Circular Letter CVM/SMI/SIN 04/2020

14/12/2020 SEI/CVM - 1158057 - Circular Letter https://sei.cvm.gov.br/sei/controlador.php?acao=documento_imprimir_web&acao_origem=arvore_visualizar&id_documento=1220080&infra_sistema… 1/11 SECURITIES AND EXCHANGE COMMISSION OF BRAZIL (CVM) Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686 Rua Cincinato Braga, 340/2nd, 3rd and 4th Floors, Bela Vista, São Paulo/ SP – ZIP: 01333-010 – Brazil - Tel.: (11) 2146-2000 SCN Q.02 – Bl. A – Ed. Corporate Financial Center, 4th Floor, S.404, Brasília/DF – ZIP: 70712-900 – Brazil - Tel.: (61) 3327-2030/2031 www.cvm.gov.br Circular Letter No. 4/2020-CVM/SMI-SIN Rio de Janeiro, December 11, 2020.

To
Directors responsible for CVM Instruction No. 617/19.

Subject: Main improvements in AML/CFT processes associated with the entry into force of CVM Instruction No. 617/19.

Dear Directors,

1. This Circular Letter aims to present the main improvements in anti-money laundering and terrorist financing prevention processes [1] (“AML/CFT”) associated with the entry into force of CVM Instruction No. 617/19 (“ICVM 617/19”) on 10/01/2020, (with the exception of articles 27 and 28 which have been in force since 12/05/2019, the date of publication of the Instruction), as well as to present the expectations of the Department of Market and Intermediary Relations (“SMI”) and the Department of Institutional Investor Relations (“SIN”) regarding the diligence expected from obligated persons.

RISK-BASED APPROACH
2. In line with the governance of the Risk-Based Approach (“RBA”), obligated persons must, within the limits of their responsibilities, identify, analyze, and understand the money laundering and terrorist financing (“ML/TF”) risks of their respective clients, products, services, distribution channels, and relevant service providers, to subsequently segment them minimally into low, medium, and high, as determined by item II of article 5 of ICVM 617/19, and based on existing information.
2.1. In situations of higher risk, and always in line with the AML/CFT Policy, as per Chapter II of ICVM 617/19, it is the responsibility of the obligated person to seek supplementary information beyond that contained in the client’s registration, if available within the institution or respective Financial Conglomerate, or even from previously qualified third parties.
2.2. In any case, the terms provided in Law No. 13.709/18 (“General Data Protection Law”) clarify that the institution has a mandate for the eventual prospecting of this additional information, reiterating here that the use of these inputs by the obligated person must not, for AML/CFT purposes, exceed the scope of Laws No. 9.613/98, 13.260/16, and 13.810/19.
3. With the advent of ICVM 617/19, requirements related to guidelines from senior management that must integrate the AML/CFT Policy were introduced, innovating the provisions of ICVM 301/99, which produced effects from 08/02/1999 until 09/30/2020.
4. The respective rules, procedures, and internal controls aimed at faithfully complying with the new Instruction, especially for mitigating the risks pointed out in paragraph 2 of this Circular Letter, must (i) be aligned with the institutional risk appetite provided in said Policy, (ii) take into account the considerations presented in the Explanatory Note to ICVM 617/19[2], and (iii) observe the provisions of CMN Resolution 4.859/20[3] regarding the adequate implementation of communication channels, when applicable. Obligated institutions, as per article 3 of ICVM 617/19, that are not subject to prior registration with the Central Bank of Brazil, must consider the voluntary adoption of said channels, as, in addition to being an important tool for managing the risks addressed here, they are also considered by SMI and SIN as a good ‘compliance’ practice.

14/12/2020 SEI/CVM - 1158057 - Circular Letter https://sei.cvm.gov.br/sei/controlador.php?acao=documento_imprimir_web&acao_origem=arvore_visualizar&id_documento=1220080&infra_sistema… 2/11
5. Nevertheless, the obligation to implement rules, procedures, and internal controls aimed at complying with (i) measures to render assets, rights, and values unavailable as a result of resolutions of the United Nations Security Council (“UNSC”); and (ii) demands for international legal cooperation arising from other jurisdictions in accordance with current national legislation as per Law 13.810/19, Decree 9.825/19, and articles 27 and 28 of ICVM 617/19 must also be emphasized, with these last two provisions being in force since the publication of said Instruction.
6. Another important point is the requirement for the annual preparation of the Internal Risk Assessment (art. 4 et seq. of ICVM 617/19). Thus, considering the transition process from the old to the new AML/CFT regulatory framework in the capital markets, the first version of said report, which will address the 2020 fiscal year, must be completed by 04/30/2021, considering the period immediately following the revocation of ICVM 301/99, namely, the period from October to December 2020.

