Circular No. 3.629

The Collegiate Board of the Central Bank of Brazil, in a session held on 2 January 2013, based on arts. 10, item IX, and 11, item VII, of Law No. 4.595, of 31 December 1964, on art. 10 of Law No. 10.214, of 27 March 2001, and on arts. 10 and 11 of Resolution No. 2.882, of 30 August 2001, and taking into account the provisions of art. 4 of the aforementioned Resolution,

R E S O L V E :

Art. 1 The annexed regulation is approved, which governs the electronic communication of data within the scope of the National Financial System (SFN).

Sole paragraph. For the purposes of the provisions of this Circular and its annexed regulation, electronic communication of data within the scope of the SFN is considered to be that carried out between technological systems of the Central Bank of Brazil (BCB), of financial institutions and other institutions authorized by it to operate, of clearinghouses and providers of clearing and settlement services and of government entities of any federative sphere.

Art. 2 The following documents are instituted, with the regulatory character of technical standards:

• I - SFN Services Catalog: regulates the technical standards of messages and files for the electronic communication referred to in this Circular;

• II - SFN Networks Manual: regulates the technical standards of the networks that support data traffic for the electronic communication referred to in this Circular;

• III - SFN Security Manual: regulates the technical security standards of services and networks in the electronic communication process referred to in this Circular.

Art. 3 This Circular enters into force on the date of its publication.

Art. 4 Circular No. 3.555, of 10 August 2011, and Circular Letter No. 3.465, of 13 August 2010, are revoked, and Communiqué No. 17.193, of 1^o August 2008, is rendered without effect. Altamir Lopes Aldo Luiz Mendes Director of Administration Director of Monetary Policy REGULATION ANNEXED TO CIRCULAR NO. 3.629, OF 19 FEBRUARY 2013 Governs the electronic communication of data within the scope of the National Financial System (SFN).

CHAPTER I

SCOPE OF APPLICATION

Art. 1 The following are subject to the provisions of this Regulation:

• I - financial institutions and other institutions authorized to operate by the Central Bank of Brazil;

• II - clearinghouses and providers of clearing and settlement services;

• III - government entities of any federative sphere that exchange data within the scope of the National Financial System (SFN);

• IV - private communication network operators that, under the terms of this Regulation, provide services within the scope of the SFN;

• V - the Information Technology Service Providers referred to in art. 29 of this Regulation.

CHAPTER II

DEFINITIONS

Art. 2 For the purposes of this Regulation, the related expressions and terms are defined as follows:

• I - electronic communication of data: process of transferring information between computer systems;

• II - service: business implemented by means of electronic communication of data that composes, by determination of the Central Bank of Brazil, the SFN Services Catalog;

• III - service manager: institution, entity or business unit responsible for the management of the service;

• IV - messages: structured and standardized set of information, which allows the exchange of electronic data between participants in requesting an operation or sending information, with the objective of enabling end-to-end automation (Straight-Through Processing – STP);

• V - files: structured set of information arranged in a format defined by mutual agreement between the parties, related to a service of a batch processing nature;

• VI - Management Committee: body responsible for implementing the policies established by the Central Bank of Brazil regarding electronic communication of data within the scope of the SFN, holding decision-making attributions;

• VII - Services Subgroup: body supporting the Management Committee on matters of technical specification of messages and files that implement a given service;

• VIII - Networks Subgroup: body supporting the Management Committee on technical matters relating to the networks that support data traffic for electronic communication;

• IX - Security Subgroup: body supporting the Management Committee on matters relating to the security of services and networks in the electronic communication process;

• X - business units: departments of the Central Bank of Brazil, managers of a given service or responsible for the regulation or approval of the business that originates it;

• XI - business advisory groups: groups instituted by business units, individually or jointly, with the objective of discussing business matters with institutions and entities with proven interest in the topic;

• XII - Business Requirements Document: business specification referring to the creation or alteration in the operation of a given service.

CHAPTER III

GENERAL PROVISIONS

Art. 3 The electronic communication of data within the scope of the SFN has as its principles:

• I - security;

• II - efficiency;

• III - flexibility.

Art. 4 The technical standards referring to electronic communication of data within the scope of the SFN shall be defined, in line with the policy established by the Central Bank of Brazil, by the Management Committee, assisted by the following subgroups:

• I - Services Subgroup;

• II - Networks Subgroup;

• III - Security Subgroup.

§ 1 The subgroups shall have their composition and operation defined in their own regulation, in line with the principles and rules of this Regulation.

§ 2 The technical standards referred to in the caput shall be disclosed by means of the SFN Services Catalog, the SFN Networks Manual and the SFN Security Manual.

