Circular No. 3681 — Regulates risk management, minimum capital requirements, governance of payment institutions, preservation of value and liquidity of balances in payment accounts, and other provisions

The Executive Board of the Central Bank of Brazil, in an extraordinary session held on October 31, 2013, based on arts. 9, items IX and XIV, 14 and 15 of Law No. 12,865, of October 9, 2013, and in view of art. 14 of Resolution No. 4,282, of November 4, 2013,

R E S O L V E:

CHAPTER I

ON THE OBJECT AND SCOPE OF APPLICATION

Art. 1. This Circular provides for procedures to be adopted by payment institutions authorized to operate by the Central Bank of Brazil for risk management, governance, calculation of their minimum capital requirements, safeguarding of resources held in payment accounts, as well as for compliance with regulations applicable to institutions integrated into the National Financial System (SFN).

Sole Paragraph. The provisions of this Circular regarding the calculation of minimum capital requirements do not apply to payment institutions that are part of a prudential conglomerate as defined in Resolution No. 4,195, of March 1, 2013.

CHAPTER II

ON RISK MANAGEMENT

Section I

Definitions

Art. 2. For the purposes of this Circular, the following are defined:

I - operational risk: possibility of occurrence of losses resulting from the following events:

a) failures in the protection and security of sensitive data related to both end-user credentials and other information exchanged for the purpose of executing payment transactions;

b) failures in end-user identification and authentication;

c) failures in payment transaction authorization;

d) internal fraud;

e) external fraud;

f) labor claims and deficient workplace security;

g) inappropriate practices regarding end-users, payment products, and services;

h) damage to physical assets owned or used by the institution;

i) occurrences that cause interruption of the payment institution's activities or discontinuity of payment services provided;

j) failures in information technology systems; and

k) failures in execution, deadline compliance, and management of activities involved in payment arrangements;

II - liquidity risk: possibility that the payment institution:

a) is unable to efficiently honor its expected and unexpected, current, and future obligations without affecting its daily operations and without incurring significant losses; and

b) is unable to convert electronic money into physical or book money at the time of the user's request; and

III - credit risk: possibility of occurrence of losses associated with the counterparty's failure to fulfill its respective financial obligations as agreed, reduction of gains or remuneration, advantages granted in renegotiation, and recovery costs, including default:

a) by the end-user vis-à-vis the issuer of a post-paid payment instrument;

b) by the issuer vis-à-vis the acquirer of a post-paid payment instrument; and

c) by a payment institution that is a debtor to another payment institution due to an interoperability agreement between different arrangements.

Sole Paragraph. The definition mentioned in item I of this article includes the legal risk associated with the inadequacy or deficiency in contracts entered into by the payment institution, sanctions due to non-compliance with legal provisions, and compensation for damages to third parties resulting from activities involved in a payment arrangement.

Section II

Risk Management Structure

Art. 3. Payment institutions must implement a risk management structure for operational, liquidity, and credit risks.

Sole Paragraph. The risk management structure mentioned in the caput must:

I - be compatible with the nature of the institution's activities and the complexity of the products and services offered, and proportional to the dimension of exposures to the aforementioned risks;

II - be segregated from the executive unit of the internal audit activity, as defined in art. 2 of Resolution No. 2,554, of September 24, 1998;

III - allow for the identification, measurement, monitoring, control, mitigation, and continuous and integrated management of operational, liquidity, and credit risks;

IV - provide for policies and strategies approved and reviewed at least annually by the executive board and the board of directors, when applicable, in order to determine their compatibility with the institution's objectives and market conditions; and

V - maintain documentation regarding its risk management policies, strategies, and governance available to the Central Bank of Brazil.

