Circular No. 3978 — Internal Policy, Procedures, and Controls for Preventing Money Laundering and Terrorist Financing — BCB — BR

The Collegiate Board of the Central Bank of Brazil, in a session held on January 22, 2020, based on arts. 9 of Law No. 4.595, of December 31, 1964, 10, 11 and 11-A of Law No. 9.613, of March 3, 1998, 6 and 7, item III, of Law No. 11.795, of October 8, 2008, and 15 of Law No. 12.865, of October 9, 2013, and having in view the provisions of Law No. 13.260, of March 16, 2016, the Convention against Illicit Traffic in Narcotic Drugs and Psychotropic Substances, promulgated by Decree No. 154, of June 26, 1991, the United Nations Convention against Transnational Organized Crime, promulgated by Decree No. 5.015, of March 12, 2004, the Inter-American Convention against Terrorism, promulgated by Decree No. 5.639, of December 26, 2005, the International Convention for the Suppression of the Financing of Terrorism, promulgated by Decree No. 5.640, of December 26, 2005, and the United Nations Convention against Corruption, promulgated by Decree No. 5.687, of January 31, 2006,

R E S O L V E:

CHAPTER I

OF THE OBJECT AND SCOPE OF APPLICATION

Art. 1 This Circular provides for the policy, procedures and internal controls to be adopted by institutions authorized to operate by the Central Bank of Brazil, aiming at preventing the use of the financial system for the practice of the crimes of "money laundering" or concealment of assets, rights and values, as provided for in Law No. 9.613, of March 3, 1998, and terrorist financing, provided for in Law No. 13.260, of March 16, 2016.

Sole paragraph. For the purposes of this Circular, the crimes referred to in the main text shall be generically referred to as "money laundering" and "terrorist financing".

CHAPTER II

OF THE POLICY FOR THE PREVENTION OF MONEY LAUNDERING AND TERRORIST FINANCING

Art. 2 The institutions mentioned in art. 1 must implement and maintain a policy formulated based on principles and guidelines that seek to prevent their use for practices of money laundering and terrorist financing.

Sole paragraph. The policy referred to in the main text must be compatible with the risk profiles:

I - of clients;

II - of the institution;

III - of operations, transactions, products and services; and

IV - of employees, partners and outsourced service providers.

Art. 3 The policy referred to in art. 2 must include, at minimum:

I - the guidelines for:

a) the definition of roles and responsibilities for compliance with the obligations provided for in this Circular;

b) the definition of procedures aimed at the prior assessment and analysis of new products and services, as well as the use of new technologies, taking into account the risk of money laundering and terrorist financing;

c) internal risk assessment and effectiveness assessment as provided for in arts. 10 and 62;

d) verification of compliance with the policy, procedures and internal controls provided for in this Circular, as well as the identification and correction of deficiencies found;

e) the promotion of an organizational culture of prevention of money laundering and terrorist financing, including employees, partners and outsourced service providers;

f) the selection and hiring of employees and outsourced service providers, taking into account the risk of money laundering and terrorist financing; and

g) the training of employees on the subject of prevention of money laundering and terrorist financing, including employees of correspondents in the Country who provide service on behalf of the institutions mentioned in art. 1;

II - the guidelines for the implementation of procedures:

a) for the collection, verification, validation and updating of registration information, aiming to know the clients, employees, partners and outsourced service providers;

b) for the recording of operations and financial services;

c) for the monitoring, selection and analysis of suspicious operations and situations; and

d) for the communication of operations to the Financial Activities Control Council (Coaf); and

III - the commitment of senior management to the effectiveness and continuous improvement of the policy, procedures and internal controls related to the prevention of money laundering and terrorist financing.

Art. 4 The adoption of a single money laundering and terrorist financing prevention policy is admitted for prudential conglomerates and for cooperative credit systems.

Sole paragraph. Institutions that do not constitute their own policy, due to the provision in the main text, must formalize the option for this facility in a meeting of the board of directors or, if nonexistent, the board of the institution.

Art. 5 The institutions mentioned in art. 1 must ensure the application of the policy referred to in art. 2 in their units located abroad.

Sole paragraph. In the event of legal impediment or limitation to the application of the policy referred to in the main text to the institution's unit located abroad, a report justifying the impediment or limitation must be prepared.

Art. 6 The policy referred to in art. 2 must be disclosed to the institution's employees, partners and outsourced service providers, in clear and accessible language, at a level of detail compatible with the functions performed and with the sensitivity of the information.

Art. 7 The policy referred to in art. 2 must be:

I - documented;

II - approved by the board of directors or, if nonexistent, by the board of the institution; and

III - kept up to date.

CHAPTER III

OF THE GOVERNANCE OF THE POLICY FOR THE PREVENTION OF MONEY LAUNDERING AND TERRORIST FINANCING

Art. 8 The institutions mentioned in art. 1 must have a governance structure aimed at ensuring compliance with the policy referred to in art. 2 and the procedures and internal controls for the prevention of money laundering and terrorist financing provided for in this Circular.

Art. 9 The institutions referred to in art. 1 must formally indicate to the Central Bank of Brazil a director responsible for compliance with the obligations provided for in this Circular.

§ 1 The director mentioned in the main text may perform other functions in the institution, provided there is no conflict of interest.

§ 2 The responsibility mentioned in the main text must be observed in each institution, even in the case of option for the facility established in arts. 4, 11, 42, 46 and 52.

CHAPTER IV

OF INTERNAL RISK ASSESSMENT

Art. 10 The institutions referred to in art. 1 must carry out an internal assessment with the objective of identifying and measuring the risk of use of their products and services in the practice of money laundering and terrorist financing.

§ 1 For the identification of the risk referred to in the main text, the internal assessment must consider, at minimum, the risk profiles:

I - of clients;

II - of the institution, including the business model and the geographic area of operation; and

III - of operations, transactions, products and services, covering all distribution channels and the use of new technologies; and

IV - of the activities carried out by employees, partners and outsourced service providers.

§ 2 The identified risk must be assessed in terms of its probability of occurrence and the magnitude of the financial, legal, reputational and socio-environmental impacts for the institution.

§ 3 Risk categories must be defined that allow for the adoption of reinforced management and mitigation controls for higher risk situations and the adoption of simplified controls in lower risk situations.

§ 4 Assessments carried out by public entities in the Country regarding the risk of money laundering and terrorist financing, when available, must be used as a subsidy for the internal risk assessment.

Art. 11 The internal risk assessment may be carried out in a centralized manner in an institution of the prudential conglomerate and the cooperative credit system.

Sole paragraph. Institutions that opt to carry out the internal risk assessment in the manner of the main text must formalize this option in a meeting of the board of directors or, if nonexistent, the board of the institution.

Art. 12 The internal risk assessment must be:

I - documented and approved by the director referred to in art. 9;

II - forwarded for information:

a) to the risk committee, if there is one;

b) to the audit committee, if there is one; and

c) to the board of directors or, if nonexistent, to the board of the institution; and

III - reviewed every two years, as well as when there are significant changes in the risk profiles mentioned in art. 10, § 1.

CHAPTER V

OF PROCEDURES AIMED AT KNOWING THE CLIENTS

Section I

Of the Procedures

Art. 13 The institutions mentioned in art. 1 must implement procedures aimed at knowing their clients, including procedures that ensure due diligence in their identification, qualification and classification.

§ 1 The procedures referred to in the main text must be compatible with:

I - the client's risk profile, including enhanced measures for clients classified in higher risk categories, according to the internal risk assessment referred to in art. 10;

II - the money laundering and terrorist financing prevention policy referred to in art. 2; and

III - the internal risk assessment referred to in art. 10.

§ 2 The procedures mentioned in the main text must be formalized in a specific manual.

§ 3 The manual referred to in § 2 must be approved by the board of the institution and kept up to date.

Art. 14 The information obtained and used in the procedures referred to in art. 13 must be stored in computerized systems and used in the procedures provided for in Chapter VII.

Art. 15 The procedures provided for in this Chapter must be observed without prejudice to the provisions of the regulation that disciplines specific products and services.

Section II

Of the Identification of Clients

Art. 16 The institutions referred to in art. 1 must adopt identification procedures that allow verifying and validating the client's identity.

§ 1 The procedures referred to in the main text must include the obtaining, verification and validation of the authenticity of the client's identification information, including, if necessary, by confronting this information with that available in public and private databases.

§ 2 In the client identification process, the following must be collected, at minimum:

I - full name, residential address and registration number in the Individual Taxpayer Registry (CPF), in the case of a natural person; and

II - trade name or corporate name, headquarters address and registration number in the National Registry of Legal Entities (CNPJ), in the case of a legal entity.

§ 3 In the case of a natural person client residing abroad who is exempt from CPF registration, as defined by the Brazilian Federal Revenue Secretariat, the use of a travel document in accordance with the Law is admitted, and the following must be collected, at minimum, the issuing country, the number and type of the document.

§ 4 In the case of a legal entity client with domicile or headquarters abroad who is exempt from CNPJ registration, as defined by the Brazilian Federal Revenue Secretariat, institutions must collect, at minimum, the company name, the headquarters address and the identification or registration number of the company in its country of origin.

Art. 17 The information referred to in art. 16 must be kept up to date.

Section III

Of the Qualification of Clients

Art. 18 The institutions mentioned in art. 1 must adopt procedures that allow qualifying their clients through the collection, verification and validation of information, compatible with the client's risk profile and with the nature of the business relationship.

§ 1 The qualification procedures referred to in the main text must include the collection of information that allows assessing the client's financial capacity, including income, in the case of a natural person, or revenue, in the case of a legal entity.

§ 2 The need for verification and validation of the information referred to in § 1 must be assessed by the institutions according to the client's risk profile and the nature of the business relationship.

§ 3 In the procedures provided for in the main text, additional information compatible with the risk of use of products and services in the practice of money laundering and terrorist financing must be collected from the client.

§ 4 The qualification of the client must be reassessed permanently, according to the evolution of the business relationship and the risk profile.

§ 5 The information collected in the client qualification must be kept up to date.

§ 6 The Central Bank of Brazil may publish a list of information to be collected, verified and validated in specific client qualification procedures.

Art. 19 The qualification procedures referred to in art. 18 must include the verification of the client's status as a politically exposed person, in accordance with art. 27, as well as the verification of the status of representative, family member or close associate of these persons.

§ 1 For the purposes of this Circular, it is considered:

I - family member, relatives in the straight or collateral line up to the second degree, spouse, partner, stepson and stepdaughter; and

II - close associate:

a) a natural person known to have any type of close relationship with a politically exposed person, including by:

having joint participation in a private law legal entity;
appearing as an attorney, even by private instrument of the person mentioned in item 1; or
having joint participation in arrangements without legal personality; and

b) a natural person who controls legal entities or arrangements without legal personality, known to have been created for the benefit of a politically exposed person.

