CVM Instruction 505: Norms and Procedures for Securities Operations in Regulated Markets

FULL TEXT OF CVM INSTRUCTION NO. 505, OF SEPTEMBER 27, 2011 WITH CHANGES INTRODUCED BY CVM INSTRUCTIONS NO. 526/12, 581/16, 612/19 AND 617/19 Establishes norms and procedures to be observed in operations carried out with securities in regulated securities markets.

THE PRESIDENT OF THE SECURITIES AND EXCHANGE COMMISSION - CVM makes public that the Collegiate Board, in a meeting held on September 21, 2011, based on items "a" and "c" of item II of art. 18 of Law No. 6.385, of December 7, 1976, APPROVED the following Instruction:

CHAPTER I - DEFINITIONS
Art. 1. For the purposes of this Instruction, the following are considered:
I – intermediary: the institution authorized to act as a member of the distribution system, on its own behalf and on behalf of third parties, in the negotiation of securities in regulated securities markets; II – special operator: the natural person or sole proprietorship authorized to act in its own name or on behalf of an intermediary, in the negotiation of securities in organized securities markets, in the cases and conditions defined by the administrator entity; II – REVOKED;

• Item II revoked by CVM Instruction No. 612, of August 21, 2019.
  III – principal or client: the natural or legal person, investment fund, investment club, or non-resident investor, in whose name operations with securities are carried out; IV – clearing or settlement member: the financial institution or institution equivalent to it, responsible, vis-à-vis those to whom it provides services and vis-à-vis the clearing and settlement entity, for the clearing and settlement of operations with securities under its responsibility; V – order: the act by which the client determines that an intermediary negotiate or register an operation with a security, in its name and under the conditions it specifies; and V – order: the prior act by which the client determines that an intermediary negotiate or register an operation with a security, in accordance with art. 12, in its name and under the conditions it specifies;
• Item V with wording given by CVM Instruction No. 612, of August 21, 2019.
  VI – related persons:
  a) administrators, employees, operators, and other agents of the intermediary who perform mediation or operational support activities; a) administrators, employees, operators, and other agents of the intermediary who perform mediation or operational support activities;
• Sub-item “a” with wording given by CVM Instruction No. 612, of August 21, 2019.
  b) autonomous agents who provide services to the intermediary; c) other professionals who maintain, with the intermediary, a service provision contract directly related to the activity of mediation or operational support; d) natural persons who are, directly or indirectly, controlling or participate in the corporate control of the intermediary; e) companies controlled, directly or indirectly, by the intermediary or by persons related to it; f) spouse or partner and minor children of the persons mentioned in sub-items “a” to “d”; and g) clubs and investment funds whose majority of quotas belong to related persons, unless managed discretely by unrelated third parties; VII – offer: the act by which the intermediary manifests the intention to carry out a transaction with a security, for itself, for its clients, or other persons with whom it maintains a contractual relationship, registering the necessary terms and conditions in the negotiation system of the administrator entity of organized markets; VIII – current account system: system for recording the financial movements of clients with the intermediary; IX – self-regulatory entity: entity responsible for the self-regulation of the organized markets referred to in the regulation that disciplines the regulated securities markets; X – intermediary’s administration bodies: bodies thus defined in its bylaws or articles of association; XI – director responsible for compliance with the norms established by this Instruction: statutory director responsible for the provision of item I of art. 4º; XII – internal controls director: statutory director responsible for the activities provided for in item II of art. 4º; XIII – business continuity plans: written action plans that define the procedures and systems necessary to continue or restore the intermediary’s operation in case of interruption of critical business processes; XIV – critical business processes: processes and operational activities whose unplanned interruption or unavailability may cause a significant negative impact on the intermediary’s business, observing the provision of § 1º of art. 35-A; XV – critical systems: term defined in art. 35-B; XVI – relevant cybersecurity incident: incident that affects critical business processes, or sensitive data or information, and has a significant impact on clients; XVII – relevant services: services related to the critical business processes referred to in art. 35-A; and XVIII – sensitive data or information: data or information thus classified by the intermediary, observing the provision of the sole paragraph of art. 35-E.
• Items VII to XVIII included by CVM Instruction No. 612, of August 21, 2019.

Sole paragraph. The references of this Instruction to the term client encompass acts originating from its attorney-in-fact, legal representative, or person authorized by it, according to its registration.

• Sole paragraph included by CVM Instruction No. 612, of August 21, 2019.

CHAPTER II – INTERMEDIATION IN REGULATED MARKETS
Art. 2. The intermediation of operations in regulated securities markets is exclusive to institutions authorized to act as members of the distribution system, on their own behalf and on behalf of third parties, in the negotiation of securities in regulated securities markets.

Art. 3. The intermediary must adopt and implement:
I – adequate and effective rules for compliance with the provisions of this Instruction; and II – procedures and internal controls with the objective of verifying the implementation, application, and effectiveness of the rules mentioned in item I.

