CMN Resolution No. 4474 — Digitalization and Management of Digitized Documents by Financial Institutions

The Central Bank of Brazil, in accordance with Article 9 of Law No. 4,595 of December 31, 1964, makes public that the National Monetary Council, in a session held on March 31, 2016, based on Articles 4, item VIII, of the aforementioned Law, and Article 23 of Law No. 12,865 of October 9, 2013,

R E S O L V E S:

Article 1. This Resolution establishes procedures for the production and management of digitized documents related to operations and transactions carried out by financial institutions and other institutions authorized to operate by the Central Bank of Brazil, as well as for the disposal of the physical originals of documents that have been digitized and stored electronically.

Sole Paragraph. For the purposes of this Resolution, the following are considered:

I - source document: the physical original of the document, related to the transaction or operation carried out by the institution, used to generate, through a digitization process, the digitized document;

II - digitization: a technological process that allows obtaining a faithful and complete digital image of a source document;

III - digitized document: the digital image of the source document, resulting from the digitization process; and

IV - disposal: the definitive elimination of the source document, after its digitization.

Article 2. The institutions referred to in Article 1 must, when digitizing a source document, register whether the document submitted to digitization is an original document, a notarized copy, an administratively authenticated copy, or a simple copy.

Article 3. A backup copy of the digitized documents must be produced.

Article 4. The procedures and technologies used in the digitization of documents and in the maintenance of digitized documents must ensure:

I - integrity, authenticity, confidentiality, and traceability of the digitized document;

II - protection of the digitized document against unauthorized access, use, alteration, reproduction, and destruction;

III - tracking and auditing of the procedures employed;

IV - image quality standard of the digitized document that guarantees its readability and use; and

V - indexing that allows the location, management, and preservation of the digitized document, as well as subsequent verification of the regularity of the stages of the adopted process.

Article 5. Digitized documents and backup copies of digitized documents must be stored in a secure location that allows quick access for consultation and restoration purposes.

§ 1. Digitized documents must be properly ordered, classified, and cataloged.

§ 2. The integrity control mechanisms for media and technological evolution of hardware and software implemented must ensure the use of the digitized document.

§ 3. Digitized documents and backup copies of digitized documents must be stored in the country.

Article 6. The production, storage, maintenance, and restoration of backup copies of digitized documents must be carried out based on procedures and requirements that ensure the protection and retention of information, with the maintenance of complete and accurate records of these copies.

§ 1. The procedures and requirements adopted in the storage of the backup copy must ensure the maintenance of the physical and logical security necessary for its protection and safeguard.

§ 2. The backup copy must be stored in a physical location distinct from the location where the digitized document is stored, so as to ensure that any unavailability of the digitized document does not compromise full access to the backup copy and vice versa.

§ 3. The media and electronic components on which the data regarding the backup copies are recorded must be regularly tested.

§ 4. The technologies, resources, and protection mechanisms applied in the use, transport, and storage of the media containing the backup copies must comply with the principles of confidentiality, integrity, and information availability, according to their level of criticality.

§ 5. The restoration and testing procedures for backup copies must be documented.

§ 6. The operational process related to the production, storage, and maintenance of backup copies must allow for the monitoring of copy execution and the detection of failures in scheduled backup copies.

Article 7. The responsibilities and criteria for granting, maintaining, reviewing, and revoking access authorizations to the systems, information related to digitized documents, and backup copies must be defined in a manner that ensures that only authorized persons have access to the systems and information.

§ 1. Access must be traceable through audit trail records.

§ 2. The granting of access authorization must follow the institution's control flow and hierarchy and must generate a record for the audit trail.

§ 3. Access authorizations must be reviewed periodically.

Article 8. The environments where the media or infrastructure containing the backup copies are stored must have physical and logical access controls that restrict unauthorized access and allow for tracking, as well as the identification of the reasons for access.

Article 9. To ensure the authenticity and integrity of the digitized document, a legally accepted standard of digital signatures must be used, which allows for the verification of digital signatures throughout the validity period of the document.

Article 10. The institutions referred to in Article 1 may dispose of the source document after its digitization.

§ 1. The disposal referred to in the main text must be compatible with the provisions of specific legislation applicable to the rights and obligations recorded in the source document.

§ 2. Prior to the disposal referred to in the main text, the institutions mentioned in Article 1 must verify whether the elimination of the source document may, directly or indirectly, prevent, hinder, complicate, or mitigate, in any way, the judicial or extrajudicial protection of the rights and interests that arise, directly or indirectly, from the source document, including with regard to the production of evidence.

§ 3. The disposal of source documents protected by specific legislation or regulation, such as official or public documents, documents with permanent retention value, and documents of historical value, must observe the provisions of the respective normative acts.

§ 4. The disposal of source documents that present material damage affecting their readability is prohibited.

§ 5. The check, after its digitization, can only be disposed of sixty days after settlement.

Article 11. The procedures used in digitization, the custody of digitized documents and backup copies, and the disposal of documents must be submitted to periodic testing by internal audit and be consistent with the institution's internal controls.

Article 12. The procedures and technologies used in the digitization of documents, which involve the production, storage, maintenance, and access to digitized documents and backup copies of digitized documents, as well as the procedure for the disposal of source documents, must be described in a specific manual of the institution.

Article 13. The institutions mentioned in Article 1 may hire third parties to provide document digitization services in the country.

§ 1. The institution contracting the services referred to in the main text is responsible for the integrity, reliability, security, and confidentiality regarding the digitization of documents carried out by third parties, as well as for compliance with the legislation and regulation regarding the procedure for digitization and disposal of source documents.

§ 2. In the event of hiring third parties to provide document digitization services, the contractor is prohibited from storing the backup copies.

§ 3. Contracts regarding the provision of document digitization services referred to in the main text must provide:

I - observance, by the contracted service provider, of the procedures and technologies used in document digitization described in the specific manual of the contracting institution, as referred to in Article 12;

II - unrestricted access by the contracting institution to the processes, documents, and information related to digitization to comply with the provisions of Article 11; and

III - permission for access by the Central Bank of Brazil to the contracts signed, documentation, and information regarding the services provided, as well as to the contractor's premises.

Article 14. The documentation and records related to control mechanisms, procedures, tests, and audit trails must be kept available to the Central Bank of Brazil for a minimum period of five years.

Article 15. The Central Bank of Brazil may establish technical requirements and operational procedures to be observed in the process of digitization and disposal of documents referred to in this Resolution.

Article 16. This Resolution enters into force on the date of its publication.

               Anthero de Moraes Meirelles Acting President of the Central Bank of Brazil