§ 2 For clients qualified as politically exposed persons or as representatives, family members or close associates of these persons, the institutions mentioned in art. 1 must:

I - adopt procedures and internal controls compatible with this qualification;

II - consider this qualification in the classification of the client in the risk categories referred to in art. 20; and

III - evaluate the interest in starting or maintaining the relationship with the client.

§ 3 The evaluation mentioned in § 2, item III, must be carried out by a holder of a position or function at a higher hierarchical level than that of the person responsible for authorizing the relationship with the client.

Section IV

Of the Classification of Clients

Art. 20 The institutions mentioned in art. 1 must classify their clients in the risk categories defined in the internal risk assessment mentioned in art. 10, based on the information obtained in the client qualification procedures referred to in art. 18.

Sole paragraph. The classification mentioned in the main text must be:

I - carried out based on the client's risk profile and the nature of the business relationship; and

II - reviewed whenever there are changes in the client's risk profile and the nature of the business relationship.

Section V

Common Provisions for the Identification, Qualification and Classification of Clients

Art. 21 The institutions referred to in art. 1 must adopt the identification, qualification and classification procedures provided for in this Chapter for administrators of legal entity clients and for representatives of clients.

Sole paragraph. The procedures referred to in the main text must be compatible with the function performed by the administrator and with the scope of the representation.

Art. 22 The criteria used to define the necessary information and the procedures for verification, validation and updating of information for each risk category must be provided for in the manual referred to in art. 13, § 2.

Art. 23 It is prohibited for the institutions referred to in art. 1 to start a business relationship without the client identification and qualification procedures being completed.

Sole paragraph. It is admitted, for a maximum period of thirty days, the start of the business relationship in case of insufficient information regarding the client's qualification, provided there is no prejudice to the monitoring and selection procedures referred to in art. 39.

Section VI

Of the Identification and Qualification of the Beneficial Owner

Art. 24 The client qualification procedures for legal entities must include the analysis of the corporate participation chain up to the identification of the natural person characterized as its beneficial owner, observing the provisions of art. 25.

§ 1 The qualification procedures defined for the risk category of the legal entity client in which the beneficial owner holds corporate participation must be applied, at minimum, to the natural person referred to in the main text.

§ 2 The representative, including the attorney-in-fact and the agent, who exercises de facto command over the activities of the legal entity, is also considered a beneficial owner.

§ 3 The provisions of the main text are excepted for legal entities constituted as open companies or non-profit entities and for cooperatives, for which the information collected must cover the information of the natural persons authorized to represent them, as well as their controllers, administrators and directors, if any.

Art. 25 The institutions mentioned in art. 1 must establish a minimum reference value of corporate participation for the identification of the beneficial owner.

§ 1 The minimum reference value of corporate participation referred to in the main text must be established based on risk and cannot exceed 25% (twenty-five percent), considering, in any case, direct and indirect participation.

§ 2 The reference value referred to in the main text must be justified and documented in the procedures manual referred to in art. 13, § 2.

Art. 26 In the case of a business relationship with a client residing abroad, who is also a client of an institution of the same group abroad, supervised by a supervisory authority with which the Central Bank of Brazil has an agreement for the exchange of information, it is admitted that information regarding the beneficial owner be obtained from the institution abroad, provided that access to the information and procedures adopted by the Central Bank of Brazil is ensured.

Section VII

Of the Qualification as a Politically Exposed Person

Art. 27 The institutions mentioned in art. 1 must implement procedures that allow qualifying their clients as politically exposed persons.

§ 1 Politically exposed persons are considered:

I - holders of elected mandates in the Executive and Legislative Branches of the Union;

II - occupants of positions, in the Executive Branch of the Union, of:

a) Minister of State or equivalent;

b) Special Nature or equivalent;

c) president, vice-president and director, or equivalents, of entities of indirect public administration; and

d) Higher Direction and Advisory Group (DAS), level 6, or equivalent;

III - members of the National Council of Justice, the Federal Supreme Court, the Superior Courts, the Regional Federal Courts, the Regional Labor Courts, the Regional Electoral Courts, the Superior Council of Labor Justice and the Council of Federal Justice;

IV - members of the National Council of the Public Ministry, the Attorney General of the Republic, the Deputy Attorney General of the Republic, the Attorney General of Labor, the Attorney General of Military Justice, the Deputy Attorneys General of the Republic and the Attorneys General of Justice of the States and the Federal District;

V - members of the Court of Accounts of the Union, the Attorney General and the Deputy Attorneys General of the Public Ministry before the Court of Accounts of the Union;

VI - national presidents and treasurers, or equivalents, of political parties;

VII - Governors and Secretaries of State and the Federal District, State and District Deputies, presidents, or equivalents, of entities of indirect public administration at the state and district level and presidents of Courts of Justice, Military Courts, Courts of Accounts or equivalents of the States and the Federal District; and

VIII - Mayors, Councilors, Municipal Secretaries, presidents, or equivalents, of entities of indirect public administration at the municipal level and Presidents of Courts of Accounts or equivalents of Municipalities.

§ 2 Persons who, abroad, are also considered politically exposed are:

I - heads of state or government;

II - politicians at senior levels;

III - occupants of senior government positions;

IV - general officers and members of senior levels of the Judiciary;

V - senior executives of public companies; or

VI - leaders of political parties.

§ 3 Leaders at senior levels of entities of public or private international law are also considered politically exposed persons.

§ 4 In the case of clients residing abroad, for the purposes of the provision in the main text, the institutions mentioned in art. 1 must adopt at least two of the following measures:

I - request an express declaration from the client regarding their qualification;

II - resort to available public information; and

III - consult public or private databases on politically exposed persons.

§ 5 The status of politically exposed person must be applied for the five years following the date on which the person ceased to fit into the categories provided for in §§ 1, 2, and 3.

§ 6 In the case of a business relationship with a client residing abroad who is also a client of an institution of the same group abroad, supervised by a supervisory authority with which the Central Bank of Brazil has an agreement for the exchange of information, it is admitted that politically exposed person qualification information be obtained from the institution abroad, provided that access to the respective data and procedures adopted by the Central Bank of Brazil is ensured.

CHAPTER VI

OF THE REGISTRATION OF OPERATIONS

Section I

General Provisions

Art. 28 The institutions referred to in art. 1 must maintain records of all operations carried out, products and services contracted, including withdrawals, deposits, contributions, payments, receipts and transfers of resources.

§ 1 The records referred to in the main text must contain, at minimum, the following information about each operation:

I - type;

II - value, when applicable;

III - date of realization;

IV - name and registration number in the CPF or CNPJ of the holder and beneficiary of the operation, in the case of a person residing or headquartered in the Country; and

V - channel used.

§ 2 In the case of operations involving a natural person residing abroad who is exempt from CPF registration, as defined by the Brazilian Federal Revenue Secretariat, institutions must include the following information in the record:

I - name;

II - type and number of the travel document and respective issuing country; and

III - international organization for which it is a representative for the exercise of specific functions in the Country, when applicable.

§ 3º In the case of operations involving a legal entity with domicile or headquarters abroad that is exempt from registration with the CNPJ, as defined by the Brazilian Federal Revenue Secretariat, institutions must include the following information in the records:

I - company name; and

II - identification or registration number of the company in its country of origin.

Art. 29. The records referred to in this Chapter must be carried out even in situations where the operation occurs within the same institution.

Section II

On the Registration of Payment, Receipt, and Fund Transfer Operations

Art. 30. In the case of operations relating to payments, receipts, and fund transfers, through any instrument, the institutions referred to in Art. 1 must include in the records mentioned in Art. 28 the information necessary to identify the source and destination of the funds.

§ 1º The source mentioned in the caput refers to the paying institution, drawee, or sender and the person drawn upon or sender of the funds, as well as the transfer or payment instrument used in the transaction.

§ 2º The destination mentioned in the caput refers to the receiving institution or recipient and the person receiving or recipient of the funds, as well as the transfer or payment instrument used in the transaction.

§ 3º For the purposes of compliance with the provisions of the caput, the following information must be included in the operation records, at minimum, when applicable:

I - name and CPF or CNPJ registration number of the sender or drawee;

II - name and CPF or CNPJ registration number of the receiver or beneficiary;

III - identification codes, in the payment settlement or fund transfer system, of the institutions involved in the operation; and

IV - numbers of the branches and accounts involved in the operation.

§ 4º In the case of fund transfers by check, the institutions mentioned in Art. 1 must include in the operation record, in addition to the information referred to in § 3, the check number.

Art. 31. If the institutions referred to in Art. 1 establish a business relationship with third parties not subject to authorization to operate by the Central Bank of Brazil, participants in a payment arrangement of which the institution also participates, access by the institution to the identification of the ultimate beneficiaries of the funds must be stipulated in contract, for the purposes of preventing money laundering and terrorist financing.

Sole Paragraph. The provisions of the caput apply even in the case of a business relationship involving interoperability with a payment arrangement not subject to authorization by the Central Bank of Brazil, of which the institutions referred to in Art. 1 do not participate.

Art. 32. In the case of fund transfers through interbank check clearing, the drawee institution must inform the depositary institution, and the depositary institution must inform the drawee institution, of the CPF or CNPJ registration numbers of the holders of the drawn account and the depositary account, respectively.

Section III

On the Registration of Cash Operations

Art. 33. In the case of operations using cash resources with an individual value greater than R$2,000.00 (two thousand reais), the institutions referred to in Art. 1 must include in the record, in addition to the information provided in Arts. 28 and 30, the name and respective CPF registration number of the bearer of the funds.

Art. 34. In the case of cash deposits or contributions with an individual value equal to or greater than R$50,000.00 (fifty thousand reais), the institutions referred to in Art. 1 must include in the record, in addition to the information provided in Arts. 28 and 30:

I - the name and respective CPF or CNPJ registration number, as applicable, of the owner of the funds;

II - the name and respective CPF registration number of the bearer of the funds; and

III - the source of the deposited or contributed funds.

Sole Paragraph. In the event that the client or bearer of the funds refuses to provide the information referred to in item III of the caput, the institution must register the fact and use this information in the monitoring, selection, and analysis procedures referred to in Arts. 38 to 47.

Art. 35. In the case of withdrawal operations, including those carried out by means of a check or payment order, with an individual value equal to or greater than R$50,000.00 (fifty thousand reais), the institutions referred to in Art. 1 must include in the record, in addition to the information provided in Arts. 28 and 30:

I - the name and respective CPF or CNPJ registration number, as applicable, of the recipient of the funds;

II - the name and respective CPF registration number of the bearer of the funds;

III - the purpose of the withdrawal; and

IV - the protocol number referred to in Art. 36, § 2, item II.

