BCB Resolution No. 406 — Provisions on the sharing of the payment transaction initiation service without redirection to other electronic environments or systems, including those of other institutions, within the scope of Open Finance

RESOLUTION
BCB NO. 406, OF AUGUST 2, 2024

Provisions on the sharing of the payment transaction initiation service without redirection to other electronic environments or systems, including those of other institutions, within the scope of Open Finance.

The Collegiate Board of the Central Bank of Brazil, in a session held on August 1, 2024, based on the provisions of Arts. 9, 10, caput, items VI and IX, and 11, caput, item VII, of Law No. 4.595, of December 31, 1964, 15 of Law No. 12.865, of October 9, 2013, and taking into account the provisions of Arts. 44, § 1, and 51, caput, item XI, of Joint Resolution No. 1, of May 4, 2020,

R E S O L V E:

Art. 1 This Resolution provides for the sharing of the payment transaction initiation service without redirection to other electronic environments or systems, including those of other institutions, within the scope of Open Finance, as provided for in Art. 9, sole paragraph, of Joint Resolution No. 1, of May 4, 2020.

Art. 2 The sharing of the payment transaction initiation service without redirection, as provided for in Art. 1, comprises the following stages:

I - account linking; and

II - payment transaction.

Art. 3 The stage provided for in Art. 2, caput, item I, consists of the client's consent granted to a payment transaction initiating institution, to link a certain electronic device to an account owned by the client or for which the client has established powers of movement.

§ 1 The client's authentication and the confirmation of account linking must occur in the environment of the account-holding institution defined by the client.

§ 2 After the client's authentication and the confirmation referred to in § 1, the payment transaction initiating institution must request the client's action to generate security credentials on its electronic device, in accordance with the security mechanism defined by the Open Finance Governance Structure, as well as its authorization for the capture and movement of components of the security credentials to the institution holding its linked account.

§ 3 The component of the security credentials referred to in § 2 will be used by the account-holding institution as part of the client authentication process during the stage provided for in Art. 4.

Art. 4 The stage provided for in Art. 2, caput, item II, consists of the client's authentication and confirmation to initiate a specific payment transaction or a specific set of payment transactions.

§ 1 In the client authentication process referred to in the caput:

I - the account-holding institution must use the security credential component mentioned in Art. 3, § 2, to authenticate the client; and

II - the payment transaction initiating institution and the client's account-holding institution must carry out the applicable security checks, observing the provisions of Arts. 16 and 16-A of Joint Resolution No. 1, of May 4, 2020.

§ 2 The confirmation process referred to in the caput must occur in the environment of the payment transaction initiating institution.

Art. 5 The institutions participating in the sharing of the payment transaction initiation service without redirection are responsible:

I - for the technological environments and electronic systems made available by them to carry out the actions that make up each stage provided for in Art. 2; and

II - for the records generated during the execution of the stages provided for in Art. 2.

Sole paragraph. The responsibility referred to in the caput includes, in particular:

I - the non-observance of risk management measures provided for in the technical specifications and current regulation; and

II - any failures in the procedures and controls of the payment transaction initiating institution to ensure the reliability, integrity, availability, security, and confidentiality of its electronic environments and systems, which compromise the ability of the account-holding institution to authenticate the client, in accordance with Art. 4, § 1, item I.

Art. 6 The implementation of the sharing of the payment transaction initiation service without redirection is mandatory:

I - starting from November 14, 2024, for account-holding institutions belonging to conglomerates and cooperative systems in which 99% (ninety-nine percent) of the total number of payment transactions successfully carried out within the scope of Open Finance were initiated, identified as the first in the order referred to in the sole paragraph of this article; and

II - for all account-holding institutions participating in the Pix payment arrangement: (Wording given by BCB Resolution No. 541, of 12/18/2025.)

a) starting from February 6, 2026, on a limited basis for production testing; and (Included by BCB Resolution No. 541, of 12/18/2025.)

b) starting from April 22, 2026, for the general public. (Included by BCB Resolution No. 541, of 12/18/2025.)

Sole paragraph. The identification of the conglomerates and cooperative systems mentioned in item I of the caput must be carried out by ordering, by institution and in descending order, the total number of payment initiation transactions carried out within the scope of Open Finance, considering the information reported by the conglomerates and cooperative systems to the Central Bank of Brazil regarding the 24 weeks prior to the publication date of this Resolution.

Art. 7 The Central Bank of Brazil will provide for:

I - value limits for the payment transactions referred to in Art. 2, caput, item II;

II - validity period of the consent referred to in Art. 2, caput, item I;

III - guidelines, conditions, and deadlines for carrying out tests, including in production, by participating institutions; and

IV - publication of a list of the conglomerates and cooperative systems whose account-holding institutions must implement the sharing of the payment transaction initiation service without redirection on a mandatory basis, as provided for in Art. 6, caput, item I.

Sole paragraph. The establishment of value limits higher than those to be defined by the Central Bank of Brazil is admitted, provided they are established in bilateral contracts between payment transaction initiating institutions and account-holding institutions.

Art. 8 This Resolution enters into force on the date of its publication.

OTÁVIO RIBEIRO DAMASO
Director of Regulation