Circular No. 3979 — Establishes and updates the operational risk database and requires remittance to the Central Bank of Brazil of information on operational risk events

The Collegiate Board of the Central Bank of Brazil, in a session held on January 30, 2020, based on arts. 9, 10, item IX, 11, item VII, and 37 of Law No. 4,595, of December 31, 1964, and in view of art. 34 of Resolution No. 4,557, of February 23, 2017, Resolution No. 4,658, of April 26, 2018, and Resolution No. 4,327, of April 25, 2014,

RESOLVES:

CHAPTER I

OF THE OBJECT, SCOPE OF APPLICATION, AND PRELIMINARY PROVISIONS

Art. 1 This Circular provides for the establishment and updating of the operational risk database and the remittance to the Central Bank of Brazil of information relating to operational risk events.

Art. 2 Financial institutions and other institutions authorized to operate by the Central Bank of Brazil classified in Segment 1 (S1) or Segment 2 (S2), in accordance with art. 2 of Resolution No. 4,553, of January 30, 2017, must establish an operational risk database, as provided for in art. 34 of Resolution No. 4,557, of February 23, 2017, according to the criteria established in this Circular.

Art. 3 For the purposes of this Circular, the following are considered:

I - operational risk: as defined in art. 32 of Resolution No. 4,557, of 2017;

II - operational loss: as defined in § 1 of art. 34 of Resolution No. 4,557, of 2017;

III - cyber risk: possibility of occurrence of losses resulting from cyber incidents;

IV - cyber incident: event related to the cyber environment that:

a) produces an adverse effect or represents a threat to information technology (IT) systems or to the information these systems process, store, or transmit; or

b) violates security policies or procedures relating to IT systems;

V - gross loss value: quantifiable value associated with operational risk events, including provisions and expenses, before any recovery by insurance or other means;

VI - risk value not covered by provision: estimate of loss for legal risk events where there is no obligation to record a provision, according to the criteria established in the Accounting Plan of the Institutions of the National Financial System (Cosif).

§ 1 The definition referred to in item IV of the caput includes incidents related to the cyber environment as provided for in Resolution No. 4,658, of April 26, 2018.

§ 2 The calculation of the gross loss value, referred to in item V of the caput, must include:

I - legal fees and court costs;

II - expenses related to operational risk events not recognized in their period of competence, which are subsequently considered due; and

III - fines, charges, and other values incident on the expenses referred to in item II of this paragraph.

CHAPTER II

OF THE OPERATIONAL RISK DATABASE

Art. 4 The operational risk database must reflect the institution's risk profile and risk management practices and include all operational risk events.

§ 1 The scope, consistency, integrity, and reliability of the processes for identifying, collecting, and processing information contained in the operational risk database must be documented.

§ 2 The operational risk database must contain:

I - operational losses associated with cyber risk and socio-environmental risk, as provided for in Resolution No. 4,327, of April 25, 2014; and

II - legal risk events for which there is no obligation to record a provision for contingencies, according to the criteria established in Cosif.

Art. 5 The operational risk database must contain, for each operational risk event:

I - the internal identification code of the operational risk event;

II - the identification of the entity where the loss occurred;

III - the identification of the business unit where the loss was verified, according to Annex I of this Circular;

IV - the dates of occurrence, discovery, and accounting recording of the loss;

V - the accumulated gross value of the loss;

VI - the accumulated value of the loss recovered by insurance or other means;

VII - the source of reimbursement, for loss recovery events;

VIII - the indication, based on consistent and verifiable criteria, of Level 1 Category and Level 2 Category in which the operational risk event is classified, according to Annex II of this Circular;

IX - the identification, where applicable, of operational losses linked to:

a) credit risk, as defined in art. 21 of Resolution No. 4,557, of 2017;

b) market risk, as defined in art. 25 of Resolution No. 4,557, of 2017;

c) socio-environmental risk, as defined in Resolution No. 4,327, of 2014; and

d) cyber risk, as defined in item III of art. 3 of this Circular;

X - the information sources on the loss;

XI - the accounting items in which the losses were recorded, according to the criteria established in Cosif, including sub-headings for internal use by the institution; and

XII - the description of operational losses considered relevant, including their causes.

§ 1 For losses associated with more than one business unit, the allocation to the respective units must be carried out based on consistent and verifiable criteria.

§ 2 The inclusion of the recovered loss value, referred to in item VI of the caput, must be supported by documented proof of payment by the insurer, or of the settlement of reimbursement.

§ 3 In the case of multiple operational losses related to the same operational risk event, the losses associated with it must be identified and grouped, based on consistent and verifiable criteria.

§ 4 Operational losses that do not have a common cause among them must not be grouped into the same operational risk event.

§ 5 For the purposes of item XII of the caput, the relevance criteria established by the Central Bank of Brazil must be considered.

Art. 6 The operational risk database must additionally contain, for each legal risk event:

I - information on the nature of the provision or contingent liability, as well as the valuation method adopted;

II - the provision expense, as well as any subsequent partial additions or reversals related to the same loss;

III - the risk value not covered by provision; and

IV - the probability of occurrence of the loss, according to the criteria established in Cosif.

