CMN Resolution No. 5,076 — Amending Resolutions No. 4,557 and No. 4,606

CMN RESOLUTION NO.
5,076, OF MAY 18, 2023

Amends
Resolution No. 4,557, of February 23, 2017, and Resolution No. 4,606, of October 19, 2017.

The Central Bank of Brazil, in accordance with Article 9 of Law No. 4,595, of December 31, 1964, makes public that the National Monetary Council, in a session held on May 18, 2023, based on
Article 4, items VIII and XI, of the aforementioned Law, Article 20, paragraph 1, of Law No. 4,864,
of November 29, 1965, Articles 7 and 23 of Law No. 6,099, of September 12, 1974, and Articles 1, paragraph 1, and 12 of Complementary Law No. 130, of April 17 2009,

R E S O
L V E D:

Art. 1. Resolution
No. 4,557, of February 23, 2017, shall enter into force with the following amendments:

“Art.
21. ..........................................................................................................

..................................................................................................................

§

1. .................................................................................................................

I

• counterparty:

a) the borrower of funds;

b) the guarantor;

c) the issuer of a security or financial instrument acquired;

d) the end user vis-à-vis the issuer of a post-paid payment instrument;

e) the issuer vis-à-vis the acquirer of a payment instrument; and

f) the institution indebted to another institution arising from an interoperability agreement between different payment arrangements; and

..................................................................................................................” (NR)

“Art.
32. ..........................................................................................................

..................................................................................................................

§
2. .................................................................................................................

..................................................................................................................

IV

• inadequate practices regarding end users, clients, products and
  services;

..................................................................................................................

VI

• situations that result in the interruption of the institution's activities or the discontinuation of the services provided, including payment services;

..................................................................................................................

VIII

• failures in execution, compliance with deadlines or management of the
  institution's activities, including those related to payment arrangements.

§
3. For payment activities, the failures mentioned in § 2 include:

I

• failures in the protection and security of sensitive data related to both
  end user credentials and other information exchanged for the purpose of making payment transactions;

II

• failures in the identification and authentication of the end user in a payment transaction;

III

• failures in the authorization of payment transactions; and

IV

• failures in the initiation of payment transactions.” (NR)

“Art.
33. ..........................................................................................................

..................................................................................................................

IV

• ...................................................................................................................

a) ensure the integrity, security and availability of stored, processed or transmitted data and the information systems used;

b) contain mechanisms for the protection and security of networks, websites, servers and communication channels with a view to reducing vulnerability to digital attacks;

c) adopt procedures to monitor, track and restrict access to sensitive data, networks, systems, databases and security modules;

d) monitor failures in data security and end user complaints regarding this;

e) be suitable for the needs and changes in the business model, both in normal circumstances and during periods of stress;

..................................................................................................................

VI

• periodic performance of scenario analyses with the aim of estimating the institution's exposure to rare and high-severity operational risk events;

VII

• review of data security and confidentiality measures, especially after the occurrence of failures and prior to changes in infrastructure or procedures;

VIII

• preparation of reports indicating procedures for correcting identified failures;

IX

• performance of tests that ensure the robustness and effectiveness of the adopted data security measures;

X

• segregation of functions in information technology environments intended for development, testing and production.

§

1. In the case of outsourcing of IT services, including those related to the
   security of payment services offered, the respective service provision contract must stipulate that:

I

• the contractor must comply with the provisions of items IV, VII, VIII, IX and X of the main text and with the provisions of § 3;

II

• the contracting party will have access to the data and information about the services provided;

III

• the Central Bank of Brazil will have access to:

a) terms signed;

b) documentation and information regarding the services provided; and

c) contractor's premises.

..................................................................................................................

§
3. For payment activities, the structure referred to in the main text must additionally provide for:

I

• adequate identification of the end user;

II

• processes to ensure that all payment transactions can be adequately tracked;

III

• monitoring and authorization mechanisms for payment transactions, with the objective of preventing fraud, detecting and blocking suspicious transactions in a timely manner;

IV

• specific assessments and filters to identify transactions considered high risk;

V

• notification to the end user regarding any non-execution of a transaction;

VI

• mechanisms that allow the end user to verify if the transaction was executed correctly;

VII

• identification, assessment, management, monitoring and mitigation of the risk arising from the participation of a sub-acquirer in the settlement process of payment transactions, in the case of an acquiring institution; and

VIII

• monitoring and control mechanisms for failures in the initiation of payment transactions, segregating, at a minimum, the following events:

a) unauthorized initiation of a payment transaction;

b) non-execution of payment transaction initiation;

c) incorrect execution of payment transaction initiation; and

d) delay in payment transaction initiation.” (NR)

“Art.
37. ..........................................................................................................

..................................................................................................................

Sole Paragraph. The definition referred to in item I of the main text includes the possibility that the electronic currency issuing institution may not be able to convert it into physical or book currency at the time of the user's request.” (NR)

Art. 2. Resolution No. 4,606, of October 19
2017, shall enter into force with the following amendments:

“Art.
20. ..........................................................................................................

..................................................................................................................