KNOW YOUR CLIENT POLICY
7. In this vein, ICVM 617/19 also improved the “Know Your Client” process by determining, beyond the identification and data collection process for clients, continuous diligence aimed at collecting supplementary information and, in particular, identifying their respective beneficial owners (See caput of art. 17 and Annex 11-A, art. 3, sole paragraph, of ICVM 617/19).
7.1. This is because, since client identification information is declared by the clients themselves, such information must be submitted to a data validation process by the participant.
7.2. Within this validation, the need for periodic consultation of the disqualified registry maintained by CVM[4] is found.
7.3. It should be highlighted that, if the minimum information required by ICVM 617/19 is not obtained, the participant must diligently seek not only to validate the data that was reported but also to obtain the other unreported data.
7.4. If, even so, the obligated institution does not possess all the required information, this situation does not prevent the start of the commercial relationship.
7.5. However, this exceptional situation must be provided for in the participant’s respective AML/CFT Policy, including, as provided in §1 of art. 16 of ICVM 617/19:
a) enhanced monitoring; b) more careful analysis of generated alerts; and, finally, c) evaluation by the director responsible for ICVM 617/19, subject to verification, regarding the interest in maintaining the relationship with the client.
7.6. Among the diligence to be adopted by participants for validating registration data, the importance of periodic consultation on the CVM page of the list of participants who are temporarily prohibited from operating in the securities market[5] must be highlighted. The frequency of this routine must be provided for in the respective AML/CFT Policy.

CLIENT AND INVESTOR
8. Regarding this, it is important to highlight that the definitions of client and investor complement each other in the Instruction, as every investor will necessarily be a client of at least one institution. These concepts, “client” and “investor,” to be observed by obligated entities, are those described in the Definitions Chapter of ICVM 617/19, namely, in their most restrictive and broad senses, respectively. And, to better clarify the purpose of using one or the other term throughout the norm, we explain as follows.
8.1. Article 11, caput, cites the term “investor,” but does not refer to all, but only to those with whom the institution maintains a “direct relationship,” that is, it refers to the concept of client. Thus, the passage “The persons mentioned in items I to III of art. 3 of this Instruction who have a direct relationship with the investor must identify them” can, for example, be read as “The persons mentioned in items I to III of art. 3 of this Instruction must identify the client.”
8.2. Article 11, § 1, and article 13, explicitly refer to “clients,” which is why it is a provision that applies to institutions specifically regarding their clients, that is, consistently with the caput of article 11.
8.3. Furthermore, we clarify that by “direct relationship” the norm intended to specify situations in which the obligated person effectively maintains a commercial relationship, as per what ICVM 505/11 has long addressed in item III of art. 1:
(III) principal or client: a natural or legal person, investment fund, investment club, or non-resident investor, in whose name operations with securities are carried out.

14/12/2020 SEI/CVM - 1158057 - Circular Letter https://sei.cvm.gov.br/sei/controlador.php?acao=documento_imprimir_web&acao_origem=arvore_visualizar&id_documento=1220080&infra_sistema… 3/11
9. The wording of ICVM 617/19, art. 2, items V and X, adapted the concept of client with that of investor, maintaining the understanding of ICVM 505/11, and clarifying, for the exclusive purposes of AML/CFT, the more limited (species) scope of the concept of client and the broader (genus) scope of the concept of investor:
(V) client: investor who maintains a direct commercial relationship with the persons mentioned in art. 3 of this Instruction; (X) investor: natural or legal person, fund or collective investment vehicle, or non-resident investor in whose name operations with securities are carried out.

CONSIDERATIONS ON INVESTMENT FUNDS
10. For investment funds, as a general rule, the distributor will be the service provider that maintains a direct commercial relationship with the unit holder, and it is their responsibility to collect registration information, maintain the registry, and adopt the diligence provided for in their AML/CFT Policy to control and monitor AML/CFT risk regarding their activities. The table below aims to illustrate how each service provider interacting with an investment fund should treat such a situation:

Service Provider of the Fund	Client
Fiduciary Administrator, provided it does not act in the distribution of fund units	Investment Fund
Asset Manager, provided it does not act in the distribution of fund units	Investment Fund
Asset Manager of Exclusive Investment Funds or Funds that are required to consult unit holders on investment decisions	Unit Holder
Distributor	Unit Holder
Custodian and Registrar	Investment Fund
Intermediary	Investment Fund and the Manager

10.1. It will be the responsibility of the fiduciary administrator that does not act in the distribution of the investment fund’s units and that does not have the unit holder as its client under ICVM 617/19, to establish in its AML/CFT Policy the operation of the distributor to verify if it has adequate AML/CFT processes and mechanisms (“know your partner”), establishing specific routines for this purpose, including the form of evaluation and adequate periodicity.
10.2. The other service providers that operate in the investment fund market and do not have a direct commercial relationship with the client, that is, that do not distribute the vehicle’s units, are not responsible for collecting and maintaining the unit holder’s registration information.
10.3. However, they are not exempt from assessing the possibility, in higher-risk situations, of using the tools provided for in § 1 of art. 17 of ICVM 617/99, mainly to mitigate possible asymmetries in risk appetite with other obligated persons with whom they interact and who relate directly to the unit holders.
10.4. In this scenario, it is reasonable to expect that in adopting the RBA concept, the diligence aimed at better knowing some characteristics of the unit holder will be proportionally smaller than those to be adopted by providers that have a direct commercial relationship with the unit holder, always respecting the confidentiality or access restriction regimes provided for in legislation. An example of this, which does not aim to exhaust this theme, is the consultation aimed at identifying investment funds that have a politically exposed person (“PEP”) or a non-profit society as a beneficial owner, as per § 2 of art. 5 of the Instruction, naturally without access to any confidential information.
10.5. For this purpose, the AML/CFT Policy of these institutions must define the criteria, scope, and diligence to be applied, always taking into account the elements necessary for implementing the monitoring measures of the investment fund (“client”) throughout the provision of services. For such definition, the degree of ML/TF risk attributed by the institution in its AML/CFT Policy, regarding that which maintains a direct relationship with the unit holder, will also contribute.

