Circular Letter CVM/SMI 06/2015

COMMISSION OF SECURITIES AND COMMODITIES
Rua Sete de Setembro, 111/2
Circular Letter No. 06/2015/
To
Institutions authorized to act as members of the distribution system, on their own behalf and on behalf of third parties, in the negotiation of securities in regulated securities markets.
Subject: I – Guidelines for preparing the “Semiannual Internal Controls Report”, as required by Article 4, § 5 of CVM Instruction No. 505/2011.
II – Communication of occurrence or identification of indications of violation of legislation, as established by Article 32, item IV of CVM Instruction No. 505/2011.
III – Request for the adoption of an alternative client registry – CVM Instruction No. 301/1999 and CVM Deliberation No. 707/2013

Dear Sir/Madam,

I – Guidelines for preparing the “Semiannual Internal Controls Report” as provided for by CVM Instruction 505/2011, Article 4, § 5.

1. The publication of this Circular Letter aims to provide the understanding of this Department of Market and Intermediary Relations (SMI) regarding the adequacy of the content of the semiannual internal controls report (RCI) and thus guide its correct preparation by intermediaries subject to the rules of CVM Instruction 505/2011.

2. As established by the rule, the RCI must be forwarded to the intermediary's management bodies by the Internal Controls Director by the last business day of the months of January and July, relative to the semester closed in the month prior to the submission date, and must be kept at its headquarters available to the CVM, the entities administering organized markets, and their self-regulation departments, if applicable.

3. The content of the report must cover (i) the conclusions of the examinations carried out, (ii) the recommendations on deficiencies found, with the respective schedules for remediation of the deficiencies, and (iii) the statement of the director responsible for compliance with the rules of CVM Instruction 505/2011 regarding the deficiencies found in previous verifications and the measures planned, according to a specific schedule, or effectively adopted to remedy them.

4. The SMI understands that, to fulfill the objectives sought by CVM Instruction 505/2011, the RCI must include, in specific sections and with sufficient depth, when applicable, the following activities carried out by intermediaries:

a) Client Registration – Compliance with procedures for preparation, maintenance, and updating of the client registry, in accordance with CVM Instruction 301/1999. This topic must cover the simplified registry, as well as the eventual adoption of alternative registration systems;

b) Transmission of Orders – Complete recording of orders with identification and validation of the issuer, origin, and method of transmission;

c) Execution of Orders – Links between orders, offers, and transactions, compliance with conditions established by the client, and compliance with best execution rules;

d) Specification of Clients – Compliance with deadlines for identification, respect for limitations regarding the respecification of accounts, and pass-through of operations;

e) Operations with Persons in Special Situations – Obedience to limits for special operators and persons affiliated with the intermediary;

f) Pass-through of Operations – Establishment of rules, procedures, and internal controls;

g) Payment and Receipt of Values – Compliance with limitations on forms of payment and receipt of values from clients;

h) Conduct Norms – Observance of duties and respect for prohibitions applicable to the intermediary;

i) File Maintenance – Compliance with the maintenance and back-up of all documents, information, and recordings.

5. For the topics mentioned above, even if (i) they are not applicable to the internal processes maintained by the intermediary, (ii) they are of minor relevance, or (iii) they offer extremely low risk in the context of the institution's activities, they must be explicitly mentioned in this condition, justifying, in this way, the absence in the RCI of mention to examinations carried out and specific recommendations for such matters.

6. The conclusions of the examinations carried out and the recommendations on deficiencies found must contain, at a minimum, the following details:

a) Description of the general protection practices adopted by the intermediary in the face of market, operational, financial, and regulatory risks;

b) Comprehensive and updated detailing of the internal controls implemented – types of control, activities or operations controlled, evaluation of the effectiveness of each control in identifying deviations or non-compliance with internal rules or regulation;

c) Methodology applied for the choice and execution of examinations. For example: mechanisms or forms of monitoring and parameters for verification of abnormalities or failures, criteria for the selection of samples in examinations;

d) Description of the procedures carried out for the analysis and classification of deficiencies or vulnerabilities found;

e) Treatment given to failures, deficiencies, or vulnerabilities, justifications for this treatment, and detailed schedule of actions and corrections intended to remedy them. Note that not finding deficiencies does not necessarily mean that internal controls are functioning perfectly. On the contrary, they may indicate, in certain cases, that the controls are not sufficient to ensure faithful observance of the provisions contained in CVM Instruction No. 505/2011. In this way, such controls need to be improved, possibly requiring more in-depth evaluations.

