, and any other member with management functions from the team involved in audit work.

§ 1º The qualification referred to in the caput depends on approval in a certification exam organized by the Federal Accounting Council together with the Institute of Independent Auditors of Brazil or, in the case of institutions registered as public companies, by entities indicated by the Securities and Exchange Commission (CVM).

§ 2º The maintenance of qualification must be proven by:

I - approval in a new certification exam within a period not exceeding 3 (three) years from the last approval; or

II - exercise of independent audit activities in institutions authorized to operate by the Central Bank of Brazil or IOSMF, together with participation in a continuing professional education program that has, at a minimum, the following characteristics:

a) minimum workload of 120 (one hundred and twenty) hours every 3 (three) years, counting all courses eligible for the period, observing participation in at least 20 (twenty) hours; and

b) predominance of topics related to operations conducted in the National Financial System, the Brazilian Payments System, or activities applicable to independent audit work.

§ 3º In the case of an auditor who has ceased to exercise independent audit activities in institutions authorized to operate by the Central Bank of Brazil or in IOSMF for a period equal to or greater than 1 (one) year, the return to functions as technical manager, director, manager, supervisor, or other management function in the team involved in audit work is conditioned on approval in a new certification exam.

§ 4º The IOSMF contracting independent audit services must keep documentation proving compliance with the provisions of this article available to the Central Bank of Brazil during the period of service provision and for 5 (five) years after its termination.

Art. 52. The independent auditor must observe, in the provision of their services, the auditing standards and procedures adopted in Brazil, including those determined by the Securities and Exchange Commission (Comissão de Valores Mobiliários), the Federal Council of Accounting (Conselho Federal de Contabilidade), and the Institute of Independent Auditors of Brazil (Instituto dos Auditores Independentes do Brasil).

Art. 53. The independent auditor must prepare, as a result of the audit work performed on the Financial Market Infrastructure (IOSMF), the following reports:

I - audit report, expressing their opinion on the financial statements and respective explanatory notes;

II - report on the internal control system, including electronic data processing and risk management systems, which have, or may come to have, relevant impacts on the financial statements of the audited IOSMF, highlighting identified deficiencies;

III - report on non-compliance with legal and regulatory provisions, which have, or may come to have, relevant impacts on the financial statements of the audited IOSMF.

§ 1º The reports of the independent auditor must be prepared considering the same period and base date as the financial statements to which they refer, and issued within 45 (forty-five) days after the date of publication of these statements.

§ 2º The reports mentioned in the caput, as well as the audit documentation, must be made available to the Central Bank of Brazil for a minimum of 5 (five) years, or for a longer period due to express determination by this agency.

§ 3º The reports of the independent auditor relating to the financial statements of institutions constituted in the form of publicly held companies must contain the communication of the main audit matters.

§ 4º The report on the internal control system must contain:

I - a summary of the process for assessing the effectiveness of the relevant aspects for the internal control systems provided for in current regulation that have, or may come to have, relevant impacts on the financial statements or on the operations of the audited institution; and

II - the highlighting of identified deficiencies.

Art. 54. The independent auditor must formally communicate to the Central Bank of Brazil, within a maximum period of 3 (three) business days from identification, the existence or evidence of error or fraud represented by:

I - non-observance of legal and regulatory norms, which place the continuity of the audited IOSMF at risk;

II - frauds of any value perpetrated by the institution's management;

III - relevant frauds perpetrated by IOSMF employees or third parties; and

IV - errors that result in material misstatements in the financial statements of the IOSMF.

§ 1º For the purposes of this article, the concepts of error and fraud established in norms of the Federal Council of Accounting or the Institute of Independent Auditors of Brazil must be observed.

§ 2º The independent auditor and internal audit must maintain, between themselves, immediate communication upon the identification of the events provided for in this article.

Art. 55. The management board provided for in the bylaws or articles of association of the IOSMF must formally communicate to the independent auditor, within a maximum period of 24 (twenty-four) hours from identification, the occurrence of the events referred to in Art. 54.

Art. 56. The performance of independent audit on IOSMFs does not exclude or limit the supervisory action exercised by the Central Bank of Brazil.

Art. 57. The contract entered into between the IOSMF and the independent auditor must provide for a specific clause that:

I - authorizes access by the Central Bank of Brazil, at any time, including by means of providing printed or digital copies, to the independent auditor's working papers, as well as to any other documents that served as the basis or evidence for the issuance of the reports prepared under the terms of Art. 53, upon formal request, within the scope of the attributions of said agency, observing the limits provided for in current legislation; and

II - obliges the independent auditor to formally communicate to the Central Bank of Brazil the existence of a modified opinion in the report referred to in item I of Art. 53, before the publication of the financial statements.

Art. 58. The independent auditor, in addition to the provisions of this Regulation, must observe the norms, regulations, and procedures emanating from the Securities and Exchange Commission, the Federal Council of Accounting, and the Institute of Independent Auditors of Brazil with respect to:

I - duties and responsibilities of independent auditors;

II - examination of technical qualification;

III - internal quality control;

IV - external quality control; and

V - continuing education program.

Sole Paragraph. The activity related to external quality control may also be performed by the Central Bank of Brazil, without prejudice to the guidelines emanating from the Securities and Exchange Commission, the Federal Council of Accounting, and the Institute of Independent Auditors of Brazil.

CHAPTER IV

OF GENERAL BUSINESS RISK

Section I

Of General Aspects

Art. 59. IOSMFs must have procedures to identify, monitor, and manage their general business risk in order to ensure the continuity of operations and services in case they suffer losses in the conduct of their business.

§ 1º The procedures referred to in the caput must:

I - be supported by principles and best practices associated with the theme;

II - clearly and objectively define the responsibilities of the parties involved, including when outsourced;

III - be supported by a broad perception of the institution in the environment in which it operates, contemplating, for this purpose, the various dimensions of risk capable of affecting the financial condition of the business, such as legal, image, financial, and operational;

IV - provide for the maintenance of sufficient resources to support losses arising from general business risk, in an amount that considers the risk profile and the time necessary for the execution of the recovery plan or ordered closure referred to in item XXII of § 1º of Art. 31, which may not be less than 6 (six) months of operational expenses, considering, for this purpose, the deduction of amortizations and depreciation;

V - be approved by the board of directors or, if nonexistent, by the management board provided for in the bylaws or articles of association; and

VI - be submitted to periodic tests and reviews.

§ 2º The provision referred to in item IV of § 1º must:

I - be supported by principles and best practices associated with the theme;

II - guarantee a broad and complete scope of operation, providing for the recovery and ordered closure of the activities exercised, the systems operated, and the institution;

III - be approved, in the last instance, by the board of directors or, if nonexistent, by the management board provided for in the bylaws or articles of association; and

IV - be submitted to periodic tests and reviews.

§ 3º The amount referred to in item IV of § 1º must:

I - be based on the institution's net equity; and

II - be calculated considering assets that are liquid and of high quality, net of current liabilities.

§ 4º The amount referred to in item IV of § 1º must not be used to cover participant defaults or to cover other financial risks.

§ 5º IOSMFs must have plans for readjustment in cases of insufficient resources to satisfy what is determined in item IV of § 1º.

§ 6º The applications relating to the amount of own resources allocated for the purpose described in item IV of § 1º must be controlled in internal-use accounting sub-accounts.

Section II

Of Net Equity

Art. 60. The IOSMF must maintain net equity compatible with the risks inherent to the Financial Markets (SMF) it operates, observing the following minimum limits:

I - R$100,000,000.00 (one hundred million reais), in the case of being responsible for a central counterparty;

II - R$50,000,000.00 (fifty million reais), in the case of being responsible for a systemically important settlement system or a central securities depository; and

III - R$30,000,000.00 (thirty million reais), in other cases.

§ 1º If the IOSMF operates more than one SMF, the minimum net equity limits referred to in the caput must correspond to the sum of the respective minimum limits required to operate each SMF.

§ 2º If the corporate object of the IOSMF encompasses other activities that are not typical of SMFs, the minimum amount of net equity must be increased by others required for the exercise of the other activities.

§ 3º The Central Bank of Brazil may determine upper limits of net equity, both in the authorization process and throughout the supervision process, establishing a deadline for its implementation, if it considers that the amount is incompatible with the risks incurred by the institution.

CHAPTER V

OF CUSTODY AND INVESTMENT RISKS

Art. 61. IOSMFs must structure the management of their assets and, when applicable, the assets of their participants in a way to safeguard them from potential losses.

Sole Paragraph. The structure referred to in the caput must:

I - be supported by principles and best practices associated with the theme;

II - clearly and objectively define the responsibilities of the parties involved, including when outsourced;

III - have as its objective to minimize the risks of financial loss;

IV - contemplate the risks associated with custodian banks, considering the total scope of existing relationship;

V - guarantee that investments are made in instruments with low credit, market, and liquidity risk, and in regulated institutions that possess robust resource and risk management;

VI - guarantee prompt access to assets when necessary, even in stress scenarios and in foreign jurisdictions;

VII - guarantee that the investment strategy is consistent with the risk management structure referred to in Chapter III of Title IV;

VIII - guarantee that the investment strategy is fully open to its participants;

IX - respect the segregation of functions between the management that trades these assets and the managements that execute operational procedures, calculate and account for the result, and manage the financial risks of these assets; and

X - be submitted to periodic assessments and reviews.

CHAPTER VI

OF OPERATIONAL RISK

Section I

Of General Aspects

Art. 62. IOSMFs must possess a robust operational risk management structure, compatible with their nature, size, complexity, structure, and risk profile.

§ 1º The structure referred to in the caput must:

I - be supported by principles and best practices of operational risk management, in order to guarantee high levels of security, continuity, and reliability and adequate and expandable capacity;

II - clearly and objectively define the responsibilities of the parties involved, including when outsourced;

III - contemplate, among other topics, fraud management, service outsourcing management, business continuity, information technology services management, and information and cybersecurity;

IV - cover the institution as a whole, including the computer system responsible for operationalizing the activities listed in Title V and the other systems (peripheral) of the institution;

V - provide, among others, appropriate policies, plans, procedures, and systems, which guarantee the identification, monitoring, and management of operational risks, through continuous assessments of internal and external risk factors, establishment and periodic review of internal controls and contingencies, awareness and promotion of risk culture, and reports, which must be brought to the knowledge of the administrators; and

VI - be evaluated, reviewed, audited, and tested periodically and after significant changes.

§ 2º The risk factors referred to in item V of § 1º must cover the segment of activity to which the IOSMF belongs and contemplate, among others, those arising from other IOSMFs, service and input providers, even within the same conglomerate, participants, and the risks that their operations may represent for other IOSMFs.

§ 3º The structure referred to in the caput must be proprietary.

§ 4º The structure referred to in the caput must be approved by the board of directors or, if nonexistent, by the management board provided for in the bylaws or articles of association, which must clearly define functions and responsibilities to deal with operational risk.

Art. 63. IOSMFs must have clearly defined operational resilience objectives.

Art. 64. IOSMFs must institute monitoring and control mechanisms with a view to ensuring the implementation and effectiveness of the information and cybersecurity policy, the information security master plan, the incident response plan, and the requirements for contracting services, especially those for processing and data storage and cloud computing, including:

I - the definition of processes, tests, and audit trails;

II - the definition of appropriate metrics and indicators; and

III - the identification and correction of any deficiencies.

§ 1º The notifications received regarding the subcontracting of relevant services, described in item VI of Art. 74, must be considered in the definition of the mechanisms referred to in the caput.

§ 2º The mechanisms referred to in the caput must be submitted to periodic tests by internal audit compatible with the institution's internal controls.

§ 3º IOSMFs must define and document roles and responsibilities relating to the monitoring and control mechanisms referred to in the caput.

Section II

Of Policies

Art. 65. IOSMFs must establish, at a minimum, policies for:

I - operational risk management;

II - fraud management;

III - service outsourcing management;

IV - business continuity;

V - information technology services management; and

VI - information and cybersecurity.