REGISTRY
Registry Update
11. Already in the provision of item III of art. 4 of ICVM 617/19, the obligated persons listed in art. 3 who have a direct relationship with the investor must pay attention that the AML/CFT Policy must necessarily address, among other points, the definition of criteria and periodicity for updating the registries of active clients, according to its art. 11, observing a maximum interval of 5 (five) years.

14/12/2020 SEI/CVM - 1158057 - Circular Letter https://sei.cvm.gov.br/sei/controlador.php?acao=documento_imprimir_web&acao_origem=arvore_visualizar&id_documento=1220080&infra_sistema… 4/11
11.1. The registries of lower-risk clients, according to the classification of the obligated institution, shall be updated according to the periodicity determined in the respective AML/CFT Policy, observing the deadline fixed in art. 4, III, of ICVM 617/19, counted from the date of registration or the last registry update.
11.2. As for the registries of higher-risk clients, also according to the classification of the obligated person, they shall be updated according to the periodicity determined in the same AML/CFT Policy, observing, however, the maximum renewal period of 24 (twenty-four) months, provided for in ICVM 301/99 (already revoked), counted from the date of registration or the last registry update. SMI and SIN understand it to be a good practice to take advantage of mutual information, both for the investment profile and for the registry. And, opportunistically, from a possible change in the ‘suitability’ norm, under study, they also understand it to be a good practice to align the deadline for updating the client’s investment profile with the deadline for updating the client’s registry, provided for in the AML/CFT Policy.

New Minimum Information
11.3. The new minimum information required in the investor’s registry, namely, “spouse or partner’s CPF number” and “CNPJ of the company for which they work,” apply to all natural person investors, national or non-resident (“NRI”). In the case of NRIs, information compatible with the respective jurisdiction of origin must be collected.
11.4. Furthermore, specifically in lower-risk situations, both regarding client risk and order transmission, or even, in line with the risk appetite inserted in the participant’s respective AML/CFT Policy, it will be possible to admit the conduct of business without such data being available. However, in these cases, a specific routine must be provided for and evidenced so that this information can be collected diligently at the first opportunity and on a priority basis.
11.5. Additionally, in cases where the investor has more than one employment link, the information of the corporation that has greater relevance regarding the income of that investor must be considered. It is important to note here that such treatment is of a registry nature, that is, this will not exempt the obligated person from collecting, in higher-risk situations, the supplementary data within the due continuous diligence.
11.6. Regarding the minimum information related to the “mother’s name,” we understand that in situations where it is not possible to obtain it, or even if its collection is not applicable, such record can be supplemented with the “registration of affiliation” and the respective name of the parents.

Alternative Registration System
11.7. The alternative registration system, previously provided for within the scope of ICVM 301/99, art. 3, §5, required prior appreciation by SMI for its implementation, as per CVM Deliberation No. 707/13.
11.8. With the advent of ICVM 617/19, art. 12, the alternative registration system is optional for all participants and its implementation is no longer pending CVM authorization. However, it must be duly provided for in its AML/CFT Policy, with evidence of its implementation accessible to SMI and SIN, as well as to the self-regulatory organization.

ON ACCOUNT BLOCKING
12. Incidentally, regarding the blocking of accounts in outdated registries, we understand that the point addressed in ICVM 617/19 is related to the non-increase of client risk exposure. That is, what is expected is that a client with a blocked account operates solely to reduce or even “zero out” their position, cases of requests for account closure or alienation or redemption of assets.
13. Likewise, in these cases, ICVM 617/19 does not allow voluntary applications, which differs from possible compulsory entries. Thus, AML/CFT duties must necessarily be aligned with the commitments previously assumed by the unit holder of an investment fund. For example, in the situation provided for in the sole paragraph of art. 27 of Instruction CVM 555/14:
Investment in closed funds intended exclusively for qualified investors can be carried out through a commitment, whereby the investor becomes obligated to integrate the value of the committed capital as the fund administrator makes calls, according to deadlines, decision-making processes, and other procedures established in the respective investment commitment.

START AND MAINTENANCE OF COMMERCIAL RELATIONSHIP
14. Art. 18 of ICVM 617/19 determines that obligated persons responsible for collecting registration information must only start any business relationship or continue an existing relationship with the client if the due compliance with the client identification process (art. 11 et seq. of ICVM 617/19) is observed, which encompasses the ‘Beneficial Owner Identification’ and ‘Know Your Client’ processes.

14/12/2020 SEI/CVM - 1158057 - Circular Letter https://sei.cvm.gov.br/sei/controlador.php?acao=documento_imprimir_web&acao_origem=arvore_visualizar&id_documento=1220080&infra_sistema… 5/11

15. As seen, the regulation imposes a duty of conduct on the obligated institution, which must, whenever requested by the CVM or the self-regulatory entity, demonstrate that it has taken all reasonable measures within its reach to obtain complete identification of the client, including the beneficial owner. However, this situation does not imply an obligation for the obligated entity to refrain from initiating, or even to terminate, the relationship with the client, as the decision remains within the institution's purview, based on its risk approach and appetite, including reputational risk, if applicable.