7. The statement of the director responsible for compliance with the rules established by CVM Instruction 505/2011 must, at a minimum, contain the following:

a) Analysis of each of the control deficiencies pointed out in previous reports, containing its evaluation of their relevance and importance;

b) Individual description of planned, executed, or ongoing actions or corrections, their schedules, and the impacts or benefits expected as a result of their conclusion;

c) Well-founded evaluation of the evolution verified by the intermediary in compliance with the requirements of CVM Instruction 505/2011 during the period of competence of the report.

8. Additionally, it is important to record that, respecting the requirements of the rule and the provisions of this circular, the RCI may share the content of the reports issued by the intermediary to meet the requirements of other regulators, self-regulators, and entities administering organized markets, in which it participates or is authorized to operate, provided that the content is sufficient and appropriate for such purposes.

Rio de Janeiro, December 23, 2015.

COMMISSION OF SECURITIES AND COMMODITIES
Rua Sete de Setembro, 111/2-5º and 23-34º Floors – Center – Rio de Janeiro - RJ – CEP: 20050-901 – Brazil Tel.: (21) 3554-8686 - www.cvm.gov.br

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION

Rua Sete de Setembro, 111/2-5th and 23rd-34th Floors – Center – Rio de Janeiro - RJ – ZIP: 20050-901 – Brazil Tel.: (21) 3554-8686 - www.cvm.gov.br

... respecting their respective competences and ensuring the confidentiality of information from one to the other, when this is the case. Considering the current profile of intermediaries in the Brazilian market, it is also worth noting that the activities covered by the RCI must encompass both performance in the stock exchange market and in the organized over-the-counter market.

9. This report must be made available to the CVM, with no need to send it to this Autarchy, unless so requested, and must evidence the date of its delivery to the administrative bodies, considering in this case as examples of evidence in this sense meeting minutes with date and signature of the representatives of the applicable administrative body, electronic mail to those responsible with the identification of the date of receipt or equivalent documents.

II – Communication of occurrence or identification of indications of violation of legislation, as established by Article 32, Item IV of CVM Instruction No. 505/2011.

10. We remind you that, in accordance with Article 32, Item IV, of CVM Instruction No. 505/2011, intermediaries must inform the CVM whenever they verify indications of violation of legislation that falls under the CVM's supervision, within a maximum period of 5 (five) business days counted from the occurrence or identification of the fact.

11. This obligation must be provided for in specific regulations established by the intermediary, in accordance with Art. 3, Item I, of CVM Instruction No. 505/2011, and its compliance must be subject to verification by the procedures and internal controls adopted and implemented in accordance with Item II of this article.

12. In this sense, we remind you that said communication is the responsibility of the statutory director indicated in accordance with Item I of Art. 4 of CVM Instruction No. 505/2011, noting that Art. 38 defines as a serious offense, for the purposes provided for in § 3 of Art. 11 of Law No. 6.385/1976, the non-compliance with the provisions of Arts. 3 and 32 of this Instruction.

13. Therefore, considering that the Superintendence of Market and Intermediary Relations will include, among the priorities of its supervision, the verification of compliance with such devices, with emphasis on market illicit acts (artificial conditions of demand, supply or price of securities, price manipulation, fraudulent operation, unfair practice and insider trading), we alert that the necessary measures must be adopted for their adequate compliance.

