BCB Resolution No. 338 — Establishes Procedures for Public Entities to Access Data Linked to Pix Keys Stored in the Transactional Account Identifiers Directory (DICT) and Publishes Regulation for Interested Parties' Adhesion

BCB Resolution No. 338

BCB RESOLUTION NO. 338,
OF AUGUST 23, 2023

Establishes procedures for access by public entities to data linked to Pix keys stored in the Transactional Account Identifiers Directory (DICT) and publishes Regulation for adhesion by interested parties.

The Collegiate Board of Directors of the Central Bank of Brazil, in a session held on August 22, 2023, based on art. 17-B of Law No. 9,613, of March 3, 1998, and Decree No. 10,046, of October 9, 2019, and in view of art. 45 of the Regulation annexed to BCB Resolution No. 1, of August 12, 2020, as well as art. 31 of Law No. 12,527, of November 18, 2011, and Law No. 13,709, of August 14, 2018,

R E S O L V E:

Art. 1st. A procedure is established for access by public entities to the Transactional Account Identifiers Directory (DICT), observing the eligibility criteria and the hypotheses provided for by law.

Art. 2nd. Direct access to DICT information will observe the rules and conditions established in the Regulation published in Annex I of this Resolution and may only be granted to public entities with legal attributions for criminal prosecution, control, or investigation of irregularities in which the data holder is involved.

§ 1st. Adhesion to the Regulation referred to in the caput is a mandatory condition for interested public entities to access the DICT.

§ 2nd. Adhesion of other public entities to the Regulation referred to in the caput may be admitted, provided that access to the DICT is compatible with their legal attributions, according to an assessment by the Office of the Attorney General of the Central Bank (PGBC), and considered viable by the DICT custodian unit within the Central Bank of Brazil.

Art. 3rd. Access by the public entity to DICT information must be requested through the presentation of an official letter, accompanied by the standard DICT access request form and an adhesion term, observing the models published in Annexes II and III of this Resolution, in which the interested party assumes the commitment to observe the Regulation referred to in art. 2nd and the responsibility for any violation of its rules.

§ 1st. The documents referred to in the caput must be signed by a public agent authorized to assume a commitment on behalf of the interested entity, upon proof of this condition and competence.

§ 2nd. In the request referred to in the caput, the public entity must demonstrate the usefulness or necessity of access to the DICT for the performance of its legal attributions and indicate the normative basis that authorizes it to treat the confidential information contained therein.

Art. 4th. The Central Bank of Brazil will evaluate the requests presented in the manner of art. 3rd, and may deny them when it does not verify compliance with the legal and regulatory requirements for direct access to the DICT or when there is any other obstacle of a legal or operational nature.

Art. 5th. DICT information obtained in the manner of this Resolution must be used exclusively for the purpose of investigating irregularities in which the data holder is involved, when there is the interested party's consent or when another legal authorizing hypothesis is present, with adhering public entities to the Regulation referred to in art. 2nd being obliged to ensure due treatment of the obtained information, preserving any confidentiality that may apply.

Art. 6th. This Resolution enters into force on September 1, 2023.

Maurício Costa de Moura Renato Dias de Brito Gomes Director of Relationship, Director of System Organization Citizenship and Conduct Supervision Financial and Resolution

ANNEX I TO BCB RESOLUTION NO. 338, OF AUGUST 23, 2023

REGULATION FOR
ACCESS TO THE TRANSACTIONAL ACCOUNT IDENTIFIERS DIRECTORY (DICT)

Regulates access to the Transactional Account Identifiers Directory (DICT).

CHAPTER I
OF THE OBJECT

Art. 1st. This Regulation establishes rules for direct access, by public entities, in the exercise of their legal attributions, to the information contained in the Transactional Account Identifiers Directory (DICT), managed by the Central Bank of Brazil.

Art. 2nd. The consultation to the DICT allows the identification of information linked to the holder of transactional accounts maintained in the participants of the Pix payment arrangement or to the Pix key consulted.

Art. 3rd. The public entity, when requesting direct access to the DICT and adhering expressly to this Regulation, declares that it is aware that the responsibility for the accuracy and timeliness of the data contained in the DICT lies with the Pix participants.

CHAPTER II
OF THE METHOD OF ACCESS TO INFORMATION

Art. 4th. Access to the mechanism made available by the Central Bank of Brazil for consulting information contained in the DICT will be done through a service account, after registration carried out by external system access managers (masters) indicated by the adhering entity.