16. Without prejudice to the above, in such situations, it is essential to effectively apply routines aimed at reinforced monitoring of operations or atypical situations involving that client, as well as conducting a more rigorous analysis of possible alerts generated with a view to possible communication to COAF, always in accordance with Article 22 of ICVM 617/19.

CONSIDERATIONS REGARDING NON-RESIDENT INVESTORS (NRIs)

17. Regarding the treatment to be given in the governance of collecting and maintaining information involving the use of the simplified registry of non-resident investors, including the respective monitoring of atypicalities, we reiterate here the terms presented in Circular Letter No. 3/2018-CVM/SMI/SIN[6], as well as by BSM in its Guidance Guide No. 004/2020-DAR-BSM[7] recently published, given that these points had been previously discussed and agreed upon with SMI and SIN.

MONITORING AND SELECTION OF OPERATIONS, PROPOSALS FOR OPERATIONS, OR ATYPICAL SITUATIONS ANALYSIS AND COMMUNICATION OF ATYPICAL EVENTS TO COAF

18. Furthermore, monitoring systems aimed at selecting and detecting the hypotheses for communication provided for in Article 20 of ICVM 617/19 must be fully consistent with the guidelines established in the AML/CFT Policy.

18.1. In the event that the obligated institution resorts to third parties to develop, maintain, or even update the parametrization of these systems, such entities must be classified as relevant service providers and subjected to due diligence prior to their effective hiring, including their respective adherence to Law No. 13.709/18 (“General Data Protection Law”).

18.2. In accordance with item I of Article 4 of ICVM 617/19, under no circumstances will it be permitted that the routines for analyzing atypicalities and respective reporting to COAF, as well as the responsibility for analyzing the atypicality, be transferred to these service providers.

19. All transactions, proposals for transactions, or situations of all clients processed by the obligated entity must be subject to this monitoring, regardless of the values involved or the risk classification of any of the variables related to the event itself.

20. Regarding the monitoring of operations performed by investment funds, it is our understanding that, just as the liabilities of clients and investors, the trading of financial assets and securities that make up the assets of these vehicles must also be monitored for AML/CFT purposes and subsequently analyzed, if applicable.

20.1. Even when an investment fund has the majority of its operations performed in organized market environments, such as in the case of some equity investment funds, this does not exempt the administrator and manager from maintaining, also in this case, their own routines for verifying operations or situations suspicious and subject to communication to COAF, always within the limits of their duties.

20.2. Therefore, it is not possible to endorse a possible argument that, given the impossibility of determining the counterparty of the operation, it would not be possible to make a communication, either because (i) the direction of the counterparty of the operations is indeed possible in certain circumstances (for example, shares, options, and private credit titles with very low liquidity), or because (ii) we already deal with the sending of communications to COAF by obligated entities involving operations in organized markets.

20.3. Structured funds, such as REITs (FIIs), Special Purpose Investment Funds (FIDICs), and Investment Funds (FIPs), must receive special and customized due diligence from each of the service providers of these vehicles (to the extent applicable and in line with their respective RBA methodology), as, due to their characteristics and nature, they present diverse possibilities of being used for money laundering and terrorist financing, compared to what occurs in retail funds.

20.4. In this sense, we cite the need for monitoring by the fund service providers, especially the fiduciary administrator and the manager, of cases involving the private trading of quotas of structured funds, as well as that the respective communication of those cases that do not have evidence of financial movement, or even that were carried out outside market price, if there is a reference parameter or quota valuation, with the aim of generating loss or gain for which there is, objectively, lack of economic or legal basis – see item II of Article 20 of ICVM 617/19.

20.5. It is natural to expect that the investor quota holder of an exclusive fund participates more actively in the vehicle's investment decision-making process, provided that, in any case, the responsibilities of the administrator and manager in decisions taken on behalf of the fund are preserved, as well as the governance structures required by legal and regulatory norms.

14/12/2020 SEI/CVM - 1158057 - Circular Letter https://sei.cvm.gov.br/sei/controlador.php?acao=documento_imprimir_web&acao_origem=arvore_visualizar&id_documento=1220080&infra_sistema… 6/11

20.6. From the perspective of AML/CFT routines, such funds present contours that require attention and particular care on the part of their administrators and managers. This is because, in exclusive funds, the analysis of the exclusive quota holder's personal profile and investment objectives cannot be overlooked in the general verification of the regularity of operations performed by the aforementioned vehicle, unlike an investment fund with a dispersed base of quota holders, precisely due to the possibility of the quota holder's influence on fund management.

20.7. In this sense, we reinforce here the importance of the sole paragraph of Article 18 of ICVM 617/19, which states that obligated entities must be attentive to the nature and purpose of the business relationship maintained with the client. In the case treated here, and notwithstanding the person effectively responsible for distributing the quota, it is up to the administrator and manager to implement a specific routine aimed at better understanding this.

20.8. For example, supervision routines in exclusive funds that allow identifying operations “carried out between the same parties or for the benefit of the same parties, in which there are successive gains or losses regarding any of those involved” (see item “a”, item II of Article 20 of ICVM 617/19) must be reinforced, considering the perspective of the quota holder as the beneficial owner of these operations.

