CMN Resolution No. 4,968 — Governs Internal Control Systems of Financial Institutions and Other Entities Authorized by the Central Bank of Brazil

RESOLUTION

CMN RESOLUTION NO. 4,968, OF NOVEMBER 25, 2021

Governs the internal control systems of financial institutions and other entities authorized to operate by the Central Bank of Brazil.

The Central Bank of Brazil, in accordance with Art. 9 of Law No. 4,595, of December 31, 1964, makes public that the Monetary Policy Council, in a session held on November 25, 2021, based on Arts. 4, item VIII, of said Law, 9 and 10 of Law No. 4,728, of July 14, 1965, 20, § 1, of Law No. 4,864, of November 29, 1965, 1 of Decree-Law No. 70, of November 21, 1966, 7 and 23, letter “a”, of Law No. 6,099, of September 12, 1974, 1, item II, of Law No. 10,194, of February 14, 2001, 1, § 2, of Provisional Measure No. 2,192-70, of August 24, 2001, and 1, § 1, of Complementary Law No. 130, of April 17, 2009,

R E S O L V E D:

CHAPTER I

OF THE OBJECT AND SCOPE OF APPLICATION

Art. 1 This Resolution regulates the internal control systems of financial institutions and other entities authorized to operate by the Central Bank of Brazil.

Sole Paragraph. The provisions of this Resolution do not apply to consortium administrators, payment institutions, securities broker-dealers, securities distribution companies, and currency brokerage firms, which must observe the regulations issued by the Central Bank of Brazil in the exercise of its legal attributes. (Amended, effective March 1, 2024, by CMN Resolution No. 5,117, of January 25, 2024.)

CHAPTER II

OF INTERNAL CONTROL SYSTEMS

Section I

Of Obligation and Objectives

Art. 2 The institutions mentioned in Art. 1 must implement and maintain internal control systems compatible with their nature, size, complexity, structure, risk profile, and business model.

Art. 3 Internal control systems must aim to achieve the following objectives:

I - performance: related to efficiency and effectiveness in the use of resources in developed activities;

II - information: related to voluntary or mandatory disclosure, internal or external, of financial, operational, and managerial information that is useful for the decision-making process; and

III - compliance: related to compliance with legal, regulatory provisions, and those established in internal policies and codes.

Section II

Of Essential Characteristics

Art. 4 Internal control systems must:

I - be continuous and effective, defining control activities for all levels of business and for all risks to which the institution is exposed;

II - integrate the routine activities of relevant areas of the institution; and

III - be reviewed and updated periodically.

Art. 5 Internal control systems must provide for:

I - regarding aspects related to control culture:

a) definition of employee responsibilities in internal control systems and respective means for their effective fulfillment;

b) obligation of timely communication to the appropriate management level, by employees, of:

1. problems in operations;

2. situations of non-compliance with conduct standards defined by the institution; and

3. violations of institutional policies or legal and regulatory provisions;

c) prohibition of establishing performance goals that encourage taking risks inconsistent with levels determined by senior management;

d) formalization of commitment to ethics and integrity, including compliance with the code of ethics or equivalent document; and

e) dissemination of the code of ethics or equivalent document;

II - regarding aspects related to identification and assessment of risks:

a) means to identify and continuously assess internal and external factors that may adversely affect the achievement of the institution's objectives and, when applicable, the economic group it integrates;

b) periodic review and update of internal control systems, including measures related to new risks or those not previously addressed;

c) measures to mitigate intolerable and uncontrolled risks; and

d) analysis of the potential occurrence of frauds in activities developed at all levels of business;

III - regarding aspects related to control activities and segregation of functions:

a) control policies and procedures, as well as verification of their compliance;

b) review and monitoring of relevant activities by appropriate management levels;

c) appropriate activity controls for different departments or business areas;

d) physical controls over valuable assets, such as restricted access, dual custody, and periodic inventories;

e) verification of compliance with exposure limits and monitoring of non-conformity situations;

f) approval and authorization system for sensitive transactions and verification and reconciliation;

g) appropriate segregation of functions assigned to institution members, in order to avoid conflict of interest situations;

h) independent identification and monitoring of areas with potential conflicts of interest, with periodic review of responsibilities and functions that may generate conflicts of this nature;

i) controls aimed at preventing the institution's involvement in improper or illegal activities, especially those related to social, environmental, and climate risks;

j) procedures and controls provided for in current legislation and regulation, aiming to prevent the use of the financial system for the practice of "money laundering" or concealment of assets, rights, and values, and terrorism financing; and

k) controls for prevention, detection, investigation, and correction of frauds;

