BCB Resolution No. 366 — Publishes the Regulation of the Central Bank Information System (Sisbacen)

BCB RESOLUTION NO. 366, OF JANUARY 17, 2024

Publishes the
Regulation of the Central Bank Information System (Sisbacen).

The Collegiate Board of the Central Bank of Brazil, in a session held on January 17, 2024, based on art. 9 of Law No. 4,595, of December 31, 1964,

R E S O L V E S:

Art. 1. The Regulation of the Central Bank Information System (Sisbacen) is published in the form of the annex to this Resolution.

Art. 2. Legal entities interested in contracting access to Sisbacen and those that have a legal or regulatory obligation to provide information to the Central Bank of Brazil through Sisbacen, or to insert records therein, are exempt from presenting proof of tax regularity with Social Security and with the Time Service Guarantee Fund (FGTS).

Art. 3. The Information Technology Department (Deinf) is authorized to adopt complementary measures aimed at compliance with this Resolution and the Annexed Regulation.

Art. 4. Circular No. 3,913, of September 5, 2018, is revoked.

Art. 5. This Resolution enters into force on February 1, 2024.

RODRIGO ALVES TEIXEIRA

Director of Administration

ANNEXED REGULATION TO BCB RESOLUTION NO. 366, OF JANUARY 17, 2024

Regulates the Central Bank Information System (Sisbacen).

CHAPTER I

ON THE NAME AND PURPOSE

Art. 1. The Central Bank Information System (Sisbacen) is the set of systems and information technology resources of the Central Bank of Brazil for conducting its work processes, in order to:

I - provide the Central Bank of Brazil with information technology instruments to fulfill its institutional mission;

II - facilitate the collection, processing, and dissemination of information of interest to the Central Bank of Brazil; and

III - make available to government bodies and entities, as well as to natural and legal persons, information contained in its databases and of interest to these entities, observing the confidentiality principles that legally involve this information.

Art. 2. Sisbacen is a registered trademark at the National Institute of Industrial Property (INPI), and the Central Bank of Brazil holds all rights over it in accordance with current legislation.

Art. 3. The data and information contained in Sisbacen, whether accessible or not to its users, are the property of the Central Bank of Brazil.

CHAPTER II

ON ADMINISTRATION

Art. 4. The administration of Sisbacen is the responsibility of the Information Technology Department (Deinf) of the Central Bank of Brazil.

Art. 5. It is the responsibility of Deinf, as administrator, to adopt, in accordance with its regimental competence, the procedures necessary for the proper functioning of Sisbacen, especially for:

I - establishing the criteria to be observed in computerized processes for collecting, validating, processing, storing, and querying information requested by the Central Bank of Brazil;

II - disseminating the necessary guidelines regarding the accreditation and use of Sisbacen; and

III - administering the security subsystem and executing the general security management of Sisbacen.

CHAPTER III

ON USERS

Art. 6. Access to the resources offered by Sisbacen will be defined based on the user's category and profile.

Art. 7. The following are the user categories of Sisbacen:

I - corporate: Central Bank of Brazil;

II - governmental: body or entity part of the Federal Public Administration, direct or indirect, including the Legislative and Judicial branches;

III - institutional: institution subject to the regulatory or supervisory action of the Central Bank of Brazil; and

IV - special: natural or legal person who accesses a restricted and limited set of Sisbacen resources.

§ 1. The oversight councils of regulated professions fall under the governmental user category.

§ 2. An institution classified as an institutional user cannot be a governmental user.

§ 3. Entities linked to the National Financial System, such as trade associations and financial market system operating institutions (IOSMF), are equated to institutional users.

§ 4. The institutional, governmental, or special user must maintain a relationship with the regional representation of the Central Bank of Brazil of the jurisdiction of the location of its headquarters.

CHAPTER IV

ON ACCESS MODALITIES

Art. 8. Sisbacen is accessible in the following forms, for non-corporate users:

I - through a service provider connected to Sisbacen, accredited by the Central Bank of Brazil; and

II - via the internet.

Sole paragraph. The costs for connecting to Sisbacen are the exclusive responsibility of the user.

CHAPTER V

ON ACCREDITATION FOR ACCESS AND USE

Art. 9. The registration of institutional and special users for access and use of Sisbacen is conditioned upon the execution of an agreement or a service provision contract.

§ 1. The contracting will proceed through ineligibility for bidding, in accordance with the caput of art. 74 of Law No. 14,133, of April 1, 2021.

§ 2. The special user is exempt from executing a contract if it uses exclusively a Sisbacen service that is not subject to cost reimbursement.

§ 3. The governmental user must use a specific form for access and use of Sisbacen, being exempt from executing an agreement or contract, except for agreements for the use of services with specific rules.

CHAPTER VI

ON SECURITY OF ACCESS TO INFORMATION

Art. 10. The information contained in Sisbacen is covered by the institution of bank secrecy, in accordance with Complementary Law No. 105, of January 10, 2001, and personal data is protected in accordance with Law No. 13,709, of August 14, 2018, receiving the treatment established in these laws, without prejudice to the provisions of other special laws.

Sole paragraph. The Privacy Policy and Terms of Use of the website, applications, and digital services of the Central Bank of Brazil (PPTU) apply to Sisbacen.

Art. 11. Access to Sisbacen by accredited users is based on validation and authentication procedures, using institutional and personal identifiers and individual passwords.

Art. 12. Security for access by accredited users is administered in a decentralized manner, through a specific subsystem, structured in two distinct hierarchical levels:

I - general security management of Sisbacen; and

II - sectoral security management of Sisbacen.

