CIRCULAR LETTER CVM/SMI NO. 1/2015

São Paulo, January 8, 2015

To
Securities Custodians ("custodians")

Subject: Adaptation to CVM Instruction No. 542/2013

Dear Sirs,

1. Pursuant to Article 22 of CVM Instruction No. 542, of December 20, 2013, all registered custodians (including those under the terms of Article 21, paragraph 1), or whose registration application has already been filed with the CVM, must adapt to the provisions of the aforementioned Instruction by December 2015.

2. Since, under Article 22, paragraph 1 of the current regulation, it is incumbent upon the Superintendence of Market and Intermediary Relations – SMI – to establish rules and procedures for adaptation, defining intermediate deadlines for compliance with obligations, the following schedule is established for the custodians' adaptation process:

Deadline or Period	Document from Annex 5 of ICVM 542
Until 2/27/2015	a) Appointment of the audit firm and declaration of independence (Art. 1, item IX)*<br>b) Current Articles of Incorporation or Bylaws (Art. 1, item II)<br>c) Functional organizational chart (Art. 1, item IV)<br>d) List of companies – shareholding participation (Art. 1, item VII)
From 5/1/2015 to 5/31/2015	e) Registration update (ICVM 510)<br>f) Name and qualifications of legal representatives (Art. 1, item V)<br>g) Copy of the minutes of the meeting electing directors (Art. 1, item VI)<br>h) Submission of a Type 1 report on the description, design, and operational effectiveness of controls (Article 1, X, of Annex 5)
Until 7/31/2015	i) Capacity document (Art. 1, item III)<br>j) Model of custody service provision contract (Art. 1, item VIII)<br>k) Detailed description of the means used and infrastructure dedicated by the custodian to provide information to the investor or issuer (Article 13 of ICVM No. 542)
Until 4/30/2016	l) Submission of the first Type 2 report on the description, design, and operational effectiveness of controls, referring to the 2015 fiscal year (Article 1, X, of Annex 5)

*The provision for the appointment of the audit firm in the first stage of the schedule is due to the need to facilitate the preparation and delivery, to the CVM on 4/30/2016 (item "l" of the schedule) of the Type 2 Report for the 2015 fiscal year, covering the most comprehensive period possible of that fiscal year.

Applicable to custodians registered under the terms of CVM Instruction No. 89/88. For custodians registered under the terms of CVM Instruction No. 542/2013, only the current update of the document previously delivered should be sent, if applicable.

3. In all phases, the delivery of documents must be electronic, via upload on the CVM website on the World Wide Web, www.cvm.gov.br, with access to the "Registration Update" option available in the CVMWeb system. After accessing the restricted environment with the responsible person's CPF and password, the "Participant Registration Update" link should be accessed, then "Fungible Custody of Registered Shares," and subsequently, "Submission of Documents for Adaptation to CVM Instruction No. 542/2013," through which digital files in .ZIP format with a maximum size of 1 MB each must be submitted.

4. The delivery of documents will be carried out according to the degree of complexity of document preparation, as well as the temporal feasibility of their delivery, as assessed by this Superintendence. Below, we provide clarifications related to the documents to be sent.

4.1. Current Articles of Incorporation or Bylaws, bearing legal formalities (Annex 5, Art. 1, item II): This document is required only for custodians registered by the CVM under the terms of CVM Instruction No. 89/1988. In the case of custodians registered under Article 21 of CVM Instruction No. 542/2013, only an updated version of the document, if any, relative to what was delivered during the custodian's accreditation, should be submitted.

4.2. Functional organizational chart of the area dedicated to custody, specifying the functions and responsibilities of the people comprising it and the regime of segregation of functions (Annex 5, Art. 1, item IV): An organizational chart should be presented showing the functional relationships of the area dedicated to the institution's custody, with a description of the responsibilities of each component of the functional diagram, and special emphasis, if applicable, on the structures dedicated to custody services for investors and that dedicated to issuers. The segregation regime of custody activities from other activities developed by the institution, such as asset management and intermediation, for example, should be detailed in this document, accompanied by a description of the mechanisms (policies, structures, controls and restrictions on access and use, training of involved employees, the involvement of compliance in ensuring the maintained structure, among others considered relevant) that make the described segregation effective.

