Circular Letter No. 1/2026/CVM/SNC/SEP on Accounting for Cloud Computing Arrangements — CVM — BR

SECURITIES AND EXCHANGE COMMISSION OF BRAZIL
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686 Rua Cincinato Braga, 340/2nd, 3rd and 4th Floors, Bela Vista, São Paulo/ SP – CEP: 01333-010 – Brazil - Tel.: (11) 2146- 2000 SCN Q.02 – Bl. A – Ed. Corporate Financial Center, S.404/4th Floor, Brasília/DF – CEP: 70712-900 – Brazil - Tel.: (61) 3327-2030/2031 www.cvm.gov.br Circular Letter No. 1/2026/CVM/SNC/SEP Rio de Janeiro, on the date of electronic signature. Dear Investor Relations Director and Dear Independent Auditor Subject: Guidance on relevant aspects to be observed in the accounting of Cloud Computing Arrangements.

Dear Sir/Madam,

The Circular Letters issued jointly by the Superintendence of Accounting Standards and Auditing - SNC and the Superintendence of Corporate Relations – SEP aim to guide the preparation of financial statements and have been considered an effective instrument by the CVM’s technical areas to safeguard the quality of information disseminated in the market.
In this sense, the CVM’s technical areas wish to clarify the accounting treatment to be given to certain events involving Cloud Computing Arrangements, which can be understood as an agreement between a customer and a cloud service provider for the on-demand delivery of computing resources, including software or infrastructure, via the internet.
In this context, some divergences in accounting treatment have been communicated to the CVM’s technical areas, related to arrangements of the SaaS (Software as a Service) type, which, in a brief summary, would be a specific type of Cloud Computing Arrangement, whose contract grants the customer, in exchange for payment, the right to access the supplier’s application software, for a certain period, which is hosted on its cloud infrastructure. Considering the current stage of migration of application software to the cloud, it has been reported that these events may represent relevant expenses to entities, demanding special attention regarding the accounting aspects to be observed, so that accounting information is not distorted and comparability is maintained.
It is important to note that this subject was the topic of two IFRS IC Agenda Decisions, one from March 2019 and another from April 2021, respectively:

Customer’s Right to Receive Access to the Supplier’s Software Hosted on the Cloud (IAS 38 Intangible Assets – Agenda Paper 7)
Configuration or Customization Costs in a Cloud Computing Arrangement (IAS 38 Intangible Assets – Agenda Paper 2)

In the first Agenda Decision, the IFRS IC concluded that a contract in the SaaS format, as described in the submission, in which only the right to receive access to the supplier’s application software, hosted on its cloud infrastructure, is granted to the customer, is a service contract, and cannot be considered a software lease nor a software use license (intangible asset).
In the second Agenda Decision, the topic submitted to the IFRS IC was the accounting treatment to be given to configuration and customization expenses, with the purpose of adapting the use to the customer’s needs, in a cloud computing arrangement in the SaaS format (service contract). Specifically, the doubt raised was whether configuration and customization expenses could be considered an intangible asset and, if not, how they should be accounted for.
Thus, it is necessary that administrators of publicly held companies and their independent auditors pay attention to the characteristics, nature, and particularities of SaaS-type contracts, particularly regarding expenses related to configuration and/or customization, for the purposes of recognition, presentation, measurement, and disclosure of these events in the financial statements, taking as a basis the applicable accounting standards.

Customer’s Right to Receive Access to the Supplier’s Software Hosted on the Cloud

Generally, the recognition of an asset by an entity is conditioned on obtaining control over that asset (the power to obtain future economic benefits and to restrict third parties’ access to those benefits).
In the case of a lease asset, item 9 of CPC 06 (R2) defines that a contract is or contains a lease if the contract conveys to the entity (customer) the right to control the use of an identifiable asset during a period in exchange for consideration. In evaluating the existence of this right, the entity (customer) must evaluate (i) whether it has the right to obtain substantially all of the economic benefits from the use of the identifiable asset and (ii) whether it has the right to direct the use of the identifiable asset.
Moreover, items B24 to B27 provide criteria that guide the application of the aforementioned concept. Specifically, in item B24, it is defined that the entity has the right to direct the use when it has the right to direct how and for what purpose the asset must be used or, if the relevant decisions are predetermined, (i) the customer has the right to operate the asset throughout the usage period without the supplier changing the operational instructions or (ii) the customer designed the asset in such a way that it predetermines how and for what purpose the asset must be used throughout the usage period.
Thus, arrangements in which the customer only receives the right to access the supplier’s software throughout the contracted period, which is hosted on the cloud infrastructure controlled by the supplier, do not, by themselves, confer upon the customer any right or power of decision on how and for what purpose the software will be used, nor do they confer upon the customer the right to obtain substantially all of the economic benefits of the software or to restrict third parties’ access to such benefits. Considering, therefore, that in contracts of this nature, control over the asset (software) is exercised by the service provider, the nature of these arrangements cannot be considered as a software lease.
In the specific case of an intangible asset, item 10 of CPC 04 (R1) presents the following requirements for its recognition: (i) being identifiable; (ii) being controlled by the entity; and (iii) generating future economic benefits.
Regarding its identifiability, item 12 of the same CPC establishes that the criterion is satisfied if the asset “(a) is separable, that is, it can be separated from the entity (...); or (b) results from contractual rights or other legal rights (...)”.
According to the characteristics of SaaS-type arrangements in which the entity (customer) commits to paying a value in exchange for the right to access, for a certain period, the supplier’s application software hosted on its cloud infrastructure, and managed and controlled by it, it is understood that the customer has only the right to receive access to the supplier’s software in the cloud and not the right over an intellectual property license that could be characterized as an asset.
This is reaffirmed in that the supplier holds control of the software (including the power to decide how or when to perform updates or which instances of hardware or infrastructure the software operates), given its power to obtain substantially all of the future economic benefits generated by this asset and to restrict third parties’ access to such benefits.
In these arrangements, therefore, the supplier does not transfer the intangible software asset to the customer, but only grants it the right to access during the contracted period, not constituting a software use license (intangible asset).
Thus, by the nature of the arrangements in which the customer has only the right to access the supplier’s application software, which is hosted on the supplier’s cloud infrastructure, it is understood that the customer does not control the software, and therefore it must be treated as a service provision contract, according to the applicable current accounting standards.
The CVM’s technical areas draw attention to the fact that the considerations described here refer to SaaS contract types that do not confer control over the software to the customer, that is, those arrangements described in the submission that were the basis for the IFRS IC Agenda Decisions referred to in this Circular Letter.
However, in the event of situations in which some specific SaaS arrangements may indicate the transfer of control over the asset to the customer, this situation must be analyzed vis-à-vis the requirements of the current accounting standards, to conclude regarding the recognition of the asset by the customer. In this sense, the arrangements must be analyzed on a case-by-case basis, based on the criteria present in the applicable accounting standards, to evaluate whether and when the customer obtains control over the asset.