14. Additionally, we inform that the communications referred to in Article 32, Item IV, of CVM Instruction No. 505/2011, must be sent to the Superintendence of Market and Intermediary Relations of the CVM, at the following addresses: Rua Sete de Setembro, 111, Center - Rio de Janeiro/RJ, ZIP 20050-901; or Rua Cincinato Braga, 340, Delta Plaza Building - São Paulo/SP, ZIP 01333-010. With the purpose of simplifying and speeding up communication between intermediaries and the CVM, we inform that the aforementioned communications may also be carried out by the email address smiviolacao@cvm.gov.br.

15. Finally, we highlight that the forwarding of communications of irregularities to the self-regulators of the organized markets does not replace the communication to the CVM required by the norm.

III – Request for the adoption of an alternative client registration system

CVM Instruction No. 301/1999 and CVM Deliberation 707/2013.

15. CVM Instruction No. 301, of April 16, 1999, establishes, in its Article 3, § 5, that the Collegiate Body of the CVM may authorize the adoption of alternative registration systems, provided that they satisfy the objectives and current norms and adopt procedures subject to verification.

Through CVM Deliberation No. 707, of April 7, 2013, the Collegiate Body of this CVM delegated to the Superintendence of Market and Intermediary Relations – SMI the competence to authorize the adoption of these alternative registration systems.

16. In accordance with the delegation received, the SMI may authorize intermediaries to adopt alternative registration systems, provided that such systems satisfy the objectives of the current norms, have procedures subject to verification and are in consonance with the precedents of the Collegiate Body regarding the subject.

17. This circular letter, regarding this subject, aims to provide guidance to intermediaries who wish to adopt alternative registration systems as provided for by the above norms.

18. In their request, interested parties must, at a minimum, provide the following information:

(i) Nature of the alternative system - Specify individually the mandatory content or procedure that will be replaced and which documents or procedures will be received or performed in substitution. In the case of the adoption of validation processes, detail the information sources for validation and the reasons that led to their choice;

(ii) Scope of application - Determine the universe of clients in which the alternative system will be applied (for example: natural or legal person) and the exceptions in which the regular system will be applied;

(iii) Handling of divergences - Demonstrate how divergences eventually pointed out during the process of analysis and validation of the provided registration data will be treated. What is the role of the different areas and hierarchical instances responsible for the approval and maintenance of the relationship with clients. For example: Registration, Risk Management and Executive Board.

(iv) Compliance with the objectives of current norms - Briefly describe the characteristics of the system that will allow compliance with the following requirements of current norms:

(a) Maintenance of content, date, time, origin and identification of the person responsible for the provision and update of all registration information carried out in the period of, at least, five years;

(b) Capacity of the system to retroact to a previous date, for a minimum period of five years, in order to show the data contained in the registration active on that date;

(c) Security controls and procedures that allow blocking access to registration data by unauthorized persons, as well as the identification of users who had access or made changes to the registration data in the period of, at least, five years;

(d) The existence or not of alert and blocking mechanisms for the expiration of new operations by clients with outdated registrations. If not provided for, explain how the control of the regulatory deadlines for updating the registration of active clients will be carried out;

(e) Description of analytical procedures and approval processes that evidence the additional diligence appropriate for the faithful compliance of Art. 3-A of CVM Instruction 301/1999.

(v) The receipt, maintenance, update, controls and processes associated with the analysis and classification of the risk profile and the adequacy of products to this profile (CVM Instruction No. 539/2013).

19. We remind you that the requests, signed by the director responsible for CVM Instruction No. 301/1999, must be sent to the attention of the Superintendence of Market and Intermediary Relations – SMI at the following addresses: Rua Sete de Setembro, 111, 2nd Floor (protocol) - Center - Rio de Janeiro/RJ, ZIP 20050-901; or Rua Cincinato Braga nº 340, 2nd Floor (protocol) - Delta Plaza Building - São Paulo/SP, ZIP 01333-010, or, still, by the electronic address smi@cvm.gov.br.

Sincerely,

Waldir de Jesus Nobre
Superintendent of Market and Intermediary Relations (SMI)