Circular Letter CVM/SIN 02/21

SECURITIES COMMISSION OF BRAZIL (CVM)
Seven of September Street, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP Code: 20050-901 – Brazil Tel.: (21) 3554-8686 - www.cvm.gov.br Circular Letter No. 2/2021/CVM/SIN Rio de Janeiro, February 23, 2021

To
Portfolio Administrators registered with the CVM

Subject: Guidelines regarding the minimum elements that must comprise compliance activities and the Compliance Report provided for in Articles 19 to 22 of CVM Instruction No. 558.

Dear Sirs,

1. Introduction

The issuance of CVM Instruction No. 558 (“ICVM 558”) brought improvements to conduct rules and internal controls, including the mandatory appointment of a Director responsible for supervising compliance with rules, procedures, and internal controls.

The compliance activity is well known in the securities market and plays a fundamental role in ensuring that participants act not only in compliance with regulatory obligations but also with the internal norms of the institution itself.

The CVM understands that the structuring and maintenance of good compliance routines and controls, as required of corporate portfolio administrators by Articles 19 to 21 of ICVM 558, is of fundamental importance. The Compliance Report provided for in the following Article 22 serves, among other things, to demonstrate that internal control activities are being effectively developed. After all, besides recording findings at a given time, the document supports future improvements in the institution's procedures and internal controls, and helps to demonstrate the responsibility of the Manager's Senior Management in the continuous maintenance and improvement of these routines and controls.

However, the Superintendency of Institutional Investor Supervision – SIN has observed in its supervisory actions that the Report is sometimes too succinct, thus failing to fulfill its objective of providing the institution's senior management with a continuous and detailed view of the company's and its employees' behavior regarding applicable regulation and the internal controls established to ensure compliance.

Although Articles 19 to 21 do not provide details on which aspects should be the focus of the Director responsible for implementing and complying with rules, policies, procedures, and internal controls (“Compliance Director”), and how the Article 22 Report should be prepared, we understand that there are minimum elements that must be considered, respecting in any case the particularities of the company.

Thus, the lack of express minimum requirements has led some portfolio administrators to demonstrate structures below what is expected, without the breadth and depth necessary to evaluate several important aspects of portfolio administration activity. Therefore, with the objective of assisting market participants, the SIN presents to portfolio administrators the points that, at a minimum, must be observed by the compliance area and, consequently, appear in the Compliance Report, as well as the corresponding tests that must accompany it.

2. Planning of internal control activities

We understand that, for the good execution of the work, it becomes necessary that all compliance work be preceded by a plan that organizes and prioritizes the points to be focused on for monitoring. The plan can be based on any data, information, or document deemed appropriate and relevant by the area.

It is crucial, for the greater effectiveness of the institution's internal control verification, monitoring, and testing work, that the plan must not fail to take into account, for example, (1) the nature and complexity of the portfolio administrator's activity, the segment in which it operates, and the strategies and types of funds used in the management activity, with special emphasis on segments where the start of activity is more recent; (2) the risk profile and appetite of the institution and its employees, directors, and administrators, as defined by the institution's senior management; or (3) the degree of maturity of the company on the various issues faced by internal controls, in particular, the experiences and findings already established by the area in previous exercises.

Thus, taking into account these and other variables that the internal controls area considers pertinent, it may establish an adequate matrix or any other form of mapping and control that weighs probabilities and impacts on the materialization of risks and that allows directing available resources and efforts proportionally and adequately to needs, without failing to pay attention to the most serious identified risks.

In this way, for a private credit fund manager, the verification of possible relationships between the manager or related persons with the issuer or the counterparty of the operation would gain special emphasis, given that these are operations agreed upon outside the stock exchange environment and only later registered in the over-the-counter market. Similarly, a manager of leveraged products on the stock exchange will highlight special emphasis on the robustness of market risk control routines of the managed funds; a fund of funds manager, on possible rebates received from invested funds; a manager of several funds that operate under order grouping, on the efficiency and integrity of the allocation carried out; and so on.

This does not mean that the compliance activity remains rigid in this planning; it must be flexible enough to adapt to new emerging risks or those that come to be given a new weighting of probability or impact by any relevant factors, whether external or internal to the institution.

The Compliance Report must describe and summarize the planning carried out for the period, as well as any changes or reprioritizations made during the execution of the work, accompanied by the justifications for these alterations.

3. Minimum aspects to be considered

The compliance work must contain at minimum considerations regarding the institution's compliance with current regulatory norms regarding resource management, fiduciary administration, risk management, suitability, and distribution of shares, depending on the category of registration held by the portfolio administrator with the CVM (such as Resource Manager, Fiduciary Administrator, or Full Administrator) and if it has authorization to distribute shares of investment funds.