Art. 5 The Management Committee is responsible for:

• I - implementing the policies of the Central Bank of Brazil regarding electronic communication of data within the scope of the SFN;

• II - receiving the demands for new services and for alterations in existing services from the business units;

• III - decide on matters related to electronic data communication within the scope of the SFN;

• IV - approve and publish the SFN Services Catalog, the SFN Network Manual and the SFN Security Manual, as well as their updates;

• V - request studies, for the purpose of improvements in electronic data communication, from the subgroups linked to the Committee;

• VI - define the format and the necessary information of the Business Requirements Document;

• VII - direct the activities of the subgroups, including establishing their work schedule, with the objective of rationalizing and standardizing the implementation of the proposed solutions, and may request work on an urgent basis in cases where there is proven need, recognized by the Banco Central do Brasil at its sole discretion;

• VIII - approve private communication networks, when applicable, supported by a prior opinion of the Networks Subgroup;

• IX - authorize the provision of services by the Information Technology Service Providers (PSTI) referred to in art. 29, supported by a prior opinion of the Networks Subgroup;

• X - prepare and publish the regulations of the subgroups referred to in art. 4;

• XI - prepare and publish the detailed operational procedures related to the technical specification process for messages and files;

• XII - publish the list, prepared by the Banco Central do Brasil, of the business units responsible for each service;

• XIII - define and disclose which network each service is authorized to use.

Sole paragraph. The Management Committee is composed of its president, the coordinators of the subgroups and other participating members, all appointed by the Information Technology Department (Deinf) from among the employees of its staff.

Art. 6 The Services Subgroup is responsible for:

• I - preparing the proposal for technical standards for messages and files, based on the Business Requirements Document submitted by the business unit(s);

• II - consolidating the technical standards produced for the formation of the SFN Services Catalog;

• III - implementing the technical standards resulting from updates to the SFN Services Catalog, after publication by the Management Committee;

• IV - carrying out technical studies when requested by the Management Committee.

Art. 7 The Networks Subgroup is responsible for:

• I - preparing the proposal for technical standards for the networks that support data traffic for electronic communication;

• II - consolidating the technical standards produced for the formation of the SFN Network Manual;

• III - supervising the work of the Integrated Second-Level Management of the National Financial System Network (RSFN) referred to in art. 27;

• IV - requesting and evaluating reports produced by the Integrated Second-Level Management and proposing improvements to the Management Committee when applicable;

• V - monitoring and supervising the operation of the approved networks and authorized PSTI, and may, among other necessary actions, request information and conduct on-site inspections, reporting the result to the Management Committee;

• VI - carrying out technical studies when requested by the Management Committee.

Art. 8 The Security Subgroup is responsible for:

• I - preparing the proposal for data security standards for electronic communication;

• II - consolidating the security standards produced in the formation of the SFN Security Manual;

• III - implementing the technical standards resulting from updates to the SFN Security Manual, after publication by the Management Committee;

• IV - carrying out technical studies when requested by the Management Committee.

CHAPTER IV

ON THE TECHNICAL SPECIFICATION OF MESSAGES AND FILES

Art. 9 The business implemented through electronic data communication within the scope of the SFN shall be considered a service at the discretion of the business unit to which it is subordinate.

Art. 10. The technical specification of messages and files for services shall be carried out by the Management Committee, at its sole discretion, assisted by the subgroups.

Art. 11. The request for the creation or alteration of a service depends on prior approval from the business unit to which it is subordinate.

§ 1 The business unit shall only analyze requests for the creation or alteration of services whose business model is previously approved or is determined legally or normatively.

§ 2 If the service is subordinate to more than one business unit, the units, jointly, shall be responsible for approving the request referred to in the caput and for the other attributions established in this Regulation.

Art. 12. The request referred to in art. 11 shall be forwarded by the service manager to the respective business unit, accompanied by the Business Requirements Document (DRN).

§ 1 If the request refers to the creation of a service not listed in the list referred to in item XII of art. 5, it shall be forwarded to the Management Committee for identification, by the Banco Central do Brasil, of the responsible unit.

§ 2 The DRN must be prepared by the service manager, who shall have full responsibility for its correct completion.

Art. 13. The business units may establish advisory groups, with the objective of discussing matters related to businesses that may give rise to the creation or alteration of services, with the participation of interested institutions and entities.

§ 1 In the event of the creation of business advisory groups, the respective business unit shall issue the group's regulation, defining, among other aspects, its composition and manner of operation.

§ 2 A regulation that deals with more than one business advisory group is permitted, if the groups are the responsibility of the same business unit.

Art. 14. Once the request for the creation or alteration of a service is approved, the business unit shall forward the DRN to the Management Committee for the preparation of the standards.