Sole Paragraph. The institution opting for the simplified methodology referred to in this Resolution that carries out payment activities or that has a subsidiary that carries out payment activities must implement a liquidity risk management structure in accordance with the provisions of Section II-A.” (NR)

“Art.
21.
..........................................................................................................

..................................................................................................................

VI

• plan to address situations of shortage of liquid assets, indicating the responsibilities, strategies, procedures and alternative sources of resources that ensure the maintenance of an adequate stock of liquid assets that can be readily converted into cash without significant loss of value;

..................................................................................................................” (NR)

“Art.
22. ..........................................................................................................

..................................................................................................................

§
2. .................................................................................................................

..................................................................................................................

IV

• inadequate practices regarding end users, clients, products and
  services;

..................................................................................................................

VI

• situations that result in the interruption of the institutions' activities or the discontinuation of the services provided, including payment;

..................................................................................................................

VIII

• failures in execution, compliance with deadlines or management of the
  institutions' activities, including those related to payment arrangements.

§
3. For payment activities, the failures mentioned in § 2 include:

I

• failures in the protection and security of sensitive data related to both
  end user credentials and other information exchanged for the purpose of making payment transactions;

II

• failures in the identification and authentication of the end user in a payment transaction;

III

• failures in the authorization of payment transactions; and

IV

• failures in the initiation of payment transactions.” (NR)

“Art.
23. ..........................................................................................................

..................................................................................................................

§

1. .................................................................................................................

..................................................................................................................

II

• .....................................................................................................................

..................................................................................................................

c) contractor's premises;

..................................................................................................................

IV

• the contractor must comply with the provisions of item IV of the main text; and

V

• in the case of outsourcing of IT services related to payment services, the contractor must also comply with the provisions of § 3.

..................................................................................................................

§
3. For the institution opting for the simplified methodology referred to in this Resolution that carries out payment activities or that has a subsidiary that carries out payment activities, the structure referred to in the main text must additionally provide for payment activities:

I

• mechanisms for the protection and security of stored, processed or transmitted data;

II

• mechanisms for the protection and security of networks, websites, servers and communication channels with a view to reducing vulnerability to attacks;

III

• procedures to monitor, track and restrict access to sensitive data, networks, systems, databases and security modules;

IV

• monitoring of failures in data security and end user complaints regarding this;

V

• review of data security and confidentiality measures, especially after the occurrence of failures and prior to changes in infrastructure or procedures;

VI

• preparation of reports indicating procedures for correcting identified failures;

VII

• performance of tests that ensure the robustness and effectiveness of the adopted data security measures;

VIII

• segregation of functions in information technology environments intended for development, testing and production;

IX

• adequate identification of the end user;

X

• mechanisms for end user authentication and authorization of payment transactions;

XI

• processes to ensure that all payment transactions can be adequately tracked;

XII

• monitoring and authorization mechanisms for payment transactions, with the objective of preventing fraud, detecting and blocking suspicious transactions in a timely manner;

XIII

• specific assessments and filters to identify transactions considered high risk;

XIV

• notification to the end user regarding any non-execution of a transaction;

XV

• mechanisms that allow the end user to verify if the transaction was executed correctly;

XVI

• identification, assessment, management, monitoring and mitigation of the risk arising from the participation of a sub-acquirer in the settlement process of payment transactions, in the case of an acquiring institution; and

XVII

• monitoring and control mechanisms for failures in the initiation of payment transactions, segregating, at a minimum, the following events:

a) unauthorized initiation of a payment transaction;

b) non-execution of payment transaction initiation;

c) incorrect execution of payment transaction initiation; and

d) delay in payment transaction initiation.” (NR)

“Section II-A

On Liquidity Risk Management

Art.
24-A. For the purposes of this Resolution, liquidity risk is defined as the possibility that the institution:

I

• may not be able to efficiently honor its expected and unexpected, current and future obligations without affecting its daily operations and without incurring significant losses; or

II

• may not be able to convert electronic currency into physical or book currency at the time of the user's request.

Art.
24-B. The simplified continuous risk management structure, referred to in Article 21, must additionally provide, for liquidity risk, processes to identify, assess, monitor and control exposure to liquidity risk at different time horizons, including intraday.

Art.
24-C. The electronic currency issuing institution must describe the main characteristics of its liquidity risk management structure in a publicly accessible report, with a minimum annual frequency.

Sole Paragraph. The institution must disclose, together with its published financial statements, the address of the institution's website where the report mentioned in the main text is located.” (NR)

“Art.
25. ..........................................................................................................

..................................................................................................................

III

• advantages granted in the restructuring of financial instruments, as defined in § 1, item II;

..................................................................................................................

§

1. .................................................................................................................

I

• counterparty:

a) the borrower of funds;

b) the guarantor;

c) the issuer of a security or financial instrument acquired;

d) the end user vis-à-vis the issuer of a post-paid payment instrument;

e) the issuer vis-à-vis the acquirer of a payment instrument; and

f) the institution indebted to another institution arising from an interoperability agreement between different payment arrangements; and

..................................................................................................................” (NR)

Art. 3. This Resolution enters into force on July 1 2023.

Roberto de Oliveira Campos Neto
President of the Central Bank of Brazil