§ 1º The policies referred to in the caput:

I - must be approved by the board of directors or, if nonexistent, by the management board provided for in the bylaws or articles of association;

II - must be reviewed periodically;

III - must be published on the institution's website at a level of detail compatible with the sensitivity of the information and with information regarding version control, as well as others possibly required by the Central Bank of Brazil;

IV - must be available to the Central Bank of Brazil for a minimum period of 5 (five) years counted from their revocation;

V - may be treated in a single document, at the institution's discretion; and

VI - must be designed to achieve the objectives referred to in Arts. 63 and 67.

§ 2º If the institution belongs to a conglomerate, the adoption of a single conglomerate policy is admitted, however guaranteeing the peculiarities associated with the institution.

Art. 66. The policy for business continuity management referred to in item IV of the caput of Art. 65 must establish, among others:

I - a process for business impact analysis that includes:

a) identification, classification, and documentation of critical business processes;

b) assessment of the potential effects of the interruption of the processes mentioned in item "a";

II - strategies to ensure the continuity of the IOSMF's activities and limit losses arising from the interruption of critical business processes;

III - business continuity plans that establish procedures and estimated deadlines for the restart and recovery of activities in case of interruption of critical business processes, as well as the necessary communication actions;

IV - tests and reviews of business continuity plans with adequate periodicity;

V - treatment of relevant incidents related to the cyber environment referred to in item IV of Art. 67;

VI - procedures to be followed in the case of interruption of relevant contracted services, especially those for processing and data storage and cloud computing contracted, covering scenarios that consider the replacement of the contracted company and the restoration of the institution's normal operation; and

VII - incident scenarios considered in the tests of continuity of services provided referred to in item "a" of item V of Art. 67.

Art. 67. The information and cybersecurity policy referred to in item VI of the caput of Art. 65 must provide for mechanisms for prevention, detection, vulnerability reduction, response, and recovery of incidents related to the cyber environment, contemplating, at a minimum:

I - the information and cybersecurity objectives of the IOSMF;

II - the procedures and controls adopted to reduce the entity's vulnerability to incidents and to meet the other information and cybersecurity objectives;

III - specific controls, including those aimed at information traceability, which seek to guarantee the security of sensitive information;

IV - the recording, analysis of cause and impact, as well as the control of the effects of relevant incidents for the entity's activities;

V - the guidelines for:

a) the elaboration of incident scenarios considered in business continuity tests and operations of significant rupture risks, including events that can cause a large-scale rupture;

b) the definition of procedures and controls aimed at prevention and treatment of incidents to be adopted by third-party service providers contracted by the IOSMF;

c) the classification of data and information regarding relevance; and

d) the definition of parameters to be used in the assessment of the relevance of incidents;

VI - the mechanisms for disseminating the culture of information and cybersecurity in the IOSMF, including:

a) the implementation of training programs and periodic personnel assessment;

b) the provision of information to participants regarding precautions in the use of products and services offered; and

c) the commitment of administrators to the continuous improvement of procedures related to information and cybersecurity;

VII - the initiatives for sharing information about relevant incidents, mentioned in item XI of § 1º of Art. 82, with IOSMFs, financial institutions, payment institutions, and other institutions authorized to operate by the Central Bank of Brazil.

§ 1º The procedures and controls referred to in item II of the caput must cover authentication, encryption, prevention and detection of intrusion, prevention of information leakage, periodic testing and scanning for vulnerability detection, protection against malicious software, establishment of traceability mechanisms, access controls and computer network segmentation, and maintenance of data and information backups.

§ 2º The procedures and controls cited in item II of the caput must be applied, also, in the development of secure information systems and in the adoption of new technologies employed in the IOSMF's activities.

§ 3º The recording, analysis of cause and impact, as well as the control of the effects of incidents, referred to in item IV of the caput, must cover even information received from third-party service providers.

§ 4º The guidelines referred to in item "b" of item V of the caput must contemplate procedures and controls at levels of complexity, scope, and precision compatible with those used by the IOSMF itself.

Section III

Of Fraud Management

Art. 68. The operational risk management structure referred to in this Chapter must provide, with respect to fraud risk:

I - the identification and understanding of risks and possibilities of fraud in products, services, and processes, considering, individually and collectively, the IOSMF and its participants, as well as other SMFs with which there is some type of relationship;

II - the definition and implementation of security requirements for prevention, detection, and response to frauds established by the IOSMF, to be observed by both the IOSMF and the participants;

III - the promotion of participant compliance with security requirements, including the execution of action plans to mitigate vulnerabilities identified during the performance of internal and external assessment procedures;

IV - the provision and use of information and tools for the continuous improvement and prevention and detection of frauds between IOSMFs and participants;

V - the timely response to signs of frauds, involving IOSMFs and participants;

VI - the continuous promotion of training, dissemination, and sharing of information for fraud management, without prejudice to banking secrecy and data protection laws; and

VII - the leveraging of learning about fraud management for the evolution and coordination of practices, including with other IOSMFs.

Section IV

Of Relevant Service Outsourcing Management

Art. 69. IOSMFs must ensure that their policies, strategies, and structures for risk management contemplate the decision criteria regarding the outsourcing of relevant services, including relevant services for processing and data storage.

Sole Paragraph. The outsourcing of relevant services does not exempt the institution from complying with any provisions of this Regulation, especially those associated with operational risk, and requires the institution to have an even more robust management of risks arising from external factors.

Art. 70. IOSMFs, prior to contracting relevant services, must adopt procedures that contemplate:

I - the adoption of corporate governance and management practices proportional to the relevance of the service to be contracted and the risks to which they are exposed;

II - the verification of the potential service provider's capacity to ensure:

a) compliance with current legislation and regulation;

b) access by the contracting institution to reports prepared by an independent specialized audit company contracted by the service provider, relating to the procedures and controls used in the provision of the services to be contracted;

c) the provision of information and management resources adequate for the monitoring of the services to be provided; and

d) access by the Central Bank of Brazil for the purpose of supervision, in the mold of those performed on the IOSMF itself; and

III - in the case of contracting relevant services for processing and data storage, the additional verification of the potential service provider's capacity to ensure:

a) access by the institution to the data and information to be processed or stored by the service provider;

b) the confidentiality, integrity, availability, and recovery of the data and information processed or stored by the service provider;

c) its observance of certifications required by the institution for the provision of the service to be contracted;

d) the identification and segregation of participant data through physical or logical controls; and

e) the quality of access controls aimed at protecting the data and information of the institution's participants.

§ 1º In assessing the relevance of the service to be contracted, as referred to in item I of the caput, the contracting entity must consider the criticality of the service and the sensitivity of the data and information to be processed, stored, and managed by the contractor, taking into account, among other things, the classification performed in accordance with item “c” of item V of art. 67.

§ 2º The procedures referred to in the caput, including information related to the verification mentioned in items II and III, must be documented.

§ 3º In the case of the execution of applications via the internet, referred to in item LII of art. 2º, the entity must ensure that the potential service provider adopts controls that mitigate the effects of potential vulnerabilities in the release of new versions of the application.

§ 4º The institution must possess the resources and competencies necessary for the adequate management of the services to be contracted, including for the analysis of information and the use of resources provided in accordance with item “c” of item II of the caput.

Art. 71. The contracting of relevant services for processing, data storage, and cloud computing provided abroad must observe the following requirements:

I - the existence of an agreement for the exchange of information between the Central Bank of Brazil and the supervisory authorities of the countries where the services may be provided;

II - the contracting institution must ensure that the provision of the services referred to in the caput does not cause harm to its regular functioning nor hinder the actions of the Central Bank of Brazil;

III - the contracting institution must define, prior to contracting, the countries and regions in each country where the services may be provided and where the data may be stored, processed, and managed; and

IV - the contracting institution must provide alternatives for business continuity in the event of the impossibility of maintaining or terminating the service provision contract.

§ 1º In the event of the absence of an agreement as referred to in item I of the caput, the contracting institution must request authorization from the Central Bank of Brazil, within the scope of the authorizations referred to in items I, II, III, and XI of art. 4º of this Regulation, for the contracting of services and for contractual amendments that imply modification of information related to the name of the contracted company, the relevant services contracted, and the indication of the countries and regions in each country where the services may be provided and the data may be stored, processed, and managed, as per item III of this article.

§ 2º Institutions must ensure that the legislation and regulation in the countries and regions in each country where the services may be provided do not restrict or prevent the access of the contracting institutions and the Central Bank of Brazil to the data and information.

§ 3º The proof of compliance with the requirements referred to in items I to IV of the caput and the fulfillment of the requirement referred to in § 2º must be documented.

§ 4º The relevant service provider abroad must meet at least the same requirements requested of relevant service providers located within the national territory.

§ 5º The relevant service provider abroad must have a representation in Brazil.

§ 6º The foreign supervisor must have the same regulatory and supervisory competencies of IOSMF of the Central Bank of Brazil supervisors.

§ 7º The agreement, as referred to in item I of the caput, or the memorandum of understanding, must provide for the direct relationship of the Central Bank of Brazil with the relevant service provider, including to conduct inspections, if necessary.

§ 8º The relevant service provider must have, in Brazil, a contingency site with mechanisms for business continuity that allow for the execution of the contracted relevant service within national territory, in the event of the materialization of risks that make the continuation of service provision abroad impossible, and such mechanisms must include the provision for the replication of the database and information to the domestic site and must be tested periodically.

§ 9º If deemed necessary, the relevant service provider must provide information and evidence to the actions of the Central Bank of Brazil, including in Portuguese, if requested.

Art. 72. The IOSMF contracting the services mentioned in art. 70 is responsible for the reliability, integrity, availability, security, and confidentiality regarding the contracted services, as well as for compliance with the applicable legislation and regulation.

Art. 73. Contracting and amendments related to the outsourcing of relevant services must be communicated by the institutions referred to in art. 1º to the Central Bank of Brazil.

§ 1º The communication mentioned in the caput must contain the following information:

I - the name of the company to be contracted;

II - the relevant services to be contracted;

III - the indication of the countries and regions in each country where the services may be provided, defined in accordance with item III of art. 71, in the case of contracting abroad; and

IV - other information at the discretion of the Central Bank of Brazil.

§ 2º The communication referred to in the caput must be carried out within 10 (ten) days after the contracting of the services.

§ 3º Contractual amendments that imply modification of the information referred to in § 1º must be communicated to the Central Bank of Brazil within 10 (ten) days after the contractual amendment.

§ 4º Draft contracts or contractual addendums related to relevant services for processing and data storage and cloud computing must be forwarded to the Central Bank of Brazil at least 60 (sixty) days before the signing of the respective contractual instruments.

Art. 74. Contracts for the provision of relevant services for processing, data storage, and cloud computing must provide:

I - the adoption of security measures for the transmission and storage of data;

II - the maintenance, while the contract is in effect, of the segregation of data and access controls to protect participants' information;

III - service level agreements and quality parameters to be observed during the validity of the contract, compatible with the regulatory and operational needs of the SMF that use the contracted services in their operation;

IV - the obligation, in the event of contract termination, of:

a) transfer of data to the new service provider or to the contracting IOSMF; and

b) deletion of data by the replaced contracted company, after the data transfer provided for in item “a” and confirmation of the integrity and availability of the received data;

V - the access of the IOSMF to:

a) information provided by the contracted company, aiming to verify compliance with items I and II;

b) information related to specialized audit reports and required certifications, in accordance with item “b” of item II and item “c” of item III of art. 70; and

c) information and management resources adequate for monitoring the services to be provided, as referred to in item “c” of item II of art. 70;

VI - the obligation of the contracted company to notify the contracting IOSMF about the subcontracting of relevant services to the institution;

VII - the permission for the Central Bank of Brazil to access the contracts and agreements entered into for the provision of services, documentation and information related to the services provided, data stored, and information about their processing, copies of data and information backups, as well as access codes to data and information and reports of the certifications treated in art. 70, item III, item “c”, as well as documentation and other inputs that supported them;

VIII - the adoption of measures by the contracting IOSMF, as a result of determination by the Central Bank of Brazil;

IX - the obligation of the contracted company to keep the contracting IOSMF permanently informed about any limitations that may affect the provision of services or compliance with the applicable legislation and regulation; and

X - the access of the Central Bank of Brazil, for the purpose of conducting supervision processes, in the same manner as would be conducted in the IOSMF.