CHAPTER III

OF SPIN-OFFS, MERGERS, ACQUISITIONS, AND INCORPORATIONS

Art. 7 In the case of mergers, incorporations, and acquisitions, all operational losses of each institution involved in the respective process must be included in the operational risk database.

Sole paragraph. The provision of the caput does not apply to operational losses relating to institutions exempt from establishing an operational risk database, in accordance with Resolution No. 4,557, of 2017.

Art. 8 In the case of spin-offs, the operational risk database of the institutions resulting from the process must include any changes relative to the situation prior to the spin-off, considering the products, services, activities, processes, and systems of each resulting institution.

CHAPTER IV

OF DATA DISPOSAL AND CORRECTION

Art. 9 The institution must request approval from the Central Bank of Brazil for the disposal of data included in the operational risk database, on an exceptional basis, when it considers the recorded event no longer relevant to its risk profile.

§ 1 The request referred to in the caput must be duly justified and prove, regarding the operational risk event to be disposed of, the absence of residual or similar exposure and of association of the event with other processes or products of the institution.

§ 2 The disposal of events recorded in the operational risk database can only be requested from the Central Bank of Brazil after three years of its inclusion, except in the case of discontinued operations by the institution.

§ 3 Disposed data and its respective documentation must be kept available to the Central Bank of Brazil for a minimum period of ten years.

Art. 10 The institution may effect the correction of information inserted in the operational risk database, observing the criteria and procedures defined in its risk management policy.

Sole paragraph. Corrections considered relevant by the institution or those that cause significant changes in the database must be duly justified and documented.

CHAPTER V

OF THE FORWARDING OF INFORMATION

Art. 11 The information contained in the operational risk database must be forwarded to the Central Bank of Brazil, in the manner to be established by it.

§ 1 The information referred to in the caput must:

I - be forwarded to the Central Bank of Brazil with semi-annual periodicity, relative to the base dates of June 30 and December 31; and

II - cover a period of ten years.

§ 2 Alternatively to the provision of § 1, item II, the following data coverage periods are admitted:

I - five years, until December 31, 2021;

II - six years, until December 31, 2022;

III - seven years, until December 31, 2023;

IV - eight years, until December 31, 2024; and

V - nine years, until December 31, 2025.

§ 3 For the purposes of computing the data coverage period, referred to in § 1, item II, the following must be considered:

I - the accounting date, for operational risk events recognized as expense; or

II - the occurrence date, for legal risk events where there is no obligation to record a provision.

§ 4 Operational risk events with an accounting or occurrence date not included in the data coverage period, referred to in § 1, item II, but with eventual production of effects on a future date, must be forwarded to the Central Bank of Brazil.

§ 5 The forwarding of information must be carried out individually, regarding each event, when:

I - the accumulated gross loss value, referred to in item V of art. 5, is equal to or greater than R$1,000.00 (one thousand reais); or

II - the risk value not covered by provision, referred to in item III of art. 6, is equal to or greater than R$10,000,000.00 (ten million reais).

§ 6 Operational risk events whose values are below the limits established in § 5 must be forwarded in an aggregated manner.

§ 7 The Central Bank of Brazil may, at its discretion, exempt the forwarding of part of the information mentioned in arts. 5 and 6 for operational risk events registered in the database before the entry into force of this Circular.

CHAPTER VI

FINAL PROVISIONS

Art. 12 The processes relating to the establishment and management of the operational risk database must be evaluated periodically by the internal audit of the institution, at least with regard to its scope, consistency, integrity, and reliability.

Art. 13 The information used in the establishment of the operational risk database must be kept available to the Central Bank of Brazil for a minimum period of ten years.

Art. 14 The director indicated in accordance with art. 44 of Resolution No. 4,557, of 2017, is responsible for the information referred to in this Circular.

Art. 15 This Circular enters into force on December 1, 2020.

Sole paragraph. For the institution classified in S2, compliance with the provisions of this Circular is admitted from June 1, 2021.

Otávio Ribeiro Damaso
Director of Regulation

ANNEX I

Business Units
Retail
Commercial
Corporate finance
Trading and sales
Payments and settlements
Financial agent services
Asset management
Retail brokerage

ANNEX II

Operational Risk Event Categories
Level 1 Category	Level 2 Category
Internal frauds	Unauthorized activity
Theft and fraud (internal origin)
External frauds	Theft and fraud (external origin)
System security
Labor demands and deficient workplace safety	Labor relations
Workplace safety
Diversity and discrimination
Inadequate practices relating to clients, products, and services	Product suitability for client, disclosure of information on products and services, breach of fiduciary duty
Improper business and market practices
Product failures
Selection, sponsorship, and exposure
Advisory activities
Damage to physical assets owned or in use by the institution	Disasters and other events
Situations that cause interruption of the institution's activities	Interruption of activities
Failures in systems, processes, or information technology (IT) infrastructure	Failures in systems, processes, or IT infrastructure
Failures in execution, compliance with deadlines, or management of the institution's activities	Capture, execution, and maintenance of transactions
Monitoring and reporting
Customer acquisition and documentation
Management of current and non-current accounts
Counterparties in transactions
Representatives and suppliers