CHAPTER III

ON OPERATIONAL RISK

Art. 4. The risk management structure must provide, regarding operational risk, at least:

I - contingency plan and other mechanisms that ensure the continuity of payment services provided;

II - mechanisms for protection and security of stored, processed, or transmitted data;

III - mechanisms for protection and security of networks, websites, servers, and communication channels aimed at reducing vulnerability to attacks;

IV - procedures to monitor, track, and restrict access to sensitive data, networks, systems, databases, and security modules;

V - monitoring of data security failures and end-user complaints regarding the same;

VI - review of data security and confidentiality measures, especially after the occurrence of failures and prior to changes in infrastructure or procedures;

VII - preparation of reports indicating procedures for correcting identified failures;

VIII - execution of tests that ensure the robustness and effectiveness of adopted data security measures;

IX - segregation of functions in information technology environments intended for development, testing, and production;

X - adequate identification of the end-user;

XI - mechanisms for end-user authentication and authorization of payment transactions;

XII - processes to ensure that all payment transactions can be adequately tracked;

XIII - mechanisms for monitoring and authorization of payment transactions, with the objective of preventing fraud, detecting, and blocking suspicious transactions in a timely manner;

XIV - specific evaluations and filters to identify transactions considered high risk;

XV - notification to the end-user regarding any non-execution of a transaction; and

XVI - mechanisms that allow the end-user to verify if the transaction was executed correctly.

Sole Paragraph. If payment institutions outsource functions related to the security of the services offered, the respective service provision contract must stipulate that the contractor must comply with the provisions of this article.

CHAPTER IV

ON LIQUIDITY RISK

Art. 5. The risk management structure must provide, regarding liquidity risk, at least:

I - processes to identify, assess, monitor, and control exposure to liquidity risk over different time horizons, including intraday; and

II - a liquidity contingency plan that establishes responsibilities and procedures to address liquidity stress situations.

Art. 6. Payment institutions that issue electronic money must demonstrate the liquidity risk management structure in a publicly accessible report, with a minimum annual frequency.

§ 1. The board of directors or, in its absence, the executive board of the institution, must state in the report mentioned in the caput its responsibility for the disclosed information.

§ 2. Institutions must disclose, together with the published financial statements, a summary of the description of their liquidity risk management structure, indicating the public access address to the report mentioned in the caput.

CHAPTER V

ON CREDIT RISK

Art. 7. The risk management structure must provide, regarding credit risk, at least:

I - limits for the execution of operations subject to credit risk;

II - procedures aimed at identifying, assessing, monitoring, and controlling exposure to credit risk; and

III - procedures for credit recovery.

CHAPTER VI

ON GOVERNANCE

Art. 8. Payment institutions must observe a governance policy, approved by the executive board and the board of directors, when applicable, which addresses aspects related to risk management, asset management, and, where applicable, the preservation of value and liquidity of issued electronic money, with a view to compliance with the provisions of this Circular.

Sole Paragraph. The policy referred to in the caput must:

I - be adequately documented and subject to annual reviews, with the documentation kept available to the Central Bank of Brazil;

II - define attributions and responsibilities; and

III - ensure the independence of risk management activities, including through segregation between the operational area and the risk management area.

CHAPTER VII

ON MINIMUM CAPITAL REQUIREMENTS

Art. 9. Institutions that issue or acquire post-paid payment instruments must permanently maintain adjusted net equity by income statement accounts in an amount corresponding to at least 2% (two percent) of the monthly average value of payment transactions executed by the institution over the last 12 (twelve) months.

Art. 10. Payment institutions that issue electronic money must permanently maintain adjusted net equity by income statement accounts corresponding to at least the greater value between 2% (two percent) of the monthly average of payment transactions executed by the institution over the last 12 (twelve) months or the balance of electronic money issued by them, calculated daily.

Art. 11. Payment institutions must use the projections presented in their respective business plans while the values of payment transactions or electronic money balances referred to in arts. 9 and 10 are not yet available.

CHAPTER VIII

ON THE ALLOCATION OF RESOURCES HELD IN PAYMENT ACCOUNTS

Art. 12. Institutions that issue electronic money must maintain liquid resources corresponding to the value of the balance of electronic money held in a payment account.