§ 1º The contract mentioned in the caput must provide, in the event of early termination due to a bidding procedure, the obligation of the contracted company to maintain, for at least 90 (ninety) days, counted from the date of early termination, access to contracts, agreements, documentation, and information related to the services provided, data stored, and information about their processing, copies of data and information backups, as well as access codes as referred to in item VII of the caput that are in the possession of the contracted company.

§ 2º The service level agreements and quality parameters treated in item III of the caput must be sufficient to ensure, at least, the provisions of Chapter I of Title V.

Art. 75. The provisions of arts. 70, 72, 73, and 74 do not apply to the contracting of systems operated by IOSMF authorized by the Central Bank of Brazil.

Art. 76. The Central Bank of Brazil may veto or impose restrictions on the contracting of processing and data storage services whenever it finds, at any time, non-compliance with the provisions of this Regulation, as well as limitations to the actions of the Central Bank of Brazil supervision, establishing a deadline for the adequacy of such services and corresponding contracts.

Art. 77. The Central Bank of Brazil may establish the requirement for certifications and other technical requirements to be requested from contracted companies, by the contracting IOSMF, in the provision of services as referred to in art. 69.

Section V

Of Business Continuity

Art. 78. IOSMF must structure business continuity management compatible with their nature, size, complexity, structure, and risk profile.

§ 1º The structure referred to in the caput must:

I - be supported by the policy, principles, and best practices of business continuity management;

II - clearly and objectively define the responsibilities of the parties involved, including when outsourced;

III - provide mechanisms for the identification of essential processes and assets;

IV - guarantee high standards of cyber and operational resilience;

V - provide a business continuity plan, responsible for establishing a set of strategies to ensure the preservation of essential processes and assets after the occurrence of a risk event, and until the return to normal operating conditions;

VI - establish and document the criteria that constitute a crisis situation;

VII - provide for the continuous promotion of training, dissemination, and sharing of information for business continuity management;

VIII - promptly communicate to the Central Bank of Brazil occurrences and interruptions that constitute a crisis situation by the IOSMF, as well as the measures for the resumption of its activities;

IX - provide treatment to mitigate the effects of relevant incidents as referred to in item IV of art. 67 and the interruption of relevant services for processing, data storage, and cloud computing contracted;

X - establish a deadline for the resumption or normalization of its activities or interrupted relevant services, in line with what is established in Chapter I of Title V, to the extent applicable to the SMF;

XI - ensure the complete settlement of operations until the end of the day of the materialization of the risk event, even under extreme conditions;

XII - contemplate other IOSMF and service and input providers, even within the same conglomerate;

XIII - be submitted to periodic evaluations and reviews;

XIV - provide for the installation and operation of a secondary processing center, subject to a set of risks different from the main processing center, capable of processing volumes at least equal to the largest volume verified in the last 252 (two hundred and fifty-two) business days, plus a safety percentage, and with synchronous replication of data from the main processing center;

XV - provide for emergency procedures, in the event of simultaneous impediment of the main and secondary processing centers;

XVI - provide for business continuity tests, at least annually, that:

a) contemplate scenarios containing events that may result in the interruption of critical activities and the loss or inaccessibility of the team responsible for these activities;

b) have their results documented, including a description of any measures to be adopted to improve procedures;

c) have their results evaluated by an independent team and brought to the attention of the administrators;

d) include the participation of third parties responsible for providing critical services and market participants; and

e) be performed preferably under normal operating conditions of the IOSMF; and

XVII - ensure the reliability and timeliness of information disclosed to the operating entity's team, participants, the Central Bank of Brazil, and, where applicable, other financial service providers and the press.

§ 2º The structure referred to in the caput must be evaluated by internal audit and independent auditors.

Art. 79. Planned changes by the IOSMF that may significantly affect business continuity management must be communicated to the Central Bank of Brazil 30 (thirty) days in advance.

Art. 80. Business continuity management must be operationalized by professionals with recognized technical competence in the matter, capable of adequately performing their responsibilities.

Section VI

Of Technological Infrastructure and Information Technology Service Management

Art. 81. IOSMF must structure information technology service management compatible with their nature, size, complexity, structure, and risk profile.

Sole Paragraph. The structure referred to in the caput must:

I - be supported by the policy, principles, and best practices of information technology service management, in order to ensure adequate management of availability, capacity, performance, incidents, problems, changes, and suppliers, among others;

II - clearly and objectively define the responsibilities of the parties involved, including when outsourced;

III - be robust and adequate to ensure the provision of services, both in normal circumstances and during periods of increasing stress volumes, and to achieve its objectives in terms of service level;

IV - be robust and adequate to the needs of the business model and appropriate to absorb possible changes in this model; and

V - be submitted to periodic evaluations and reviews.

Section VII

Of Information and Cybersecurity

Art. 82. IOSMF must structure information and cybersecurity management and infrastructure compatible with their nature, size, complexity, structure, risk profile, and sensitivity of the data and information under their responsibility.

§ 1º The structure referred to in the caput must:

I - be supported by the policy, principles, and best practices related to information and cybersecurity, preserving the confidentiality, integrity, and availability of data and systems;

II - cover not only technological aspects, but also processes and people;

III - clearly and objectively define the responsibilities of the parties involved, including when outsourced;

IV - provide adequate levels of governance, ensuring, among other things, an adequate incentive structure for various stakeholders;

V - provide mechanisms to protect the reliability, integrity, and availability of its data and assets, broadly inhibiting intrusion and leakage of data and information;

VI - provide mechanisms for the early detection of anomalies and potential risk events;

VII - be properly integrated with the incident management structure and business continuity structure, in order to allow a prompt and adequate response and recovery;

VIII - be submitted to periodic evaluations and reviews;

IX - provide for a program of regular tests in information and cybersecurity systems compatible with and in accordance with current best practices;

X - consider the segment of activity to which the IOSMF belongs and contemplate, among others, those arising from other IOSMF, service and input providers, even within the same conglomerate, participants, and the risks that their operations may represent for other IOSMF;

XI - provide mechanisms for sharing information about relevant incidents through secure channels with the segment of activity, as well as for the responsible disclosure of events that have occurred; and

XII - provide, in view of the constant evolution and mutability of the sector, mechanisms that guarantee constant learning and the continuous adaptation and evolution of the structure.

§ 2º The structure referred to in § 1º must be its own.

§ 3º The structure referred to in the caput must be evaluated by internal audit and independent auditors.

§ 4º The sharing referred to in item XI of § 1º must cover information about relevant incidents received from third-party service providers.

§ 5º The information shared, as provided for in item XI of § 1º, must be available to the Central Bank of Brazil.

Art. 83. The body responsible for the management of information and cybersecurity of the IOSMF must be its own.

§ 1º The body responsible for the management of information and cybersecurity must be assured of due independence, in order to ensure effective management.

§ 2º Those responsible for the management of information and cybersecurity must be professionals with recognized technical competence in the matter, capable of adequately performing their responsibilities.

Art. 84. IOSMF must establish an information security master plan aiming to implement the information and cybersecurity policy.

Sole Paragraph. The plan mentioned in the caput must cover, at minimum:

I - the actions to be developed by the IOSMF to adapt its organizational and operational structures to the principles and guidelines of the information and cybersecurity policy;

II - the routines, procedures, controls, and technologies to be used in the prevention and response to incidents, in accordance with the guidelines of the information and cybersecurity policy; and

III – the treatment of potential vulnerabilities and threats, including regarding physical security.

Art. 85. IOSMF must establish an incident response plan aiming to adequately manage incidents that may impact their operation.

§ 1º The plan mentioned in the caput must establish roles and responsibilities related to incident management, including activities such as:

I - identification and registration of relevant incidents;

II - classification and prioritization of incidents according to previously established criteria;

III - execution of response and recovery procedures aiming to mitigate the effects of incidents on the IOSMF's operation;

IV - implementation of communication plans, both for the internal and external public; and

V - identification of lessons learned for the improvement of incident management.

§ 2º The plan mentioned in the caput must be periodically tested and reviewed.

Art. 86. IOSMF must designate a director, defined in the bylaws or articles of incorporation, responsible for the information and cybersecurity policy and for the execution of the information security master plan.

Sole Paragraph. The director mentioned in the caput may perform other functions in the entity, provided there is no conflict of interest.

Art. 87. IOSMF must prepare an annual report on the implementation of the information security master plan as referred to in art. 84, with a base date of December 31.

§ 1º The report referred to in the caput must address, at minimum:

I - the effectiveness of the implementation of the actions described in item I of the sole paragraph of art. 84;

II - a summary of the results obtained in the implementation of the routines, procedures, controls, and technologies to be used in the prevention and response to incidents described in item II of the sole paragraph of art. 84;

III - the treatment of potential vulnerabilities and threats, including regarding physical security, described in item III of the sole paragraph of art. 84;

IV - relevant incidents that occurred during the period, with emphasis on those related to the cyber environment; and

V - the results of the continuity tests of the services provided, considering scenarios of unavailability caused by incidents.

§ 2º The report mentioned in the caput must be presented to the board of directors and, if none exists, to the management provided for in the bylaws or articles of incorporation, by March 31 of the year following the base date.

§ 3º The report mentioned in the caput must be available to the Central Bank of Brazil for a minimum period of 5 (five) years from its issuance.

Art. 88. The information security master plan mentioned in art. 84 must:

I - be approved by the IOSMF's board of directors or, if none exists, by the management provided for in the bylaws or articles of incorporation;

II - be reviewed, at minimum, annually; and

III - be available to the Central Bank of Brazil for a minimum period of 5 (five) years from its revocation.

CHAPTER VII

OF EFFICIENCY AND EFFECTIVENESS

Art. 89. IOSMF must be structured to deliver products and services offered, especially settlement, centralized deposit, and registration systems, as well as the technological support used, to their participants and the market in which they operate, with efficiency and effectiveness.

Sole Paragraph. The institution must structure management for the continuous monitoring of the efficiency and effectiveness delivered, with objectives and metrics established for this purpose.

CHAPTER VIII

OF COMMUNICATION PROCEDURES AND STANDARDS

Art. 90. IOSMF must use or, at minimum, accommodate relevant communication procedures and standards, internationally accepted.

CHAPTER IX

OF DISCLOSURE OF RULES, PROCEDURES, AND MARKET DATA

Art. 91. IOSMF must provide participants, in a clear and objective manner, all information necessary for them to identify the risks and costs to which they are subject.

§ 1º The information referred to in the caput must be comprehensive and relate both to the FMI and to the SMFs operated by it, allowing the participant to fully perceive its obligations as well as the institution's obligations.

§ 2º The provision of information referred to in the caput must include training that increases the participant's awareness regarding their scope of participation.

§ 3º Changes to the information referred to in the caput must be communicated to participants in advance so that they can provide opinions and manage their risk in the best possible manner.

§ 4º The tariffs charged must be publicly disclosed at the level of individual services offered, as well as the available discount policies.

§ 5º The services offered must have a clear description that allows comparison with services provided by similar institutions.

Art. 92. FMIs must periodically publish a self-assessment of adherence to the Principles for Financial Market Infrastructures (Principles for Financial Market Infrastructures – PFMI) applicable to activities carried out through the SMFs operated by them, according to the standard originally published by the Committee on Payment and Settlement Systems of the Bank for International Settlements (CPSS/BIS) and the Board of the International Organization of Securities Commissions (IOSCO Board).

