Circular No. 3232 — Discloses New Regulation of Sisbacen - Banco Central Information System

Circular No. 3,232, of April 6, 2004 1

CIRCULAR NO. 3,232
Discloses New Regulation of Sisbacen -
Banco Central Information System.

The Collegiate Board of the Central Bank of Brazil, in a session held on March 24, 2004,

D E C I D E D:

Art. 1º Introduce amendments to the Sisbacen Regulation, which shall now be in force according to the attached document.

Art. 2º Exempt legal entities that, interested in contracting access to Sisbacen, have a legal or regulatory obligation to provide information to the Central Bank through Sisbacen or, furthermore, to insert records into it, from presenting proof of tax regularity, with respect to social security and to the FGTS (Severance Indemnity Fund).

Art. 3º Exempt Credit Cooperatives and Microentrepreneur Credit Societies (SCM) that are within the limits established in the Annex to the Regulation currently instituted, from the reimbursement of costs with the use of Sisbacen.

Art. 4º Authorize the head of the Information Technology Department (Deinf) and the regional administrative managers of the Central Bank of Brazil to enter into the contracts referred to in the regulation, with the supervised institutions, respectively, by the Headquarters and by the other regional representations.

Art. 5º Authorize the Deinf, of the Central Bank of Brazil, to adopt complementary measures and to disclose the necessary guidelines for the implementation of this Circular.

Art. 6º Revoke Circular 2,717, of 03.09.1996 and Carta-Circular 2,775, of 16.12.1997.

Art. 7º This Circular enters into force on the date of its publication.

Brasília, April 6, 2004.

João Antônio Fleury Teixeira
Director

This text does not replace that published in the DOU of 7/4/2004, Section 1, p. 62/63, and in Sisbacen.

Circular No. 3,232, of April 6, 2004 2

REGULATION OF SISBACEN - BANCO CENTRAL INFORMATION SYSTEM

TITLE I
OF THE NAME AND PURPOSE

Art. 1º Sisbacen - Banco Central Information System - is a set of information technology resources, interconnected in a network, used by the Central Bank of Brazil in the conduct of its work processes, in order to:

I - provide the Central Bank of Brazil with information technology instruments for the fulfillment of its institutional mission;

II - facilitate the collection, processing, and dissemination of information of interest to the Central Bank of Brazil, regarding institutions subject to its supervisory, regulatory, and auditing actions;

III - make available to government bodies and entities, as well as to natural and legal persons, information contained in its databases and of interest to these entities, observing the confidentiality principles that legally involve them.

Art. 2º Sisbacen is a registered trademark at the National Institute of Industrial Property (INPI), and the Central Bank of Brazil holds all rights over it in accordance with current legislation.

Art. 3º The data and information contained in Sisbacen, accessible or not to its users, are the property of the Central Bank of Brazil, including those originating from any user that have been inserted by the Central Bank of Brazil into the system databases.

TITLE II
OF ADMINISTRATION

Art. 4º The administration of Sisbacen is the responsibility of the Information Technology Department (Deinf) of the Central Bank of Brazil.

Art. 5º It is the responsibility of Deinf, as administrator, to adopt, in accordance with its regimental competence, the procedures necessary for the adequate functioning of Sisbacen, especially:

I - establish the criteria to be observed in the computerized processes of collection, validation, processing, storage, and consultation of information requested by the Central Bank of Brazil;

II - disclose the necessary guidelines regarding the accreditation and use of SISBACEN;

III - administer the security subsystem and execute the general security management of SISBACEN.

Circular No. 3,232, of April 6, 2004 3

TITLE III
OF USERS

Art. 6º Access to the resources offered by Sisbacen will be defined based on the category and profile of the user, as established in this regulation.

Art. 7º The following are the user categories of Sisbacen:

I - corporate user;

II - governmental user;

III - institutional user;

IV - special user;

V - public user.

Art. 8º The corporate user of Sisbacen is the Central Bank of Brazil.

Art. 9º A governmental user is a body of the direct administration of the federal, state, municipal, and Federal District governments.

Sole Paragraph. Bodies of the other branches of the Union, States, Municipalities, and Federal District are equivalent to the governmental user.

Art. 10. An institutional user of Sisbacen is an institution subject to the regulatory/auditing action of the Central Bank of Brazil.

Sole Paragraph. Entities linked to the National Financial System, such as trade associations and stock exchanges, as well as entities linked to the branches of the Union, States, Municipalities, and Federal District, are equivalent to institutional users.

Art. 11. A special user is a natural or legal person not covered in the previous article, who needs access to certain resources of Sisbacen, temporarily or not, by virtue of some normative act of the Central Bank of Brazil or of the Federal Government.

Art. 12. A public user is a natural or legal person who may have access to Sisbacen resources permitted, at the discretion of the Central Bank of Brazil.

