Rule · BCB · 13 Nov 2019 · Circular 3969
Payment institutions must notify the Central Bank of Brazil within ten days of contracting relevant data processing, data storage or cloud computing services, and within ten days of any contractual amendment changing the information referred to in art. 15, § 1. Where no agreement under item I of art. 16 exists, the institution must request authorization at least sixty days before contracting or amending the contract. § 4 of art. 15 of Circular No. 3.909 is revoked, and this Circular enters into force on the date of its publication.
The Board of Directors of the Central Bank of Brazil, in a session held on 13 November 2019, based on arts. 9, 10 and 15 of Law No. 12.865, of 9 October 2013, and in view of art. 14 of Resolution No. 4.282, of 4 November 2013,
R E S O L V E S :
Art. 1 Circular No. 3.909, of 16 August 2018, shall come into force with the following amendments:
“Art. 15. The contracting of relevant data processing, data storage and cloud computing services must be communicated by payment institutions to the Central Bank of Brazil.
................................................................
§ 2 The communication referred to in the caput must be made within ten days after the contracting of the services.
§ 3 Contractual amendments that entail modification of the information referred to in § 1 must be communicated to the Central Bank of Brazil within ten days after the contractual amendment.
..........................................................” (NR)
“Art. 16. .....................................................
................................................................
§ 1 In the event of the inexistence of an agreement under the terms of item I of the caput, the contracting payment institution must request authorization from the Central Bank of Brazil to:
I - contract the service, within a minimum period of sixty days before the contracting, observing the provisions of art. 15, § 1, of this Circular; and
II - make contractual amendments that entail modification of the information referred to in art. 15, § 1, observing the minimum period of sixty days before the contractual amendment.
..........................................................” (NR)
Art. 2 § 4 of art. 15 of Circular No. 3.909, of 2018, is revoked.
Art. 3 This Circular enters into force on the date of its publication.
Otávio Ribeiro Damaso Director of Regulation
Note from RegAlert. AI assistants can read this document in full, and search 70,000+ more, through the RegAlert MCP connector (https://mcp.regalert.today/mcp). Free with an account. How to connect ChatGPT, Claude or Cursor.
RegAlert holds no document that amends or replaces this one. This is not a check that it is in force: confirm with the regulator.
“Circular No. 3.909, of 16 August 2018, shall come into force with the following amendments”
“and in view of art. 14 of Resolution No. 4.282, of 4 November 2013”
“based on arts. 9, 10 and 15 of Law No. 12.865, of 9 October 2013”
This document amends: Circular No. 3909 — Cybersecurity Policy and Requirements for Cloud Computing and Data Processing Services
More like this from BCB
BCB published 15 documents in the last 30 days. We email you each new one the day it's published.
Source: Banco Central do Brasil — original document · Summary generated with machine assistance and reviewed before publication; the authoritative text is the regulator's original document. How RegAlert works
In RegAlert: added