Art. 93. FMIs must periodically publish, at a minimum, data on registered and deposited assets and on volumes and values of transactions processed in the SMFs, where applicable.

TITLE V

OF THE FINANCIAL MARKET SYSTEMS

CHAPTER I

OF GENERAL ASPECTS

Art. 94. The availability index of the SMFs must be at least 99.8% (ninety-nine and eight-tenths percent).

Art. 95. The recovery point targeted by the SMFs must be equal to 0 (zero), in order to preserve all data.

Art. 96. The recovery time targeted by the SMFs must be, at most:

I - 30 (thirty) minutes, for real-time gross settlement systems; or

II - 2 (two) hours, for other types of SMFs.

Art. 97. In the SMFs, transactions must be confirmed on the day they were transmitted.

Sole Paragraph. Transactions may be confirmed on the next business day following transmission in the following cases:

I - activation of the business continuity plan; and

II - transactions not settled by the central counterparty and transmitted after 18:00 (eighteen o'clock).

Art. 98. The SMFs must enable the settlement, on the respective due date, of the main and accessory obligations of issuers of financial assets and securities, as well as contractual obligations processed therein.

Sole Paragraph. The provisions of the caput do not apply to registration systems.

Art. 99. The SMFs must store information relating to operations, movements, and records performed in their systems, in a manner that allows traceability.

CHAPTER II

OF THE REGULATIONS OF THE FINANCIAL MARKET SYSTEMS

Art. 100. All aspects related in this Chapter are considered an integral part of the SMF regulation, regardless of whether they are contained in a single document or in the nomenclature attributed to the documents in which they are contained.

§ 1º If the aspects related in this Chapter are contained in several documents, the relationship between the commands must be clear and cohesive, indicating, furthermore, which document should prevail in case of ambiguity.

§ 2º The FMI must publish the SMF regulation on its website, in an exclusive space for each SMF.

§ 3º The disclosure referred to in § 2º must also contain information regarding version control and the internal responsible person for approving the SMF regulation, as well as others potentially required by the Central Bank of Brazil.

§ 4º FMIs must promptly disclose to all participants any changes to the regulations of the SMFs operated by them.

§ 5º Previous versions of the SMF regulation must be kept available to the Central Bank of Brazil for at least 5 (five) years from their revocation.

Art. 101. The SMF regulation may assign the definition of parameters relating to risks, costs, and charges to the administrators of the FMI, provided that such assignment is consistent with the statutes or the articles of association and that the aspects taken into account in the administrators' decisions are included in the regulations.

Art. 102. The SMF regulations must contain, clearly and objectively:

I - description of all activities and all services provided;

II - operating hours and relevant aspects of each activity performed;

III - costs, charges, and their method of collection;

IV - participation criteria;

V - criteria and procedures for granting, suspending, and canceling participant access;

VI - criteria and procedures for, in case of cancellation of participation, the orderly closure of rights and obligations of the participant who no longer meets the requirements established in the SMF regulation;

VII - rights, duties, and procedures to be adopted in case the participant is subjected to intervention or resolution regimes, considering the provision of information to relevant authorities;

VIII - criteria for applying penalties to participants;

IX - obligation of the participant to ensure the truthfulness and updating of the registration information maintained in the SMF for end clients to whom service is provided;

X - rights and duties of participants towards the FMI;

XI - rights and duties of the FMI towards participants of the SMF, especially regarding risk management;

XII - all materially relevant risks, including those related to third parties, in which participants incur when participating in the SMF;

XIII - rights and duties of the FMI towards other FMIs, including those constituted and domiciled abroad, with which it maintains interconnection;

XIV - rights and duties of the FMI towards the foreign central counterparty providing services to it, if any;

XV - mechanisms and safeguards adopted to contain risks, including legal, general business, custody, investment, and operational risks;

XVI - business continuity plan;

XVII - aspects of the recovery plan related to the rules to be complied with by participants, including loss allocation and need for financial resource contribution, where applicable; and

XVIII - availability index, recovery point, and targeted recovery time.

Art. 103. The regulations of settlement systems must establish, clearly and objectively, in addition to the provisions of Art. 102:

I - the moment from which an unsettled transaction cannot be revoked by participants;

II - the requirements and the moment for a transaction to be accepted;

III - the requirements and the moment from which an accepted transaction is settled;

IV - the settlement mode and, in deferred net settlement systems by net value, the duration of the settlement cycle;

V - the moment from which settlement is final;

VI - the rules and procedures adopted to contain credit, liquidity, custody, and investment risks;

VII - events characterizing participant default;

VIII - the rules and procedures to be adopted in case of participant default;

IX - the structure of financial accounts, in financial assets and securities, if applicable;

X - the rules and procedures related to the opening, maintenance, and closing of the accounts referred to in item IX, if applicable; and

XI - the rules and procedures to be adopted to guarantee the portability of positions and guarantees of clients, under a certain participant, to other participants, if applicable.

Art. 104. The regulations of centralized deposit systems must establish, clearly and objectively, in addition to the provisions of Art. 102:

I - the list of eligible financial assets;

II - procedures related to reconciliation;

III - mechanisms and safeguards adopted to contain custody and investment risks, if applicable;

IV - the account structure and procedures related to its opening, maintenance, and closing;

V - the form and procedures related to the provision of balances and statements;

VI - the systematic transfer of fiduciary ownership constituting the deposit; and

VII - procedures related to the constitution, alteration, and dissolution of liens and encumbrances on financial assets, in cases where the centralized deposit system exercises this activity.

§ 1º The procedures referred to in item VII of the caput must contain, at a minimum:

I - form of constitution, alteration, and dissolution of liens and encumbrances, including on sets or universality of assets;

II - responsibilities, rights, and obligations of those involved in the acts of constitution, alteration, and dissolution of liens and encumbrances, including regarding the establishment of deadlines;

III - procedures related to the treatment given to events of financial assets subject to liens and encumbrances;

IV - forms of transfer of effective ownership of financial assets subject to liens and encumbrances, respecting legal restrictions;

V - procedures related to the treatment applicable to situations of early maturity of obligations subject to liens and encumbrances; and

VI - regime and form of making available information stored about liens and encumbrances, including regarding the provision of information and issuance of certificates.

§ 2º The regulation must, for each financial asset in the list referred to in item I of the caput, be in total conformity with the laws and norms governing the asset.

Art. 105. The regulations of registration systems must establish, clearly and objectively, in addition to the provisions of Art. 102:

I - the list of eligible financial assets;

II - procedures related to reconciliation;

III - the form and procedures for the registration of information;

IV - rules intended for participants to ensure the truthfulness of information and keep records duly updated;

V - procedures aimed at the quality of information registered by participants; and

VI - procedures related to the constitution, alteration, and dissolution of liens and encumbrances on financial assets, in cases where the registration system exercises this activity.

§ 1º The procedures referred to in item VI of the caput must contain, at a minimum:

I - form of constitution, alteration, and dissolution of liens and encumbrances, including on sets or universality of assets;

II - responsibilities, rights, and obligations of those involved in the acts of constitution, alteration, and dissolution of liens and encumbrances, including regarding the establishment of deadlines;

III - procedures to notify the participant holding control of the ownership of the financial asset regarding the constitution, alteration, or dissolution of liens and encumbrances, in situations where said participant was not responsible for instructing or confirming the command referred to in Art. 163; and

IV - regime and form of making available information stored about liens and encumbrances, including regarding the provision of information and issuance of certificates.

§ 2º The regulation must, for each financial asset in the list referred to in item I of the caput, be in total conformity with the laws and norms governing the asset.

CHAPTER III

OF ACCESS
TO
FINANCIAL MARKET SYSTEMS

Art. 106. FMIs must establish objective, risk-based, and non-discriminatory criteria for participation and access by direct participants, indirect participants, and other FMIs, to the services of the SMFs operated by them, admitting restrictions aimed at promoting the safety and efficiency of the FMI and the markets served by it.

§ 1º The participation and access criteria referred to in the caput must be public.

§ 2º The access and participation restrictions referred to in the caput must be proportional to the increase in safety or efficiency sought to be obtained.

§ 3º In order to ensure compliance with the access and participation criteria referred to in the caput, FMIs must establish procedures for the continuous monitoring of their participants, including the provision in regulations of clear criteria for suspension, exclusion, or orderly closure of rights and obligations of a participant.

§ 4º FMIs may require tests to be conducted prior to the accreditation of SMF participants and periodically for their already accredited participants.

§ 5º FMIs must act with neutrality towards their participants.

Art. 107. The Central Bank of Brazil, FMIs, financial institutions, and other institutions authorized by the Central Bank of Brazil may participate directly in settlement systems, provided there is compatibility between the activities the institution is authorized to perform and the transactions settled within the scope of the respective system.

Sole Paragraph. In any situation, the entity's participation in settlement systems will be conditioned upon approval of its access in accordance with the respective regulations.

Art. 108. FMIs must identify, monitor, and manage risks materially incurred as a result of different categories of participation in the SMFs operated by them, encompassing, at a minimum:

I - harmonization of rules, procedures, and contracts with obtaining relevant information on indirect participants and clients of SMF participants;

II - identification of significant dependencies between direct and indirect SMF participants that may affect the FMI;

III - identification of indirect participants responsible for a significant proportion of transactions processed by the SMF;

IV - identification of indirect participants in settlement systems whose transactions represent significant volumes or values relative to the transactions of the direct participants to which they are linked, where applicable; and

V - review, at a minimum annual periodicity, of the risks referred to in the caput, with adoption of mitigating measures for these risks.

Art. 109. Participants must provide accurate information to FMIs.

Sole Paragraph. Upon verification of inaccuracies in the information provided, participants shall be presumed responsible, subjecting themselves to the penalties provided for in the SMF regulations.

Art. 110. FMIs must communicate to the Central Bank of Brazil within up to 1 (one) business day:

I - the default of a participant that is an FMI, financial institution, or another institution authorized to operate by the Central Bank of Brazil; and

II - the suspension, exclusion, or orderly closure of rights and obligations of a participant, except when the closure occurs at the request of the participant.

CHAPTER IV

OF SETTLEMENT SYSTEMS

Section I

Of the Object of
Settlement

Art. 111. Obligations arising from the following may be the object of settlement in a settlement system, individually or jointly:

I - checks and other papers;

II - electronic debit and credit orders;

III - transfer of funds in national currency;

IV - foreign currency transactions; and

V - transactions with financial assets and securities carried out on stock exchanges and organized over-the-counter markets.

§ 1º The settlement of checks and other papers is carried out by the Check Clearing Centralizer (Compe), operated by Banco do Brasil S.A., in accordance with its regulation.

§ 2º Except for settlement systems operated by the Central Bank of Brazil, fund transfer settlement systems must settle exclusively unilateral transfer orders of monetary amounts in national currency, excluding, therefore, those associated with the consideration of obligations related to foreign currency, financial asset, and securities transactions.

§ 3º Foreign currency settlement systems must settle exclusively obligations related to transactions associated with different currencies.

§ 4º The Central Bank of Brazil may determine, at any time, on a case-by-case examination, restrictions on the types of operations whose obligations are eligible for settlement in the same settlement system, if it assesses that this compromises the safety or efficiency of the clearinghouse or the compensation and settlement service provider or poses a risk to the solidity and normal functioning of the National Financial System and the Brazilian Payments System.

Section II

Of Hybrid Settlement Systems

Art. 112. Hybrid settlement systems will be examined by the Central Bank of Brazil according to their specificities, observing, where applicable, the requirements established in this Regulation for deferred net settlement systems by net value and for real-time gross settlement systems.

Section III

Of Payment Systems

Art. 113. Clearinghouses and compensation and settlement service providers operating payment systems must implement measures aimed at avoiding concentration, both in terms of value and quantity, of transfer orders at the end of the period provided for.