In Annex I of this Circular, there is a table with topics that must be addressed by the compliance area, and associated aspects to be considered.

It is expected that the Compliance Report reports on these topics, and, in addition to the conclusion as to whether each point was found to be in compliance or not, contain the justification for this conclusion and present the evidence of what was analyzed, or, at least, where such evidence can be found in the institution's records.

We highlight that the items listed in the table are not exhaustive and, thus, should be considered only as a reference when preparing the work and, consequently, the Compliance Report.

It should be clarified that the need to verify suitability by the compliance area in the Compliance Report does not coincide with the Report provided for in ICVM 539, because what is expected in this case is the exercise of compliance in the second line of defense regarding this requirement.

We remind you that compliance regarding the prevention of money laundering and terrorist financing should be treated in a specific Report on the subject, as required by Art. 6 of CVM Instruction No. 617, with the option established in its paragraph 2.

4. Tests to be carried out by the Compliance Director

For the preparation of the Compliance Report, the Director must, therefore, establish a continuous work routine that contains, according to the size and activity of the company, the guidelines of the document, and the tests to be applied, including when they occur through sampling.

For this purpose, periodic internal reports from the management and risk areas, adoption of checklists of periodic obligations, direct monitoring of operations, reports from other areas of the company may be used, without prejudice to other methods, as long as they are verifiable.

Thus, it will be up to this Director to define the types of tests (adherence tests, stress tests, etc.), appropriate to the size of the manager, that will be applied in the conduct of their work, in order to allow the conclusion of the Report successfully and compatible with the risks that the responsible person mapped and intends to mitigate.

It is understood that, for reasons of practicality, in the various tests applied during the execution of the work, and for the purpose of preparing the Compliance Report, statistical sampling methods may be used, reducing the effort expended, but without loss of the reliability and representativeness necessary.

5. Preparation of the Compliance Report

As per Art. 22, the work of presenting and keeping the Report will be completed with (i) the conclusions of the examinations carried out, (ii) the recommendations regarding any deficiencies, with the establishment of remediation schedules, where applicable; and (iii) the statement of the director responsible for the administration of securities portfolios or, where applicable, by the director responsible for risk management regarding the deficiencies found in previous verifications and the planned measures, according to a specific schedule, or effectively adopted to remedy them.

In other words, for the completeness of the work, the statement of the director responsible for portfolio administration and/or the director responsible for risk management is necessary.

6. Final Considerations

We reinforce that the work of the compliance area must be continuous, in order to actively monitor the activities developed by the company, and should not be restricted to a specific time of the year just to fulfill regulatory obligations. In this sense, we remind you that if in the SIN's supervisory actions it is identified that the compliance area does not act independently or does not develop its activities as required by ICVM 558, the institution may, under the terms of applicable legislation and regulation, suffer sanctions ranging from the issuance of an Alert Letter to, at the limit, the cancellation of the company's authorization as a portfolio administrator due to loss of the requirement established in Art. 4, VII, of ICVM 558.

Finally, we suggest that the Report that must be prepared by April 2021, referring to the 2020 compliance activities, take into consideration the guidelines contained in this Circular Letter, to the extent of the possibilities.

Sincerely,

Digitally signed by
DANIEL WALTER MAEDA BERNARDO
Superintendent of Institutional Investor Supervision

SECURITIES COMMISSION OF BRAZIL (CVM)
Seven of September Street, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP Code: 20050-901 – Brazil Tel.: (21) 3554-8686 - www.cvm.gov.br