4.3. List of companies in which the custodian holds share participation, including indirectly controlled or affiliated companies (Annex 5, Art. 1, item VII): If the institution holds participation in the capital of other companies (even if indirectly), it must sign a declaration specifying these participations and the respective percentages of social capital held. If, on the other hand, the institution authorized to act as a custodian does not hold participation in the capital of other companies, it must send a declaration regarding this condition.

4.4. The mandatory registration update provided for in CVM Instruction No. 510/2011: During the month of May of each year, custodians must confirm that the information contained in the registration forms remains valid. Thus, during the month of May 2015, all custodians must confirm their registration information and inform the names of the directors responsible for complying with CVM Instructions, accompanied by the submission of a copy of the corporate document with the respective appointments (Annex 5, Art. 1, item VI).

4.5. Name and qualifications of legal representatives (Annex 5, Art. 1, item V): Compliance with this requirement will be achieved by presenting the signature card (Annex I) with the full name, CPF, position, and signature of each director.

4.6. Document intended to demonstrate the organizational, technical, operational, and financial capacity of the custodian (Annex 5, Art. 1, item III): According to the structure contained in the Instruction, the document must be composed, at least and in detail, by the following topics. We alert that, for custodians providing services to investors and to issuers, each of the items below must be discriminated individually for each of these types of service provision, without prejudice to the need for additional segmentation in this description, when applicable (for example, for the issuer custodian providing services for investment funds regulated by CVM Instruction No. 409/04 and for investment funds regulated by CVM Instruction No. 356/01).

4.6.1. Description of the main characteristics of the processes and computerized systems that must be used in the provision of services, with the specification of operational routines intrinsic and extrinsic to the systems, as well as the relevant internal procedures and controls, with emphasis on the internal procedures and controls related to (i) receipt, verification, and execution of the client's custody transfer request; and (ii) custody of records and documents related to custody activities, including recording systems, when applicable.

4.6.2. Description of the custody account structure, with emphasis on the necessary segregation between the different types of services provided by the institution.

4.6.3. Summary description of security standards regarding facilities, equipment, and data.

4.6.4. Policies of segregation of functions, physical access control and password use, and employee training:

• Logical Security:
  i. information security policy: guidelines, approval, and process of dissemination and training to collaborators and third parties;
  ii. password parameters: minimum configuration;
  iii. administration of access to systems, database, and networks:
  1. process of approval, alteration, and revocation of access;
  2. segregation of functions matrix: definition, application, and treatment for cases of exception;
     iv. security of the network, files, systems, and database: tool, monitoring, and treatment.
• Physical Security:
  i. Access Control: control tools and method of monitoring.

4.6.5. Description of human resources allocated to the activity, with specification of the functions and positions necessary for its performance:

• Description of positions (and respective functions) related to the custody activity with the minimum qualification required for its filling as well as the quantity of professionals allocated to the custody activity by position.

4.6.6. Plan for contingencies, to ensure business continuity and service provision, and systems for file and database recovery.

A Business Continuity Plan must be submitted, with the strategies of action, the planned stress scenarios, and the infrastructure implemented to face them, in addition to a description of the tests that are performed and their results.

4.6.7. Copies of software licensing and development contracts, entered into between the applicant and the company owning the system or responsible for its development, in the event that the systems were not developed by the applicant.

4.7. Model of custody service provision contract (Annex 5, Art. 1, item VIII): The custody service provision contract must respect not only the content of the Instruction, but also the provisions of the Regulations and/or Operations Manuals of the Central Depositories, insofar as pertinent. It is important to highlight that the custodian can provide services to the issuer and/or to the investor, and therefore, in this case, at least two models of custody service provision contracts must be submitted (more models admitted, if applicable), if the custodian intends to exercise both services.