Section IV

Of Systemically Important Settlement Systems

Art. 114. The following are considered systemically important by the Central Bank of Brazil:

I - settlement systems for foreign currency, financial asset, and securities transactions, regardless of the individual value of each transaction and the daily financial turnover; and

II - fund transfer settlement systems that have an average daily financial turnover superior to 4% (four percent) of the average daily financial turnover of the Reserve Transfer System (STR).

§ 1º For the purposes of the provision in item II of the caput, the average daily financial turnover is calculated:

I - taking the 30 (thirty) largest positions observed in the 6 (six) months preceding the evaluation month; and

II - disregarding, in the case of the STR, movements where the sender and beneficiary are the same financial institution.

§ 2º The Central Bank of Brazil will evaluate monthly the fund transfer settlement systems regarding the criterion established in item II of the caput, and, if the evaluated indicator points to a classification of the settlement system different from that previously adopted:

I - notify the clearinghouse or compensation and settlement service provider, to give it the opportunity to manifest itself regarding the eventual exceptionality of the evaluated indicators; and

II - analyze the eventual exceptionality and project the indicators listed in item II of the caput for subsequent periods.

§ 3º If the Central Bank of Brazil considers that the inclusion of a fund settlement system in the criterion listed in item II of the caput has a low probability of occurring in subsequent periods, the clearinghouse or compensation and settlement service provider shall be informed.

§ 4º If the Central Bank of Brazil considers that the inclusion of a fund settlement system in the criterion listed in item II of the caput has a high probability of repeating in subsequent periods, the clearinghouse or compensation and settlement service provider must be notified so that, within 180 (one hundred and eighty) days, counted from the month following the notification referred to in § 2º, it promotes the necessary adaptations resulting from the classification as systemically important of the operating settlement system.

Art. 115. In deferred net settlement systems by net value considered systemically important, accepted transactions must have settlement scheduled for:

I - the same day, in deferred net settlement systems by net value of fund transfers;

II - up to 1 (one) business day, in the case of spot transactions with financial assets and securities, except spot transactions with shares and investment fund share transactions carried out on a stock exchange;

III - up to 2 (two) business days, in the case of spot transactions with shares, investment fund share transactions carried out on a stock exchange, and spot transactions with foreign currencies; or

IV - the timeframe to be defined by the Central Bank of Brazil, in other situations, in the authorization or supervision processes.

§ 1º In settlements referring to the first operation involving financial assets or securities subject to initial book-entry registration, the Central Bank of Brazil may, upon reasoned request from the clearinghouse or compensation and settlement service provider, authorize, on a case-by-case basis, a settlement period longer than that stipulated in items II and III of the caput, in view of promoting the solidity and normal functioning of the National Financial System and the Brazilian Payments System.

§ 2º The act of disclosing the timeframe referred to in § 1º must specify the operation to which it applies, as well as the start and end dates of its validity.

§ 3º The timeframes defined in items II and III of the caput do not apply to procedures intended for the treatment of failure to deliver financial assets and securities provided for in the regulations of settlement systems, which will be evaluated by the Central Bank of Brazil, on a case-by-case basis, in view of the liquidity of the financial assets and securities subject to the failure to deliver procedures.

Art. 116. Clearinghouses and compensation and settlement service providers operating deferred net settlement systems by net value considered systemically important must maintain an account at the Central Bank of Brazil destined for the settlement of obligations in national currency processed within the scope of the aforementioned settlement systems.

Section V

Of Settlement of
Obligations

Art. 117. Clearinghouses and compensation and settlement service providers must establish rules and procedures that ensure the final settlement of transactions in real-time or on an intraday basis, at the latest until the end of the day stipulated in the regulations of the settlement systems operated by them.

Art. 118. In fund transfer settlement systems, final settlement must be made directly in the financial accounts maintained by participants at the Central Bank of Brazil or in accounts maintained by participants at clearinghouses and compensation and settlement service providers.

§ 1º The clearinghouse or compensation and settlement service provider may make financial accounts available to its participants, provided it proves to the Central Bank of Brazil that the aforementioned accounts:

I - are segregated from the entity's own resources and by participant;

II - are destined exclusively for the fulfillment of obligations assumed by participants within the scope of the settlement system;

III - are constituted exclusively with resources originating from accounts maintained at the Central Bank of Brazil; and

IV - do not have, at any time, a negative balance.

§ 2º In fund transfer clearing systems not considered systemically important, whose average daily financial turnover is less than 0.4% (four-tenths of one percent) of the average daily financial turnover of the STR, it is permitted that clearing occurs in institutions with financial accounts maintained at the Central Bank of Brazil, provided that the clearinghouse or the clearing and settlement service provider proves to the Central Bank of Brazil that the following have been:

I - criteria established and monitored for clearing institutions, which considered, at a minimum, their creditworthiness, capitalization, and operational reliability; and

II - contractual instruments or equivalents formalized with the clearing institutions stipulating the moments from which transfers must occur, become final, and funds can be freely moved by participants.

Art. 119. In foreign currency, financial assets, and securities clearing systems, the final settlement of funds must be made directly in financial accounts maintained at the Central Bank of Brazil.

Sole Paragraph. If direct settlement in financial accounts maintained at the Central Bank of Brazil is operationally unfeasible, the business continuity plans of the clearinghouse or the clearing and settlement service provider may provide for the settlement of funds in a clearing system or clearing institution with financial accounts maintained at the Central Bank of Brazil.

Art. 120. In foreign currency, financial assets, and securities clearing systems that do not settle obligations in foreign currencies directly in accounts maintained at the respective issuing central banks, the clearinghouse or the clearing and settlement service provider must prove to the Central Bank of Brazil that:

I - transfers are made directly in the foreign currencies settled by the clearing system;

II - criteria have been established and monitored for its clearing institutions, which considered, at a minimum, their regulation and supervision, creditworthiness, capitalization, access to liquidity, and operational reliability;

III - contractual instruments or equivalents have been formalized with the clearing institutions stipulating the moments from which transfers must occur, become final, and funds can be freely moved by participants; and

IV - at least 3 (three) clearing institutions meeting the criteria established in items I to III have been used, in the case of foreign currency clearing systems.

Art. 121. In financial assets and securities clearing systems, the settlement of financial assets and securities deposited in central depositories may be made in accounts maintained by clearinghouses or clearing and settlement service providers at the respective central depositories, if there are legal or operational obstacles to settlement occurring directly in accounts maintained by participants at the central depositories.

Sole Paragraph. The clearinghouse or the clearing and settlement service provider must prove to the Central Bank of Brazil that the accounts maintained at the central depositories:

I - segregate the entity’s own funds and each participant’s funds;

II - are intended exclusively for the fulfillment of obligations assumed by participants within the clearing system;

III - are constituted exclusively with funds from accounts maintained at the respective central depositories; and

IV - do not present a negative balance at any time.

Art. 122. Clearinghouses and clearing and settlement service providers may settle obligations consisting of the physical delivery of goods, provided they clearly define their obligations and those of their participants.

Sole Paragraph. Clearinghouses and clearing and settlement service providers must identify, monitor, and manage the risks and costs associated with the storage and physical delivery of goods.

Art. 123. Without prejudice to the provisions of this Section, in clearing systems for foreign currency, financial assets, and securities operations, the final settlement of associated obligations must be mutually linked to:

I - fund transfer obligation linked to the assignment of contractual position or the transfer of title of financial assets, securities, or goods (delivery versus payment);

II - fund transfer obligation linked to the transfer of foreign currencies (payment versus payment); or

III - obligation to assign contractual position or transfer title of financial assets, securities, and goods linked to the assignment of contractual position or the transfer of title of financial assets, securities, or goods (delivery versus delivery).

Sole Paragraph. The delivery-versus-payment model in which financial assets and securities are settled at gross value prior to fund transfer at net value is prohibited.

Section VI

Regarding Rules and Procedures Related to Participant Default

Art. 124. Without prejudice to the provisions of Arts. 138 and 151 of this Regulation, clearinghouses and clearing service providers must, regarding the rules and procedures related to participant default referred to in item VIII of Art. 103:

I - continue to fulfill their obligations, within the clearing system, in the event of a participant’s default;

II - provide for the replenishment of resources after default;

III - be prepared, in terms of human resources and operational capacity, to implement the rules and procedures referred to in the caput, including any discretionary procedures provided for in regulations; and

IV - conduct, with participants of the clearing systems and other interested parties, tests and reviews of the rules and procedures referred to in the caput.

Sole Paragraph. The tests and reviews of rules referred to in the caput must:

I - provide for the closure of positions, when applicable; and

II - be conducted at a minimum annual periodicity or whenever there are materially significant modifications to the rules and procedures referred to in the caput.

Section VII

Central Counterparties

Subsection I

Criteria for Mandatory Nature

Art. 125. Clearinghouses and clearing and settlement service providers for operations with financial assets and securities conducted in organized exchange and organized over-the-counter markets must assume the function of counterparty to the operations settled by the deferred net value clearing systems they operate.

§ 1º The assumption referred to in the caput does not include:

I - risk management of the issuer;

II - operations conducted in organized over-the-counter markets through a centralized and bilateral negotiation system that allows the matching and interaction of buy and sell offers of financial assets and securities between previously authorized counterparties; and

III - operations conducted in organized over-the-counter markets through the registration of previously conducted operations.

§ 2º The service referred to in the caput may be provided regarding operations negotiated in organized over-the-counter markets mentioned in items II and III of § 1º and those related to the settlement of foreign currency operations.

§ 3º Foreign central counterparties, if recognized as qualified by the Central Bank of Brazil, may provide services, exclusively regarding operations negotiated in organized over-the-counter markets mentioned in items II and III of § 1º and those related to the settlement of foreign currency operations, to clearinghouses and clearing and settlement service providers and their participants.

Subsection II

Interoperability of Clearing Systems with Central Counterparty

Art. 126. The interoperability of clearing systems in which the clearinghouse or clearing and settlement service provider assumes the function of counterparty depends on the proof of the following requirements:

I - timely availability of prices and other market variables necessary for the calculation of credit and liquidity risks, required margins, and prices and haircuts applied to accepted collateral;

II - compatibility of credit and liquidity risk calculation systems, required margins, and prices and haircuts applied to accepted collateral;

III - identification of the direct and indirect effects of the default of the interoperable central counterparty;

IV - absence of impacts on the fulfillment of obligations with its own participants;

V - non-use of collateral offered by participants of the clearing system as collateral to cover exposures between interoperable central counterparties; and

VI - treatment of exposure to credit and liquidity risks to the other central counterparty no less rigorous than the treatment of exposure to its own participants.

Subsection III

Foreign Central Counterparties

Art. 127. The Central Bank of Brazil will recognize a foreign central counterparty as qualified if it proves the cumulative fulfillment of the following requirements:

I - being authorized to exercise its activities in its home jurisdiction and subject to authorization and supervision processes by foreign competent authorities, ensuring compliance with the principles guiding the Brazilian Payments System and the Principles for Financial Market Infrastructures (Principles for Financial Market Infrastructures – PFMI), originally published by the Committee on Payment and Settlement Systems of the Bank for International Settlements (CPSS/BIS) and the Technical Committee of the International Organization of Securities Commissions (TC/IOSCO), applicable to central counterparties;

II - being subject to systems for preventing the use of the financial system for the practice of money laundering or concealment of assets, rights, and values, and terrorism financing, analogous to those provided by Law No. 9,613 of March 3, 1998, and Law No. 13,260 of March 16, 2016, and subsequent amendments;

III - having provision, by the jurisdiction of origin of the foreign central counterparty, of a system for recognizing central counterparties constituted and domiciled abroad that may be applicable to clearinghouses and clearing and settlement service providers constituted and domiciled in Brazilian territory; and

IV - the existence of a cooperation agreement between the Central Bank of Brazil and foreign competent authorities that regulates, at a minimum, the following aspects:

a) mechanisms for immediate notification, between the Central Bank of Brazil and foreign competent authorities, regarding any relevant regulatory changes concerning the requirements referred to in items I to III;

b) mechanisms for information exchange between the Central Bank of Brazil and foreign competent authorities, regarding the foreign central counterparty;

c) mechanisms for immediate notification to the Central Bank of Brazil, by foreign competent authorities, of infractions committed by the foreign central counterparty that violate the conditions under which its authorization was granted or the norms to which it is subject; and

d) procedures for coordinating the supervision activities of the foreign central counterparty, including on-site inspections.