§ 1º The rules, procedures, and internal controls referred to in this article must:
I – be written;
II – be verifiable; and
III – be available for consultation by the persons mentioned in art. 1º, item VI, sub-items “a” to “c”, by the CVM, by the administrator entities of the organized markets in which the intermediary is authorized to operate, and by the self-regulatory entity, if applicable.

• Item III with wording given by CVM Instruction No. 612, of August 21, 2019.

§ 2º Non-compliance with the provisions of items I and II of the caput is considered not only the non-existence or insufficiency of the rules, procedures, and controls referred to therein, but also their non-implementation or inadequate implementation for the purposes provided for in this Instruction.

§ 3º Evidence of inadequate implementation of the rules, procedures, and internal controls includes:
I – the repeated occurrence of failures; and
II – the absence of recording of the application of the methodology, in a consistent and verifiable manner.

§ 4º Without prejudice to the responsibility of the directors referred to in items I and II of the caput of art. 4º, it is incumbent upon the administration bodies of the intermediaries:
I – approve the rules and procedures referred to in the caput; and II – supervise the compliance and effectiveness of the procedures and internal controls referred to in the caput.

• § 4º included by CVM Instruction No. 612, of August 21, 2019.

Art. 4. The intermediary must indicate:
I – a statutory director responsible for compliance with the norms established by this Instruction; and II – a statutory director responsible for the supervision of the procedures and internal controls provided for in item II of the caput of art. 3º.

§ 1º The appointment or replacement of the statutory directors referred to in items I and II must be reported to the CVM and to the administrator entities of the organized markets in which the intermediary is authorized to operate, if applicable, within a period of 7 (seven) business days.

§ 2º The functions referred to in items I and II of the caput cannot be performed by the same statutory director.

§ 3º The function referred to in item II of the caput cannot be performed in conjunction with functions related to the trading desk of the intermediary.

§ 3º-A Without prejudice to the provision of item II of the caput and § 2º of this article, the intermediary may attribute to a specific director the responsibility for compliance with the obligations provided for in Chapters VIII-A and VIII-B of this Instruction, provided that:
I – the performance of the accumulated functions by the director does not entail a conflict of interest; and II – the responsibility attributed to each director is contained in the information security policy provided for in art. 35-D.

• § 3º-A included by CVM Instruction No. 612, of August 21, 2019.

§ 4º The directors referred to in items I and II must act with probity, good faith, and professional ethics, employing, in the exercise of their functions, all care and diligence expected of a professional in their position.

§ 5º The director referred to in item II of the caput must send to the administration bodies of the intermediary, by the last business day of the months of January and July, a report relating to the semester ended in the month immediately preceding the delivery date, containing:
I – the conclusions of the examinations carried out; II – recommendations regarding any deficiencies, with the establishment of remediation schedules, if applicable; and III – the manifestation of the director referred to in item I of the caput regarding the deficiencies found in previous verifications and the measures planned, according to a specific schedule, or effectively adopted to remedy them.

§ 5º The internal controls director must send a report to the administration bodies of the intermediary, by the last business day of the month of April of each year, containing, at minimum:
I – detailed and updated description:
a) of the internal controls implemented, informing the types of controls existing and the activities and operations covered; b) of the methodology applied for the choice and realization of examinations, indicating, for example, monitoring mechanisms, parameters used for verification of abnormalities or failures, as well as criteria established for the selection of samples; and c) of the procedures carried out for the analysis of deficiencies found; II – detailing of the tests carried out and the conclusions obtained regarding the efficiency and effectiveness of the internal controls to ensure compliance with the provisions of Chapters III to IX of this Instruction involving:
a) client registration activities, transmission and execution of orders, specification of principals, operations with related persons, transfer of operations, payment and receipt of values, conduct norms, and file maintenance, covering both the intermediary’s activity in the stock market and the organized over-the-counter market; and b) monitoring of information technology infrastructure, provided for in Chapters VIII-A and VIII-B, highlighting the cybersecurity program referred to in art. 35-H; III – recommendations regarding any deficiencies that have been identified during the reference period of the report by the intermediary, by the CVM, by the administrator entity of the market in which it is authorized to operate, and by the self-regulatory entity, with the establishment of action plans and remediation schedules for correction, if applicable; IV – risk assessment for the intermediary regarding its internal controls and its vulnerability to cyberattacks; and V – manifestation of the director responsible for compliance with the norms established by this Instruction regarding the deficiencies found, containing, at minimum:
a) regarding each of the deficiencies that have been identified in the previous period, including those identified by the CVM, by the administrator entity of the market in which it is authorized to operate, and by the self-regulatory entity, information on the progress or on the eventual conclusion of the actions planned to remedy them; b) regarding the deficiencies pointed out in previous reports, inform if the remediation schedules were implemented and the result of the actions adopted to remedy the deficiencies; c) reasoned evaluation on the intermediary’s evolution in compliance with the requirements of this Instruction during the period of competence of the report; and d) evaluation on the adequacy of the business continuity plan, indicating the needs for improvement, if necessary.

• § 5º with wording given by CVM Instruction No. 612, of August 21, 2019.

§ 6º The report referred to in § 5º must be available, for the CVM, for the administrator entity of the market in which it is authorized to operate, and for the self-regulatory department, if applicable, at the intermediary’s headquarters.