20.9. Other non-exhaustive examples of points of attention we can cite are operations “whose developments include characteristics that may constitute a device to evade the identification of those actually involved and respective beneficiaries” (see item “c”, item II of Article 20 of ICVM 617/19), from the perspective of the possible use of the fund as a vehicle for such evasion; or “carried out with the apparent purpose of generating loss or gain for which there is, objectively, lack of economic or legal basis” (see item “g”, item II of Article 20 of ICVM 617/19).

20.10. One must not confuse the figure of the administrator or manager as a legal entity, who is responsible both for communicating suspicious operations and for maintaining the AML/CFT structure, with that of operators, traders, analysts, and managers as natural persons who work on behalf of the institution, and who may eventually violate the norms applicable to their activity, even entirely against the knowledge and ignorance of the companies that hired them and their rules and policies.

20.11. Resource administrators and managers are already obligated to maintain an adequate structure to ensure the verification of the permanent compliance with the duties imposed on them resulting from the activities exercised, with the respective calculation and investigation of eventual illicit acts and, within limits, the appropriate punishment of those involved.

20.12. Thus, the communication of operations or atypical situations performed by a certain market participant, even when involving their employees, does not necessarily constitute evidence of the practice of irregularities by the communicator; on the contrary, it only reinforces and corroborates the existence and maintenance of robust, effective, and adequate internal rules, procedures, and controls to what is provided by the Money Laundering Law, and which will also be considered, in the event of a CVM inspection, as elements that remove the administrative liability of the legal entity.

20.13. On the other hand, regarding compliance with the provisions of Articles 27 and 28 of ICVM 617/19, we remind you that the other service providers of the fund, in addition to those who have a direct relationship with the quota holder, are also obligated to comply with the determinations imposed by the UN Security Council (CSNU), in case they possess information that allows them to execute the unavailability order. In situations like these, such service providers must interact with the fund distributor through the mechanisms provided for in § 1 of Article 17 of ICVM 617/19.

21. Without prejudice to guidelines emanating from self-regulatory entities, which were previously agreed upon with SMI and SIN, the deadlines for selecting the atypical event, as well as for concluding the respective analysis, must integrate the scope of the obligated institution's AML/CFT Policy. Subsequently, the respective performance of these routines must be measured and presented in the Internal Risk Assessment, at which point such indicators will demonstrate whether they were or were not effective for the purposes of mitigating the risks treated here.

22. The communication of an operation or atypical situation must be sent to COAF within a period of up to 24 (twenty-four) hours from the moment of concluding the analysis that defined the reporting of the atypicality to the Financial Intelligence Unit. The minimum content expected to be contained in this report must follow the provisions of Article 22 of ICVM 617/19, reiterating here that the mere proposal of operations that may constitute serious indications of ML/TF can be subject to this communication.

23. Sending the communication of an operation or atypical situation to COAF does not exempt the obligated entity from also evaluating, if applicable, whether the event should also be communicated to the CVM in accordance with item IV of Article 32 of ICVM 505/11.

24. In accordance with Article 23 of ICVM 617/19, obligated entities must communicate to the CVM, if applicable, the non-occurrence, in the previous calendar year, of situations, operations, or proposals for operations subject to communication. This routine must be implemented through the mechanisms established in the agreement concluded between the CVM and COAF. For transition purposes from the old AML/CFT regulation to ICVM 617/19, the possible communication of this type of report regarding the 2020 exercise may be sent until 04/30/2021 – see Annex II of this Circular Letter.

25. Specifically regarding the provisions of Law 13.810/19, Decree 9.825/19, and Articles 27 and 28 of ICVM 617/19, the latter in force since the publication of the aforementioned Instruction, and already treated in paragraph 5 of this Circular Letter, we highlight that the monitoring of the respective lists of the United Nations Security Council (“UNSC”) aims to identify the alert signals provided for in items “a” and “b” of item III of Article 20 of the Instruction.

25.1. Obligated institutions must pay attention that the faithful compliance with the aforementioned provisions applies to business relationships maintained by persons included in the list of Article 3 of ICVM 617/19 and to those that may be initiated subsequently with any clients covered by the unavailability determinations. Regarding this, we also reiterate here the point described in paragraph 20.13 of this Circular Letter.

25.2. The compliance with the routines treated here must have an immediate character; the concept of Risk-Based Approach does not apply. Once the communication hypotheses registered in paragraph 25 of this Circular Letter are detected, the unavailability routines must be promptly implemented without the need for prior analysis, and regardless of the values involved.

25.3. In accordance with item II of Article 27 of ICVM 617/19, and immediately after the effective unavailability of assets, COAF must be communicated within the frameworks of items “a” or “b” of item III of Article 20 of the Instruction, without prejudice to the simultaneous communication to the CVM through the address listas@cvm.gov.br, as well as to the Ministry of Justice and Public Security (“MJSP”) at the address csnu@mj.gov.br.

25.4. The unavailability referred to in Articles 27 and 28 of ICVM 617/19 refers to the prohibition of transferring, converting, moving, making available, or disposing of assets, directly or indirectly, as provided for in item II of Article 2, its administration, custody, or safekeeping must follow the provisions of § 2 of Article 31, all of Law No. 13.810/19.