ANNEX I

Topics	Minimum Aspects
Legal requirements for the exercise of the activity	- Whether the requirements of Arts. 3 and 4 of ICVM 558 for maintaining the registration of both the director responsible for the activity and the legal entity are being met, and, in particular, the maintenance of adequate human and computational resources for the size and area of activity of the legal entity.; - Verify the clean reputation requirements of the directors and controllers of the company.
Submission of reports	- Whether the periodic and eventual reports due to the Regulator have been sent within the deadline established in CVM norms. This includes verifying if the Reference Form sent by the CVMWeb System and available on the company's website is being updated when applicable.; - For fiduciary administrators, this includes verifying the delivery of all reports related to the investment funds under their administration.
Update of registration data	- Attest that the institution's registration data in the CVM registry are updated and that updates have been made in a timely manner.
Minimum Capital	- For fiduciary administrators, if subject to minimum capital (ICVM 558, Art. 1, § 21, II), verify the delivery and consistency of the required documents (Art. 1, § 5). If there is any inconsistency, point out the regularization procedures.
Policies	- Whether the documents and manuals required in Art. 14 of CVM Instruction 558 are on the company's website in their updated version;; - Point out if any adjustments in policies and documents were a consequence of regulatory changes, or regulator's requirements, or if they were a consequence of internal changes, managerial decisions, or even if they were motivated by points raised in due diligence processes.
Employees	- Point out if there was non-compliance with the respective Code of Ethics and other internal policies by administrators, employees, and collaborators, and report how more serious professional deviations were resolved, if they resulted in sanctions and/or consequences (financial, commercial, image, etc.) to the company and the employee in question, with emphasis on the measures taken for their future prevention.; - Also report the procedures for verifying compliance with the policy on personal investments and the company, and whether there were any eventual occurrences related to it, abusive market practices by employees (insider trading, front running, spoofing, etc.), or practices that may have put the proper functioning of investment funds and the company at risk.; - Whether the training program for administrators, employees, and collaborators previously established, required in Art. 21, III of ICVM 558, was fulfilled, and the eventual need for adjustments and improvements in the program, in order to take into account, among other things, past findings of the compliance area itself;
Conflicts of Interest	- Whether the policies to prevent possible conflicts of interest were effectively complied with, including regarding the exercise of external activities by administrators, collaborators, and employees, such as participation in boards of directors, supervisory boards, advisory boards, or committees of invested or potentially invested companies by the investment vehicles managed or administered, as well as the correct disclosure in the Reference Form of potential conflicts of interest with other activities of the institution and its affiliated companies.
Information Security and Business Continuity Plan	- Whether the control of confidential information is effective, and the existence of periodic security tests of the systems. If incidents have occurred, report the measures taken and their updated status.; - Whether the computational resources and other records maintained of operations and businesses are protected against tampering and also allow for audit with a report of the tests carried out.; - Whether the keeping and maintenance of the company's files for the period established in the norms preserves their integrity and availability;; - Whether the contingency plans, business continuity, and disaster recovery plans provided for are feasible and have conditions to be implemented immediately according to tests carried out. Report if the plan was activated, if there were re-evaluations, reviews, and if it is adequate to current conditions.
Segregation of Activities	- If the institution exercises other activities that require segregation, it should be evaluated through tests whether there is physical, system, and personnel segregation between the various areas of the company, including access to facilities and systems, if it is operational and meets its objectives, avoiding the improper leakage of data and information between different areas of the company.; - Whether the manuals required by Art. 25 of ICVM 558 are compliant with what is required by the norm and verify their compliance. If there is evidence of non-compliance, a detailed report of the failures found and the measures adopted for regularization must be made.
Risk Management and Order Allocation	- Whether the risk management policy (market, credit, liquidity, counterparty, operational) was complied with and is adequate to norms and regulations;; - Report deviations and non-compliance with mandates by managers and what measures were adopted.; - Determine if the market risk management policy was adequate to assess events of higher volatility that occurred during the year.; - Whether the technical tools used underwent changes or revisions (whether by the manager or by its supplier), if there are new functionalities, controls, or reports that were implemented, or if there is an expectation for the future exercise.; - Regarding operational risk, presentations of statistics of events that occurred throughout the year, their diagnosis, and improvements motivated by them are recommended.; - Regarding credit risk, determine if the management area is giving the treatment established in the policies in special situations, such as default events, payment delays, revisions of bond clauses, re-evaluation or changes in guarantees.; - Regarding counterparties, special attention should be given to the monitoring of brokers, their approvals, re-evaluations, rankings, and metrics.; - Attest if the order allocation and division policy is fulfilled satisfactorily, reporting cases where non-compliance was identified and the measures adopted.
Fiduciary Administration	- Determine the regularity of the calculation of shares, management fees, and performance fees charged (reporting significant events that occurred and improvements), as well as the transfer of benefits obtained in the capacity of portfolio administrator to clients' portfolios (if it is being effectively carried out and controlled).; - Verify if deviations and non-compliance with mandates by managers that occurred were treated in accordance with current norms.; - Whether the effective exercise of voting rights in general assemblies of invested companies or funds is properly documented or has justified absence, as applicable.; - Whether the pricing of assets, especially the more complex ones (such as illiquid ones), is being executed according to the pricing manual.; - Whether the performance of third parties hired to provide services is adequate, including regarding their qualification. If applicable, point out any contract ruptures that were motivated by situations that potentially represented risks to the funds and investors.
Administrators or Managers, in the capacity of Distributors	- Determine if the norms for client registration and the adequacy of products and services to the profile of each client (suitability) are being fulfilled satisfactorily.; ; Obs: The above reports do not replace the specific reports defined by ICVMs 539 and 617.
Regulatory Environment	- Analyze the effectiveness of the mapping and control of regulatory changes that affected the institution, and to what extent the due adjustments made (policies, procedures, professionals, controls, etc.) are already closed, implemented, in the analysis phase, as well as what adjustments were made as a result of this.; - Verify if the letters received from regulators, self-regulatory organizations, and other authorities were treated appropriately and led to operational improvements.