Configuration and/or Customization Costs in a Cloud Computing Agreement of the SaaS Type

The second situation presented to the IFRS IC refers to how the customer accounts for configuration and customization expenses of the supplier’s application software in the implementation of SaaS-type agreements, which do not confer control of the software asset to the customer, as the customer’s right is restricted to access to the supplier’s software, which is hosted on the supplier’s cloud infrastructure, during the contract term. The conclusions reached by the IFRS IC in the second Agenda Decision are related to these arrangements, which are considered service provision contracts.
Specifically, the issue addressed relates to whether, in applying CPC 04 (R1), the customer recognizes an intangible asset regarding configuration or customization expenses and if an intangible asset is not recognized, how the customer accounts for such expenses.
For expenses with configuration or customization of the supplier’s application software to be treated as an intangible asset, what is determined in item 18 of CPC 04 (R1) must be observed, that is, compliance with the definition of intangible asset and the criteria for its recognition. Items 9 to 17 of CPC 04 (R1) determine that for an item to meet the definition of an intangible asset, it must be identifiable, controlled, and generate future economic benefits. Regarding recognition, item 21 of CPC 04 (R1) determines that an intangible asset must be recognized if it is probable that the future economic benefits generated by the asset will be attributable to the entity and that the cost can be estimated reliably. It should be noted that the entity controls an asset if it has the power to obtain the future economic benefits that will flow from the asset and restrict third parties from accessing these future economic benefits to be generated.
It is emphasized that in the types of SaaS arrangements subject to this analysis, the customer does not control the supplier’s application software that is being configured or customized, and the assessment of whether configuration or customization expenses originate an asset for the customer depends on the nature and result of such configurations or customizations performed.
As in these arrangements the customer does not have control over the software asset that is configured or customized, normally such configuration or customization does not create a resource controlled by the customer that is separable (identifiable) from the software. Thus, lacking control, the customer does not have power over future economic benefits nor the ability to restrict third parties’ access to these benefits.
On the other hand, in specific situations, if the arrangement results in the creation of additional codes or the alteration or development of local (legacy) software to enable connection with the application software in the cloud, for example, creating additional functionalities that the customer controls, such a situation will warrant an analysis of whether the customer should recognize an intangible asset, in accordance with CPC 04 (R1), mainly considering whether the item is identifiable and meets the recognition criteria.
In cases where configuration and customization expenses do not meet the criteria of CPC 04 (R1) to be recognized as intangible assets, items 68 to 70 of CPC 04 (R1) must be applied. Item 69 A specifies that “... Services are received when they are provided by a supplier according to a service provision contract and not when the entity uses them to provide other services....”. In this way, CPC 04 (R1) requires the customer to determine when the supplier provides the configuration and customization service, according to the contract for the provision of these services.
If the contract provides that the delivery of configuration and customization services will be made by the supplier of the application software in the cloud itself (including cases in which the supplier subcontracts the services with third parties), then the customer must observe:

1) if the services that the customer receives are distinct, then the customer must recognize the expenses with configuration and customization as an expense when the supplier configures or customizes the application software;
2) if the services that the customer receives are not distinct, that is, they are not separately identifiable from access to the application software in the cloud, then the customer recognizes the expenses with configuration and customization as an expense when the supplier releases access to the application software in the cloud.

In the case where the contract provides that the delivery of configuration and customization services will be made by a third party distinct from the supplier that provides access to the application in the cloud, then the customer recognizes the expenses as an expense when the third party configures or customizes the application software.

Other Requirements to Be Observed

The administrators of publicly held companies must also observe the other requirements of the applicable accounting standards, specifically the provisions of CPC 23 – Accounting Policies, Change in Estimate and Correction of Errors.

Sincerely,

Document electronically signed by Fernando Soares Vieira, Superintendent, on 02/02/2026, at 16:20, based on art. 6 of Decree No. 8,539, of October 8, 2015.
Document electronically signed by Fabio Pinto Coelho, Superintendent, on 02/02/2026, at 17:03, based on art. 6 of Decree No. 8,539, of October 8, 2015.
The authenticity of the document can be verified on the site https://sei.cvm.gov.br/conferir_autenticidade, informing the verification code 2568484 and the CRC code 8E1A0DBD.
This document's authenticity can be verified by accessing https://sei.cvm.gov.br/conferir_autenticidade, and typing the "Verification Code" 2568484 and the "CRC Code" 8E1A0DBD.
Reference: Process No. 19957.000734/2026-65 SEI Document No. 2568484