CHAPTER III
OF OBLIGATIONS

Art. 5th. The Central Bank of Brazil commits to adopting the following necessary measures for the execution of this Regulation:

I - make available a mechanism for consulting information contained in the DICT;

II - register, in the Central Bank Information System (Sisbacen), the persons indicated to act as masters by the adhering entity, observing the provisions of the Regulation annexed to Circular No. 3,913, of September 5, 2018, and the other procedures adopted by the Central Bank of Brazil;

III - deliver the password to the master indicated by the adhering entity;

IV - receive as a user of the DICT information consultation mechanism the service account registered by the master of the adhering entity;

V - equip the DICT and other applications used in its operation with the technological resources necessary to maintain security and the adequate treatment of information, in accordance with applicable legislation;

VI - communicate to the adhering entity any changes in the DICT and other applications used in its operation.

Art. 6th. The adhering entity must adopt the following necessary measures for the execution of this Regulation:

I - ensure the proper use of the consultation mechanism made available by the Central Bank of Brazil, observing the right to privacy and the rules of access restriction to information provided for in applicable legislation and other governing norms;

II - indicate, through a document signed by the competent authority, the public agent or administrative component responsible for managing the information referred to in this Regulation, who will be responsible for administration and supervision within the adhering entity;

III - indicate, through a document signed by the competent authority, the names of the masters for accreditation in Sisbacen;

IV - maintain, at least, 2 (two) registered masters, immediately informing the Central Bank of Brazil of the removal of any of them from the function, for the purpose of their de-accreditation in Sisbacen;

V - register, in an internal system of the adhering entity, the persons authorized to consult the DICT, through the service account;

VI - de-register, in an internal system of the adhering entity, the persons no longer authorized to consult the DICT, through the service account;

VII - use information obtained in the DICT exclusively for the purpose stipulated in art. 1st of this Regulation, promoting, for the purposes of administrative or criminal liability, the investigation of occurrences of improper use of the consultation mechanism;

VIII - definitively cease the practice of sending official letters of consultation to the DICT through the Central Bank of Brazil's Digital Protocol;

IX - use its own means (equipment with internet access and communication lines) to access the consultation mechanism offered by the Central Bank of Brazil; and

X - promote adequate collection and storage, preferably in electronic media and with storage on a secure server, of the express consent of the data holder, in the event of access carried out under the terms of art. 31, § 1st, item II, of Law No. 12,527, of November 18, 2011.

§ 1st. The indication referred to in item III of the caput, dispensable if the adhering entity already has masters registered in Sisbacen, must be accompanied by the specific form, duly filled out for this purpose, available on the Central Bank of Brazil's website at this address: https://www.bcb.gov.br/acessoinformacao/sisbacen[.](https://www.bcb.gov.br/?SISBACEN)

§ 2nd. The adhering entity must adopt appropriate cybersecurity practices to prevent attacks on the consultation mechanism provided by the Central Bank of Brazil, as well as on its own interface systems that will integrate with the mentioned mechanism.

§ 3rd. The Central Bank of Brazil may, unilaterally and at any time, without prior notice, suspend access to the consultation mechanism of the adhering entity in order to prevent or mitigate cyber attacks.

CHAPTER IV
OF ADMINISTRATION AND SUPERVISION

Art. 7th. The administration and supervision resulting from this Regulation, within the Central Bank of Brazil, will be the responsibility of the Department of Competition and Financial Market Structure (Decem), as the managing unit of the DICT, and the Department of Institutional Service (Deati), the unit responsible for evaluating the requests presented by adhering entities and verifying compliance with the legal and regulatory requirements for direct access to the DICT.

Art. 8th. Within the adhering entity, this attribution will belong to the person responsible for managing the information referred to in this Regulation.

Art. 9th. The Central Bank of Brazil will supervise the faithful observance of the provisions of this Regulation, without prejudice to the supervision exercised by the adhering entity.

CHAPTER V
OF THE ABSENCE OF FINANCIAL OBLIGATIONS

Art. 10. Adhesion to this Regulation is celebrated free of charge, implying no financial burden or transfer of resources between the Central Bank of Brazil and the adhering entity.

CHAPTER VI
OF VALIDITY

Art. 11. The bond resulting from this Regulation will take effect from the approval, by the Central Bank of Brazil, of the adhesion request submitted by the interested entity and will have indefinite validity.

§ 1st. Adhesion to this Regulation may be revoked at any time, through manifestation of the adhering entity or unilateral decision of the Central Bank of Brazil, previously communicated in writing, with a minimum advance notice of 90 (ninety) days.

§ 2nd. Any denunciation of this Regulation by the adhering entity will not prejudice the execution of services that have been established through a specific instrument, and activities already initiated must be developed regularly until their end, in accordance with the provisions established in this Regulation.

CHAPTER VII
FINAL PROVISIONS

Art. 12. Omitted cases, doubts, or any divergences resulting from the execution of this Regulation will be resolved by the Central Bank of Brazil or by the adhering entity, through consultations and mutual understanding.