Art. 36. The institutions mentioned in Art. 1 must request from customer and non-customer drawers a request for provisioning with, at least, three business days' advance notice, for withdrawal operations, including those carried out by means of a check or payment order, with a value equal to or greater than R$50,000.00 (fifty thousand reais).

§ 1º The withdrawal operations referred to in the caput must be considered individually, for the purposes of observing the limit provided in the caput.

§ 2º The institutions referred to in the caput must:

I - enable the request for provisioning through the institution's electronic site on the internet and at branches or Service Points;

II - issue a service protocol to the client or non-customer drawer, in which the value of the operation, the branch where the withdrawal will be made, and the scheduled date for the withdrawal must be informed; and

III - register, at the time of the provisioning request, the information indicated in Art. 35, as applicable.

§ 3º In the case of cash withdrawal to be carried out by means of a check by a non-customer drawer, the provisioning request referred to in the caput must be carried out exclusively at branches or at Service Points.

§ 4º The provisions of this article must be observed without prejudice to Art. 2 of Resolution No. 3,695, of March 26, 2009.

Art. 37. The institutions referred to in Art. 1 must keep a specific record of bill payments received paid with cash resources.

Sole Paragraph. The institution that receives a payment bill that is not issued by itself must forward to the issuing institution the information that the bill was paid in cash.

CHAPTER VII

ON THE MONITORING, SELECTION, AND ANALYSIS OF SUSPICIOUS OPERATIONS AND SITUATIONS

Section I

On the Monitoring, Selection, and Analysis Procedures for Suspicious Operations and Situations

Art. 38. The institutions referred to in Art. 1 must implement monitoring, selection, and analysis procedures for operations and situations with the objective of identifying and dispensing special attention to suspicions of money laundering and terrorist financing.

§ 1º For the purposes of this Circular, suspicious operations and situations refer to any operation or situation that presents indications of the use of the institution for the commission of the crimes of money laundering and terrorist financing.

§ 2º The procedures referred to in the caput must be applied, inclusive, to operation proposals.

§ 3º The procedures mentioned in the caput must:

I - be compatible with the policy for preventing money laundering and terrorist financing referred to in Art. 2;

II - be defined based on the internal risk assessment referred to in Art. 10;

III - consider the status of politically exposed persons, in accordance with Art. 27, as well as the status of representative, family member, or close collaborator of the politically exposed person, in accordance with Art. 19; and

IV - be described in a specific manual, approved by the institution's board of directors.

Section II

On the Monitoring and Selection of Suspicious Operations and Situations

Art. 39. The institutions referred to in Art. 1 must implement monitoring and selection procedures that allow identifying operations and situations that may indicate suspicions of money laundering and terrorist financing, especially:

I - the operations carried out and the products and services contracted that, considering the parties involved, the values, the methods of execution, the instruments used, or the lack of economic or legal basis, may configure the existence of indications of money laundering or terrorist financing, including:

a) the operations carried out or services provided that, due to their habitual nature, value, or form, constitute a device intended to circumvent the identification, qualification, registration, monitoring, and selection procedures provided for in this Circular;

b) cash deposit or contribution operations, cash withdrawals, or provisioning requests for withdrawal that present indications of concealment or disguise of the nature, origin, location, disposition, movement, or ownership of assets, rights, and values;

c) operations carried out and products and services contracted that, considering the parties and values involved, present incompatibility with the financial capacity of the client, including income, in the case of a natural person, or revenue, in the case of a legal entity, and assets;

d) operations with politically exposed persons of Brazilian nationality and with representatives, family members, or close collaborators of politically exposed persons;

e) operations with foreign politically exposed persons;

f) clients and operations regarding which it is not possible to identify the ultimate beneficiary;

g) operations originating from or destined to countries or territories with strategic deficiencies in the implementation of the recommendations of the Financial Action Task Force (FATF); and

h) situations in which it is not possible to keep client registration information up to date; and

II - operations and situations that may indicate suspicions of terrorist financing.

Sole Paragraph. The period for carrying out the monitoring and selection procedures for suspicious operations and situations cannot exceed forty-five days, counted from the date of occurrence of the operation or situation.

Art. 40. The institutions referred to in Art. 1 must ensure that the systems used in the monitoring and selection of suspicious operations and situations contain detailed information about the operations carried out and the situations occurred, including information about the identification and qualification of those involved.

§ 1º Institutions must keep detailed documentation of the parameters, variables, rules, and scenarios used in the monitoring and selection of operations and situations that may indicate suspicions of money laundering and terrorist financing.

§ 2º The systems and procedures used in the monitoring and selection of suspicious operations and situations must be verifiable regarding their adequacy and effectiveness.

Art. 41. The following must be included in the manual referred to in Art. 38, § 3, item IV:

I - the criteria for defining the periodicity of execution of monitoring and selection procedures for different types of monitored operations and situations; and

II - the parameters, variables, rules, and scenarios used in monitoring and selection for different types of operations and situations.

Art. 42. The monitoring and selection procedures referred to in Art. 39 can be carried out in a centralized manner by an institution of the prudential conglomerate and the cooperative credit system.

Sole Paragraph. Institutions that opt to carry out the monitoring and selection procedures in the manner of the caput must formalize this option in a meeting of the board of directors or, if nonexistent, the institution's executive board.

Section III

On the Analysis Procedures for Suspicious Operations and Situations

Art. 43. The institutions referred to in Art. 1 must implement analysis procedures for the operations and situations selected through the monitoring and selection procedures referred to in Art. 39, with the objective of characterizing them or not as suspicious of money laundering and terrorist financing.

§ 1º The period for carrying out the analysis procedures for the selected operations and situations cannot exceed forty-five days, counted from the date of selection of the operation or situation.

§ 2º The analysis mentioned in the caput must be formalized in a dossier, independent of the communication to COAF referred to in Art. 48.

Art. 44. The following are prohibited:

I - hiring third parties to carry out the analysis referred to in Art. 43; and

II - carrying out the analysis referred to in Art. 43 abroad.

Sole Paragraph. The prohibition mentioned in the caput does not include hiring third parties to provide auxiliary services to the analysis referred to in Art. 43.

Art. 45. The institutions referred to in Art. 1 must have, within the Country, the resources and competencies necessary for the analysis of suspicious operations and situations referred to in Art. 43.

Art. 46. The analysis procedures referred to in Art. 43 can be carried out in a centralized manner by an institution of the prudential conglomerate and the cooperative credit system.

Sole Paragraph. Institutions that opt to carry out the analysis procedures in the manner of the caput must formalize the option in a meeting of the board of directors or, if nonexistent, the institution's executive board.

Section IV

General Provisions

Art. 47. In the case of contracting data processing and storage services and cloud computing used for monitoring and selection of suspicious operations and situations, as well as auxiliary services for the analysis of these operations and situations, the institutions referred to in Art. 1 must observe:

I - the provisions of Chapter III of Circular No. 3,909, of August 16, 2018, and, where applicable, Chapters IV and V of said Circular, in the case of payment institutions; and

II - the provisions of Chapter III of Resolution No. 4,658, of April 26, 2018, and, where applicable, Chapters IV and V of said Resolution, in the case of financial institutions and other institutions authorized to operate by the Central Bank of Brazil.

CHAPTER VIII

ON THE PROCEDURES FOR COMMUNICATION TO COAF

Section I

On the Communication of Suspicious Operations and Situations

Art. 48. The institutions referred to in Art. 1 must communicate to COAF operations or situations suspected of money laundering and terrorist financing.

§ 1º The decision to communicate the operation or situation to COAF must:

I - be grounded based on the information contained in the dossier mentioned in Art. 43, § 2;

II - be registered in detail in the dossier mentioned in Art. 43, § 2; and

III - occur by the end of the analysis period referred to in Art. 43, § 1.

§ 2º The communication of the suspicious operation or situation to COAF must be carried out by the next business day following the communication decision.

Section II

On the Communication of Cash Operations

Art. 49. The institutions mentioned in Art. 1 must communicate to COAF:

I - cash deposit or contribution operations or cash withdrawals with a value equal to or greater than R$50,000.00 (fifty thousand reais);

II - operations relating to payments, receipts, and fund transfers, through any instrument, against cash payment, with a value equal to or greater than R$50,000.00 (fifty thousand reais); and

III - the request for provisioning of cash withdrawals with a value equal to or greater than R$50,000.00 (fifty thousand reais) referred to in Art. 36.

Sole Paragraph. The communication mentioned in the caput must be carried out by the next business day following the occurrence of the operation or provisioning.

Section III

General Provisions

Art. 50. The institutions referred to in Art. 1 must carry out the communications mentioned in Arts. 48 and 49 without informing those involved or third parties.

Art. 51. Communications altered or canceled after the fifth business day following their realization must be accompanied by justification for the occurrence.

Art. 52. Communications can be carried out in a centralized manner through an institution of the prudential conglomerate and cooperative credit system, in the name of the institution in which the operation or situation occurred.

Sole Paragraph. Institutions that opt to carry out communications in a centralized manner, in accordance with the caput, must formalize the option in a meeting of the board of directors or, if nonexistent, the institution's executive board.

Art. 53. The communications referred to in Arts. 48 and 49 must specify, when applicable, if the person object of the communication:

I - is a politically exposed person or representative, family member, or close collaborator of such person;

II - is a person who has knowingly committed or attempted to commit terrorist acts or participated in or facilitated their commission; and

III - is a person who owns or controls, directly or indirectly, resources in the institution, in the case of item II.

Art. 54. The institutions referred to in Art. 1 that have not made communications to COAF in each calendar year must submit a declaration, within ten business days after the end of said year, attesting to the non-occurrence of operations or situations subject to communication.

Art. 55. The institutions referred to in Art. 1 must qualify to carry out communications in the Financial Activities Control System (Siscoaf), of COAF.

CHAPTER IX

ON PROCEDURES TO KNOW EMPLOYEES, PARTNERS, AND OUTSOURCED SERVICE PROVIDERS

Art. 56. The institutions mentioned in Art. 1 must implement procedures intended to know their employees, partners, and outsourced service providers, including identification and qualification procedures.

Sole Paragraph. The procedures referred to in the caput must be compatible with the policy for preventing money laundering and terrorist financing referred to in Art. 2 and with the internal risk assessment referred to in Art. 10.

Art. 57. The procedures referred to in Art. 56 must be formalized in a specific document approved by the institution's executive board.

Sole Paragraph. The document mentioned in the caput must be kept up to date.

Art. 58. The institutions referred to in Art. 1 must classify the activities performed by their employees, partners, and outsourced service providers into the risk categories defined in the internal risk assessment, in accordance with Art. 10.

§ 1º The classification into risk categories mentioned in the caput must be kept up to date.

§ 2º The criteria for classification into the risk categories referred to in the caput must be provided for in the document mentioned in Art. 57.

§ 3º Information regarding employees, partners, and outsourced service providers must be kept up to date, considering even eventual changes that imply a change in classification in the risk categories.