ON THE REGISTRATION OF OPERATIONS AND MAINTENANCE OF RECORDS PROVIDED FOR IN CHAPTER VI OF ICVM 617/19

26. The measures to be implemented by obligated entities for the faithful compliance with Chapter VI of ICVM 617/19, in accordance with Articles 25 and 26 of the Instruction, must also observe the scope of ICVM 505/11, insofar as applicable, especially regarding paragraph 32 of this Circular Letter.

SPECIFIC CONSIDERATIONS ON:
SECURITIES CONSULTANTS
CREDIT RATING AGENCIES
SECURITIES REGISTRARS

27. The following will present specific considerations regarding some peculiarities involving some of the obligated entities treated in Article 3 of ICVM 617/19, starting with securities consultants.

28. As established in ICVM 592/17, the exercise of securities consulting activity comprises the provision of professional, independent, and individualized advice, recommendation, and counseling services on investments in the securities market, whose adoption and implementation are exclusive to the client. Therefore, the investor must be considered as a client of the consultant, based on the direct commercial relationship of service provision maintained with them. Although not responsible for the investor's registration with the intermediary or distributor, the consultant is subject to suitability rules, which determine obtaining information that allows making investment product recommendations appropriate to the investor's risk profile.

29. It is verified that in their operation, the securities consultant has access to information that justifies monitoring their clients regarding AML/CFT. As the implementation of investment recommendations provided by the consultant is exclusive to the client and the investor may not always choose to share their operations with the consultant, the level of monitoring of these clients in an RBA context will involve fewer diligences compared to clients who provide data on their investment portfolio to the consultant.

30. We also highlight credit rating agencies, regarding the issuers that hire them, as well as securitization companies, regarding the assignors or originators from whom they acquire titles for the issuance of certificates. Such service providers must conduct due diligence and apply directly to them the rules, procedures, and internal controls, as well as respective verifications appropriate for the identification of atypicalities. For example, business proposals, even if not carried out, for which “there is lack of economic or legal basis” (Article 20, II, “g”); or “that may constitute a device to evade the identification of those actually involved and respective beneficiaries” (Article 20, II, c), seen here the classified or structured issuance, as applicable, as the means by which the identification of these beneficiaries is hidden or made difficult.

31. Without prejudice to the obligations contained in Article 21 of ICVM 543/13 and Articles 27 and 28 of ICVM 617/19, as well as specific routines involving the provision of services in the investment fund market, it will be up to securities registrars to define in their AML/CFT Policies their respective risk appetite, and also which investor information will be requested, if applicable, to entities administering organized markets, to entities operating financial market infrastructure, and to intermediaries, for the purposes of necessary governance of the risks treated here.

31.1. For this purpose, and notwithstanding the provisions of Article 15 of the same ICVM 543/13, registrars must, within the scope of the routines provided for in § 1 of Article 17 of ICVM 617/19, inform entities administering organized markets, entities operating financial market infrastructure, and intermediaries, which supplementary information will be demanded for the purposes of managing ML/TF risks.

ON THE USE OF NEW TECHNOLOGIES

32. In accordance with item “a”, item I of Article 7 of ICVM 617/19, obligated institutions must implement specific rules, procedures, and internal controls for the treatment of new technologies, aiming to mitigate ML/TF risks.

33. For this purpose, the respective AML/CFT Policy must consider, when applicable, the premises of the Information Security Policy, provided for in Article 35-D and following of ICVM 505/11, including, among others, the treatment and control of client data and cybersecurity.

34. And among the control of data of these investors are the registration data and other information that allow the identification of clients.

35. The AML/CFT Policy, aligned with the Information Security Policy, as defined in Article 35-D of ICVM 505/11, must provide, at a minimum, measures to be adopted for the treatment of cyber incidents and recovery of data and systems. Thus, it is fundamental to understand that work aimed at mitigating ML/TF risks must also observe risks related to possible cyberattacks.

OBSERVATIONS REGARDING THE DIRECTOR RESPONSIBLE FOR ICVM 617/19

36. The Director Responsible for ICVM 617/19, previously Director Responsible for ICVM 301/99, now has new duties, beyond those determined in the old AML/CFT regulation. Thus, we must highlight the provisions of Article 8 of ICVM 617/19, as well as the duties aimed at implementing and maintaining the AML/CFT Policy, which must be compatible with the nature, size, complexity, structure, risk profile, and business model of the institution, in order to ensure the effective management of the ML/TF risks pointed out.

37. Furthermore, we also emphasize the requirements provided for in Article 6 of the Instruction, which determine that the AML Director prepare a report regarding the internal assessment of ML/TF risk, to be sent to the high administration bodies specified in the AML/CFT Policy, by the last business day of April. The scope of the mentioned report must meet all points required in Section II of Chapter II of ICVM 617/19.

CONCLUSION

38. For all these reasons, what is expected is that obligated institutions act healthily and diligently, mitigating the risks inherent to which the securities market is subject so that it can be used for ML/TF, as provided by ICVM 617/19, without failing to meet the best interest of the investor, as prescribed, for example, in Article 30 of ICVM 505/11.

