Central Bank of Brazil Instruction Normative No. 592 — Extends the Effective Date of Instruction Normative No. 590 of February 5, 2025

CENTRAL BANK OF BRAZIL INSTRUCTION NORMATIVE NO. 592, OF

MARCH 19, 2025

Extends the entry into force of Instruction Normative No. 590, of February 5, 2025, which amends Instruction Normative BCB No. 330, of November 24, 2022, which consolidates the procedures for the registration of registration information in the System of Information on Entities of Interest of the Central Bank (Unicad) governed by Resolution BCB No. 209, of March 22, 2022, providing procedures for the registration of companies hired, governed by art. 5 of Joint Resolution No. 6, of May 23, 2023.

The Head of the Department of Financial System Monitoring – Desig, in the exercise of the authority conferred upon him by art. 23, item I, letter “a”, of the Internal Regulations of the Central Bank of Brazil, published through Resolution BCB No. 340, of September 21, 2023, based on art. 85, item I, letter “b”, of the aforementioned Regulations, having in view the provisions of

Joint Resolution No. 6, of May 23, 2023, CMN Resolution No. 4,893, of February 26, 2021, and BCB Resolutions Nos. 85, of April 8, 2021, 209, of March 22, 2022, and 343, of October 4, 2023,

RESOLVES:

Art. 1

Instruction Normative BCB No. 590, of February 5, 2025, published in the Official Gazette of the Union on February 7, 2025, in Section 1, p. 126, shall enter into force with the following alterations:

“Art. 2 This Instruction Normative shall enter into force on March 3, 2025, producing effects from May 2, 2025.” (NR)

Art. 2 This Instruction Normative shall enter into force on the date of its publication.

ANDRÉ MAURÍCIO TRINDADE DA ROCHA

NOTE

1. The System of Information on Entities of Interest of the Central Bank - Unicad, governed by Resolution BCB No. 209, of March 22, 2022, was established with the objective of maintaining, in a single database, registration information on financial institutions, other institutions authorized to operate, and natural and legal persons subject to some type of authorization or registration by the Central Bank of Brazil, or that are of interest to this Autarchy.

2. On May 23, 2023, Joint Resolution No. 6 was published, which provides for requirements for the sharing of data and information on indications of fraud to be observed by financial institutions, payment institutions, and other institutions authorized to operate by the Central Bank of Brazil, except for consortium administrators.

3. The aforementioned Resolution also establishes that institutions may hire a company to provide the service of sharing data and information on indications of fraud. Furthermore, it considered this service relevant for the purposes of applying the current regulation on the hiring of data processing and storage services and cloud computing services by financial institutions, payment institutions, and other institutions authorized to operate by the Central Bank of Brazil.

4. CMN Resolution No. 4,893, of February 26, 2021, and BCB Resolution No. 85, of April 8, 2021, which provide for cybersecurity policy and requirements for the hiring of data processing and storage services and cloud computing services to be observed by institutions authorized to operate by the Central Bank of Brazil, establish that the hiring of relevant data processing, storage, and cloud computing services must be communicated to the Central Bank of Brazil and that this communication must be made within ten days after the hiring of the services.

5. In light of this, Instruction Normative BCB (IN BCB) No. 590, of February 5, 2025, was published, establishing the procedures for the registration, in Unicad, of companies hired to provide the service of sharing data and information on indications of fraud. However, due to operational problems at this Central Bank to adapt Unicad for the implementation of this registration, it was necessary to extend the start of the effects of the aforementioned IN BCB to May 2, 2025.

6. Decree No. 10,411, of June 30, 2020, regulates the conduct of regulatory impact analysis – AIR as a prerequisite for the issuance of normative acts. However, in its art. 4, the aforementioned Decree establishes the hypotheses for dispensing with the conduct of AIR. This Instruction Normative falls under the hypothesis provided for in item IV – normative act that aims to update or revoke norms considered obsolete, without alteration of merit.

7. As informed in paragraph 5, it was necessary to alter the start of the effects of IN BCB No. 590, of 2025, which justifies the classification of the present IN under Decree No. 10,411, of 2020, art. 4, item IV.

8. Thus, based on the provisions of paragraphs 6 and 7, I understand that the issuance of this Instruction Normative is exempt from the conduct of regulatory impact analysis.

ANDRÉ MAURÍCIO TRINDADE DA ROCHA

Head of the Department of Financial System Monitoring – Desig