Art. 59. The institutions referred to in Art. 1, in entering into contracts with financial institutions headquartered abroad, must:

I - obtain information about the contractor that allows understanding the nature of its activity and its reputation;

II - verify if the contractor was the object of investigation or action by a supervisory authority related to money laundering or terrorist financing;

III - certify that the contractor has physical presence in the country where it is constituted or licensed;

IV - know the controls adopted by the contractor regarding the prevention of money laundering and terrorist financing;

V - obtain the approval of the holder of a position or function of hierarchical level higher than that of the person responsible for the contracting; and

VI - inform the director mentioned in Art. 9 about the partnership contract.

Sole Paragraph. The provisions of the caput apply inclusive to partnership relationships established with correspondent banks abroad.

Art. 60. The institutions referred to in Art. 1, in entering into contracts with third parties not subject to authorization to operate by the Central Bank of Brazil, participants in a payment arrangement of which the institution also participates, must:

I - obtain information about the third party that allows understanding the nature of its activity and its reputation;

II - verify if the third party was the object of investigation or action by a supervisory authority related to money laundering or terrorist financing;

III - certify that the third party has a license from the arranger to operate, when applicable;

IV - know the controls adopted by the third party regarding the prevention of money laundering and terrorist financing; and

V - inform the director mentioned in Art. 9 about the contract.

CHAPTER X

ON MONITORING AND CONTROL MECHANISMS

Art. 61. The institutions mentioned in Art. 1 must institute monitoring and control mechanisms to ensure the implementation and adequacy of the policy, procedures, and internal controls referred to in this Circular, including:

I - the definition of processes, tests, and audit trails;

II - the definition of adequate metrics and indicators; and

III - the identification and correction of any deficiencies.

Sole Paragraph. The mechanisms referred to in the caput must be submitted to periodic tests by internal audit, when applicable, compatible with the institution's internal controls.

CHAPTER XI

ON EFFECTIVENESS ASSESSMENT

Art. 62. The institutions referred to in Art. 1 must assess the effectiveness of the policy, procedures, and internal controls referred to in this Circular.

§ 1º The assessment referred to in the caput must be documented in a specific report.

§ 2º The report referred to in § 1 must:

I - be prepared annually, with a base date of December 31; and

II - be forwarded, for information, by March 31 of the year following the base date:

a) to the audit committee, if there is one; and

b) to the board of directors or, if nonexistent, to the institution's executive board.

Art. 63. The report referred to in Art. 62, § 1, must:

I - contain information describing:

a) the methodology adopted in the effectiveness assessment;

b) the tests applied;

c) the qualification of the evaluators; and

d) the deficiencies identified; and

II - contain, at minimum, the assessment:

a) of the procedures intended to know clients, including the verification and validation of client information and the adequacy of registration data;

b) of the monitoring, selection, analysis, and communication to COAF procedures, including the assessment of the effectiveness of the selection parameters for operations and suspicious situations;

c) the governance of the policy for the prevention of money laundering and terrorist financing;

d) measures to develop an organizational culture focused on the prevention of money laundering and terrorist financing;

e) periodic staff training programs;

f) procedures designed to know employees, partners, and outsourced service providers; and

g) actions to regularize findings arising from internal audit and supervision by the Central Bank of Brazil.

Art. 64. The preparation of a single effectiveness evaluation report in accordance with Art. 62, § 1º, is permitted for institutions within the prudential conglomerate and the credit cooperative system.

Sole Paragraph. Institutions that opt to conduct the effectiveness evaluation report in the manner set forth in the caput must formalize this option in a meeting of the board of directors or, if none exists, the executive board of the institution.

Art. 65. The institutions referred to in Art. 1º must prepare an action plan aimed at resolving deficiencies identified through the effectiveness evaluation provided for in Art. 62.

§ 1º The monitoring of the implementation of the action plan referred to in the caput must be documented through a monitoring report.

§ 2º The action plan and the respective monitoring report must be submitted for information and evaluation, by June 30 of the year following the base date of the report referred to in Art. 62, § 1º:

I - to the audit committee, if one exists;

II - to the executive board of the institution; and

III - to the board of directors, if one exists.

CHAPTER XII

FINAL PROVISIONS

Art. 66. The following must remain available to the Central Bank of Brazil:

I - the document referred to in Art. 7º, item I, relating to the policy for the prevention of money laundering and terrorist financing provided for in Art. 2º;

II - the minutes of the meeting of the board of directors or, in its absence, the executive board of the institution, in the case where the option referred to in the caput of Art. 4º is formalized;

III - the report referred to in Art. 5º, sole paragraph, if it exists;

IV - the document relating to the internal risk assessment referred to in Art. 12, item I, along with the supporting documentation for its preparation;

V - the contract referred to in Art. 31;

VI - the minutes of the meeting of the board of directors or, in its absence, the executive board of the institution, in the case where the options mentioned in Arts. 11, 42, 46, 52, and 64 are formalized;

VII - the effectiveness evaluation report referred to in Art. 62, § 1º;

VIII - previous versions of the internal risk assessment referred to in Art. 10;

IX - the manual relating to procedures designed to know customers referred to in Art. 13, § 2º;

X - the manual relating to procedures for monitoring, selecting, and analyzing suspicious operations and situations mentioned in Art. 38, § 3º, item IV;

XI - the document relating to procedures designed to know employees, partners, and outsourced service providers mentioned in Art. 57;

XII - previous versions of the effectiveness evaluation report referred to in Art. 62, § 1º;

XIII - the data, records, and information relating to the monitoring and control mechanisms referred to in Art. 61; and

XIV - the documents relating to the action plan and the respective monitoring report mentioned in Art. 65.

§ 1º The contract referred to in item V of the caput must remain available to the Central Bank of Brazil for a minimum period of five years after the termination of the contractual relationship.

§ 2º The documents and information referred to in items VIII to XIV of the caput must remain available to the Central Bank of Brazil for a minimum period of five years.

Art. 67. The institutions referred to in Art. 1º must keep available to the Central Bank of Brazil and conserve for a minimum period of ten years:

I - the information collected in the procedures designed to know customers provided for in Arts. 13, 16, and 18, counting the period referred to in the caput from the first day of the year following the end of the customer relationship;

II - the information collected in the procedures designed to know employees, partners, and outsourced service providers provided for in Art. 56, counting the period referred to in the caput from the date of termination of the contractual relationship;

III - the information and records provided for in Arts. 28 to 37, counting the period referred to in the caput from the first day of the year following the realization of the operation; and

IV - the dossier referred to in Art. 43, § 2º.

Art. 68. Circular No. 3,691, of December 16, 2013, shall enter into force with the following alterations:

“Art. 18. Agents authorized to operate in the foreign exchange market must verify the legality of operations, the responsibilities of the parties involved, as well as identify their customers prior to carrying out operations in the foreign exchange market in the manner provided by the regulation on the policy, procedures, and internal controls in the prevention of the crimes of ‘money laundering’ or concealment of assets, rights, and values, provided for in Law No. 9,613, of March 3, 1998, and terrorist financing, provided for in Law No. 13,260, of March 16, 2016.” (NR)

“Art. 135. Institutions authorized to operate in the foreign exchange market must develop mechanisms that allow them to avoid carrying out operations aimed at circumventing the limits and other requirements established in this Circular.” (NR)

“Art. 139. Institutions authorized to operate in the foreign exchange market must certify the qualification of their customers, through documentation in physical or electronic media and through the implementation, among other pertinent measures, of performance evaluation, commercial procedures, and financial capacity.” (NR)

Art. 69. The following are repealed:

I - Circular No. 3,461, of July 24, 2009;

II - Circular No. 3,517, of December 7, 2010;

III - Circular No. 3,583, of March 12, 2012;

IV - Circular No. 3,654, of March 27, 2013;

V - Circular No. 3,839, of June 28, 2017;

VI - Circular No. 3,889, of March 28, 2018;

VII - Arts. 6º, 6º-A, and 6º-B of Circular No. 3,680, of November 4, 2013;

VIII - § 2º of Art. 11 of Circular No. 3,691, of 2013;

IX - the sole paragraph of Art. 19 of Circular No. 3,691, of 2013;

X - Art. 32 of Circular No. 3,691, of 2013;

XI - item IV of Art. 32-A of Circular No. 3,691, of 2013;

XII - items I and II of Art. 139 of Circular No. 3,691, of 2013;

XIII - Art. 166 of Circular No. 3,691, of 2013;

XIV - Art. 170 of Circular No. 3,691, of 2013;

XV - Art. 213 of Circular No. 3,691, of 2013;

XVI - Art. 2º of Circular No. 3,727, of November 6, 2014;

XVII - Art. 3º of Circular No. 3,780, of January 21, 2016; and

XVIII - Art. 18 of Circular No. 3,858, of November 14, 2017.

Art. 70. This Circular enters into force on July 1, 2020.

Otávio Ribeiro Damaso
Director of Regulation

What changed in the obligations

Against Circular No. 3583 — Amends Circular No. 3,461 of July 24, 2009, Consolidating Rules on Procedures for Preventing and Combating Activities Related to Crimes Under Law No. 9,613 of March 3, 1998 (2012-03-12)

254 new obligations · 1 change of who is bound

2 obligations are the same in both texts.

Changed (1)

Who is bound
Before
Art. 1º Articles 1 and 5 of Circular No. 3,461 of July 24, 2009, shall enter into force with the following wording: § 6º The director responsible for implementing and complying with the measures established in this Circular, in accordance with Article 18, must inform the Central Bank of Brazil in writing about the existence of legislation or regulation that prevents or limits the application of t…
Now
In the event of legal impediment or limitation to the application of the policy referred to in the main text to the institution's unit located abroad, a report justifying the impediment or limitation must be prepared.