§ 1 The Management Committee may request adjustments to the DRN whenever necessary for the specification of messages and files.

§ 2 The Management Committee shall publicize to all business units the DRN, indicating a deadline for manifestation.

Art. 15. The Management Committee shall forward the DRN to the Services Subgroup for the preparation of a proposal for the specification of the messages and files that will support the services.

§ 1 In preparing the proposal referred to in the caput, the Services Subgroup must, whenever possible:

• I - seek uniformity among technical standards;

• II - where there is identity of purpose, use unique elements, such as events, messages, fields, types and abbreviations.

§ 2 Whenever it deems necessary, the Services Subgroup may request a manifestation from the Networks Subgroup, regarding the impacts of the proposal on the communication network that supports the corresponding service, and from the Security Subgroup, regarding aspects of the security of electronic data communication.

Art. 16. Once the proposal is prepared by the Services Subgroup, the Management Committee shall disclose the version for homologation of the SFN Services Catalog.

§ 1 The procedures for the implementation of the corresponding version of the applications in the homologation environment are the responsibility of the Services Subgroup.

§ 2 After the version is implemented in the homologation environment, the managers of services created or altered must perform tests with the objective of validating the implemented solution, especially verifying whether there are divergences in relation to the specification contained in the DRN.

§ 3 The business units have the prerogative to request participation in the homologation tests of the institutions, bodies and entities subject to this Regulation.

§ 4 If an inconsistency is verified during the homologation tests, the service managers must report it to the Management Committee aiming at the corresponding adjustments.

§ 5 If adjustments not related to what is specified in the DRN are requested, the Management Committee must request a manifestation from the business unit to which the service is subordinate.

Art. 17. Once the homologation tests are completed, the Management Committee shall approve the proposal, disclose the updated version of the SFN Services Catalog on the website of the Central Bank of Brazil on the internet and define the date of its effectiveness.

§ 1 The approval by the Management Committee must be based on the validation of each service manager.

§ 2 The definition of the procedures for the implementation of the updated version of the applications in the production environment, on the date of the beginning of the effectiveness of the Catalog, is the responsibility of the Services Subgroup.

CHAPTER V

ON NETWORKS AND DATA COMMUNICATION SECURITY

Art. 18. The following principles govern the communication networks that support electronic data traffic for electronic communication:

• I - availability;

• II - performance;

• III - security.

Art. 19. The SFN Networks Manual and the SFN Security Manual shall be approved and published by the Management Committee, upon a proposal prepared by the Networks Subgroup and the Security Subgroup, respectively.

Art. 20. The Management Committee may demand a review and a new proposal for the SFN Networks Manual and for the SFN Security Manual whenever it deems necessary.

Art. 21. The business units may request from the Management Committee the homologation of a private network that supports electronic communication within the scope of the SFN referring to services under their responsibility.

§ 1 The request referred to in the caput must be accompanied by descriptive documentation, prepared by the person responsible for the network, containing, at a minimum, the following elements:

• I - network governance structure;

• II - technical-operational architecture of the network;

• III - security elements;

• IV - services that the network will support and the respective projected data volumes.

§ 2 The Management Committee may demand additional information from the business unit and from the person responsible for the network, whenever necessary for the evaluation of the request, as well as request a technical opinion from the Networks Subgroup and the Security Subgroup.

Art. 22. The Management Committee may establish specific requirements for a given communication network, due to the nature of the services supported.

CHAPTER VI

ON THE NATIONAL FINANCIAL SYSTEM NETWORK (RSFN)

Art. 23. The National Financial System Network (RSFN) is the data communication structure whose purpose is to support the traffic of information within the scope of the SFN for services authorized by the Management Committee, observing the provisions of art. 24.

Sole paragraph. The technical specifications of the RSFN are defined in the SFN Networks Manual and in the SFN Security Manual.

Art. 24. The RSFN has as its main objective to support the traffic of data directly related to critical services, and may, without interfering with its main objective, support the traffic of data of another nature.

§ 1 For the purposes of the provisions of the caput, the following are considered critical services:

• I - the transfer of financial resources, securities and other financial assets within the scope of the SFN;

• II - the holding of exchange auctions;

• III - the obtaining of information for the formation of the PTAX rate.

§ 2 The Management Committee must enter into service level agreements with the business units, providing full capacity to meet the demand for data traffic, considering stress scenarios and peak hours.

Art. 25. It is incumbent upon the Management Committee to ensure the implementation of the technical specifications of the RSFN established in the SFN Networks Manual and in the SFN Security Manual, as well as to decide on issues not provided for in the aforementioned manuals.