4.8. Detailed description of the means used by the custodian to provide information to the investor (Art. 13 of ICVM No. 542): A descriptive report of the means and models used for providing information to the investor should be presented, with examples of the material sent, method, and frequency of sending. If there is segmentation that implies the use of differentiated communication means with the custodian's clients, this fact must be properly exposed.

4.9. Appointment of the independent audit firm registered with the CVM that will perform the operational audit of the custody service, as well as a declaration of its independence from the audited institution (Annex 5, Art. 1, item IX): Declaration stating the name of the independent audit firm contracted to comply with Article 17, item II of CVM Instruction No. 542/2013.

4.10. Submission of the report on the description, design, and operational effectiveness of controls (type 1) for the custody service (Annex 5, Art. 1, item X): In the interpretation of this Superintendence, a report with this scope, prepared by the independent auditor indicated in attention to item "a" of the schedule, must be delivered by the date indicated in item "h" of this same schedule. We inform that the delivery of the report provided for in Article 8 of CVM Instruction No. 89/88 will be admitted, for the purpose of meeting this item, for all institutions that possess it for the reference fiscal year of 2014.

5. At this opportunity, we highlight that the custodians' adaptation process to the provisions of CVM Instruction No. 542/2013 is not limited to compliance with the schedule now informed, inasmuch as the Instruction established some new obligations for custodians, among which we highlight:

5.1. Rules, procedures, and internal controls (Art. 15): Document that will be required starting from January 2016.

5.2. Internal Audit Report (Art. 17, item I, letters "a", "b", and "c"): Although the CVM encourages the production of the report relating to the year 2015 (i.e., to be presented in 2016), the internal audit report will only be required starting from 2016. Thus, the first report must be presented by April 28, 2017.

5.3. Internal audit structure (Art. 19): Custodians must have structured by December 2015 an internal audit area compatible with the services they provide, considering the public served by the custodian, the volumes held in custody, the contracting with third parties, and the other relevant operational and structural aspects related to the provision of the service.

5.4. The first independent auditor report required under Article 17, II (i.e., Type 2, in the form of NBC TO 3402, approved by the Federal Council of Accounting), must be delivered by the last business day of April 2016, with reference to the maximum possible period relative to the 2015 fiscal year (at least, from March onwards, given item "a" of the schedule provided in item 2 of this Circular Letter).

6. We also inform that the CVM intends to carry out, in partnership with the central depositories BVM&FBOVESPA and CETIP, specific workshops where doubts can be clarified. As soon as such events are feasible, they will be the subject of specific disclosure.

7. Any doubts related to the adaptation process can be clarified by contacting the Market Structure and Electronic Systems Management – GME (gme@cvm.gov.br).

8. Finally, we inform that non-compliance with the schedule provided in this Circular Letter will imply the cancellation of the institution's accreditation for securities custodian services, observed, in any case, the right of appeal provided for in CVM Deliberation No. 463/03.

Sincerely,

WALDIR DE JESUS NOBRE
Superintendent of Market and Intermediary Relations

---

Annex I

Signature Card – CUSTODIAN

Institution / Corporate Name
Account No. (USER
CBLC –
BROKER/AGEN
CY CUSTODY)

Hereby represented, by its legal representatives below signed, appoints and constitutes as its attorneys the person(s) identified below, in order to represent it before the Securities and Exchange Commission - CVM.

This instrument is valid until XX / XX / XXXX (maximum period of two years) and applies to the user(s) registered under CNPJ No.: XX.XXX.XXX.XXX-XX

Any changes in accreditation or powers related here must be immediately communicated to the CVM.

Name	Signature	CPF	POSITION
Name	Signature	CPF	POSITION
Name	Signature	CPF	POSITION
Name	Signature	CPF	POSITION
Name	Signature	CPF	POSITION

NOTE: This card will only be valid if the powers are proven through the contract, articles of incorporation, and/or corresponding mandate in the form of Current Legislation.

Space reserved for notarization of signature.