New in this text (254)

Art. 2 The institutions mentioned in art. 1 must implement and maintain a policy formulated based on principles and guidelines that seek to prevent their use for practices of money laundering and terrorist financing.
The policy referred to in the main text must be compatible with the risk profiles: I - of clients;
The policy referred to in the main text must be compatible with the risk profiles: II - of the institution;
The policy referred to in the main text must be compatible with the risk profiles: III - of operations, transactions, products and services; and
The policy referred to in the main text must be compatible with the risk profiles: IV - of employees, partners and outsourced service providers.
Art. 3 The policy referred to in art. 2 must include, at minimum: I - the guidelines for: a) the definition of roles and responsibilities for compliance with the obligations provided for in this Circular;
Art. 3 The policy referred to in art. 2 must include, at minimum: I - the guidelines for: b) the definition of procedures aimed at the prior assessment and analysis of new products and services, as well as the use of new technologies, taking into account the risk of money laundering and terrorist financing;
Art. 3 The policy referred to in art. 2 must include, at minimum: I - the guidelines for: c) internal risk assessment and effectiveness assessment as provided for in arts. 10 and 62;
Art. 3 The policy referred to in art. 2 must include, at minimum: I - the guidelines for: d) verification of compliance with the policy, procedures and internal controls provided for in this Circular, as well as the identification and correction of deficiencies found;
Art. 3 The policy referred to in art. 2 must include, at minimum: I - the guidelines for: e) the promotion of an organizational culture of prevention of money laundering and terrorist financing, including employees, partners and outsourced service providers;
Art. 3 The policy referred to in art. 2 must include, at minimum: I - the guidelines for: f) the selection and hiring of employees and outsourced service providers, taking into account the risk of money laundering and terrorist financing; and
Art. 3 The policy referred to in art. 2 must include, at minimum: I - the guidelines for: g) the training of employees on the subject of prevention of money laundering and terrorist financing, including employees of correspondents in the Country who provide service on behalf of the institutions mentioned in art. 1;
Art. 3 The policy referred to in art. 2 must include, at minimum: II - the guidelines for the implementation of procedures: a) for the collection, verification, validation and updating of registration information, aiming to know the clients, employees, partners and outsourced service providers;
Art. 3 The policy referred to in art. 2 must include, at minimum: II - the guidelines for the implementation of procedures: b) for the recording of operations and financial services;
Art. 3 The policy referred to in art. 2 must include, at minimum: II - the guidelines for the implementation of procedures: c) for the monitoring, selection and analysis of suspicious operations and situations; and
Art. 3 The policy referred to in art. 2 must include, at minimum: II - the guidelines for the implementation of procedures: d) for the communication of operations to the Financial Activities Control Council (Coaf); and
Art. 3 The policy referred to in art. 2 must include, at minimum: III - the commitment of senior management to the effectiveness and continuous improvement of the policy, procedures and internal controls related to the prevention of money laundering and terrorist financing.
Art. 4 The adoption of a single money laundering and terrorist financing prevention policy is admitted for prudential conglomerates and for cooperative credit systems.
Institutions that do not constitute their own policy, due to the provision in the main text, must formalize the option for this facility in a meeting of the board of directors or, if nonexistent, the board of the institution.
Art. 6 The policy referred to in art. 2 must be disclosed to the institution's employees, partners and outsourced service providers, in clear and accessible language, at a level of detail compatible with the functions performed and with the sensitivity of the information.
Art. 7 The policy referred to in art. 2 must be: I - documented;
Art. 7 The policy referred to in art. 2 must be: II - approved by the board of directors or, if nonexistent, by the board of the institution; and
Art. 7 The policy referred to in art. 2 must be: III - kept up to date.
Art. 8 The institutions mentioned in art. 1 must have a governance structure aimed at ensuring compliance with the policy referred to in art. 2 and the procedures and internal controls for the prevention of money laundering and terrorist financing provided for in this Circular.
Art. 9 The institutions referred to in art. 1 must formally indicate to the Central Bank of Brazil a director responsible for compliance with the obligations provided for in this Circular.
§ 1 The director mentioned in the main text may perform other functions in the institution, provided there is no conflict of interest.
§ 2 The responsibility mentioned in the main text must be observed in each institution, even in the case of option for the facility established in arts. 4, 11, 42, 46 and 52.
Art. 10 The institutions referred to in art. 1 must carry out an internal assessment with the objective of identifying and measuring the risk of use of their products and services in the practice of money laundering and terrorist financing.
§ 1 For the identification of the risk referred to in the main text, the internal assessment must consider, at minimum, the risk profiles:
II - of the institution, including the business model and the geographic area of operation; and
III - of operations, transactions, products and services, covering all distribution channels and the use of new technologies; and
IV - of the activities carried out by employees, partners and outsourced service providers.
§ 2 The identified risk must be assessed in terms of its probability of occurrence and the magnitude of the financial, legal, reputational and socio-environmental impacts for the institution.
§ 3 Risk categories must be defined that allow for the adoption of reinforced management and mitigation controls for higher risk situations and the adoption of simplified controls in lower risk situations.
§ 4 Assessments carried out by public entities in the Country regarding the risk of money laundering and terrorist financing, when available, must be used as a subsidy for the internal risk assessment.
Art. 11 The internal risk assessment may be carried out in a centralized manner in an institution of the prudential conglomerate and the cooperative credit system.
Institutions that opt to carry out the internal risk assessment in the manner of the main text must formalize this option in a meeting of the board of directors or, if nonexistent, the board of the institution.
Art. 12 The internal risk assessment must be: I - documented and approved by the director referred to in art. 9;
Art. 12 The internal risk assessment must be: II - forwarded for information: a) to the risk committee, if there is one;
Art. 12 The internal risk assessment must be: II - forwarded for information: b) to the audit committee, if there is one; and
Art. 12 The internal risk assessment must be: II - forwarded for information: c) to the board of directors or, if nonexistent, to the board of the institution; and
Art. 12 The internal risk assessment must be: III - reviewed every two years, as well as when there are significant changes in the risk profiles mentioned in art. 10, § 1.
Art. 13 The institutions mentioned in art. 1 must implement procedures aimed at knowing their clients, including procedures that ensure due diligence in their identification, qualification and classification.
§ 1 The procedures referred to in the main text must be compatible with:
I - the client's risk profile, including enhanced measures for clients classified in higher risk categories, according to the internal risk assessment referred to in art. 10;
II - the money laundering and terrorist financing prevention policy referred to in art. 2; and
III - the internal risk assessment referred to in art. 10.
§ 2 The procedures mentioned in the main text must be formalized in a specific manual.
§ 3 The manual referred to in § 2 must be approved by the board of the institution and kept up to date.
Art. 14 The information obtained and used in the procedures referred to in art. 13 must be stored in computerized systems and used in the procedures provided for in Chapter VII.
Art. 15 The procedures provided for in this Chapter must be observed without prejudice to the provisions of the regulation that disciplines specific products and services.
Art. 16 The institutions referred to in art. 1 must adopt identification procedures that allow verifying and validating the client's identity.
§ 1 The procedures referred to in the main text must include the obtaining, verification and validation of the authenticity of the client's identification information, including, if necessary, by confronting this information with that available in public and private databases.
§ 2 In the client identification process, the following must be collected, at minimum:
I - full name, residential address and registration number in the Individual Taxpayer Registry (CPF), in the case of a natural person; and
II - trade name or corporate name, headquarters address and registration number in the National Registry of Legal Entities (CNPJ), in the case of a legal entity.
§ 3 In the case of a natural person client residing abroad who is exempt from CPF registration, as defined by the Brazilian Federal Revenue Secretariat, the use of a travel document in accordance with the Law is admitted, and the following must be collected, at minimum, the issuing country, the number and type of the document.
§ 4 In the case of a legal entity client with domicile or headquarters abroad who is exempt from CNPJ registration, as defined by the Brazilian Federal Revenue Secretariat, institutions must collect, at minimum, the company name, the headquarters address and the identification or registration number of the company in its country of origin.
Art. 17 The information referred to in art. 16 must be kept up to date.
Art. 18 The institutions mentioned in art. 1 must adopt procedures that allow qualifying their clients through the collection, verification and validation of information, compatible with the client's risk profile and with the nature of the business relationship.

The first 60 of 254 are shown.

Against Circular No. 3517 — Amends Circular No. 3,461 of July 24, 2009, Consolidating Rules on Procedures for Preventing and Combating Money Laundering and Terrorist Financing (2010-12-07)

252 new obligations · 1 changed obligation · 1 deadline changed · 4 not carried over

1 obligation is the same in both texts.

Changed (2)

What must be done
Before
I - when a natural person, the full name and the registration number in the Register of Natural Persons (CPF); and
Now
I - full name, residential address and registration number in the Individual Taxpayer Registry (CPF), in the case of a natural person; and
Deadline
Before
§ 8. The drawee institution must inform the depository institution and the depository institution must inform the drawee institution, when requested, within a maximum period of 5 (five) business days counted from the date of the request, the CPF or CNPJ registration numbers of the holders of the drawee account and the depository account relating to the value transfer operations carried out by mea…
Now
Art. 32. In the case of fund transfers through interbank check clearing, the drawee institution must inform the depositary institution, and the depositary institution must inform the drawee institution, of the CPF or CNPJ registration numbers of the holders of the drawn account and the depositary account, respectively.

New in this text (252)