IV - regarding aspects related to information and communication:

a) effective communication channels that ensure employees, according to their corresponding level of operation, access to understandable, reliable, timely, and relevant information for carrying out their tasks and fulfilling their responsibilities;

b) adequate information flows so that objectives, strategies, expectations, policies, and procedures established by superiors reach employees and relevant information is shared among organizational components;

c) methodologies for recording and maintaining internal institutional information, such as financial, operational, and compliance data;

d) guidelines for the use of external information sources and for disclosure to the external public about events and market conditions relevant to decision-making;

e) reliable information systems and respective security and independent monitoring measures for their maintenance;

f) requirements related to adequate processing of information in electronic format and provision of an adequate audit trail;

g) periodic security tests for information and technology systems; (Amended, effective January 1, 2025, by CMN Resolution No. 5,178, of September 26, 2024.)

h) business recovery and contingency plans for situations of interruption of the institution's service provision due to events outside its control, providing for the use of remote physical facilities, including services provided by third parties; and

i) (Revoked, effective January 1, 2026, by Joint Resolution No. 18, of November 28, 2025.)

V - regarding aspects related to monitoring:

a) continuous monitoring of the effectiveness of internal control systems and the main risks associated with the institution's activities;

b) periodic assessments, including by internal audit, regarding the effectiveness of internal control systems and the main risks associated with the institution's activities;

c) systematic monitoring of developed activities, to evaluate, at minimum, whether:

1. the institution's objectives are being achieved;

2. established limits and applicable laws and regulations are being complied with; and

3. any identified deviations are being promptly corrected;

d) update of premises, methodologies, and risk management models; and

e) methodology and channels for reporting on deficiencies in internal controls to responsible parties, the board of directors, and the administrative council, in case of material failures.

Sole Paragraph. (Revoked, effective January 1, 2026, by Joint Resolution No. 18, of November 28, 2025.)

Section III

Of Periodic Reports

Art. 6 Systematic monitoring of activities related to internal control systems must be subject to an annual report containing:

I - the assessment of the adequacy and effectiveness of internal control systems;

II - recommendations regarding any deficiencies, with the establishment of a remediation schedule, where applicable; and

III - the statement of those responsible for the corresponding areas regarding deficiencies found in previous verifications and measures effectively adopted to remedy them.

Sole Paragraph. The report referred to in the main text must:

I - be submitted to the board of directors or, if nonexistent, to the Executive Management, as well as to the institution's internal and external audits; and

II - remain available to the Central Bank of Brazil for a period of five years.

CHAPTER III

OF MANAGEMENT RESPONSIBILITY

Art. 7 The Executive Management and the Board of Directors must actively engage in defining internal control systems, through:

I - the promotion of high ethical and integrity standards;

II - the establishment of an organizational culture emphasizing the relevance of internal control systems and the engagement of each employee in the internal control process;

III - the maintenance of an adequate organizational structure to guarantee the quality and effectiveness of internal control systems and processes; and

IV - the guarantee of adequate and sufficient resources for the exercise of activities related to internal control systems, in an independent, objective, and effective manner.

Art. 8 The board of directors is responsible for ensuring that:

I - the institution's executive management takes necessary measures to identify, measure, monitor, and control risks according to defined risk levels;

II - identified failures are promptly corrected;

III - the institution's executive management monitors the adequacy and effectiveness of internal control systems; and

IV - internal control systems are implemented and maintained in accordance with the provisions of this Resolution.

Sole Paragraph. For institutions that do not have a board of directors, the responsibilities provided for in the main text must be attributed to the institution's executive management.

Art. 9 The institution's Executive Management is responsible for:

I - implementing the guidelines regarding internal control systems approved by the board of directors; and

II - monitoring the adequacy and effectiveness of internal control systems.

Art. 10. The institutions mentioned in Art. 1 must designate to the Central Bank of Brazil a director responsible for compliance with the provisions of this Resolution.

Sole Paragraph. The director mentioned in the main text may perform other functions in the institution, provided there is no conflict of interest.

CHAPTER IV

GENERAL AND TRANSITIONAL PROVISIONS

Art. 11. The Central Bank of Brazil is authorized to:

I - determine the adoption of additional controls in cases where inadequacy in controls implemented by the institution is confirmed; and

II - issue norms and adopt necessary measures for compliance with this Resolution.

Art. 12. The following are revoked:

I - Resolution No. 2,554, of September 24, 1998;

II - Resolution No. 3,056, of December 19, 2002; and

III - Resolution No. 4,390, of December 18, 2014.

Art. 13. This Resolution enters into force on:

I - January 1, 2023, regarding Art. 10; and

II - January 1, 2022, regarding the remaining articles.

Roberto de Oliveira Campos Neto
President of the Central Bank of Brazil