Circular Letter CVM/SMI 06/2020

SECURITIES AND EXCHANGE COMMISSION OF BRAZIL (CVM) Seven of September Street, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686 Cincinato Braga Street, 340/2nd, 3rd and 4th Floors, Bela Vista, São Paulo/ SP – ZIP: 01333-010 – Brazil - Tel.: (11) 2146-2000 SCN Q.02 – Bl. A – Ed. Corporate Financial Center, S.404/4th Floor, Brasília/DF – ZIP: 70712-900 – Brazil - Tel.: (61) 3327-2030/2031 www.cvm.gov.br

Circular Letter No. 6/2020-CVM/SMI
Rio de Janeiro, August 18, 2020.

To
Directors responsible for CVM Instruction No. 505/11 with Intermediaries

Subject: Best practices for monitoring third-party trading platforms connected to the Intermediary's OMS (Order Management System).

Dear Directors,

This Circular Letter aims to bring recommendations to intermediaries regarding measures that should be adopted to ensure that third-party trading platforms, connected to the OMS (Order Management System), are subject to periodic diligence with the objective of avoiding the possibility of carrying out operations contrary to the investor's interest.

I – INTRODUCTION

Article 30 of CVM Instruction No. 505/11 states that intermediaries must conduct their activities in good faith, diligence, and loyalty towards their clients (Article 30, caput), being prohibited from privileging their own interests or those of persons linked to them to the detriment of their clients' interests (Article 30, sole paragraph).
With the advent of CVM Instruction No. 612/19, issued on 08/21/2019 and entering into force on 09/01/2020, requirements related to information technology were introduced, altering and innovating provisions of the current CVM Instruction No. 505/11, the CVM's norm on internal controls.
Among the innovations introduced, CVM Instruction No. 612/19 determines that the intermediary must place, on its digital page and in the contracting term of each trading platform, a notice with the following content: "All order transmission via digital means is subject to interruptions or delays, which may prevent or hinder the sending of orders or the receipt of updated information" (art. 32, item XII).
And CVM Instruction No. 612/19 further requires that the information technology structure must be compatible with the volume, nature, and complexity of its operations, in order to preserve service to clients even during periods of demand peaks (art. 32, § 1º).
And that the technological systems used by the intermediary must be submitted to tests at adequate periodicity, fixed in its policy, to verify their functioning in stress scenarios (art. 32, § 3º, item II, of CVM Instruction No. 612/19).
In particular, CVM Instruction No. 612/19 determines that the intermediary must identify and list its relevant service providers, and must also evaluate the controls performed by these providers and ensure that service provision contracts guarantee certain obligations on the part of the service provider (art. 35-J, caput).
Regarding contracts signed with service providers, CVM Instruction No. 612/19 points out:
I - compliance with the information maintenance requirements provided for in art. 36; II - the institution's access to the data and information to be processed or stored by the service provider; and III - the confidentiality, integrity, availability, and recovery of the data and information processed or stored by the service provider.
Notably, § 1º of art. 35-J of CVM Instruction No. 612/19 warns that the hiring of third parties does not remove the intermediary's responsibility for the recording and archiving of the documents and information mentioned in art. 36.
And the aforementioned art. 36 provides, among other things, that intermediaries must maintain, for a minimum period of 5 (five) years counted from receipt by the intermediary, the audit trails referred to in art. 5º-A and in item II of the sole paragraph of art. 13, and the records of the origins of the orders referred to in item I of § 1º of art. 15.
§ 2º of art. 35-J of CVM Instruction No. 612/19 adds that the intermediary must ensure that contracts regarding outsourced services do not limit or prohibit access by the CVM and the self-regulatory entity:
I - to the content of the contracts; and
II - to documents, data, and information processed or stored by the service providers.
Art. 32, item II, of the current CVM Instruction No. 505/11 also provides that the intermediary must maintain control of client positions, with periodic reconciliation between executed orders; positions in the database that generate the statements and reports of movements provided to its clients; and positions provided by clearing and settlement entities, if applicable.