[1] In Annex I of this Circular Letter, considerations on the theme of proliferation of weapons of mass destruction within the context of Law 13.810/19 and the latest FATF/FATF guidelines will be presented.
[2] http://www.cvm.gov.br/legislacao/notas-explicativas/nota617.html [3] https://www.bcb.gov.br/estabilidadefinanceira/exibenormativo?tipo=Resolução %20CMN&numero=4859 [4] http://www.cvm.gov.br/menu/afastamentos/julgamentos.html [5] http://www.cvm.gov.br/menu/afastamentos/index.html [6] http://www.cvm.gov.br/legislacao/oficios-circulares/smi-sin/oc-smi-sin-0318.html [7] https://www.bsmsupervisao.com.br/assets/file/noticias/comunicado-externo-BSM-004-2020-ABR-e-INR.pdf

Sincerely,

14/12/2020 SEI/CVM - 1158057 - Ofício-Circular https://sei.cvm.gov.br/sei/controlador.php?acao=documento_imprimir_web&acao_origem=arvore_visualizar&id_documento=1220080&infra_sistema… 9/11 FRANCISCO JOSÉ BASTOS SANTOS OVÍDIO ROVELLA Superintendent of Market and Intermediary Relations Substitute Superintendent of Institutional Investor Relations

ANNEX I
ON THE PROLIFERATION OF WEAPONS OF MASS DESTRUCTION

1. One of the results of the FATF/GAF Plenary held in October 2020 was the deliberation of some adjustments to the Recommendations and their respective Interpretative Notes of that body, in order to require that countries and their respective obligated subjects include in their AML/CFT risk matrices the theme of the proliferation of weapons of mass destruction, in accordance with Recommendation 7, that is, all must also identify, analyze, understand, and mitigate such risks. See link below: https://www.fatf-gafi.org/publications/financingofproliferation/documents/statement-proliferation-financing-2020.html .

2. In this vein, it is pertinent to transcribe the considerations that the COAF made on the subject treated here on its address on the world wide web (emphasis added). See link below: https://www.gov.br/coaf/pt-br/assuntos/o-sistema-deprevencao-a-lavagem-de-dinheiro/o-que-e-o-crime-de-lavagem-de-dinheiro-ld .

What is money laundering and terrorism financing

The crime of money laundering is characterized by a set of commercial or financial operations that seek to incorporate into the economy of each country, in a temporary or permanent manner, resources, goods, and values of illicit origin, and that develop through a dynamic process involving, theoretically, three independent phases that, frequently, occur simultaneously.

To disguise illicit profits without compromising those involved, money laundering is carried out through a dynamic process that requires: first, distancing the funds from their origin, avoiding a direct association of them with the crime; second, disguising their various movements to make tracking these resources difficult; and third, making the money available again to the criminals after it has been sufficiently moved in the laundering cycle and can be considered "clean."

Terrorism financing

The fight against terrorism financing is intimately linked to the fight against money laundering. The large-scale terrorist attacks that occurred in the last decade led nations to intensify mutual cooperation against terrorism and its financing.

The organizations of the United Nations System (UN), immediately after the attacks of September 11, 2001, mobilized to intensify the fight against terrorism. Thus, on September 28 of that same year, the Security Council adopted Resolution 1373, to prevent the financing of terrorism, criminalize the collection of funds for this purpose, and immediately freeze the financial assets of terrorists.

Additionally, the Security Council also adopted measures to combat the proliferation of weapons of mass destruction, embodied in Resolution 1540. Thus, the Security Council obliged States to cease any support to non-state actors for the development, acquisition, production, possession, transport, transfer, or use of nuclear, biological, and chemical weapons and their means of delivery. In 2006, following the international effort to contain terrorism, the General Assembly unanimously adopted the UN Global Counter-Terrorism Strategy. This strategy defines a series of specific measures to combat terrorism in all its aspects, at the national, regional, and international levels.

Likewise, the Financial Action Task Force (FATF/GAF), after the attacks of 2001, expanded its mandate to also deal with the issue of financing terrorist acts and organizations, as well as issues related to the financing of the proliferation of weapons of mass destruction. Thus, specific recommendations were created to combat the financing of terrorism. Currently, these recommendations are part of the 40 FATF Recommendations and are presented in the section “C - Terrorism Financing and Proliferation Financing” of the aforementioned publication.

The effort to combat the financing of terrorism has allowed the blocking of material and financial resources of terrorists. Transnational criminal organizations have been dismantled, resulting from the development and employment of agile and secure mechanisms for identifying and strangulating their sources of financing. International cooperation and the exchange of information between Financial Intelligence Units (FIUs) of various countries have been expanded. At this point, the important role of the Egmont Group, which encompasses FIUs from more than 160 countries and acts in promoting the exchange of information, training, and exchange of experiences among these units, should be highlighted.

Brazil repudiates terrorism, as a constitutional principle, and has the conviction that terrorism, in all its forms, is unacceptable and can never be justified. Thus, Brazil is a signatory to the International Convention for the Suppression of the Financing of Terrorism, promulgated by Decree No. 5.640, of December 26, 2005.

The Financial Activities Control Council (COAF) coordinates Brazil's participation in various multigovernmental organizations for the prevention and combat of terrorism financing. Thus, the Council seeks to internalize the discussions and guidelines on how to implement the recommendations of international bodies, with the objective of complying with the best practices adopted to effectively combat financial crimes.