§ 1º Compliance with the provisions of items I to IV of the caput will be reevaluated by the Central Bank of Brazil whenever a relevant regulatory change occurs.

§ 2º The recognition of the foreign central counterparty does not imply authorization for the operation, or alteration of the regulations of the clearing systems part of the Brazilian Payments System for which it intends to provide its services, in accordance with Chapter I of Title III of this Regulation.

Art. 128. The request for recognition of a foreign central counterparty must be accompanied by documents proving compliance with the requirements set forth in items I to III of Art. 127.

Sole Paragraph. Original documents must be presented with their respective translations into the vernacular, performed by a sworn public translator.

Art. 129. The Central Bank of Brazil may cancel the recognition of a foreign central counterparty if, at any time, any of the following situations are verified:

I - the cooperation agreement between the Central Bank of Brazil and the competent authority ceases to produce effects;

II - the competent authority cancels, revokes, or renders void the authorization granted for the foreign central counterparty to operate in its home jurisdiction; or

III - a relevant regulatory change occurs in the jurisdiction of origin of the foreign central counterparty that, at the discretion of the Central Bank of Brazil, implies non-compliance with any of the items of Art. 127.

Art. 130. The clearinghouse or clearing and settlement service provider for which the foreign central counterparty provides services must express its view on the continuity of services within 5 (five) business days, counted from the receipt of notification from the Central Bank of Brazil informing about the cancellation of the recognition of the foreign central counterparty.

§ 1º If the IOSMF referred to in the caput expresses continuity in the provision of services, it must submit a request for authorization or a supplementary authorization request for a clearing system, in accordance with Title III of this Regulation, within 90 (ninety) days after receiving notification from the Central Bank of Brazil referred to in the caput.

§ 2º If the clearinghouse or clearing and settlement service provider referred to in the caput expresses discontinuation of the provision of services, it must submit, along with its statement, a plan for the orderly closure of the service, providing for the treatment of positions for open operations.

Subsection IV

Segregation and Portability

Art. 131. In order to ensure the provisions of item XI of Art. 103 of this Regulation, central counterparties must have means to segregate positions and collateral of their participants from the positions and collateral of their respective clients, through the individualization of positions and collateral of all clients.

Sole Paragraph. Central counterparties must make public any legal and operational obstacles to the individualization of positions and collateral of clients of the same participant, specifying the categories of clients whose positions or collateral cannot be or are not viable to individualize.

Art. 132. Central counterparties must adopt rules and procedures that enable the timely portability of client positions and collateral, under a given participant, to other participants.

§ 1º The regulation of central counterparties may provide for the compulsory transfer of client positions and collateral of a defaulting participant or one subject to an intervention or resolution regime, to other participants chosen by them.

§ 2º Central counterparties must make public any legal and operational obstacles to the portability of positions and collateral, specifying which positions or collateral and of which clients cannot be or are not viable to transfer.

Section VIII

Credit and Liquidity Risks

Subsection I

General Aspects

Art. 133. Clearinghouses and clearing and settlement service providers must, regarding participants of the clearing systems they operate:

I - provide sufficient and timely information for the management of credit and liquidity risks to which they are exposed;

II - establish operational limits in deferred net value clearing systems to mitigate the consequences of settlement failures; and

III - stipulate sanctions, including monetary, for settlement failures.

Art. 134. The provisions of Subsections II to V of this Section apply only to clearinghouses and clearing and settlement service providers that operate clearing systems considered systemically important.

§ 1º The Central Bank of Brazil, in a case-by-case examination and considering the safety and efficiency of the clearinghouse or clearing and settlement service provider, as well as the promotion of solidity and normal functioning of the National Financial System and the Brazilian Payments System, may determine the observance of mechanisms aimed at mitigating credit and liquidity risks by the clearinghouse or clearing and settlement service provider operating a fund transfer clearing system not considered systemically important.

§ 2º If the hypothesis of § 1º is verified, the Central Bank of Brazil will notify the clearinghouse or clearing and settlement service provider, informing which requirements must be observed by the clearing system and determining that necessary adjustments be made within 180 (one hundred and eighty) days.

Subsection II

Credit Risk

Art. 135. Clearinghouses and clearing and settlement service providers that incur credit risk due to the operation of clearing systems must:

I - have adequate structure to manage their credit exposures to participants of the clearing systems and credit risks resulting from the settlement process of operations;

II - identify sources of credit risk;

III - measure and monitor their credit exposures regularly;

IV - have adequate tools to mitigate the credit risk to which they are exposed; and

V - cover, with a high degree of confidence, their exposure to the credit risk of each participant, through collateral.

Art. 136. Clearinghouses and clearing and settlement service providers must, for each deferred net value clearing system they operate in which there is no settlement guarantee, but in which participants face credit exposures arising from their settlement processes, have sufficient resources to, at a minimum, cover the scenario of joint default of the 2 (two) participants who, together with their economic group, result in the greatest credit exposure for the clearinghouse or clearing and settlement service provider.

Sole Paragraph. If they have dedicated own resources for the purpose described in the caput, clearinghouses and clearing and settlement service providers must control these resources in internal accounting sub-accounts.

Art. 137. Without prejudice to the provisions of Art. 135, central counterparties must, for each clearing system in which they act as counterparty, have sufficient resources to cover various stress scenarios that include, at a minimum, the joint default of the 2 (two) participants who, together with their economic group, result in the greatest credit exposure for the central counterparty, under extreme but plausible market conditions.

§ 1º The Central Bank of Brazil may, upon a reasoned request from the central counterparty, authorize the reduction of the minimum requirement referred to in the caput for covering the participant default scenario that, together with its economic group, results in the greatest credit exposure for the central counterparty, under extreme but plausible market conditions.

§ 2º The request referred to in § 1º may only be formulated for clearing systems that are not systemically important in more than one jurisdiction and do not settle obligations arising from:

I - financial asset lending;

II - securities lending;

III - credit derivatives operations; and

IV - operations with complex financial assets and securities.

§ 3º Central counterparties must control in internal accounting sub-accounts the applications related to own resources dedicated for the purpose described in the caput.

Art. 138. Clearinghouses and clearing and settlement service providers must specify mechanisms and procedures for loss allocation, as well as possess a safeguard replenishment plan in the event of a credit event resulting in the use of these resources.

Sole Paragraph. The plan referred to in the caput must have, at a minimum, the objective of complying with the provisions of Art. 136 or Art. 137, as applicable.

Subsection III

Collateral and Margins

Art. 139. For the purposes of managing credit and liquidity risks, clearinghouses and clearing and settlement service providers must require participants of the clearing systems to provide real collateral with low credit, liquidity, and market risks, which are:

I - sufficient to cover the obligations to which they relate; and

II - taken with conservative haircuts relative to market prices, in order to avoid pro-cyclical adjustments.

§ 1º The Central Bank of Brazil may, upon a reasoned request addressed to it, authorize clearinghouses and clearing and settlement service providers to accept the provision of personal guarantees, such as surety bonds, issued by banking financial institutions, provided that:

I - they are not issued as collateral for positions of another banking financial institution;

II - they are issued by solvent institutions, whose capacity to honor the guarantee is evaluated based on objective criteria;

III - they are subject to limits per issuer and per participant supported by credit and liquidity risk management mechanisms;

IV - they are not subject to significant risk of unfavorable correlation;

V - they are irrevocable and unconditional, and their issuer cannot invoke any legal or contractual exception or safeguard to oppose their payment; and

VI - they can be honored, upon request, within the settlement period of the defaulting participant’s portfolio, without any legal, regulatory, or operational limitation.

§ 2º The provision of item I of § 1º does not prevent banking financial institutions from using personal guarantees issued in favor of their clients, for the purposes of default treatment, in accordance with the clearing system’s regulation.

Art. 140. Clearinghouses and clearing and settlement service providers may accept the provision of collateral abroad by non-resident investors, provided that their total amount, considering the haircuts referred to in Art. 139, does not exceed 8% (eight percent) of the total collateral required by the clearing system.

Art. 140. Clearinghouses and settlement service providers may accept the provision of guarantees abroad, provided that their total amount, considering the haircuts referred to in Article 139, does not exceed 8% (eight percent) of the total guarantees required by the settlement system. (Amended by Central Bank Resolution No. 469, of 4/30/2025.)

§ 1º The settlement system regulation must provide an operational routine to ensure compliance with the limit referred to in the caput, including its restoration in case of extraordinary exceedance, through a passive increase in participation percentage.

§ 2º The limit referred to in the caput does not apply to foreign guarantees intended to secure obligations denominated in foreign currencies settled by settlement systems.

Art. 141. Clearinghouses and settlement service providers must mitigate risks associated with foreign guarantees, ensuring a high degree of confidence regarding their timely execution in all jurisdictions where they must or may produce effects, which may be achieved by:

I - authorization for operation or recognition by competent foreign authorities, which, in the judgment of the Central Bank of Brazil, confers legal efficacy equivalent to that of Articles 6 and 7 of Law No. 10,214, of March 27, 2001, with regard to participants' obligations and the executability of the provided guarantees; or

II - formalization of a contractual instrument that, in the judgment of the Central Bank of Brazil, confers legal efficacy equivalent to that of agreements for the clearing and settlement of obligations within the National Financial System, admitted by Article 30 of Provisional Measure No. 2.192-70, of August 24, 2001, and that describes the circumstances implying early maturity, as well as the methodology for calculating, clearing, and settling obligations.

§ 1º For the purposes of the evaluation referred to in this article, it is admitted that competent authorities to declare the intervention and resolution of participants may suspend, for up to 2 (two) business days, the efficacy of the provisions that offer enforceability to the guarantee.

§ 2º The credit and liquidity risk management structure of clearinghouses and settlement service providers must consider the possibility of the temporary suspension of rights referred to in § 1º of this article.

Art. 142. Clearinghouses and settlement service providers must avoid the concentration of guarantees, establishing total limits and per-participant limits based on issuers and types of instruments accepted as guarantees.

Art. 143. Clearinghouses and settlement service providers must not accept guarantees that:

I - are subject to significant risks of unfavorable correlation, unless this risk has been adequately attenuated by the applied haircuts; or

II - have been issued by the participant providing the guarantee or by a legal entity of the same economic group.

Sole Paragraph. Clearinghouses and settlement service providers may accept bank guarantees to cover their exposures to non-bank institutions, provided that they take bank guarantees into account when calculating their exposure to banks that perform multiple functions, such as participants, liquidity providers, and issuers of financial assets and securities accepted as guarantees.

Art. 144. Clearinghouses and settlement service providers must use effective and flexible guarantee management systems.

Art. 145. Central counterparties must establish margin models that:

I - are based on the risks of the products, portfolios, and markets relevant to the settlement system;

II - use market prices obtained in real time from reliable sources or estimated based on consistent and verifiable methodologies and procedures;

III - manage margin values sufficient to cover losses resulting from at least 99% (ninety-nine percent) of expected movements related to all exposures within a time horizon adequate for the closing of financial positions, in financial assets, and securities of participants;

IV - use conservative estimates for the hedging or closing time horizon of financial positions, in financial assets, and securities of participants, including under stressed market conditions; and

V - are operationally capable of marking participants' positions to market and performing intraday margin calls.

Sole Paragraph. Margin models may only provide for compensations or reductions of required margins if it is demonstrated that there is significant and reliable correlation of product risks.