TITLE IV
OF TYPES OF ACCESS

Art. 13. Sisbacen is accessible to its users in the following ways:

I - Direct connection to the Central Bank of Brazil's computer network;

Circular No. 3,232, of April 6, 2004 4

II - Access via a private network providing access services to Sisbacen, accredited by the Central Bank of Brazil to provide this type of service;

III - Access via the Internet.

Sole Paragraph - The costs of connection to Sisbacen are the exclusive responsibility of the respective users.

TITLE V
OF ACCREDITATION FOR ACCESS AND USE

Art. 14. The institutional, governmental, and special users have their accreditation for access and use of Sisbacen conditioned upon the signing of a service provision contract, as per this regulation.

First Paragraph. The contracting process will proceed with exemption from bidding, based on the caput of art. 25 of Law No. 8,666, of 21.6.1993.

Second Paragraph. The signing of the contract with the special user is applicable only in the case of using services subject to cost reimbursement.

Art. 15. The operational procedure for signing the service provision contract by representatives of Sisbacen users, according to a system to be established by Deinf, may be:

I - in person, at the premises of the Central Bank of Brazil;

II - in person, at affiliated institutions for the operational procedures of signing the service provision contract; and

III - electronically, using a digital signature recognized within the Brazilian Public Key Infrastructure - ICP-Brasil, dispensing the presence of representatives.

TITLE VI
OF ACCESS SECURITY TO INFORMATION

Art. 16. The information contained in Sisbacen is covered by the institution of bank secrecy, as characterized in Complementary Law No. 105, of 10.01.2001, and is given the treatment established in related legislation.

Art. 17. Access to Sisbacen by accredited users is based on validation and authentication procedures, using institutional and personal identifiers and individual passwords.

Art. 18. Security for access by accredited users is administered in a decentralized manner, through a specific subsystem, structured in four distinct hierarchical levels:

Circular No. 3,232, of April 6, 2004 5

I - General Security Management of Sisbacen;

II - Sectoral Security Management of Sisbacen, at the institution level;

III - Sectoral Security Management of Sisbacen, at the branch level;

IV - Individual user.

Art. 19. It is the responsibility of the General Security Manager of Sisbacen:

I - the maintenance of the set of system transactions;

II - the registration and deregistration of user institutions in the system;

III - the registration and deregistration of user institution branches in the system;

IV - the accreditation and deaccreditation of sectoral security managers of Sisbacen, at the institution level;

V - the assignment of the first access password or a new password, in case of forgetting and absence of an alternate manager, to the sectoral security managers of Sisbacen, at the institution level;

VI - the creation and maintenance of access profiles.

Sole Paragraph. The competencies provided for in items II to V of this article may be delegated to affiliated institutions for the operational procedures of signing the service provision contract.

Art. 20. It is the responsibility of the Sectoral Security Manager of Sisbacen, at the level of the user institution:

I - the accreditation of alternate sectoral security managers, at the institution level, assigning them the respective access passwords;

II - the accreditation and deaccreditation of transactions, for access by the institution's branches;

III - the accreditation and deaccreditation of sectoral security managers of Sisbacen, at the branch level;

IV - the assignment of access passwords to sectoral security managers of Sisbacen, at the branch level.

Art. 21. It is the responsibility of the Sectoral Security Manager of Sisbacen, at the level of the user branch:

Circular No. 3,232, of April 6, 2004 6

I - the accreditation of alternate sectoral security managers, at the branch level, assigning them the respective access passwords;

II - the accreditation and deaccreditation of individual users for access to the system;

III - the authorization of access, by accredited individual users, to the transactions authorized for the branch;

IV - the assignment of access passwords to individual users accredited in the branch.

Art. 22. It is the responsibility of the individual user:

I - the keeping of confidentiality regarding the data and information to which they may have access, when these possess that characteristic;

II - the keeping and protection of their individual access password to Sisbacen;

III - the exchange of their access password when requested by the system, or when they deem such procedure convenient, in accordance with the preceding item.

Sole Paragraph. Individual users who cease to access Sisbacen for a consecutive period of 6 (six) months will be automatically disabled by the system itself.

Art. 23. The delivery of access passwords provided for in item V of article 19 to representatives of Sisbacen users, according to a system to be established by Deinf, may be:

I - in person, at the premises of the Central Bank of Brazil;

II - in person, at affiliated institutions for the operational procedures of signing the service provision contract; and

III - electronically, using a digital signature within the scope of ICP-Brasil, dispensing the presence of representatives.

Art. 24. Access by the public user does not require the use of an identifier or an individual password.

Art. 25. The user profile is defined by a set of characteristics inherent or common to a certain group of users and determines to the Sisbacen security subsystem which tools, data, information, solutions, and facilities may be accessed and/or used by them, or by the group of which they are a member.

Sole Paragraph. Access profiles are established by Deinf.