II – DILIGENCE OF INTERMEDIARIES TOWARDS THIRD-PARTY TRADING PLATFORMS

In this regulatory context and considering the growing adoption of third-party trading platforms by investors, the intermediary is a participant in the securities market, and it is prohibited, under the terms of art. 30, sole paragraph, of CVM Instruction No. 505/11, to privilege its own interests or those of persons linked to it to the detriment of its clients' interests, including in the case of client access through platforms linked to the intermediary.
Here, a platform linked to the intermediary is understood as one that has with it a service provision contract directly related to the intermediation activity or operational support, as provided in art. 1º, VI, c, of CVM Instruction No. 505/11.
Therefore, the receipt of orders, in the name of the investor, originating from third-party trading platforms must be duly evaluated regarding:
a) suitability to the investor's profile; b) the account not having been captured by third parties (irregular portfolio administration); c) excessive portfolio turnover (churning).
For this purpose, Circular Letter No. 5/2019-CVM/SMI, of 10/11/2019, had already addressed best practices, by intermediaries, for monitoring operations with excessive costs for investors, involving the suitability process, irregular portfolio administration, and churning.
Along with these best practices and considering that third-party trading platforms are relevant service providers, it is recommended that the intermediary perform periodic evaluation of the controls performed by these providers (art. 35-J, caput, initial part, of CVM Instruction No. 612/19).
Not only that, in the understanding of this SMI, the intermediary must ensure that the service provision contracts signed with third-party trading platforms guarantee (art. 35-J, caput, final part, of CVM Instruction No. 612/19):
I - compliance with the information maintenance requirements provided for in art. 36; II - the intermediary's access to the data and information to be processed or stored by the third-party trading platform; and III - the confidentiality, integrity, availability, and recovery of the data and information processed or stored by the third-party trading platform.
It should be noted that § 1º of art. 35-J of CVM Instruction No. 612/19 warns that the hiring of third-party trading platforms does not remove the intermediary's responsibility for the recording and archiving of the documents and information mentioned in art. 36.
And § 2º of the same device adds that the intermediary must ensure that contracts regarding third-party trading platforms, as relevant service providers, do not limit or prohibit access by the CVM and the self-regulatory entity:
I - to the content of the contracts; and
II - to documents, data, and information processed or stored by the third-party trading platforms.
Among these diligences, and in line with the new CVM Instruction No. 612/19, this SMI understands that the intermediary must have adequate technology structure to monitor the volume, nature, and complexity of operations originating from third-party trading platforms in order to preserve service to all its clients, even during periods of demand peaks (art. 32, § 1º).
Furthermore, to the extent of the criticality of the platform's systems for the intermediary's own operation, this Technical Area understands that it must also submit third-party trading platforms, just as it does with its own systems, to tests at adequate periodicity, fixed in its information technology policy, to verify their functioning in stress scenarios (art. 32, § 3º, item II, of CVM Instruction No. 612/19), as well as the integrity of audit trails, to ensure the tracking of additions, alterations, and deletions (sole paragraph of art. 5º-A of CVM Instruction No. 612/19).
It should be noted that, in the case where the third-party trading platform provides services and order automation algorithms, as well as when it is a relevant service for the intermediary's own operation, it must perform diligence, at adequate periodicity, fixed in its information technology policy, to verify if the platform has adequate controls both for the creation and testing of these algorithms and for monitoring their functioning, in a manner analogous to other third-party trading platforms (art. 35-J, caput, of CVM Instruction No. 612/19).
In the view of this SMI, the intermediary, under the terms of art. 32, V, CVM Instruction No. 505/11, must disclose information to its clients regarding the eventual charging of costs related to the use of third-party trading platforms linked to it, as well as alert clients regarding the correct understanding and use of the functionalities existing on third-party trading platforms, especially those related to the parametrization of order conditions, thus avoiding the execution of transactions that do not meet the client's objectives.
Moreover, in the understanding of this Technical Area and as a best practice, the intermediary must guarantee the timely synchronization of sensitive information related to (i) the actual custody position and orders issued in the name of the client, (ii) operational limits, risk exposure, and available guarantees for operations executed in the name of the client, and (iii) the information presented by third-party trading platforms, ensuring that the maximum latency time for such synchronization between the different platforms is duly made available to the client, either by adhesion contract or by announcements offering third-party trading platforms, clarifying by which means the client can access such information, thus avoiding causing an informational failure that could mislead the client (art. 32, item II, of the current CVM Instruction No. 505/11).
Additionally, this Technical Area understands that, under the terms of the risk management view established by CVM Instruction No. 612/19, it is a best practice, to the extent of the criticality and relevance of the use of algorithms, that the intermediary's control and risk management systems are capable of making a general assessment of their degree of exposure to business models intensive in the use of algorithms, also known as "algotrading", including those brought by contracted platforms, as well as implementing governance and mitigation policies proportional to the identified risks.
Still considering the provisions of article 30, sole paragraph, of CVM Instruction No. 505/11, we consider it important the evaluation and disclosure by the intermediary to its clients of relevant conflicts of interest that may arise involving the business models of the contracted platforms, including those arising from their interactions with social media and other forms of electronic media.
Finally, it is a best practice that the intermediary presents, in a clear, objective, and easily accessible manner on its internet page, as well as in a specific clause, with due emphasis, in the contracting term of each third-party trading platform made available, the following minimum information, following the determination of art. 32, item XII, of CVM Instruction No. 612/19:
a) All order transmission via digital means is subject to interruptions or delays, which may prevent or hinder the sending of orders or the receipt of updated information (i) of order 'status'; (ii) of custody positions, operations, and limits; and (iii) of asset quotes. b) Methods of updating information on the platform, among them, (i) order 'status'; (ii) custody positions, operations, and limits; and (iii) asset quotes. c) Methods of contracting the tool. d) Related costs (use, test environment, etc.). e) Functionalities (platform manual, etc.). f) Methods to test the tools and functionalities (test environment made available to the investor, etc.). g) Contingency procedure, detailing the steps to be followed by the investor in cases of unavailability and instability of the tool and methods of notice about incidents by the Broker. h) Available types of platforms, algorithms, and responsibilities involved in each type. i) Audit trails – registered information.

III – COMMUNICATIONS TO THE CVM

The intermediary, for all the above stated, when monitoring third-party trading platforms and identifying irregularities, must communicate to the CVM, as determined by art. 32, item IV, of CVM Instruction No. 505/11.

IV – CONCLUSION

Acting thus, it is expected that the intermediary acts in a healthy and diligent manner, in the best interest of the client, to mitigate the possibility that third-party trading platforms, connected to its OMS, may cause the investor not only possible loss of business opportunities, but also excessive costs.

Sincerely,

Document electronically signed by Francisco José Bastos Santos, Superintendent, on 08/18/2020, at 14:51, based on art. 6º, § 1º, of Decree No. 8.539, of October 8, 2015.
The authenticity of the document can be verified on the site https://sei.cvm.gov.br/conferir_autenticidade, informing the code verifier 1078304 and the CRC code 891D4267.
This document's authenticity can be verified by accessing https://sei.cvm.gov.br/conferir_autenticidade, and typing the "Código Verificador" 1078304 and the "Código CRC" 891D4267.
Reference: Process No. 19957.005135/2019-17 SEI Document No. 1078304

Circular Letter CVM/SMI 06/2020

Lineage: In force