Subsection IV

On Liquidity Risk

Art. 146. Clearinghouses and settlement service providers must have an adequate liquidity risk management structure within the settlement systems they operate, with regard to participants, liquidity providers, and national and other jurisdiction settlement institutions.

Sole Paragraph. For the measurement of liquidity risk, the clearinghouse or settlement service provider must have operational and analytical capacity to identify, measure, and monitor, continuously and timely, its flows in all relevant currencies, including, when applicable, access to intraday liquidity lines.

Art. 147. In addition to defining operational limits and defining the minimum degree of liquidity of accepted guarantees, clearinghouses and settlement service providers must mitigate liquidity risk through the establishment of qualified liquid resources in all relevant currencies.

Art. 148. With regard to qualified liquid resources, clearinghouses and settlement service providers:

I - must control in internal accounting sub-accounts the applications related to own resources dedicated for the purpose described in the caput and indicate those responsible for authorizing its use;

II - must diversify the financial institutions providing liquidity lines, especially in the event that these are predominant among qualified liquid resources;

III - must ensure that their providers of qualified liquid resources, such as participants and financial institutions providing liquidity lines, have sufficient information to understand and manage risks related to these resources;

IV - must test access procedures to qualified liquid resources at a minimum annual frequency;

V - may, if they have access to currency swaps and liquidity lines routinely offered by central banks, consider them qualified liquid resources up to the limit of currencies, financial assets, and securities accepted as guarantees by central banks; and

VI - must not consider emergency liquidity lines exceptionally offered by central banks as qualified liquid resources, even if they have access to these resources.

Art. 149. Clearinghouses and settlement service providers must, for each deferred net settlement system they operate in which they do not assume the role of contracting party, have or ensure that their participants have qualified liquid resources in all relevant currencies in sufficient value to timely fulfill payment obligations, with a high degree of confidence and under various stress scenarios that include, at a minimum, the default of the participant who, together with its economic group, generates the largest aggregate payment obligation within the settlement system, under extreme but plausible market conditions.

Sole Paragraph. The provisions of the caput do not apply to obligations with issuer risk.

Art. 150. Central counterparties must, for each settlement system in which they act as a contracting party, have qualified liquid resources sufficient to cover various stress scenarios that contemplate, at a minimum, the joint default of the 2 (two) participants who, together with their economic group, result in the largest payment obligation for the central counterparty, under extreme but plausible market conditions.

§ 1º The Central Bank of Brazil may, upon a reasoned request from the central counterparty, authorize the reduction of the minimum requirement referred to in the caput for covering the scenario of default of the participant who, together with its economic group, results in the largest payment obligation for the central counterparty, under extreme but plausible market conditions.

§ 2º The request referred to in §1º may only be formulated for settlement systems that are not systemically important in more than one jurisdiction and do not settle obligations arising from:

I - financial asset lending;

II - securities lending;

III - credit derivative operations; and

IV - operations with complex financial assets and securities.

Art. 151. Clearinghouses and settlement service providers must establish clear rules and procedures that allow them to perform settlements on the expected date, even in the event of default by one or more of their participants.

§ 1º The rules and procedures referred to in the caput must contemplate, at a minimum, actions aimed at:

I - responding to unexpected liquidity deficits;

II - restoring, in case of use, qualified liquid resources to, at a minimum, comply with the provisions of Article 149 or Article 150, as applicable; and

III - minimizing the risk of revocation of operations or untimely settlement of fund and foreign currency payments.

§ 2º The circumstances for restoring resources involving participants and for revoking operations or untimely settlement of fund and foreign currency payments, referred to in items II and III of § 1º, must be provided for in the settlement system regulation.

Subsection V

On Testing and Validation of Credit and Liquidity Risk Models

Art. 152. Clearinghouses and settlement service providers must, for the settlement systems they operate, periodically review their models, scenarios, and parameters adopted for calculating the credit and liquidity risks to which they are exposed, including, when applicable, calculations related to guarantees, required margins, and the minimum amount of qualified liquid resources, as well as the performance of the following procedures:

I - verification tests a posteriori (backtesting) and stress tests with a minimum daily frequency;

II - sensitivity analyses of margin models and reverse stress tests with a minimum monthly frequency, in the case of central counterparties; and

III - independent validation, with a minimum annual frequency.

§ 1º The detailed results of the procedures described in items I to III of the caput must be reported periodically to the administrators of the clearinghouse or settlement service provider and to the Central Bank of Brazil.

§ 2º The fundamental information related to the risk models referred to in the caput, as well as the assumptions adopted in performing stress tests, must be made public.

§ 3º The sensitivity analysis referred to in item II of the caput must necessarily include the review of parameters and premises that capture a variety of historical and hypothetical conditions, including the most volatile periods experienced by markets relevant to the settlement system and the test of the model's capacity to produce accurate results using real and hypothetical data.

§ 4º Independent validation may be conducted by personnel of the clearinghouse or settlement service provider, provided that they are not the same people, subordinates, or belonging to the same hierarchical chain as those responsible for the development or operation of the validated models.

Section IX

On Special Equity

Art. 153. To comply with the provisions of Article 5 of Law No. 10,214, of 2001, clearinghouses and settlement service providers must link a special equity account for each of the settlement systems they operate that are considered systemically important.

§ 1º The special equity account referred to in the caput must present a minimum value of R$10,000,000.00 (ten million reais) and be constituted exclusively by federal public bonds.

§ 2º The federal public bonds referred to in § 1º must be transferred, in the Special Settlement and Custody System (Selic), to a special equity account linked to each settlement system, remaining blocked for trading.

§ 3º The clearinghouse or settlement service provider must provide immediate reinforcement of special equity whenever, evaluated based on the unit prices used by the Central Bank of Brazil in its repurchase operations, it presents a value lower than the minimum stipulated in § 1º.

§ 4º The earnings from federal public bonds must be incorporated into the special equity account in settlement systems where the clearinghouse or settlement service provider acts as a contracting party.

§ 5º The Central Bank of Brazil may determine a higher minimum special equity, both during the authorization process and during the supervision process, establishing a deadline for its implementation, if it considers that the amount is incompatible with the credit and liquidity risks incurred by the central counterparty due to the operation of settlement systems.

§ 6º The earnings from federal public bonds may be withdrawn from the special equity account in settlement systems where the clearinghouse or settlement service provider does not act as a contracting party, provided that this does not result in a value lower than the minimum stipulated in the caput.

Art. 154. Clearinghouses and settlement service providers may replace the federal public bonds in special equity accounts linked to the systems they operate, provided that the following criteria and procedures are observed:

I - the bonds used to constitute special equity are considered by the respective unit prices used and published daily by the Central Bank of Brazil in its repurchase operations and are transferred, in Selic, to the existing special equity account;

II - the bonds used remain unavailable, may be replaced by others whose financial value, on the date of substitution, calculated in the manner of item I, is, at a minimum, equivalent to that of the originally linked bonds;

III - the value of the bonds used, calculated in the manner of item I, corresponds daily to, at a minimum, 100% (one hundred percent) of the required special equity; and

IV - the substitution is made until the business day prior to the maturity of the bonds, observing the operational rules of the Selic Regulation.

Sole Paragraph. In the event of redemption of bonds from the special equity account, the Central Bank of Brazil will only approve the transfer of resources to the indicated settlement bank after proof of linkage of new bonds, whose financial value is equivalent, at a minimum, to that of the redeemed bonds, except for the circumstances provided for in Articles 155 and 156.

Art. 155. The resources of the special equity linked to a settlement system will be released:

I - in the amount exceeding R$10,000,000.00 (ten million reais), in settlement systems where the clearinghouse or settlement service provider does not act as a contracting party, upon request by the clearinghouse or settlement service provider;

II - in full, in case the settlement system ceases to be considered systemically important; or

III - in full, in case the activities of the settlement system are terminated by request of the clearinghouse or settlement service provider or by determination of the Central Bank of Brazil.

Sole Paragraph. In the event that the termination of the settlement system's activities is due to the migration of operations conducted by it to another settlement system operated by the same clearinghouse or settlement service provider, its special equity must be incorporated into the special equity of the other settlement system.

Art. 156. The resources of the special equity of a settlement system may be used exclusively to fulfill obligations assumed by the clearinghouse or settlement service provider within the own settlement system only after the exhaustion of the system's safeguard structure resulting in the need for own resources of the clearinghouse or settlement service provider.

Sole Paragraph.
In the circumstance referred to in the caput, the clearinghouse or settlement service provider must submit a reasoned request to the Central Bank of Brazil, accompanied by a resource restoration plan for the resources it intends to use or a plan for terminating the activities of the settlement system.

CHAPTER V

ON CENTRALIZED DEPOSIT SYSTEMS

Art. 157. The centralized deposit system referred to in item LIV of Article 2º:

I - performs the centralized deposit activity referred to in item XIII of Article 2º;

II - may perform the activity of creating, altering, and dissolving encumbrances and liens on deposited financial assets; and

III - is operated by a central depository.

Art. 158. The centralized deposit system must have adequate rules, procedures, and controls, including robust accounting practices, to safeguard the rights of issuers and holders of securities, avoiding their unauthorized creation and elimination.

Sole Paragraph. Without prejudice to the provisions of the caput, the centralized deposit system:

I - must not allow transfers on overdraft or debtor balances in its securities accounts;

II - must maintain securities in immobilized or dematerialized form so that the transfer is book-entry;

III - must consider offering incentives for the immobilization and dematerialization of securities whenever possible;

IV - must protect the assets deposited therein against custody risk through adequate rules and procedures consistent with current regulation; and

V - must identify, measure, monitor, and manage risks arising from other activities it may perform, including the use of additional tools, if necessary, to address such risks.

Art. 159. The transfer of fiduciary ownership of the financial asset to the central depository is performed:

I - by including the financial assets in the centralized deposit system, when they are book-entry; or

II - by the specific transfer mechanisms of each financial asset, according to its nature and terms of the centralized deposit system regulation, when issued in non-book-entry form.

§ 1º When it concerns the constitutive registration of the issuance of financial assets performed in the centralized deposit system, the registration itself is equivalent to the transfer of fiduciary ownership to the central depository.

§ 2º In the circumstance of item I of the caput, when it does not concern the constitutive registration of the issuance of a financial asset performed in the centralized deposit system, its inclusion in this system depends on the prior registration of the transfer in the issuer's books or systems.

Art. 160. The centralized deposit system must adopt daily reconciliation procedures so that the total financial assets deposited in the centralized deposit and the financial asset positions maintained in custody accounts faithfully reflect the respective information maintained in each participant's controls.

Sole Paragraph. The level of detail of the reconciliation referred to in the caput must:

I - be compatible with the purpose of the stored information; and

II - cover, at a minimum, information on the quantity and types of financial assets, as well as on encumbrances and liens eventually constituted.

Art. 161. The centralized deposit system must maintain an account structure that allows the identification of the end customer, when required by relevant regulation or at the discretion of the direct participant providing service to the end customer.

§ 1º In the event of non-identification of the end customer, the centralized deposit system's account structure must segregate the direct participant's position from that of its clients.

§ 2º In the event of identification of the end customer, the centralized deposit system must provide means that allow the end customer to access the balances and statements of their account, which must contain, at a minimum, initial position, movement, and final position.

Art. 162. The creation, alteration, and dissolution of encumbrances and liens on deposited financial assets may only be performed by the central depository, through a centralized deposit system, which must adopt procedures aimed at:

I - ensuring the uniqueness of the financial asset and the continuity of information on encumbrances and liens constituted on these financial assets;

II - generating the information necessary for the exercise of the right of sequence by the beneficiaries of the encumbrances and liens, including other IOSMF; and

III - controlling access to information on encumbrances and liens constituted within the IOSMF, observing the provisions of applicable legislation, allowing the issuance of a certificate in favor of potential interested parties.

Art. 163. The encumbrance or lien on a financial asset deposited is constituted at the moment the command is accepted by the central depository, in accordance with its regulation.