Circular No. 3,232, of April 6, 2004 7

TITLE VII
OF COST REIMBURSEMENT

Art. 26. Sisbacen users are subject to reimbursement, to the Central Bank of Brazil, of the costs with the accreditation and use of the system.

Art. 27. Cost reimbursement will be based on digital traffic and/or the demanded service.

Art. 28. Governmental users and public users are exempt from cost reimbursement with the use of Sisbacen.

Art. 29. The Central Bank of Brazil, at the discretion of its Board, may establish other levels of exceptionality for cost reimbursement with the use of Sisbacen.

Art. 30. For accreditation for access to Sisbacen, user institutions will reimburse the Central Bank of Brazil a monthly amount, as per the Annex to this regulation.

SECTION I
OF CHARGING FOR DIGITAL TRAFFIC

Art. 31. Digital traffic will be measured in megabytes (millions of bytes).

Art. 32. In this modality, cost reimbursement will be made by payment of a value corresponding to the megabytes transmitted, as per the Annex to this regulation.

Sole Paragraph. Accreditation for access to Sisbacen grants the right to monthly traffic of 3 megabytes transmitted and/or received from the Central Bank of Brazil.

Art. 33. For the purpose of reimbursement, digital traffic will be considered as the quantity of magnetic media - cartridges, CDs, and others - containing data forwarded to feed SISBACEN, at the value corresponding to the dispatch of each medium, as per the Annex to this regulation.

SECTION II
OF CHARGING FOR DEMANDED SERVICE

Art. 34. The Central Bank of Brazil will disclose which Sisbacen services will be subject to cost reimbursement.

Art. 35. In this modality, cost reimbursement will be made by payment of a specific value for the use of the service.

Sole Paragraph. The values of the services will be established by the Central Bank of Brazil, and their fixation will be subject to prior disclosure.

SECTION III

Circular No. 3,232, of April 6, 2004 8

OF PAYMENT

Art. 36. Reimbursement will be made in monthly installments, corresponding to the accreditation values, plus the value corresponding to digital traffic and/or demanded service.

Art. 37. The payment of installments related to reimbursement will be effected by:

I - transfer to the Central Bank of Brazil, via STR (Reserve Transfer System) message, of the values informed via SLB (Central Bank Posting System), when the user institution maintains a reserve bank account with the Central Bank of Brazil;

II - transfer to the Central Bank of Brazil, via STR (Reserve Transfer System) message, of the values informed via SLB (Central Bank Posting System), by a financial institution affiliated by the user institution for this purpose, when it does not maintain a reserve bank account with the Central Bank of Brazil;

III - bank charge, made by a financial institution accredited by the Central Bank of Brazil;

IV - others, when established by the Central Bank of Brazil in complementary regulation to this regulation.

Art. 38. The non-payment of reimbursement installments corresponding to three months, consecutive or not, will lead to the automatic disqualification of the institution to access Sisbacen and will constitute sufficient grounds for the termination of the service provision contract signed between it and the Central Bank of Brazil, which will occur without prejudice to the adoption, by the Autarchy, of necessary measures to recover the values involved.

Sole Paragraph. Verifying the situation provided for in this article, and if the Service Provision Contract is terminated, the user institution may not impute to the Central Bank of Brazil any type of damages it may suffer as a result of its disqualification to access Sisbacen.

Art. 39. The values in national currency corresponding to accreditation and the megabyte transmitted are those contained in the Annex to this regulation.

First Paragraph. The values fixed for the installments referenced in this article may be reviewed annually by the Central Bank of Brazil, based on art. 65, item II, letters b, c, and d, combined with art. 58, sole paragraph, both of Law No. 8,666/93, to preserve the economic-financial balance of the contract.

Second Paragraph. Any alterations in the values referred to in this article will be subject to official communication to user institutions, and their validity will begin from the first day of the month following the disclosure, including for institutions that have been accredited for less than one year.

Circular No. 3,232, of April 6, 2004 9

Art. 40. The values in national currency corresponding to demanded services will be subject to timely disclosure as they are made available.

TITLE VIII
OF CONNECTION SERVICE PROVIDERS

Art. 41. The Central Bank of Brazil may accredit companies that express interest in performing access provision services for Sisbacen.

Art. 42. The Information Technology Department of the Central Bank of Brazil (Deinf) may, at its discretion, conduct an inspection to assess the technical capability of the company that requests accreditation as a provider of access services to Sisbacen.

Art. 43. Deinf will establish the modality of connection to Sisbacen to be used by companies interested in acting as providers of access services.

Art. 44. The accreditation for providing access provision services to Sisbacen will be formalized between the interested company and the Central Bank of Brazil, through the signing of a Service Provision Contract.

Sole Paragraph. The contracting process will proceed with exemption from bidding, based on the caput of art. 25, of Law No. 8,666, of 21.06.93.