Art. 2 The institutions mentioned in art. 1 must implement and maintain a policy formulated based on principles and guidelines that seek to prevent their use for practices of money laundering and terrorist financing.
The policy referred to in the main text must be compatible with the risk profiles: I - of clients;
The policy referred to in the main text must be compatible with the risk profiles: II - of the institution;
The policy referred to in the main text must be compatible with the risk profiles: III - of operations, transactions, products and services; and
The policy referred to in the main text must be compatible with the risk profiles: IV - of employees, partners and outsourced service providers.
Art. 3 The policy referred to in art. 2 must include, at minimum: I - the guidelines for: a) the definition of roles and responsibilities for compliance with the obligations provided for in this Circular;
Art. 3 The policy referred to in art. 2 must include, at minimum: I - the guidelines for: b) the definition of procedures aimed at the prior assessment and analysis of new products and services, as well as the use of new technologies, taking into account the risk of money laundering and terrorist financing;
Art. 3 The policy referred to in art. 2 must include, at minimum: I - the guidelines for: c) internal risk assessment and effectiveness assessment as provided for in arts. 10 and 62;
Art. 3 The policy referred to in art. 2 must include, at minimum: I - the guidelines for: d) verification of compliance with the policy, procedures and internal controls provided for in this Circular, as well as the identification and correction of deficiencies found;
Art. 3 The policy referred to in art. 2 must include, at minimum: I - the guidelines for: e) the promotion of an organizational culture of prevention of money laundering and terrorist financing, including employees, partners and outsourced service providers;
Art. 3 The policy referred to in art. 2 must include, at minimum: I - the guidelines for: f) the selection and hiring of employees and outsourced service providers, taking into account the risk of money laundering and terrorist financing; and
Art. 3 The policy referred to in art. 2 must include, at minimum: I - the guidelines for: g) the training of employees on the subject of prevention of money laundering and terrorist financing, including employees of correspondents in the Country who provide service on behalf of the institutions mentioned in art. 1;
Art. 3 The policy referred to in art. 2 must include, at minimum: II - the guidelines for the implementation of procedures: a) for the collection, verification, validation and updating of registration information, aiming to know the clients, employees, partners and outsourced service providers;
Art. 3 The policy referred to in art. 2 must include, at minimum: II - the guidelines for the implementation of procedures: b) for the recording of operations and financial services;
Art. 3 The policy referred to in art. 2 must include, at minimum: II - the guidelines for the implementation of procedures: c) for the monitoring, selection and analysis of suspicious operations and situations; and
Art. 3 The policy referred to in art. 2 must include, at minimum: II - the guidelines for the implementation of procedures: d) for the communication of operations to the Financial Activities Control Council (Coaf); and
Art. 3 The policy referred to in art. 2 must include, at minimum: III - the commitment of senior management to the effectiveness and continuous improvement of the policy, procedures and internal controls related to the prevention of money laundering and terrorist financing.
Art. 4 The adoption of a single money laundering and terrorist financing prevention policy is admitted for prudential conglomerates and for cooperative credit systems.
Institutions that do not constitute their own policy, due to the provision in the main text, must formalize the option for this facility in a meeting of the board of directors or, if nonexistent, the board of the institution.
Art. 5 The institutions mentioned in art. 1 must ensure the application of the policy referred to in art. 2 in their units located abroad.
In the event of legal impediment or limitation to the application of the policy referred to in the main text to the institution's unit located abroad, a report justifying the impediment or limitation must be prepared.
Art. 6 The policy referred to in art. 2 must be disclosed to the institution's employees, partners and outsourced service providers, in clear and accessible language, at a level of detail compatible with the functions performed and with the sensitivity of the information.
Art. 7 The policy referred to in art. 2 must be: I - documented;
Art. 7 The policy referred to in art. 2 must be: II - approved by the board of directors or, if nonexistent, by the board of the institution; and
Art. 7 The policy referred to in art. 2 must be: III - kept up to date.
Art. 8 The institutions mentioned in art. 1 must have a governance structure aimed at ensuring compliance with the policy referred to in art. 2 and the procedures and internal controls for the prevention of money laundering and terrorist financing provided for in this Circular.
Art. 9 The institutions referred to in art. 1 must formally indicate to the Central Bank of Brazil a director responsible for compliance with the obligations provided for in this Circular.
§ 1 The director mentioned in the main text may perform other functions in the institution, provided there is no conflict of interest.
§ 2 The responsibility mentioned in the main text must be observed in each institution, even in the case of option for the facility established in arts. 4, 11, 42, 46 and 52.
Art. 10 The institutions referred to in art. 1 must carry out an internal assessment with the objective of identifying and measuring the risk of use of their products and services in the practice of money laundering and terrorist financing.
§ 1 For the identification of the risk referred to in the main text, the internal assessment must consider, at minimum, the risk profiles:
II - of the institution, including the business model and the geographic area of operation; and
III - of operations, transactions, products and services, covering all distribution channels and the use of new technologies; and
IV - of the activities carried out by employees, partners and outsourced service providers.
§ 2 The identified risk must be assessed in terms of its probability of occurrence and the magnitude of the financial, legal, reputational and socio-environmental impacts for the institution.
§ 3 Risk categories must be defined that allow for the adoption of reinforced management and mitigation controls for higher risk situations and the adoption of simplified controls in lower risk situations.
§ 4 Assessments carried out by public entities in the Country regarding the risk of money laundering and terrorist financing, when available, must be used as a subsidy for the internal risk assessment.
Art. 11 The internal risk assessment may be carried out in a centralized manner in an institution of the prudential conglomerate and the cooperative credit system.
Institutions that opt to carry out the internal risk assessment in the manner of the main text must formalize this option in a meeting of the board of directors or, if nonexistent, the board of the institution.
Art. 12 The internal risk assessment must be: I - documented and approved by the director referred to in art. 9;
Art. 12 The internal risk assessment must be: II - forwarded for information: a) to the risk committee, if there is one;
Art. 12 The internal risk assessment must be: II - forwarded for information: b) to the audit committee, if there is one; and
Art. 12 The internal risk assessment must be: II - forwarded for information: c) to the board of directors or, if nonexistent, to the board of the institution; and
Art. 12 The internal risk assessment must be: III - reviewed every two years, as well as when there are significant changes in the risk profiles mentioned in art. 10, § 1.
Art. 13 The institutions mentioned in art. 1 must implement procedures aimed at knowing their clients, including procedures that ensure due diligence in their identification, qualification and classification.
§ 1 The procedures referred to in the main text must be compatible with:
I - the client's risk profile, including enhanced measures for clients classified in higher risk categories, according to the internal risk assessment referred to in art. 10;
II - the money laundering and terrorist financing prevention policy referred to in art. 2; and
III - the internal risk assessment referred to in art. 10.
§ 2 The procedures mentioned in the main text must be formalized in a specific manual.
§ 3 The manual referred to in § 2 must be approved by the board of the institution and kept up to date.
Art. 14 The information obtained and used in the procedures referred to in art. 13 must be stored in computerized systems and used in the procedures provided for in Chapter VII.
Art. 15 The procedures provided for in this Chapter must be observed without prejudice to the provisions of the regulation that disciplines specific products and services.
Art. 16 The institutions referred to in art. 1 must adopt identification procedures that allow verifying and validating the client's identity.
§ 1 The procedures referred to in the main text must include the obtaining, verification and validation of the authenticity of the client's identification information, including, if necessary, by confronting this information with that available in public and private databases.
§ 2 In the client identification process, the following must be collected, at minimum:
II - trade name or corporate name, headquarters address and registration number in the National Registry of Legal Entities (CNPJ), in the case of a legal entity.
§ 3 In the case of a natural person client residing abroad who is exempt from CPF registration, as defined by the Brazilian Federal Revenue Secretariat, the use of a travel document in accordance with the Law is admitted, and the following must be collected, at minimum, the issuing country, the number and type of the document.
§ 4 In the case of a legal entity client with domicile or headquarters abroad who is exempt from CNPJ registration, as defined by the Brazilian Federal Revenue Secretariat, institutions must collect, at minimum, the company name, the headquarters address and the identification or registration number of the company in its country of origin.
Art. 17 The information referred to in art. 16 must be kept up to date.

The first 60 of 252 are shown.

Not carried over (4)

The development of an internal procedure aimed at identifying occasional financial operations or services that present a low risk of use for money laundering or terrorist financing is admitted, for which the requirement to obtain customer registration information is waived, provided that the provisions of the other articles of this circular are complied with."
§ 2. The records referred to in item I of § 1 made by a depository institution must contain, at a minimum, the data relating to the value and the number of the deposited check, the clearing code of the drawee institution, and the numbers of the agency and the deposit account of the drawee.
§ 3. The records referred to in item I of § 1 made by the drawee institution must contain, at a minimum, the data relating to the value and the number of the check, the clearing code of the depository institution, the numbers of the agency and the deposit account of the depository institutions, with the depository institution being responsible for providing the drawee institution with the data re…
III - 5 (five) years, for the registration information defined in Articles 2 and 3.

Against Circular No. 3461 — Consolidates rules on procedures for prevention and combat of crimes under Law No. 9,613 of March 3, 1998 (2009-07-24)

198 new obligations · 3 changed obligations · 3 amounts or limits changed · 4 deadlines changed · 10 changes of scope · 3 changes of who is bound · 54 not carried over

29 obligations are the same in both texts.

Changed (23)

