BCB Resolution No. 342 — Amends the Pix Operating Regulations to Mandate Security Incident Notification to Account Holders and Updates the Pix Penalty Manual

BCB Resolution No. 342, OF SEPTEMBER 26, 2023

Amends the Regulation annexed to BCB Resolution No. 1, of August 12, 2020, which governs the operation of the Pix payment arrangement, to provide for the notification to holders of the occurrence of a security incident involving personal data, and amends Annexes I and II to BCB Resolution No. 177, of December 22, 2021 (Pix Penalty Manual), to provide for non-compliance with Pix technical security requirements and for the criteria for applying penalties.

The Collegiate Board of the Central Bank of Brazil, in a session held on September 26, 2023, based on art. 10, item IV, of Law No. 4.595, of December 31, 1964, art. 10 of Law No. 10.214, of March 27, 2001, arts. 6, 7, 9, 10, 14 and 15 of Law No. 12.865, of October 9, 2013, Resolution No. 4.282, of November 4, 2013, Communication No. 32.927, of December 21, 2018, and Communication No. 34.085, of August 28, 2019,

R E S O L V E:

Art. 1 The Regulation annexed to BCB Resolution No. 1, of August 12, 2020 (Pix Regulation), shall enter into force with the following amendments:

“Art. 32. ..........................................................................................................

.........................................................................................................................

VI - provide non-discriminatory treatment for the different Pix participants with whom they establish a relationship for the provision of the service, in terms of service quality and price;

VII - use the information linked to Pix keys for Pix security purposes, as referred to in §§ 1 and 2 of art. 59, as one of the factors to be considered for the purpose of authorizing and rejecting transactions within the scope of Pix; and

VIII - notify the holders of transactional accounts provided by the participant who are natural persons of the occurrence of a security incident involving personal data related to a database associated with a component or infrastructure of Pix, even if the participant providing the account is not responsible for the incident and even if the security incident cannot result in relevant risk or damage to the holders, as defined by the Central Bank of Brazil in a specific document.

Sole Paragraph. The Central Bank of Brazil shall establish in a specific document the operational procedures relating to the notification referred to in item VIII of the main text.” (NR)

Art. 2 Annex I to BCB Resolution No. 177, of December 22, 2021 (Pix Penalty Manual), shall enter into force with the following amendments:

“Art. 5 ............................................................................................................

I - ......................................................................................................................

.........................................................................................................................

e) fail to ensure the correct performance of the third party with a view to ensuring the security, efficiency, reliability, integrity, confidentiality and quality of the payment service, as referred to in item VII of § 2 and item IV of § 5, both of art. 116 of the Pix Regulation;

f) fail to meet Pix technical security requirements, subject to the provisions of items II and III;

II - .....................................................................................................................

.........................................................................................................................

c) fail to meet Pix technical security requirements, resulting in a security incident with the following repercussions:

1. compromise, even if partial, of the execution of Pix transactions involving its end users; or

2. compromise of the confidentiality, integrity or availability of information linked to Pix keys, Pix transactions or Pix end users, except for events whose consequences are limited to the exposure of information that may be made available under the conditions set out in the Pix Regulation;

.........................................................................................................................

III - ....................................................................................................................

.........................................................................................................................

b) fail to meet Pix technical security requirements, resulting in a security incident with the following repercussions:

1. compromise, even if partial, of the operation of Pix components or infrastructures; or

2. theft of funds from a transactional account of an end user;

.........................................................................................................................

§ 2 The base value attributable to the offense shall be multiplied by the result of the sum of the weighting factors provided for in Tables 1, 2 and 3 of Annex II, which are based, respectively, on the type of institution, on the percentage of the total Pix transactions processed by the participant in the Instant Payment System (SPI) and on the percentage of the total Pix keys potentially compromised in a security incident.

................................................................................................................”
(NR)

“Art. 6 ............................................................................................................

.........................................................................................................................

II - if total or partial non-compliance with the notification referred to in art. 91-B of the Pix Regulation is verified, including with regard to the ineffectiveness of the measures referred to in items I and II of § 1 of the same article;

III - the participant fails to act promptly to cease or mitigate events that compromise Pix security;

IV - the participant fails to prove that it adopted measures to restore service availability as quickly as possible, in cases where such availability is affected;

V - if the confidentiality of data evidencing the financial, tax or asset situation of end users is compromised; or

VI - if the confidentiality of data used for security purposes is compromised.

................................................................................................................”
(NR)

Art. 3 Annex II to BCB Resolution No. 177, of 2021, shall enter into force with the following amendments:

“WEIGHTING FACTORS FOR FINE CALCULATION

Table 1 – Weighting factor by type of institution

Type of institution	Weighting Factor
Multiple Bank, Commercial Bank, Investment Bank, Exchange Bank and Savings Bank that are part of a prudential conglomerate classified in Segment 1 (S1), in accordance with Resolution No. 4.553, of January 30, 2017	25
Multiple Bank, Commercial Bank, Investment Bank, Exchange Bank, Development Bank and Savings Bank, except institutions that are part of a prudential conglomerate classified in Segment 1 (S1), in accordance with Resolution No. 4.553, of 2017	5
Authorized Payment Institution	3
Leasing Company and Savings and Loan Association	3
Central Credit Cooperative and Credit Confederation	2
Credit, Financing and Investment Company and Singular Credit Cooperative	2
Direct Credit Company and Peer-to-Peer Lending Company	2
Unauthorized Payment Institution	0.5
Others	0.5

Table 2 – Percentage of total Pix transactions paid and received in the Instant Payment System (SPI) during the period comprising the 3 (three) base dates prior to the infraction of the penalty

Percentage of total Pix transactions paid and received in SPI	Weighting factor
> 5%	25
<= 5% to 3%	5
<= 3% to 1%	3
<= 1% to 0.5%	2
<= 0.5%	0.5

Table 3 – Percentage of total Pix keys potentially compromised in security incidents relative to the total Pix keys registered in the DICT on the date of cessation of the event

Percentage of total Pix keys potentially compromised	Weighting factor
> 0.5%	25
<= 0.5% to 0.3%	5
<= 0.3% to 0.1%	3
<= 0.1% to 0.05%	2
<= 0.05%	0.5
= 0	0

” (NR)

Art. 4 This Resolution enters into force on the date of its publication.

Renato Dias de Brito Gomes

Director of Organization of the Financial System and Resolution