Art. 13. It is the responsibility of the general security manager of Sisbacen to maintain:

I - the set of access groups;

II - the registry of user institutions; and

III - the registry of sectoral security managers of Sisbacen.

Art. 14. The sectoral security manager of Sisbacen at the user institution is responsible for maintaining:

I - the user registry;

II - the accreditation of users in access groups;

III - the registry of alternate sectoral security managers; and

IV - the registry of its branches or subsidiaries.

§ 1. The sectoral security manager mentioned in the caput can only register a user in Sisbacen after the express consent of the person, or their legal representative, who will be registered as a user in Sisbacen for the purposes of Law No. 13,709, of 2018.

§ 2. The user's institution must maintain the record of consent for a minimum period of five years after the date of deregistration from Sisbacen.

§ 3. If requested, the user's consent must be presented by the institution to the Central Bank of Brazil.

Art. 15. The user is responsible for:

I - keeping the confidentiality regarding the data and information to which they may have access, when these have that characteristic; and

II - keeping and protecting the individual password for access to Sisbacen.

Art. 16. The user institution may not impute to the Central Bank of Brazil any type of damage suffered as a result of the actions of its sectoral security manager or its user.

CHAPTER VII

ON COST REIMBURSEMENT

Art. 17. User institutions are subject to reimburse the Central Bank of Brazil for the costs of using Sisbacen, defined in specific regulation established by Deinf.

Sole paragraph. The use of the homologation version of Sisbacen, which is the system testing environment, is exempt from cost reimbursement.

Art. 18. Cost reimbursement will be based on digital traffic or the demanded service.

Art. 19. The governmental user is exempt from reimbursing costs for the use of Sisbacen.

Art. 20. The Central Bank of Brazil may establish exceptions for cost reimbursement for the use of Sisbacen.

Art. 21. The revision of cost reimbursement may be requested by the user institution to verify the correctness of billing and its values.

Art. 22. In cases where the calculated costs result from errors in the use of Sisbacen, the user institution may request a reduction in the amount of reimbursement due to the Central Bank of Brazil.

Sole paragraph: The reduction referred to in the caput:

I - is limited to double the highest amount paid by the institution as reimbursement in the twelve months prior to the revised base date; and

II - will only be granted if its implementation does not, by itself, constitute an imbalance relative to the total reimbursement of Sisbacen on the base date, according to the Central Bank of Brazil's assessment.

Art. 23. Sisbacen user institutions that undergo extrajudicial liquidation proceedings by the Central Bank of Brazil are exempt from cost reimbursement from the date of the declaration of liquidation.

Section I

On Digital Traffic

Art. 24. Cost reimbursement for digital traffic will be made by paying a value corresponding to the quantity of megabytes (MB) transmitted.

Sole paragraph. Digital traffic will be measured in megabytes (MB), disregarding fractions, being equivalent to one million bytes, as defined in the International System of Units.

Section II

On Demanded Service

Art. 25. Cost reimbursement for the demanded service will be made by paying a specific value for the consumption of the service.

Section III

On Payment

Art. 26. The payment of installments regarding reimbursement will be effected by:

I - transfer to the Central Bank of Brazil of values through the Central Bank Posting System (SLB);

II - bank charge made by a financial institution accredited by the Central Bank of Brazil; or

III - another modality established by the Central Bank of Brazil.

CHAPTER VIII

ON CONNECTION SERVICE PROVIDERS

Art. 27. The Central Bank of Brazil may accredit companies that express interest in providing access services to Sisbacen.

Art. 28. Deinf may conduct inspections to assess the technical capability of the company requesting accreditation as a provider of access services to Sisbacen.

Art. 29. Companies interested in acting as providers of access services must use the connection modality to Sisbacen specified by the Central Bank of Brazil.

Art. 30. The accreditation for providing access services to Sisbacen will be subject to a Service Provision Contract between the interested company and the Central Bank of Brazil.

Sole paragraph. The contracting will proceed through ineligibility for bidding, based on the caput of art. 74 of Law No. 14,133, of 2021.

Art. 31. The Service Provision Contract must observe, among others, the following guidelines:

I - grant authorization for the provision of the services in question, on a non-transferable and non-exclusive basis; and

II - be governed by current legislation.

Art. 32. The costs of the resources made available to institutions that accredit themselves to provide access services to Sisbacen, referring to resources part of the computational and communications park of the Central Bank of Brazil, allocated based on the establishment of the connection between the data communication networks administered by the parties, will be subject to reimbursement by those institutions to the Central Bank of Brazil.

Art. 33. The costs referred to in art. 32 will be subject to reimbursement from the signing of the contract, in the form established in this Regulation.

§ 1. The reimbursement referred to in this article will be effected through the provision of advisory services, by the provider institution to the Central Bank of Brazil, in the various areas responsible for maintaining the systems and infrastructure supporting Sisbacen.

§ 2. It is at the exclusive discretion of the Central Bank of Brazil to choose the areas in which the advisory services referred to in this article will be provided.

§ 3. The advisory services, as defined in this article, will be provided by professionals linked to the access provider.

§ 4. It is established that for each set of 30 (thirty) users, disregarding fractions, whose access to Sisbacen is intermediated by the provider, there will be an obligation to provide 170 (one hundred and seventy) hours of monthly technical advisory services, in accordance with this Regulation.

§ 5. It is also established that 170 (one hundred and seventy) is the minimum number of monthly hours of technical advisory services that must be obligatorily provided by the provider institution to the Central Bank of Brazil, in the form provided in this article.

CHAPTER IX

FINAL PROVISIONS

Art. 34. Deinf is authorized to establish complementary procedures contained in this Regulation, with a view to achieving its objectives.