CMN Resolution No. 4595 — Dispenses on the compliance policy of financial institutions and other institutions authorized to operate by the Central Bank of Brazil

The Central Bank of Brazil, in accordance with Article 9 of Law No. 4,595 of December 31, 1964, makes public that the National Monetary Council, in a session held on August 28, 2017, based on Articles 4, item VIII, of the aforementioned Law, and Article 1, § 1, of Complementary Law No. 130 of April 17, 2009,

R E S O L V E S:

Art. 1 This Resolution regulates the compliance policy applicable to financial institutions and other institutions authorized to operate by the Central Bank of Brazil.

Sole Paragraph. The provisions of this Resolution do not apply to consortium administrators and payment institutions, which must observe the regulations issued by the Central Bank of Brazil, in the exercise of their legal powers.

Art. 2 The institutions mentioned in Art. 1 must implement and maintain a compliance policy compatible with the nature, size, complexity, structure, risk profile, and business model of the institution, in order to ensure the effective management of its compliance risk.

Sole Paragraph. Compliance risk must be managed in an integrated manner with the other risks incurred by the institution, in accordance with specific regulations.

Art. 3 A single compliance policy may be adopted by:

I - a conglomerate; or

II - a credit cooperative system.

Art. 4 The compliance policy must be approved by the board of directors.

Sole Paragraph. The compliance policy of credit cooperatives must also be approved by the general assembly.

Art. 5 The compliance policy must define, at a minimum:

I - the objective and scope of the compliance function;

II - the clear division of responsibilities of the people involved in the compliance function, in order to avoid possible conflicts of interest, mainly with the business areas of the institution;

III - the allocation of personnel in sufficient quantity, adequately trained and with the necessary experience to carry out activities related to the compliance function;

IV - the position, in the organizational structure of the institution, of the specific unit responsible for the compliance function, when constituted;

V - the measures necessary to guarantee independence and adequate authority to those responsible for activities related to the compliance function in the institution;

VI - the allocation of sufficient resources for the performance of activities related to the compliance function;

VII - the free access of those responsible for activities related to the compliance function to the information necessary for the exercise of their duties;

VIII - the communication channels with the management, with the board of directors, and with the audit committee, when constituted, necessary for reporting the results arising from activities related to the compliance function, possible irregularities or identified failures; and

IX - the procedures for coordinating activities related to the compliance function with risk management functions and with internal audit.

Art. 6 The unit responsible for the compliance function, when constituted, must be fully segregated from the internal audit activity.

Art. 7 Those responsible for carrying out activities related to the compliance function, regardless of the existence of a specific unit in the organizational structure of the institution, must:

I - test and evaluate the institution's adherence to the legal framework, sub-legal regulations, recommendations of supervisory bodies, and, when applicable, codes of ethics and conduct;

II - provide support to the board of directors and the management of the institution regarding the observance and correct application of the items mentioned in item I, including keeping them informed about relevant updates regarding such items;

III - assist in informing and training all employees and relevant third-party service providers on matters related to compliance;

IV - review and monitor the resolution of points raised in the report on non-compliance with legal and regulatory provisions prepared by the independent auditor, in accordance with specific regulations;

V - prepare a report, with a minimum annual frequency, containing a summary of the results of activities related to the compliance function, its main conclusions, recommendations, and measures taken by the institution's management; and

VI - systematically and timely report the results of activities related to the compliance function to the board of directors.

Sole Paragraph. The institutions mentioned in Art. 1 may hire specialists to carry out activities related to the compliance policy, maintaining the full attributions and responsibilities of the board of directors.

Art. 8 The remuneration policy for those responsible for activities related to the compliance function must be determined independently of the performance of the business areas, in order not to generate conflicts of interest.

Art. 9 The board of directors must, in addition to what is provided in Art. 4 of this Resolution:

I - ensure:

a) the adequate management of the compliance policy in the institution;

b) the effectiveness and continuity of the application of the compliance policy;

c) the communication of the compliance policy to all employees and relevant third-party service providers; and

d) the dissemination of integrity and ethical conduct standards as part of the institution's culture;

II - guarantee that corrective measures are taken when compliance failures are identified; and

III - provide the necessary means for activities related to the compliance function to be carried out adequately, in accordance with this Resolution.

Art. 10. For the institutions referred to in Art. 1 that do not have a board of directors, the attributions and responsibilities provided for in this Resolution must be attributed to the management of the institution.

Art. 11. The institutions mentioned in Art. 1 must keep available to the Central Bank of Brazil:

I - the documentation related to the compliance policy approved by the board of directors; and

II - the report referred to in item V of Art. 7, for a minimum period of five years.

Art. 12. The institutions mentioned in Art. 1 must implement the compliance policy by December 31, 2017.

Art. 13. The Central Bank of Brazil is authorized to issue norms and adopt measures that are necessary for the compliance with this Resolution, including:

I - determine the constitution of a specific compliance unit; and

II - establish simplified procedures for defining the compliance policy referred to in Art. 5 for microentrepreneur credit companies and small business credit companies and for credit cooperatives classified in Segment 5 (S5), as defined in current regulations, observing the size, nature, complexity, structure, risk profile, and business model of the institutions.

Art. 14. This Resolution enters into force on the date of its publication.

Ilan Goldfajn
President of the Central Bank of Brazil