Art. 26. The operators contracted for the supply of connection services to the RSFN must meet the service level requirements established by the Central Bank of Brazil.

Art. 27. The participants of the RSFN must, jointly, contract an independent company, called the Integrated Second-Level Management of the RSFN, which will have the following attributions:

• I - monitor the traffic of messages, files and other services authorized by the Management Committee;

• II - monitor the quality of the services provided by the operators;

• III - advise the SFN Network Subgroup on issues related to the operation of the RSFN;

• IV - monitor the configuration and failure activities of the RSFN, with planning, monitoring, execution and documentation functions;

• V - ensure the maintenance and updating of the RSFN architecture, its configuration criteria and compliance with the service level agreements established in the contracts between the participants and the providers;

• VI - monitor network performance up to the entry node of the RSFN participants;

• VII - monitor and audit the operation of the RSFN and compliance with the service levels of the providers;

• VIII - monitor and audit all traffic of the participants, communicating to the SFN Network Subgroup any deviations in the use of the RSFN;

• IX - assist in resolving requests from participants not served by the operators;

• X - research and propose improvements to the RSFN, both regarding performance and stability, as well as the implementation of new services and possible products that may be added;

• XI - assist in planning the implementation of new services.

Art. 28. Institutions authorized in the services that use the RSFN are eligible to participate in it.

§ 1º The authorization of an institution in a given service is granted by the business unit responsible for it.

§ 2º After obtaining authorization, the institution wishing to participate in the RSFN must enter into an adhesion contract with the communication service providers and with the Integrated Second Level Management of the RSFN, the terms of which must be subject to prior analysis by the Management Committee.

§ 3º Once the contract is signed, the institution must request from the Network Subgroup the technical information necessary for its connection to the network.

CHAPTER VII

ON INFORMATION TECHNOLOGY SERVICE PROVIDERS

Art. 29. For the purposes of this Regulation, Information Technology Service Providers (PSTI) are entities authorized by the Management Committee to provide data processing services, for the purpose of access to the RSFN, to financial institutions and other institutions authorized to operate by the Central Bank of Brazil, through shared Data Processing Centers (CSI).

Sole paragraph. The following may not act as PSTI:

• I - the communication service providers contracted to operate the RSFN;

• II - financial institutions and other institutions authorized to operate by the Central Bank of Brazil, except for the other institutions of the same conglomerate, through processing in their own CSI.

Art. 30. To act as a PSTI, the entity must request authorization through a communication sent to the Management Committee.

§ 1º The authorization request must contain the entity's business plan and the description of the implementation project for the technological requirements established in the SFN Network Manual.

§ 2º The Management Committee shall consult the business units regarding the authorization to operate as a PSTI in cases where the requesting entity carries out activities subject to authorization by the Central Bank of Brazil.

§ 3º The authorization referred to in the caput shall be revoked in case of non-compliance with the requirements, at the discretion of the Management Committee, or if the PSTI does not provide information technology services within the scope of the SFN for one uninterrupted year.

§ 4º The PSTI must provide information whenever requested by the Central Bank of Brazil, under penalty of revocation of the authorization referred to in the caput.

§ 5º The authorization referred to in the caput is not required for financial institutions that act as PSTI for the other institutions of the same conglomerate.

Art. 31. The duties of the PSTI are:

• I - keep unchanged the content of the data it processes;

• II - ensure and preserve the confidentiality of information processed through it;

• III - offer the same level of service to institutions that use its services;

• IV - have available, for supervision by the Central Bank of Brazil, the source codes of its programs, connection diagrams and program, machine and telecommunications diagrams, involving the institution and the PSTI;

• V - operate at least two independent and interconnected CSIs, in order to offer uninterrupted operation, and the availability index must be equal to or greater than 99.8% (ninety-nine point eight percent) for services considered critical.

Art. 32. The duties of the contracting entity of a PSTI are:

• I - ensure the safekeeping and integrity of its private cryptographic key for digital signature, in cases where communication uses this security requirement, which cannot be located on the PSTI's server machines, except in the case of § 5º of art. 30;

• II - digitally sign, encrypt and forward data under its responsibility to the PSTI;

• III - verify the digital signature, decrypt and process the data forwarded to it by the PSTI;

• IV - have available, for supervision by the Central Bank of Brazil, the source codes of its access programs, connection diagrams and program, machine and telecommunications diagrams, involving the institution itself and the PSTI.

Sole paragraph. In the case of art. 30, § 5º, each participating institution must have its own digital certificate, and its data must be signed with the private keys related to its certificate, in cases where communication uses this security requirement.

Art. 33. The SFN Network Manual and the SFN Security Manual may address technical requirements applicable to PSTIs.