§ 1. Until the end of the time established for the operation of the Reserve Transfer System (STR) of the Central Bank of Brazil, the resources calculated in the manner of the caput must be allocated exclusively to:

I - cash, via credit transfer to a specific account at the Central Bank of Brazil; or

II - federal public securities, registered in the Special Settlement and Custody System (Selic), including through committed operations as defined in Resolution No. 3,339, of January 26, 2006, custodied in a specific account in that system.

§ 2. The credit transfer to the specific account mentioned in § 1, item I, must be commanded exclusively by an institution holding a Bank Reserves account or a Clearing Account.

§ 3. An electronic money issuing institution that does not hold an account in the STR may make a debit transfer from the specific account mentioned in § 1, item I, exclusively to the credit of a Bank Reserves account of its free choice, with each transaction.

§ 4. An electronic money issuing institution that holds a Clearing Account may make a debit transfer from the specific account mentioned in § 1, item I, only to the credit of its own account, with each transaction.

§ 5. In the committed operations referred to in § 1, item II, one of the contracting parties must be a multiple bank, commercial bank, or savings bank authorized to perform these operations.

§ 6. The federal public securities referred to in § 1, item II, must:

I - be denominated in reais and acquired in the secondary market;

II - have a maximum remaining term of 540 (five hundred and forty) days until maturity; and

III - not be referenced in foreign currency.

§ 7. It is prohibited to execute an agreement for free movement of securities subject to repurchase commitments in the committed operations referred to in § 1, item II.

§ 8. For the purpose of compliance with the provisions of this article, electronic money issuing institutions must observe the operational procedures established by the Financial System Regulation Department (Denor), the Banking and Payment Systems Operations Department (Deban), and the Open Market Operations Department (Demab) of the Central Bank of Brazil.

Art. 13. It is prohibited to allocate the balance of resources in federal public securities, as provided in art. 12, § 1, item II, when the issuance of electronic money is carried out by a multiple bank with a commercial portfolio, commercial bank, or savings bank.

Sole Paragraph. The provisions of the caput do not apply in the case of electronic money issuance for use exclusively in payment for services and products of a specific segment, such as food, autonomous transporters, and culture.

CHAPTER IX

FINAL PROVISIONS

Art. 14. The Central Bank of Brazil may determine the adoption of supplementary risk management actions, as well as establish additional capital and liquidity requirements and limits, setting a deadline for implementation, if it considers the actions adopted by payment institutions inadequate or insufficient for the purposes of compliance with the provisions of this Circular.

Art. 15. Payment institutions must observe the set of criteria, procedures, and accounting rules for identification, measurement, and asset, economic, and control registration, as well as for the preparation, submission, and publication of financial statements, established in the current regulations and embodied in the Accounting Plan of Institutions of the National Financial System (Cosif).

Art. 16. Payment institutions and payment arrangement initiators must observe the provisions of Resolution No. 2,554, of 1998, regarding the implementation of internal control systems.

Sole Paragraph. The powers established in art. 2, § 3, items II and III, of Resolution No. 2,554, of 1998, may be exercised by payment institutions that are not part of a prudential conglomerate as defined in Resolution No. 4,195, of 2013.

Art. 17. Payment institutions that issue post-paid payment instruments must submit to the Central Bank of Brazil, in accordance with the provisions of Resolution No. 3,658, of December 17, 2008, information regarding their operations that may be considered for registration in the Credit Information System (SCR), in accordance with art. 3 of that Resolution.

Art. 18. Payment institutions must also observe:

I - art. 1 of Resolution No. 3,694, of March 26, 2009, and Resolution No. 3,919, of November 25, 2010, in the contracting and provision of payment services to end-users, including for the purpose of charging remuneration; and

II - Resolution No. 3,849, of March 25, 2010, which provides for the establishment of an organizational component for an ombudsman.

Art. 19. Payment institutions must indicate a director responsible for risk management.

Sole Paragraph. For the purposes of the responsibility referred to in the caput, it is admitted that the indicated director may perform other functions in the institution, except those related to the administration of third-party resources and the execution of operations subject to credit risks.

Art. 20. This Circular enters into force 180 (one hundred and eighty) days after the date of its publication.

Luiz Edson Feltrim
Acting Director of Regulation