Scope
Before
Art. 1. Financial institutions and other institutions authorized to operate by the Central Bank of Brazil must implement internal control policies and procedures aimed at preventing their use in the commission of the crimes set forth in Law No. 9,613, of March 3, 1998.
Now
Art. 2 The institutions mentioned in art. 1 must implement and maintain a policy formulated based on principles and guidelines that seek to prevent their use for practices of money laundering and terrorist financing.
Scope
Before
IV - include the prior analysis of new products and services, from the perspective of preventing the aforementioned crimes;
Now
Art. 3 The policy referred to in art. 2 must include, at minimum: I - the guidelines for: b) the definition of procedures aimed at the prior assessment and analysis of new products and services, as well as the use of new technologies, taking into account the risk of money laundering and terrorist financing;
Scope
Before
§ 1º For the purposes of the responsibility referred to in the main text, it is admitted that the indicated director performs other functions in the institution, except those related to the administration of third-party resources.
Now
§ 1 The director mentioned in the main text may perform other functions in the institution, provided there is no conflict of interest.
What must be done
Before
Art. 3. The institutions mentioned in Art. 1 must obtain the following registration information from their occasional clients, from the owner, and from the recipient of the resources involved in the financial operation or service: I - when a natural person, the full name, identification document data (type, number, date of issue, and issuing authority), and registration number in the Individual T…
Now
I - full name, residential address and registration number in the Individual Taxpayer Registry (CPF), in the case of a natural person; and
What must be done
Before
§ 6. In the case of resource transfer operations involving a natural person resident abroad exempt from CPF registration, as defined by the Brazilian Federal Revenue Secretariat (RFB), the identification provided for in § 5, items I and IV, letter "b", may be carried out by the number of their respective passport, complemented by the nationality of the said person and, where applicable, the inter…
Now
§ 3 In the case of a natural person client residing abroad who is exempt from CPF registration, as defined by the Brazilian Federal Revenue Secretariat, the use of a travel document in accordance with the Law is admitted, and the following must be collected, at minimum, the issuing country, the number and type of the document.
Deadline
Before
Art. 2. The institutions mentioned in Art. 1 must collect and keep updated the registration information of their permanent clients, including, at minimum: § 5. The institutions mentioned in Art. 1 must perform verification tests, with a maximum periodicity of one year, that ensure the adequacy of the registration data of their clients.
Now
§ 5 The information collected in the client qualification must be kept up to date.
Who is bound
Before
Art. 10. The institutions referred to in Art. 1 must pay special attention to: III - evaluation by senior management regarding interest in initiating or maintaining the relationship with the client.
Now
III - evaluate the interest in starting or maintaining the relationship with the client.
What must be done
Before
Art. 4. The institutions referred to in Art. 1 must collect from their permanent clients information that allows them to characterize them or not as politically exposed persons and to identify the origin of the funds involved in the transactions of clients thus characterized.
Now
Art. 27 The institutions mentioned in art. 1 must implement procedures that allow qualifying their clients as politically exposed persons.
Amount or limit
Before
§ 3. In the case of foreign clients, for the purposes of the caput, the institutions mentioned in Art. 1 must adopt at least one of the following measures:
Now
§ 4 In the case of clients residing abroad, for the purposes of the provision in the main text, the institutions mentioned in art. 1 must adopt at least two of the following measures:
Scope
Before
§ 6. In the case of a business relationship with a foreign client who is also a client of a foreign institution supervised by a governmental entity similar to the Central Bank of Brazil, it is admitted that the measures regarding politically exposed persons be adopted by the foreign institution, provided that access to the respective data and procedures adopted by the Central Bank of Brazil is en…
Now
§ 6 In the case of a business relationship with a client residing abroad who is also a client of an institution of the same group abroad, supervised by a supervisory authority with which the Central Bank of Brazil has an agreement for the exchange of information, it is admitted that politically exposed person qualification information be obtained from the institution abroad, provided that access …
Scope
Before
Art. 6. The institutions referred to in Art. 1 must keep records of all financial services provided and of all financial operations carried out with clients or in their name.
Now
Art. 28 The institutions referred to in art. 1 must maintain records of all operations carried out, products and services contracted, including withdrawals, deposits, contributions, payments, receipts and transfers of resources.
Scope
Before
IV - the name and the respective registration number in the CPF, in the case of cash withdrawal by means of a prepaid card whose holder is a resident or domiciled person in the Country;
Now
IV - name and registration number in the CPF or CNPJ of the holder and beneficiary of the operation, in the case of a person residing or headquartered in the Country; and
Scope
Before
II - the name, passport number, and respective issuing country, in the case of issuance or reload of values in a prepaid card carried out by a natural person not resident in the Country or domiciled abroad;
Now
II - type and number of the travel document and respective issuing country; and
Who is bound
Before
I - the name and the respective registration number in the CPF or CNPJ, as the case may be, of the owner or beneficiary of the resources and of the person who makes the deposit, cash withdrawal, or request for provisioning for withdrawal;
Now
Art. 34. In the case of cash deposits or contributions with an individual value equal to or greater than R$50,000.00 (fifty thousand reais), the institutions referred to in Art. 1 must include in the record, in addition to the information provided in Arts. 28 and 30: I - the name and respective CPF or CNPJ registration number, as applicable, of the owner of the funds;
Scope
Before
§ 2. The procedures referred to in the caput must include measures previously and expressly established, which allow:
Now
§ 2º The procedures referred to in the caput must be applied, inclusive, to operation proposals.
Scope
Before
II - cash deposits, cash withdrawals, cash withdrawals by means of a prepaid card, or requests for provisioning for withdrawal, that present signs of concealment or dissimulation of the nature, origin, location, disposition, movement, or ownership of assets, rights, and values;
Now
I - the operations carried out and the products and services contracted that, considering the parties involved, the values, the methods of execution, the instruments used, or the lack of economic or legal basis, may configure the existence of indications of money laundering or terrorist financing, … b) cash deposit or contribution operations, cash withdrawals, or provisioning requests for withdra…
Scope
Before
Art. 10. The institutions referred to in Art. 1 must pay special attention to: V - transactions with clients originating from countries that apply the FATF recommendations insufficiently, according to information published by the Central Bank of Brazil;
Now
I - the operations carried out and the products and services contracted that, considering the parties involved, the values, the methods of execution, the instruments used, or the lack of economic or legal basis, may configure the existence of indications of money laundering or terrorist financing, … g) operations originating from or destined to countries or territories with strategic deficiencies…
Deadline
Before
Art. 12. The institutions referred to in Art. 1º must communicate to the Financial Activities Control Council (Coaf), in the manner determined by the Central Bank of Brazil: II - the occurrences referred to in Art. 9º, § 1º, items I and III, on the date of the operation.
Now
III - occur by the end of the analysis period referred to in Art. 43, § 1.
Deadline
Before
Art. 13. The institutions referred to in Art. 1º must communicate to Coaf, in the manner determined by the Central Bank of Brazil: § 2º Communications of the occurrences referred to in items III and IV must be made by the next business day following the day on which they were verified.
Now
§ 2º The communication of the suspicious operation or situation to COAF must be carried out by the next business day following the communication decision.
Amount or limit
Before
I - cash deposits, cash withdrawals, cash withdrawals by means of a prepaid card, or requests for provisioning for withdrawal, of a value equal to or greater than R$100,000.00 (one hundred thousand reais);
Now
Art. 49. The institutions mentioned in Art. 1 must communicate to COAF: I - cash deposit or contribution operations or cash withdrawals with a value equal to or greater than R$50,000.00 (fifty thousand reais);
Amount or limit
Before
III - issuance of administrative checks, TED, or any other instrument of fund transfer against cash payment, of a value equal to or greater than R$100,000.00 (one hundred thousand reais).
Now
Art. 49. The institutions mentioned in Art. 1 must communicate to COAF: II - operations relating to payments, receipts, and fund transfers, through any instrument, against cash payment, with a value equal to or greater than R$50,000.00 (fifty thousand reais); and
Who is bound
Before
Art. 14. The communications referred to in Arts. 12 and 13 must be made without giving notice to the parties involved.
Now
Art. 50. The institutions referred to in Art. 1 must carry out the communications mentioned in Arts. 48 and 49 without informing those involved or third parties.
Deadline
Before
Art. 16. The institutions referred to in Art. 1º must keep, for a period of 5 (five) years, the documents relating to the analysis of operations or proposals that underpinned the decision to make or not make the communications referred to in Arts. 12 and 13.
Now
Art. 67. The institutions referred to in Art. 1º must keep available to the Central Bank of Brazil and conserve for a minimum period of ten years:

New in this text (198)

The policy referred to in the main text must be compatible with the risk profiles: II - of the institution;
The policy referred to in the main text must be compatible with the risk profiles: III - of operations, transactions, products and services; and
The policy referred to in the main text must be compatible with the risk profiles: IV - of employees, partners and outsourced service providers.
Art. 3 The policy referred to in art. 2 must include, at minimum: I - the guidelines for: a) the definition of roles and responsibilities for compliance with the obligations provided for in this Circular;
Art. 3 The policy referred to in art. 2 must include, at minimum: I - the guidelines for: c) internal risk assessment and effectiveness assessment as provided for in arts. 10 and 62;
Art. 3 The policy referred to in art. 2 must include, at minimum: I - the guidelines for: d) verification of compliance with the policy, procedures and internal controls provided for in this Circular, as well as the identification and correction of deficiencies found;
Art. 3 The policy referred to in art. 2 must include, at minimum: I - the guidelines for: e) the promotion of an organizational culture of prevention of money laundering and terrorist financing, including employees, partners and outsourced service providers;
Art. 3 The policy referred to in art. 2 must include, at minimum: I - the guidelines for: g) the training of employees on the subject of prevention of money laundering and terrorist financing, including employees of correspondents in the Country who provide service on behalf of the institutions mentioned in art. 1;
Art. 3 The policy referred to in art. 2 must include, at minimum: II - the guidelines for the implementation of procedures: a) for the collection, verification, validation and updating of registration information, aiming to know the clients, employees, partners and outsourced service providers;
Art. 3 The policy referred to in art. 2 must include, at minimum: II - the guidelines for the implementation of procedures: b) for the recording of operations and financial services;
Art. 3 The policy referred to in art. 2 must include, at minimum: II - the guidelines for the implementation of procedures: d) for the communication of operations to the Financial Activities Control Council (Coaf); and
Art. 3 The policy referred to in art. 2 must include, at minimum: III - the commitment of senior management to the effectiveness and continuous improvement of the policy, procedures and internal controls related to the prevention of money laundering and terrorist financing.
Art. 4 The adoption of a single money laundering and terrorist financing prevention policy is admitted for prudential conglomerates and for cooperative credit systems.
Institutions that do not constitute their own policy, due to the provision in the main text, must formalize the option for this facility in a meeting of the board of directors or, if nonexistent, the board of the institution.
Art. 5 The institutions mentioned in art. 1 must ensure the application of the policy referred to in art. 2 in their units located abroad.
In the event of legal impediment or limitation to the application of the policy referred to in the main text to the institution's unit located abroad, a report justifying the impediment or limitation must be prepared.
Art. 6 The policy referred to in art. 2 must be disclosed to the institution's employees, partners and outsourced service providers, in clear and accessible language, at a level of detail compatible with the functions performed and with the sensitivity of the information.
Art. 7 The policy referred to in art. 2 must be: I - documented;
Art. 7 The policy referred to in art. 2 must be: III - kept up to date.
Art. 8 The institutions mentioned in art. 1 must have a governance structure aimed at ensuring compliance with the policy referred to in art. 2 and the procedures and internal controls for the prevention of money laundering and terrorist financing provided for in this Circular.
§ 2 The responsibility mentioned in the main text must be observed in each institution, even in the case of option for the facility established in arts. 4, 11, 42, 46 and 52.
Art. 10 The institutions referred to in art. 1 must carry out an internal assessment with the objective of identifying and measuring the risk of use of their products and services in the practice of money laundering and terrorist financing.
§ 1 For the identification of the risk referred to in the main text, the internal assessment must consider, at minimum, the risk profiles:
II - of the institution, including the business model and the geographic area of operation; and
III - of operations, transactions, products and services, covering all distribution channels and the use of new technologies; and
IV - of the activities carried out by employees, partners and outsourced service providers.
§ 2 The identified risk must be assessed in terms of its probability of occurrence and the magnitude of the financial, legal, reputational and socio-environmental impacts for the institution.
§ 3 Risk categories must be defined that allow for the adoption of reinforced management and mitigation controls for higher risk situations and the adoption of simplified controls in lower risk situations.
§ 4 Assessments carried out by public entities in the Country regarding the risk of money laundering and terrorist financing, when available, must be used as a subsidy for the internal risk assessment.
Art. 11 The internal risk assessment may be carried out in a centralized manner in an institution of the prudential conglomerate and the cooperative credit system.
Institutions that opt to carry out the internal risk assessment in the manner of the main text must formalize this option in a meeting of the board of directors or, if nonexistent, the board of the institution.
Art. 12 The internal risk assessment must be: I - documented and approved by the director referred to in art. 9;
Art. 12 The internal risk assessment must be: II - forwarded for information: a) to the risk committee, if there is one;
Art. 12 The internal risk assessment must be: II - forwarded for information: b) to the audit committee, if there is one; and
Art. 12 The internal risk assessment must be: II - forwarded for information: c) to the board of directors or, if nonexistent, to the board of the institution; and
Art. 12 The internal risk assessment must be: III - reviewed every two years, as well as when there are significant changes in the risk profiles mentioned in art. 10, § 1.
Art. 13 The institutions mentioned in art. 1 must implement procedures aimed at knowing their clients, including procedures that ensure due diligence in their identification, qualification and classification.
§ 1 The procedures referred to in the main text must be compatible with:
I - the client's risk profile, including enhanced measures for clients classified in higher risk categories, according to the internal risk assessment referred to in art. 10;
II - the money laundering and terrorist financing prevention policy referred to in art. 2; and
III - the internal risk assessment referred to in art. 10.
§ 2 The procedures mentioned in the main text must be formalized in a specific manual.
Art. 14 The information obtained and used in the procedures referred to in art. 13 must be stored in computerized systems and used in the procedures provided for in Chapter VII.
Art. 15 The procedures provided for in this Chapter must be observed without prejudice to the provisions of the regulation that disciplines specific products and services.
Art. 16 The institutions referred to in art. 1 must adopt identification procedures that allow verifying and validating the client's identity.
§ 1 The procedures referred to in the main text must include the obtaining, verification and validation of the authenticity of the client's identification information, including, if necessary, by confronting this information with that available in public and private databases.
§ 2 In the client identification process, the following must be collected, at minimum:
§ 4 In the case of a legal entity client with domicile or headquarters abroad who is exempt from CNPJ registration, as defined by the Brazilian Federal Revenue Secretariat, institutions must collect, at minimum, the company name, the headquarters address and the identification or registration number of the company in its country of origin.
Art. 17 The information referred to in art. 16 must be kept up to date.
Art. 18 The institutions mentioned in art. 1 must adopt procedures that allow qualifying their clients through the collection, verification and validation of information, compatible with the client's risk profile and with the nature of the business relationship.
§ 1 The qualification procedures referred to in the main text must include the collection of information that allows assessing the client's financial capacity, including income, in the case of a natural person, or revenue, in the case of a legal entity.
§ 2 The need for verification and validation of the information referred to in § 1 must be assessed by the institutions according to the client's risk profile and the nature of the business relationship.
§ 3 In the procedures provided for in the main text, additional information compatible with the risk of use of products and services in the practice of money laundering and terrorist financing must be collected from the client.
§ 4 The qualification of the client must be reassessed permanently, according to the evolution of the business relationship and the risk profile.
Art. 19 The qualification procedures referred to in art. 18 must include the verification of the client's status as a politically exposed person, in accordance with art. 27, as well as the verification of the status of representative, family member or close associate of these persons.
§ 2 For clients qualified as politically exposed persons or as representatives, family members or close associates of these persons, the institutions mentioned in art. 1 must:
I - adopt procedures and internal controls compatible with this qualification;
II - consider this qualification in the classification of the client in the risk categories referred to in art. 20; and
§ 3 The evaluation mentioned in § 2, item III, must be carried out by a holder of a position or function at a higher hierarchical level than that of the person responsible for authorizing the relationship with the client.
Art. 20 The institutions mentioned in art. 1 must classify their clients in the risk categories defined in the internal risk assessment mentioned in art. 10, based on the information obtained in the client qualification procedures referred to in art. 18.