Furthermore, it is the responsibility of COAF to regulate, apply administrative penalties, receive, examine, and identify suspicious occurrences of illicit activities, as well as to communicate to the competent authorities for the initiation of appropriate procedures when the Council concludes the existence or well-founded indications of money laundering and terrorism financing crimes. In light of this, COAF published Resolution No. 31, of June 7, 2019, which establishes procedures to be observed by individuals and legal entities regulated by COAF regarding operations or proposals for operations related to terrorism or its financing.

Brazil took an important step with the promulgation of Law No. 13.260, of March 16, 2016, which “typifies terrorism and its financing.” More recently, the joint action with other bodies stands out for the approval of Law No. 13.810, of March 8, 2019, and its subsequent regulation by the Executive Branch (Decree No. 9.825, of June 5, 2019), which strengthened the AML/CFT system by providing for the compliance with sanctions imposed by resolutions of the United Nations Security Council, including the unavailability of assets of natural and legal persons and entities, and the national designation of persons investigated or accused of terrorism, its financing, or acts correlated to it.

3. In view of the above, and considering that in accordance with Law 13.810/19, the proliferation of weapons of mass destruction is already within the scope of obligations of the respective obligated persons, including monitoring the lists of the United Nations Security Council (“UNSC”) and possible freezing of client assets (see paragraphs 5, 20.13, 25, and 25.1 to 25.4 of this Circular Letter), it is important that this theme be explicitly stated, whenever applicable, in the scope of the AML/CFT Policy, rules, internal procedures, and controls, as well as in the due periodic training.

ANNEX II
NEGATIVE COMMUNICATION

1. Negative communication continues to be required, when applicable. Thus, in line with art. 23 of ICVM 617/19, Participants must communicate to the CVM, if applicable, the non-occurrence, in the previous calendar year, of situations, operations, or proposals for operations that are subject to communication.

2. And this communication must be made annually, until the last business day of April, through the mechanisms established in the agreement concluded between the CVM and the COAF. Therefore, we reinforce that the negative declaration must be effectively sent to the Financial Intelligence Unit (“FIU”) through the Siscoaf system, already available for such communications, and not to the CVM.

3. For those who still do not have access to the system or have doubts about access, we advise consulting the manual available at: http://www.fazenda.gov.br/orgaos/coaf/arquivos/sistema/manual-cadastro.pdf .

4. Some additional clarifications regarding the aforementioned negative communications remain, and the first refers to market participants who, by the very dynamics of the regulation to which they are subject, in one way or another inform the CVM whether or not they exercise the activity.

5. This is the case of portfolio administrators and securities consultants, who, in accordance with the regulations governing their activities, must submit, by March 30 of each year, a reference form (“FR”) in which, among other information, they confirm whether they exercised the activity during the reference period of the document.

6. For these participants, there is no justification for demanding any negative communication to the FIU, since there are no operations in the capital market on which they could express themselves. Thus, portfolio administrators and securities consultants who indicate, through the FR, that they do not exercise the activity, are also exempt from sending the negative communication referred to in article 23 of CVM Instruction No. 617/19.

7. A similar situation is that of portfolio administrators and securities consultants who are natural persons acting as responsible for these activities in a portfolio administrator or securities consultancy legal entity, as the case may be.

14/12/2020 SEI/CVM - 1158057 - Ofício-Circular https://sei.cvm.gov.br/sei/controlador.php?acao=documento_imprimir_web&acao_origem=arvore_visualizar&id_documento=1220080&infra_sistema… 11/11
8. Considering that the director responsible for the portfolio administration or securities consultancy activity of a legal entity is prohibited from accumulating any other activities, within or outside the institution for which they are responsible, it can be assumed that this director acts in the function of portfolio administration or consultancy exclusively through the society for which they are responsible, hence they are not obliged to send, in their capacity as a natural person accredited with the CVM, the aforementioned negative communication, although the legal entity for which they are responsible continues to be obliged to make this communication, clearly.

9. In the same way, the market participant who is in a registration situation indicating non-exercise of the activity in any way, such as, for example, the registration situations of “suspension,” “in extrajudicial liquidation,” or “paralyzed,” is also not obliged to send the communication.

10. It is also worth stating that the obligated person, in accordance with article 23 of CVM Instruction No. 617/19, must send a single negative declaration, regardless of the number of registrations or authorizations they hold with this Commission.

11. Finally, it is worth emphasizing that any report to Siscoaf, whether suspicious communication or negative declaration, should not be made in the name of an investment fund, but rather in the name of the respective service provider, that is, the administrator, the manager, the custodian, among others.

Document electronically signed by Francisco José Bastos Santos, Superintendent, on 11/12/2020, at 17:02, based on art. 6, § 1, of Decree No. 8.539, of October 8, 2015.
Document electronically signed by Ovidio Rovella, Substitute Superintendent, on 11/12/2020, at 17:19, based on art. 6, § 1, of Decree No. 8.539, of October 8, 2015.
The authenticity of the document can be verified on the site https://sei.cvm.gov.br/conferir_autenticidade, by providing the verification code 1158057 and the CRC code 9B53EBD6.
This document's authenticity can be verified by accessing https://sei.cvm.gov.br/conferir_autenticidade, and typing the "Verification Code" 1158057 and the "CRC Code" 9B53EBD6.
Reference: Process No. 19957.000718/2020-87 SEI Document No. 1158057