§ 1º The command referred to in the caput must be instructed or confirmed by a participant of the central depository:

I - in its own name, if it is the owner of the deposited financial asset; or

II - in the name of the owner of the deposited financial asset.

§ 2º The regulation of the centralized deposit system must specify the conditions for the creation of encumbrances and liens referred to in item II of § 1º.

Art. 164. Centralized deposit systems that possess interoperability mechanisms must monitor, measure, and manage credit and liquidity risks that may be transmitted from one system to another through these mechanisms.

§ 1º Temporary transfers of financial assets between centralized deposit systems are prohibited.

§ 2º The investor centralized depository system shall only interoperate with an issuer centralized depository system if the agreement executed between them provides a high level of protection for the rights of the participants of the investor centralized depository system.

§ 3º The investor centralized depository system that uses an intermediary to interoperate with an issuer centralized depository system must measure, monitor, and manage the additional risks, including custody, credit, legal, and operational risks, arising from the use of the intermediary.

CHAPTER VI

OF THE REGISTRATION SYSTEMS

Art. 165. The registration system referred to in item LXIV of art. 2º:

I - exercises the registration activity referred to in item XXXVIII of art. 2º;

II - may carry out the activity of constituting, altering, and dissolving liens and encumbrances on registered financial assets; and

III - is operated by a registrar entity.

Sole paragraph. The information stored by the registration system includes those related to the issuance of financial assets carried out outside the central depository environment, whose validity is conditioned by law or regulation to the registration.

Art. 166. The registration system must adopt reconciliation procedures, at least monthly, of the information on registered financial assets with respect to the information maintained by the participant who brought the financial asset to registration, except for requirements of a shorter period provided for in specific regulation.

Sole paragraph. The level of detail of the reconciliation referred to in the caput must:

I - be compatible with the purpose of the stored information; and

II - cover, at a minimum, information on the quantity and types of financial assets, as well as on liens and encumbrances eventually constituted.

Art. 167. The constitution, alteration, and dissolution of liens and encumbrances on registered financial assets may only be carried out by the registrar entity, through a registration system, in which the financial assets are registered, which must adopt procedures aimed at:

I - ensuring the uniqueness of the registration of the financial asset to be registered and the continuity of information on liens and encumbrances constituted on these financial assets;

II - generating the necessary information for the exercise of the right of pursuit by the beneficiaries of the liens and encumbrances, including other FMI; and

III - controlling access to information on liens and encumbrances constituted within the entity, observing the provisions of applicable legislation, allowing the issuance of a certificate in favor of potential interested parties.

§ 1º For the constitution of liens and encumbrances, the registration system must establish procedures so that the participant who brought the financial asset to registration demonstrates that it holds control of its ownership.

§ 2º In cases where the authorization to exercise the registration activity for a certain type of financial asset has been granted to at least one FMI, the constitution of liens and encumbrances on that type of financial asset by another FMI is conditioned upon the demonstration, before the Central Bank of Brazil, that adequate interoperability mechanisms have been implemented with all registration systems that register that type of financial asset.

§ 3º The interoperability mechanisms referred to in § 2º must guarantee, through compatible rules, procedures, and technologies:

I - the verification of the uniqueness of the registration of the financial asset to be registered among all registration systems offering the registration of that type of financial asset;

II - the portability of the registration of financial assets among all registration systems offering the registration of that type of financial asset; and

III - the exchange of other necessary information for the fulfillment of their obligations towards participants, provided for in specific regulation of each financial asset.

§ 4º The provisions of § 2º do not apply in cases where the registered financial asset represents a payment obligation of the financial institution that brought the financial asset to registration, observing the specific regulation of each financial asset.

Art. 168. The lien or encumbrance on a registered financial asset is constituted at the moment the command is accepted by the registration system, in accordance with its regulations.

§ 1º The command referred to in the caput must be instructed or confirmed by a participant of the registrar entity:

I - in its own name, if it is the owner of the registered financial asset; or

II - in the name of the owner of the registered financial asset.

§ 2º The regulations of the registration system must specify the conditions for the constitution of liens and encumbrances referred to in item II of § 1º.

Art. 169. The registrar entity must notify the participant who holds control of the ownership of the financial asset of the constitution, alteration, or dissolution of the lien or encumbrance, if this participant was not responsible for the command referred to in art. 168.

§ 1º The notification referred to in the caput must occur on the day of the command referred to in art. 168.

§ 2º If inconsistencies are identified between the information of the participant who holds control of the ownership of the financial asset and the information stored by the registrar entity regarding the liens and encumbrances constituted, the registrar entity must immediately communicate this to the owner of the financial asset and to the beneficiary of the lien or encumbrance, or their representatives, so that they adopt the appropriate measures.

Art. 170. The provisions of this Regulation that refer to procedures related to the constitution, alteration, and dissolution of liens and encumbrances on financial assets, treated in item II of art. 165, in item VI of art. 105, in art. 168, and in art. 169, do not apply to financial assets registered exclusively for the purpose of complying with Resolution No. 4,088, of May 24, 2012.

Art. 171. The registrar entity must treat the additional operational risks related to its interoperability mechanisms to ensure the scalability and reliability of information technology and related resources.

Art. 172. Registrar entities that interoperate with other registrar entities must implement the interoperability mechanisms referred to in § 2º of art. 167 based on the following principles:

I - promotion of competition among registration systems and among their participants;

II - efficiency and effectiveness in the exchange of information, as per item III of § 3º of art. 167;

III - technological and business rule standardization that enables compliance with regulatory provisions and serves as a basis for the harmonization of processes and information; and

IV - transparency, security, privacy, and confidentiality of information transmitted between registration systems.

Art. 173. Registrar entities authorized to register a certain financial asset must establish a common structure, responsible for the governance of the interoperability mechanisms referred to in § 2º of art. 167.

§ 1º The structure referred to in the caput shall be organized and established by the registrar entities that interoperate and must be provided for in the convention or formal agreement executed between these entities, to regulate aspects of the registration of the corresponding financial asset, in accordance with the regulation of the Central Bank of Brazil.

§ 2º The interoperability governance structure referred to in the caput shall be responsible, among other matters, for:

I - resolution of omissions, divergences, conflicts, and disputes between registrar entities, arising from interoperability between registration systems;

II - standardization of triggering events for billing and definition of the interoperability tariff structure;

III - execution of monitoring regarding compliance with the rules and procedures established in the regulation and in the formal agreements and conventions in force within the scope of interoperability;

IV - application of penalties to registrar entities according to clauses established in formal agreements and conventions in force within the scope of interoperability;

V - contracting of services necessary for the operationalization of interoperability;

VI - management and monitoring of risks inherent to interoperability;

VII - management of disputes, occurrences, and incidents related to interoperability mechanisms;

VIII - management and monitoring of interoperability mechanisms, adopting all necessary procedures to ensure the timeliness of sending information to the Central Bank of Brazil and to registration systems regarding relevant facts that may impact the normal functioning of interoperability mechanisms;

IX - proposal and monitoring of homologation tests for participating registrar entities or those wishing to participate in interoperability;

X - observance and establishment of curation procedures for cases where information exchange is implemented through shared management databases; and

XI - standardization of aspects related to interoperability.

§ 3º The structure responsible for interoperability governance must possess:

I - internal regulations, providing, among other things, for the form of internal organization, the functioning of its deliberative bodies, and decision-making;

II - a system for funding activities;

III - a policy for admission and remuneration of members of statutory bodies; and

IV - mechanisms to mitigate conflicts of interest among its members, among registration entities, and among participants of registration entities, according to clauses established in formal agreements and conventions in force within the scope of interoperability.

§ 4º The interoperability governance structure referred to in the caput must establish rules, procedures, and technologies that allow its action in the governance of interoperability mechanisms intended for other financial assets.

§ 5º The incident management procedures treated in item VII of § 2º must provide for:

I - criteria for classification and prioritization of incidents;

II - establishment of service level agreements to be observed in the treatment of incidents by the different parties involved; and

III - the adequate recording of incidents and the identification of lessons learned with the objective of mitigating the future occurrence of incidents of the same nature.

§ 6º The curation procedures treated in item X of § 2º must include:

I - the definition of domain dictionaries related to stored information;

II - the definition of information quality parameters to be observed by registrar entities and of audit requirements for curation procedures to be implemented;

III - the procedures for inclusion, exclusion, or alteration of large volumes of information; and

IV - the definition of recurring reports for verification of the integrity and quality of stored information.

TITLE VI

OF SUPERVISION

Art. 174. FMIs are supervised by the Central Bank of Brazil based on the norms applicable to the Brazilian Payments System.

§ 1º Without prejudice to the legal and regulatory norms applicable within the scope of the Brazilian Payments System, the Central Bank of Brazil will observe the Principles for Financial Market Infrastructures (PFMI), originally published by the Committee on Payment and Settlement Systems of the Bank for International Settlements (CPSS/BIS) and by the Technical Committee of the International Organization of Securities Commissions (TC/IOSCO), applicable to the activities exercised by FMIs through the FMIs they operate.

§ 2º The Central Bank of Brazil will publish the Principles for Financial Market Infrastructures applicable to each FMI under its supervision.

Art. 175. FMIs that hire third parties to carry out important stages of the services of clearing and settlement of obligations, as well as of centralized deposit and registration of financial assets, must include in their respective contracts the permission for access by the Central Bank of Brazil to the premises of these third parties, to the contracts and agreements executed for the provision of services, to the documentation and information regarding the services provided, to the stored data and information about their processing, to the backups of data and information, as well as to the access codes to the data and information.

Art. 176. FMIs must guarantee the Central Bank of Brazil full access to information, related to services provided within the scope of an FMI, held by both the FMI and by third parties hired by it.

§ 1º FMIs must structure a communication process to the Central Bank of Brazil that ensures timeliness and effectiveness in the provision of the information referred to in the caput.

§ 2º FMIs must immediately communicate to the Central Bank of Brazil any occurrences that may prevent or delay the normal functioning of the FMIs they operate.

§ 3º The third parties referred to in the caput include, among others, other FMIs and service and input providers, even within the same conglomerate.

§ 4º The Central Bank of Brazil may request from FMIs the establishment of a process for the regular sending of information.

Art. 177. FMIs must supervise, directly or indirectly, the acts practiced by participants in their FMIs, including the insertion of information, with a view to ensuring full adherence to the rules established in the system regulations.

Sole paragraph. In the exercise of this assignment, FMIs must establish measures to remedy the infractions observed and, in the cases and in the manner previously specified in the FMI regulations, apply penalties to offending participants.

Art. 178. FMIs must establish mechanisms to identify and report to the Central Bank of Brazil operations outside the market standard carried out by institutions authorized to operate by the Central Bank of Brazil or with financial assets under their sphere of competence.

Art. 179. The Central Bank of Brazil may:

I - determine the adoption of additional controls in cases where inadequacy of controls implemented by the institution is found; and

II - impose more restrictive operational limits on the institution that fails to observe determination in accordance with item I within the period established for such.

Art. 180. In order to ensure compliance with this Regulation, the Central Bank of Brazil may, at any time, determine that the FMI promotes changes in its structure, in the FMIs and their regulations.

Art. 181. Changes not subject to authorization by the Central Bank of Brazil must be previously informed to it before their entry into force.

TITLE VII

OF TRANSITIONAL PROVISIONS

Art. 182. In cases where, on the date of publication of this Regulation, there is more than one system in operation registering a certain type of financial asset, the offer of services for the constitution of liens and encumbrances on that type of financial asset is conditioned upon the demonstration, before the Central Bank of Brazil, by each of the entities operating the registration systems in question, individually or jointly, that adequate interoperability mechanisms have been implemented in all registration systems offering the registration of that type of financial asset.

Sole paragraph. The provisions of the caput do not prejudice the activity of registration of financial assets, which may continue to be exercised by the registrar entities authorized while the interoperability mechanisms referred to therein are not implemented.