CMN Resolution No. 4737

The Central Bank of Brazil, in accordance with Article 9 of Law No. 4,595 of December 31, 1964, makes public that the National Monetary Council, in a session held on July 29, 2019, based on Articles 4, items VI and VIII, of the aforementioned Law, Article 7 of Law No. 6,099 of September 12, 1974, Article 1, paragraph 1, of Complementary Law No. 130 of April 17, 2009, and Article 12, paragraph 3, of Law No. 12,414 of June 9, 2011, and considering the provisions of Article 1, paragraph 3, item VII, of Complementary Law No. 105 of January 10, 2001,

RESOLVES:

CHAPTER I

OBJECT AND SCOPE OF APPLICATION

Article 1. This Resolution provides for the provision, by financial institutions and other institutions authorized to operate by the Central Bank of Brazil, of compliance information for natural persons and legal entities to the managers of databases governed by Law No. 12,414 of June 9, 2011, and the conditions for obtaining and canceling the registration of these managers.

CHAPTER II

PROVISION OF INFORMATION TO DATABASE MANAGERS

Article 2. Financial institutions and other institutions authorized to operate by the Central Bank of Brazil must provide database managers governed by Law No. 12,414 of 2011 and Decree No. 9,936 of July 24, 2019, with the information comprising the history of the following operations of their clients:

I - credit operations;

II - leasing operations;

III - self-financing operations carried out through consortium groups; and

IV - other operations with characteristics of credit granting.

Sole Paragraph. The information regarding the operations provided for in item III must be passed on by the consortium administrators responsible for the respective groups.

Article 3. For the purposes of Article 2, the history of the operations comprises:

I - the date of granting the loan or financing, or the assumption of the obligation or payment commitment;

II - the total original value of the loan or financing granted, or the obligation or commitment assumed;

III - the values of the loan or financing installments, or the installments of the obligations or commitments, indicating the due dates; and

IV - the amounts paid, even if partial, of the loan or financing installments, or the installments of the obligations or commitments, indicating the payment dates.

Article 4. In the event of sale or transfer of the operation, the obligation to provide the information provided for in Article 2 shall lie with the institution that maintains the accounting record of the operation in its assets, as provided for in current regulation.

Article 5. The information referred to in Article 2 must be passed on to database managers registered by the Central Bank of Brazil.

CHAPTER III

REGISTRATION OF DATABASE MANAGER

Article 6. The requirements for the registration of a database manager with the Central Bank of Brazil are:

I - regular constitution of the database manager;

II - observance of the minimum requirements provided for in Article 2 of Decree No. 9,936 of 2019;

III - designation of a director responsible for the management of the database and a director responsible for the information security policy, observing the provisions of Articles 8 to 10 of this Resolution;

IV - compliance, by the members of the control group, with the conditions provided for in Article 8 of this Resolution, in the case of a database manager organized as a corporation or a limited liability company; and

V - identification of the natural or legal persons who make up the control group of the database manager, with their respective shareholdings, in the case of a database manager organized as a corporation or a limited liability company.

§ 1. In the event of transfer of responsibility for the management of a database in operation on the date of entry into force of Decree No. 9,936 of 2019 to another legal entity, the certifications and assurances issued and the tests carried out before this transfer that are still valid may, at the discretion of the Central Bank of Brazil, be considered for the purposes of compliance with the operating requirements provided for in Article 2, item II, of that Decree by the legal entity that assumes responsibility for the management of the database.

§ 2. For the purposes of this Resolution, the control group is considered to be a person or group of persons who hold partner rights corresponding to the majority of the voting capital of a corporation or 75% (seventy-five percent) of the social capital of a limited liability company.

§ 3. In cases where the control of the company is not identified according to the criteria mentioned in § 2 of this article, the Central Bank of Brazil may use other elements to identify the control group.

§ 4. A database manager controlled exclusively by institutions authorized to operate by the Central Bank of Brazil is exempt from proving compliance with the requirement established in item IV of the main text.

Article 7. The Central Bank of Brazil will deny the registration request of a database manager if the following are verified:

I - circumstances that affect the reputation of the members of the control group, the director responsible for the management of the database, or the director responsible for the information security policy; or

II - omissions or provision of documents, data, or information that are incorrect or in disagreement with legal or regulatory norms, considering the circumstances of each concrete case and the context of the facts.

§ 1. To evaluate the circumstance mentioned in item I of the main text, the Central Bank of Brazil will take into account the situations and occurrences described in Article 9 of this Resolution.

§ 2. In the cases covered by this article, the Central Bank of Brazil will grant a deadline for interested parties to express their views.

CHAPTER IV

CONTROL GROUP AND FUNCTIONS OF DIRECTOR RESPONSIBLE FOR DATABASE MANAGEMENT AND DIRECTOR RESPONSIBLE FOR INFORMATION SECURITY POLICY

Article 8. The conditions to integrate the control group and to exercise the functions of director responsible for the management of the database and director responsible for the information security policy of a database manager referred to in Article 1 are:

I - to have an impeccable reputation;

II - to be a resident in the country, in the case of the director responsible;

III - not to be barred by special law, nor convicted of bankruptcy crime, tax evasion, malfeasance, active or passive corruption, extortion, embezzlement, against the popular economy, public faith, property, or the National Financial System, or sentenced to a criminal penalty that prohibits, even temporarily, access to public office;

IV - not to be declared ineligible or suspended from exercising the positions of fiscal councilor, administration councilor, director, or managing partner in the institutions referred to in Article 1 or in complementary pension entities, insurance companies, capitalization societies, open companies, or entities subject to the supervision of the Securities and Exchange Commission;

V - not to be responding to, nor any company of which they are a controller or administrator, to protests of titles, judicial collections, issuance of bad checks, non-compliance with obligations, and other analogous occurrences or circumstances;

VI - not to be declared bankrupt or insolvent;

VII - not to have controlled or administered, in the last two years, a firm or company subject to a declaration of insolvency, liquidation, intervention, bankruptcy, or judicial reorganization.