The first 60 of 198 are shown.

Not carried over (54)

I - specify, in an internal document, the responsibilities of members at each hierarchical level of the institution;
II - include the collection and recording of timely information about clients, allowing for the identification of the risk of occurrence of the aforementioned crimes;
VI - receive wide internal dissemination.
I - to confirm the registration information of clients and identify the beneficial beneficiaries of the operations;
II - to enable the characterization or not of clients as politically exposed persons.
I - financial institutions, representatives, or correspondents located abroad, especially in countries, territories, and dependencies that do not adopt registration and control procedures similar to those defined in this circular;
II - clients whose contact is made electronically, through correspondents in the country or by other indirect means.
Art. 2. The institutions mentioned in Art. 1 must collect and keep updated the registration information of their permanent clients, including, at minimum: I - the same registration information requested from depositors as provided in Art. 1 of Resolution No. 2,025, of November 24, 1993, with the wording given by Resolution No. 2,747, of June 28, 2000;
Art. 2. The institutions mentioned in Art. 1 must collect and keep updated the registration information of their permanent clients, including, at minimum: II - the values of monthly income and assets, in the case of natural persons, and of average monthly revenue for the twelve months prior, in the case of legal persons;
Art. 2. The institutions mentioned in Art. 1 must collect and keep updated the registration information of their permanent clients, including, at minimum: III - a declaration signed regarding the purposes and the nature of the business relationship with the institution.
Art. 2. The institutions mentioned in Art. 1 must collect and keep updated the registration information of their permanent clients, including, at minimum: § 1. The information relating to a natural person client must cover the natural persons authorized to represent them.
Art. 2. The institutions mentioned in Art. 1 must collect and keep updated the registration information of their permanent clients, including, at minimum: § 4. The registration information relating to an investment fund client must include its respective name, registration number in the National Registry of Legal Entities (CNPJ), as well as the information referred to in item I regarding the pers…
The development of an internal procedure aimed at identifying occasional financial operations or services that do not present a risk of use for money laundering or terrorist financing is admitted, for which the requirement to obtain client registration information is waived, except for compliance with the provisions of Art. 12 of this circular.
§ 2. In the case of Brazilian clients, the following must be covered:
§ 1. In the case of resource movement by permanent clients, the records must contain consolidated information that allows verification:
II - of the origin of the resources moved;
III - of the beneficial beneficiaries of the movements.
§ 2. The recording system must allow identification:
I - of the operations that, carried out with the same person, financial conglomerate, or group, in the same calendar month, exceed, by institution or entity, in their entirety, the value of R$10,000.00 (ten thousand reais);
I - of the operations relating to the acceptance in deposits of Available Electronic Transfers (TED), checks, administrative checks, payment order checks, and other compensable documents of the same nature, and to the settlement of checks deposited in another financial institution;
II - of the issuance of administrative checks, payment order checks, payment orders, Credit Documents (DOC), TED, and other resource transfer instruments, when of a value greater than R$1,000.00 (one thousand reais).
§ 2. The records referred to in item I of § 1 carried out by the depositing institution must contain, at minimum, the data relating to the value and number of the deposited check, the clearing code of the drawn institution, the numbers of the agency and deposit accounts of the drawn institution, and the registration number in the CPF or CNPJ of the respective holder.
§ 3. The records referred to in item I of § 1 carried out by the drawn institution must contain, at minimum, the data relating to the value and number of the check, the clearing code of the depositing institution, the numbers of the agency and deposit accounts of the depositing institution, and the registration number in the CPF or CNPJ of the respective holder, the depositing institution being r…
II - when paid by check, the clearing code of the institution, the number of the agency and deposit accounts of the drawn institution relating to the check used for the respective payment, including in the case of a check drawn against the same issuing institution of the instruments referred to in this article;
IV - in the case of a payment order: a) intended for credit to an account: the numbers of the recipient agency and the deposit account of the depositing institution;
§ 7. The identification provided for in § 5, items I and IV, letter "b", does not apply to resource transfer operations involving a legal person with domicile or headquarters abroad exempt from CNPJ registration, as defined by the RFB.
Art. 8. The institutions referred to in Art. 1 must keep specific records of the issuance or reload of values in one or more prepaid cards.
§ 1. The recording system must allow identification of:
I - the issuance or reload of values in one or more prepaid cards, in an accumulated amount equal to or greater than R$100,000.00 (one hundred thousand reais) or the equivalent in foreign currency, in the calendar month;
II - the issuance or reload of values in a prepaid card that presents signs of concealment or dissimulation of the nature, origin, location, disposition, movement, or ownership of assets, rights, and values.
I - the name or corporate name and the respective registration number in the CPF or CNPJ of the natural or legal person responsible for the issuance or reload of values in a prepaid card, in the case of issuance or reload carried out by a resident or domiciled person in the Country;
III - the name and the respective registration number in the CPF of the natural person to whom the prepaid card is destined;
IV - the identification of the institutions, agencies, and deposit or savings accounts debited, the names of the account holders, and their respective registration numbers in the CPF, in the case of issuance or reload of values in a prepaid card originating from debit transfers from deposit or savings accounts held by natural persons;
V - the identification of the institutions, agencies, and deposit or savings accounts debited, the names of the account holders, and their respective registration numbers in the CNPJ, as well as the names of the natural persons authorized to move them and their respective registration numbers in the CPF, in the case of issuance or reload of values in a prepaid card originating from debit transfer…
VI - the date and value of each issuance or reload of values in a prepaid card;
VII - the purpose of the issuance of the prepaid card;
VIII - the name and the respective registration number in the CPF of the natural persons who represent the legal persons responsible for the issuance or reload of values in a prepaid card.
Art. 9. Commercial banks, Caixa Econômica Federal, multiple banks with commercial or real estate credit portfolios, real estate credit companies, savings and loan societies, and credit cooperatives must keep specific records of cash deposit operations, cash withdrawals, cash withdrawals by means of a prepaid card, or requests for provisioning for withdrawal.
§ 1. The recording system must allow identification of:
II - the type and number of the document, the number of the institution, agency, and checking deposit account or savings account to which the values are destined or from which the value will be withdrawn, as the case may be;
III - the name and the respective registration number in the CPF or CNPJ, as the case may be, of the holders of the accounts referred to in item II, if in the same institution;
V - the name and passport number and the respective issuing country, in the case of cash withdrawal by means of a prepaid card whose holder is a non-resident person in the Country or domiciled abroad;
VI - the date and value of the deposit, cash withdrawal, cash withdrawal by means of a prepaid card, or provisioning for withdrawal.
Art. 10. The institutions referred to in Art. 1 must pay special attention to: I - operations or proposals whose characteristics, with respect to the parties involved, values, forms of realization, and instruments used, or that, due to the lack of economic or legal foundation, indicate a risk of occurrence of the crimes provided for in Law No. 9,613, of 1998, or related to them;
Art. 10. The institutions referred to in Art. 1 must pay special attention to: II - proposals for starting relationships and operations with politically exposed persons of Brazilian nationality and those originating from countries with which Brazil has a high number of financial and commercial transactions, common borders, or ethnic, linguistic, or political proximity;
Art. 10. The institutions referred to in Art. 1 must pay special attention to: III - signs of circumvention of the identification and recording procedures established in this circular;
Art. 10. The institutions referred to in Art. 1 must pay special attention to: II - analysis with a view to verifying the need for the communications referred to in Arts. 12 and 13;
Art. 11. The information and records referred to in this circular must be maintained and preserved for the following minimum periods, counted from the first day of the year following the end of the relationship with the permanent client or the conclusion of the operations: II - 5 (five) years, for the information and records referred to in Arts. 6º, 8º and 9º.
The information referred to in Art. 2º must be maintained and preserved together with the name of the person responsible for updating the registration, the name of the manager responsible for checking and confirming the information provided, and the date of commencement of the relationship with the permanent client.
Proposals to carry out the operations referred to in the main text must also be communicated to Coaf.
Art. 13. The institutions referred to in Art. 1º must communicate to Coaf, in the manner determined by the Central Bank of Brazil: III - operations carried out or services provided, regardless of the value, to persons who have knowingly perpetrated or attempted to perpetrate terrorist acts or participated in or facilitated their commission, as well as the existence of resources belonging to or co…
Art. 13. The institutions referred to in Art. 1º must communicate to Coaf, in the manner determined by the Central Bank of Brazil: § 3º Proposals to carry out the operations and acts described in items I to IV must also be communicated to Coaf.
§ 2º In the case of financial conglomerates, it is admitted the indication of a director responsible for implementing and complying with the measures established in this circular, as well as for the communications regarding the respective institutions that are part of it.
Art. 20. The updating of registration information relating to permanent clients whose relationships were initiated before the entry into force of this circular must be carried out in accordance with the verification tests referred to in § 5º of Art. 2º.

“Not carried over” means the sentence has no counterpart in this text; the rule can still be in force in another text.