BCB Resolution No. 86 — Amending BCB Resolution No. 32 of October 29, 2020, on Technical Requirements and Operational Procedures for Open Banking Implementation

Resolution No. 86

BCB RESOLUTION
No. 86, OF APRIL 14, 2021

Amends BCB Resolution No. 32, of October 29, 2020, which establishes the technical requirements and operational procedures for the implementation in the Country of the Open Banking Financial System.

The Collegiate Board of the Central Bank of Brazil, in a session held on April 14, 2021, based on arts. 9 of Law No. 4.595, of December 31, 1964, 9, item II, of Law No. 12.865, of October 9, 2013, 46, item I, and 51, items I, II and IX, of Joint Resolution No. 1, of May 4, 2020, and having in view the provisions of art. 1º-A of Circular No. 4.032, of June 23, 2020,

R E S O L V E :

Art. 1º BCB Resolution No. 32, of October 29, 2020, shall enter into force with the following alterations:

"Art. 3º ............................................................................................................

.........................................................................................................................

III - Manual of Services Provided by the Structure Responsible for Open Banking Governance;

IV - Security Manual of Open Banking; and

V - Customer Experience Manual in Open Banking.

................................................................................................................" (NR)

"Art. 6º-A For the purposes of sharing customer registration data and their representatives, as well as transactions, as referred to in art. 5, item I, letters "c" and "d", of Joint Resolution No. 1, of 2020, the data-transmitting institution must inform the date and time of the last update of the shared data, as well as the date and time when the data sharing was effected.

Sole Paragraph. Without prejudice to regulation regarding the response time of each interface request, it is admitted that the data shared by the data-transmitting institution may have a maximum lag in relation to their availability in their electronic channels:

I - up to five minutes, with respect to data relating to the balance and transactions carried out in deposit or payment accounts; and

II - up to one hour, for the other cases." (NR)

"Art. 10. ...........................................................................................................

.........................................................................................................................

§ 1º The rights and obligations of the participant referred to in item III of the caput must cover, among others, aspects related to privacy and the use of data, to the treatment and resolution of disputes within the scope of Open Banking, as well as the contribution to the funding of the maintenance activities of the Structure Responsible for Open Banking Governance, if such system is approved by the Deliberative Council of that structure, in consonance with art. 15 of the Regulation Annexed to Circular No. 4.032, of June 23, 2020, and art. 45 of Joint Resolution No. 1, of 2020.

................................................................................................................" (NR)

"Art. 12. ...........................................................................................................

.........................................................................................................................

II - support channels for access to the directory and for forwarding demands to participating institutions;

III - Open Banking portal in Brazil; and

IV - API testing environment.

Sole Paragraph. For the purposes of the provision in the caput, the Manual shall establish, among others, the detailing of parameters on unavailability and performance in the execution of the activities referred to in items I to IV, based on criteria related to the frequency of availability and to the response time to the handling of demands, as the case may be." (NR)

"Art. 13. ...........................................................................................................

.........................................................................................................................

III - management of directory information, which covers the availability of updated information of interest to participants and developers on technical standards, regulatory requirements and other information necessary for the implementation of APIs;

IV - monitoring and disclosure of information on the unavailability and performance of processes for requesting data and service sharing within the scope of Open Banking; and

V - carrying out compliance tests and the registration of APIs of participating institutions.

................................................................................................................" (NR)

"CHAPTER VII

.........................................................................................................................

Section V
Of the API testing environment

Art. 15-A. The Structure Responsible for Open Banking Governance referred to in art. 44, § 1º, of Joint Resolution No. 1, of 2020, shall maintain an API testing environment that allows participating institutions:

I - to submit, even in the development stage, their implementations of Open Banking APIs to automated functional and non-functional tests; and

II - to access example implementations of Open Banking APIs." (NR)

"CHAPTER VIII-A
OF THE CUSTOMER EXPERIENCE

Art. 16-A. The Customer Experience Manual in Open Banking must contain:

I - the principles that should guide the customer experience in the process of requesting data and service sharing in Open Banking; and

II - the requirements of the customer experience guide, including its content and structure of topics, with a view to harmonizing the stages of consent, authentication and confirmation among the participating institutions of Open Banking.

Sole Paragraph. The guide referred to in item II of the caput must:

I - cover the different possible use cases, including the situations provided for in art. 16-B;

II - be prepared, reviewed and periodically updated by the Structure Responsible for Open Banking Governance referred to in art. 44, § 1º, of Joint Resolution No. 1, of 2020; and

III - be made available, in its most current version, to participating institutions and the general public, through the Open Banking Portal in Brazil, referred to in art. 15.

Art. 16-B. For the purposes of data sharing referred to in art. 5, item I, letters "c" and "d", of Joint Resolution No. 1, of 2020, relating to joint accounts of natural persons, the data-transmitting institution must:

I - ensure that the data-receiving institution has access only to the registration data of the account holder responsible for the consent, and the sharing of registration data of the other holders of the respective account is not admitted; and

II - share transactional data of the joint account through the consent of the holders who may have access to transactional information of the account.

Sole Paragraph. The data-transmitting institution must require the confirmation of all holders of the account to effect the sharing referred to in item II of the caput whenever access to transactional information of the account depends on the authorization of all holders." (NR)

Art. 2º This Resolution enters into force on the date of its publication.

Otávio Ribeiro Damaso
Director of Regulation