Art. 45. The Service Provision Contract to be signed will observe, among others, the following characteristics:

I - it will confer authorization to provide the services in question, in a non-transferable and non-exclusive manner;

II - it will be governed by current legislation.

Art. 46. The costs of the resources made available to institutions that accredit to provide access provision services to Sisbacen, regarding the resources integrated into the computer and communications park of the Central Bank of Brazil, allocated due to the establishment of the connection between the data communication networks administered by the parties, will be subject to reimbursement, by those institutions to the Central Bank of Brazil.

Art. 47. The costs referred to in the previous article will be subject to arbitration by the Central Bank of Brazil, as established in this regulation, and their reimbursement will occur from the signing of the contract.

First Paragraph. The reimbursement referred to in this article will be effected through the provision of technical advisory services, by the provider institution to the Central Bank of Brazil, in the various areas that regulate the development, maintenance, operation, administration, and security of data and the support for equipment, programs, and communications within the scope of Sisbacen.

Circular No. 3,232, of April 6, 2004 10

Second Paragraph. It will be at the exclusive discretion of the Central Bank of Brazil to choose, among the projects under development under the responsibility of Deinf, those that will be subject to the provision of advisory services referred to in this article.

Third Paragraph. The advisory services, as defined in this article, will be provided by professionals linked to the access provider, chosen based on their training and the area and complexity of the project to be developed.

Fourth Paragraph. The Central Bank of Brazil may, at any time and at its exclusive discretion, request the substitution of any of the professionals designated by the access provider for the provision of technical advisory services, due to:

I - their personal or professional conduct;

II - the start, alteration, cancellation, or completion of any projects;

III - the alteration of priorities regarding the projects, regardless of the phase of their development.

Fifth Paragraph. It is established that for each set of 30 (thirty) users - disregarding fractions - whose access to Sisbacen is intermediated by the provider, there will be an obligation to provide 170 (one hundred and seventy) hours per month of technical advisory services, as per this regulation.

Sixth Paragraph. It is also established that 170 (one hundred and seventy) is the minimum number of monthly hours of technical advisory services that must be obligatorily provided by the provider institution to the Central Bank of Brazil, as provided in this article.

Seventh Paragraph. In the calculation of the quantity of hours of services effectively provided, calculated monthly, the set of professionals designated by the provider institution, involved in all projects under development that have been qualified by Deinf for the provision of advisory services, will be considered.

Eighth Paragraph. The services provided and the corresponding hours will be subject to permanent monitoring, control, and evaluation by the Central Bank of Brazil and the provider institution, which will establish, by mutual agreement, the operational procedures to be observed in their implementation.

TITLE IX
OF GENERAL PROVISIONS

Art. 48. The Information Technology Department (Deinf) is authorized to establish complementary procedures contained in this Regulation, with a view to achieving its objectives.

Circular No. 3,232, of April 6, 2004 11

Sole Paragraph. The procedures established in the manner of this article will be subject to disclosure by Deinf and will enter into force after its publication.

Art. 49. The relationship between Sisbacen users and the Central Bank of Brazil will be effected through the Information Technology Department and by the administrative component that represents it regionally.

First Paragraph. For the purposes of the provisions of this article, and in the case of institutional users, the relationship must be maintained with the regional representation of the jurisdiction of the institution's headquarters.

Art. 50. Sisbacen will not receive information, requested regularly or occasionally, from institutions subject to the supervisory, regulatory, and/or auditing action of the Central Bank of Brazil and subject to cost reimbursement, which, not being accredited with Sisbacen, send dispatches jointly with other institutions.

Art. 51. User institutions of Sisbacen that undergo an extrajudicial liquidation process by the Central Bank of Brazil will be exempt from cost reimbursement from the date of the decree of liquidation.

Circular No. 3,232, of April 6, 2004 12

ANNEX TO THE SISBACEN REGULATION

1. Monthly basic value corresponding to accreditation for the use of Sisbacen: R$159.00
   (one hundred and fifty-nine reais)

2. Value corresponding to the use of Sisbacen by the "megabyte" transmitted that exceeds 3 (three)
   "megabytes" per month: R$53.00 (fifty-three reais).

3. Per magnetic media received in each shipment (cartridge, cd and others): R$106.00 (one hundred and six
   reais).

4. Per "megabyte" received via magnetic media that exceeds 3 (three) "megabytes": R$53.00
   (fifty-three reais).

5. Credit Cooperatives are exempt from reimbursing costs with the use of
   Sisbacen.

6. Microentrepreneur Credit Societies (SCM) are exempt from reimbursing costs with the use of
   Sisbacen.

7. The special user is exempt from reimbursing the monthly basic value corresponding
   to accreditation for the use of Sisbacen and the value corresponding to the use of Sisbacen by the "megabyte" transmitted.