Sole Paragraph. In cases of non-compliance with the provisions of items V to VII of the main text, the Central Bank of Brazil will consider the circumstances of each case, in view of the public interest.

Article 9. In evaluating the compliance, by the members of the control group and by the directors responsible for the management of the database and the information security policy of database managers referred to in Article 1, with the requirement established in Article 8, item I, the Central Bank of Brazil may take into account the following situations and occurrences:

I - criminal process or police inquiry to which the persons referred to in the main text, or any company of which they were or had been, at the time of the facts, controllers or administrators, are responding;

II - judicial or administrative process that has a relationship with the National Financial System;

III - other situations, occurrences, or analogous circumstances judged relevant by the Central Bank of Brazil.

Sole Paragraph. In the analysis regarding the parameters stipulated in this article, the Central Bank of Brazil will consider the circumstances of each case, in view of the public interest.

Article 10. The director responsible for the management of the database and the director responsible for the information security policy must, in addition to complying with the provisions of Article 2, paragraph 9, of Decree No. 9,936 of 2019, have technical capacity compatible with the duties of the position, proven based on academic training, professional experience in the area of activity, or specific technical knowledge related to database management and information security policy.

§ 1. The designated director may exercise the functions referred to in the main text for a period of up to four years, which may be renewed for equal periods.

§ 2. The Central Bank of Brazil may dispense with the proof of technical capacity referred to in the main text, in the case of a responsible director whose name has already been subject to appraisal by the autarchy for the exercise of the function.

Article 11. The database manager registered under the terms of this Resolution must communicate to the Central Bank of Brazil, in the manner defined by it, the designation of the director responsible for the management of the database and the director responsible for the information security policy.

Sole Paragraph. If the designated director does not meet the conditions established in Articles 8 and 10 of this Resolution, the Central Bank of Brazil will grant a deadline for the database manager to regularize the situation, under penalty of cancellation of its registration.

Article 12. The database manager registered with the Central Bank of Brazil must communicate cases where the director responsible for the management of the database or the director responsible for the information security policy, during the exercise of their functions, cease to meet the conditions provided for in Article 8.

§ 1. The communication referred to in the main text must be made within a maximum period of fifteen days, counted from the knowledge or access to information regarding the occurrence that characterizes the non-compliance with the condition.

§ 2. The Central Bank of Brazil will evaluate the occurrences subject to the communication mentioned in the main text and, considering the circumstances of each concrete case and the context of the facts, may cancel its registration.

Article 13. The alteration in the control group of a database manager organized as a corporation or a limited liability company must be communicated to the Central Bank of Brazil in the manner defined by it.

Sole Paragraph. If the new members of the control group do not meet the requirements provided for in Article 8 of this Resolution, the Central Bank of Brazil will grant a deadline for the database manager to regularize the situation, under penalty of cancellation of its registration.

CHAPTER V

CANCELLATION OF REGISTRATION

Article 14. The Central Bank of Brazil, considering the circumstances of each concrete case and the context of the facts, will cancel, observing Law No. 9,784 of January 29, 1999, the registration of a database manager if the following are found, at any time:

I - non-observance of the conditions established in this Resolution;

II - omissions or provision of documents, data, or information that are incorrect or in disagreement with legal or regulatory norms; or

III - absence, for a period exceeding 45 days, counted from the date of the event, of designation of a substitute to exercise the functions of director responsible for the management of the database or director responsible for the information security policy, in the event of dismissal from these functions.

§ 1. The Central Bank of Brazil, prior to the cancellation referred to in the main text, will notify and grant a deadline for the database manager to express their views on the intention to cancel its registration.

§ 2. In the event of cancellation of the registration, the Central Bank of Brazil will communicate the motivation to the database manager.

§ 3. It is prohibited for the institutions mentioned in Article 1 to provide information on the credit history of their clients to database managers whose registration has been canceled in the manner of the main text.

§ 4. Database managers whose registration has been canceled in the manner of the main text cannot use for any purpose the information originating from the institutions mentioned in Article 1.

Article 15. The cancellation, upon request, of the registration of a database manager is conditioned on the filing of the request with the Central Bank of Brazil in the manner defined by it.

Sole Paragraph. The prohibitions provided for in §§ 3 and 4 of Article 14 of this Resolution apply to the cancellation, upon request, of the registration of a database manager.

CHAPTER VI

FINAL PROVISIONS

Article 16. The Central Bank of Brazil, during the analysis of the matters dealt with in this Resolution, may request information, clarifications, or additional documents considered necessary for the examination and decision.

Article 17. The Central Bank of Brazil will issue the necessary instructions for the compliance with the provisions of this Resolution, including with regard to the procedures for instructing and evaluating the registration request referred to in Article 6, the communications referred to in Articles 11 and 13, and the request referred to in Article 15.

Article 18. Resolution No. 4,172 of December 20, 2012, is revoked.

Article 19. This Resolution enters into force on the date of its publication.

Roberto de Oliveira Campos Neto
President of the Central Bank of Brazil