§ 1st. Any controversies resulting from adhesion to this Regulation will be submitted to an attempt at conciliation before the Mediation and Conciliation Chamber of the Federal Public Administration, of the Attorney General's Office of the Union, in accordance with art. 37 of Law No. 13,140, of June 26, 2015, art. 11 of Provisional Measure No. 2,180-35, of August 24, 2001, and art. 41, item III, of Annex I to Decree No. 11,328, of January 1, 2023.

§ 2nd. If there is no conciliation in the manner indicated in § 1st, the forum of the Federal Justice, Judicial Section of the Federal District, is elected by force of item I of art. 109 of the Federal Constitution, to resolve issues arising from this Regulation.

Art. 13. Adhesion to this Regulation, as well as any denunciation, must be made exclusively through electronic means.

ANNEX II TO BCB RESOLUTION NO. 338, OF AUGUST 23,
2023

STANDARD REQUEST FOR
ACCESS TO THE DICT

PUBLIC ENTITY IDENTIFICATION

Name:

CNPJ:

Affiliation:

Headquarters address:

Legal representative:

Position:

CPF:

Manifest, on behalf of the public entity identified above, the interest in accessing the information contained in the Transactional Account Identifiers Directory (DICT), judged relevant/necessary for the performance of its institutional attributions, with sufficient legal support to justify the treatment of any confidential information.

[Free field to detail the usefulness or necessity of access to the DICT for the performance of its legal attributions and indicate the normative basis that authorizes it to treat the confidential information contained therein, resulting from the right to intimacy. Alternatively, the detail may be in attached document(s).]

I affirm that the requested access will be carried out in the strict performance of the institutional mission of the public entity identified above, using the obtained information exclusively for the purposes provided for by law.

I indicate the public agent (name, CPF, and position) or administrative component as responsible for managing the information referred to in the Regulation for Access to the DICT, who will be responsible for administration and supervision within the adhering entity.

I inform, finally, that this request is accompanied by an Adhesion Term to the Regulation for Access to the DICT.

Brasília/DF

The date of the document corresponds to the date of signature

Signature

(The document must be signed electronically, with Digital Certificate – ICP Brazil or with gov.br account, Silver or Gold identity.)

ANNEX III TO BCB RESOLUTION NO. 338, OF AUGUST 23,
2023

ADHESION TERM TO
THE REGULATION FOR ACCESS TO THE TRANSACTIONAL ACCOUNT IDENTIFIERS DIRECTORY (DICT)

I, (name of the public agent), registered under CPF No. (CPF number), holding the position of (name of public position), at (adhering public entity), on behalf of which I sign this Term with the Central Bank of Brazil for access to the Transactional Account Identifiers Directory (DICT), in accordance with BCB Resolution No. 338, of August 23, 2023, also observing the provisions (cite legislation that authorizes the adhering public entity to request confidential information).

Through this Term, I manifest full awareness of the clauses established in this instrument, the provisions of the Regulation for Access to the DICT, approved by BCB Resolution No. 338, of 2023, and other applicable norms, which become part of this Term, committing myself, on behalf of the public entity identified above, to their faithful and integral compliance and observance.

I also declare that I am aware of the obligations specified below, committing myself, on behalf of the public entity identified above, to fulfill them faithfully and integrally:

I - ensure the proper use of the consultation mechanism made available by the Central Bank of Brazil, observing the right to privacy and the rules of access restriction to information provided for in applicable legislation;

II - indicate, through a document signed by the competent authority, the public agent or administrative component responsible for managing the information referred to in the Regulation for Access to the DICT, who will be responsible for administration and supervision within the adhering entity;

III - indicate, through a document signed by the competent authority, the names of the masters for accreditation in the Central Bank Information System (Sisbacen);

IV - maintain, at least, 2 (two) registered masters, immediately informing the Central Bank of Brazil of the removal of any of them from the function, for the purpose of their de-accreditation in Sisbacen;

V - register, in an internal system of the adhering entity, the persons authorized to consult the DICT, through the service account;

VI - de-register, in an internal system of the adhering entity, the persons no longer authorized to consult the DICT, through the service account;

VII - use information obtained in the DICT exclusively for the purpose stipulated in the Regulation for Access to the DICT, promoting, for the purposes of administrative or criminal liability, the investigation of occurrences of improper use of the consultation mechanism;

VIII - definitively cease the practice of sending official letters of consultation to the DICT through the Central Bank of Brazil's Digital Protocol;

IX - use its own means (equipment with internet access and communication lines) to access the mechanisms offered by the Central Bank of Brazil; and

X - promote adequate collection and storage, preferably in electronic media and with storage on a secure server, of the express consent of the data holder, in the event of access carried out under the terms of art. 31, § 1st, item II, of Law No. 12,527, of November 18, 2011.

Brasília/DF

The date of the document corresponds to the date of signature

Signature

(The document must be signed electronically, with Digital Certificate – ICP Brazil or with gov.br account, Silver or Gold identity.)