§ 6º All activities mentioned in item II of § 5° must be included in the annual report, even if they are not applicable to the intermediary’s internal processes, are of little relevance, or offer low risk in the context of the intermediary’s activities, only the reason justifying the absence of mention of the conclusions of the tests carried out in these cases being presented.

• § 6º with wording given by CVM Instruction No. 612, of August 21, 2019.

§ 7º Without prejudice to the responsibility of the directors referred to in items I and II of the caput, it is incumbent upon the administration bodies of the intermediaries:
I – approve the rules and procedures referred to in art. 3º; and II – supervise the compliance and effectiveness of the procedures and internal controls referred to in art. 3º.

§ 7º If the intermediary has attributed to a specific director the responsibility for compliance with the obligations provided for in Chapters VIII-A and VIII-B of this Instruction, in the manner of § 3º-A, the report referred to in § 5º must also include its manifestation in accordance with sub-items “a”, “b”, “c”, and “d” of item V of § 5º of art. 4º.

• § 7º with wording given by CVM Instruction No. 612, of August 21, 2019.

§ 8º The report referred to in § 5º must be available at the intermediary’s headquarters for consultation by the CVM, by the administrator entity of the market in which it is authorized to operate, and by the self-regulatory entity, if applicable, its sending not being necessary, except when requested by the CVM and by the entities mentioned in this paragraph.

• § 8º included by CVM Instruction No. 612, of August 21, 2019.

CHAPTER III – CLIENT REGISTRATION
Section I – General Rules
Art. 5. The intermediary must carry out and maintain the registration of its clients with the minimum content determined in a specific norm.

§ 1º Client registration may be carried out and maintained in an electronic system.

§ 2º The electronic system for maintaining client registration referred to in §1º must:
I – allow immediate access by the intermediary to the registration data; and II – use technology capable of fully complying with the provisions of this Instruction and the specific norms regarding client registration.

§ 3º The client registration maintained by the intermediary must allow the identification of the date and content of all changes and updates carried out.

§ 3º REVOKED.

• § 3º revoked by CVM Instruction No. 612, of August 21, 2019.

§ 4º Intermediaries must identify the persons authorized to issue orders on behalf of more than one principal and inform the organized market administrator entities in which they operate, in accordance with the terms and standards established by them.

§ 4º Intermediaries must identify the persons authorized to issue orders on behalf of more than one principal and inform the organized market administrator entities in which they operate in accordance with the terms and standards established by them.

• § 4º with wording given by CVM Instruction No. 612, of August 21, 2019.

Art. 5º-A. The client registration maintained by the intermediary must allow the identification of the date and content of all changes and updates carried out.

Sole paragraph. Without prejudice to other procedures and controls adopted due to art. 35-B, the intermediary must ensure that the electronic registration systems contain complete and sufficient audit trails to ensure the tracking of additions, changes, and exclusions, and that they allow, at minimum, the identification of:
I – the responsible user;
II – the date and time of the occurrence of the event; and III – whether the event constitutes an addition, change, or exclusion.

• Art. 5º-A included by CVM Instruction No. 612, of August 21, 2019.

Art. 6. The intermediary must keep the registration of its clients updated with the organized market administrator entities in which it operates and with the corresponding clearing and settlement entities, if applicable, in accordance with the terms and standards established by them.

Art. 7. It is optional for the intermediary to use a unified registration if it is part of a financial conglomerate.

Sole paragraph. Unified registration is understood as an electronic system for storing information and documentation for shared use.

Art. 8. Without prejudice to the responsibilities applicable to the intermediary under this Instruction, the preparation and maintenance of client registrations may, with CVM approval, be carried out in a centralized manner by the organized market administrator entities, by the clearing and settlement entities, and by the entities representing market participants.

Section II – Simplified Registration
Art. 9. It is optional for the intermediary to maintain a simplified registration of non-resident investors, provided that:
I – the non-resident investor is a client of a foreign intermediary institution, with which it is duly registered in accordance with the legislation applicable in its country of origin; II – the foreign intermediary institution referred to in item I assumes, vis-à-vis the intermediary, the obligation to present, whenever requested, all registration information duly updated capable of meeting the requirements present in the CVM regulation regarding client registration within the securities market; III – the intermediary:
a) establishes criteria that allow it to evaluate the degree of reliability of the foreign intermediary institution referred to in item I; b) adopts the necessary measures to ensure that the client’s registration information will be promptly presented by the foreign intermediary institution, whenever requested; and c) ensures that the foreign intermediary institution referred to in item I adopts adequate client identification and registration practices, consistent with the legislation applicable in the respective country of origin. IV – the foreign intermediary institution referred to in item I is located in a country that is not considered high-risk in terms of money laundering and terrorist financing, and is not classified as non-cooperative by international organisms, regarding the combat of illicit activities of this nature; and V – the capital market regulatory body of the country of origin of the foreign intermediary institution has entered into a mutual cooperation agreement with the CVM that allows the exchange of investor financial information, or is a signatory to the multilateral memorandum of understanding of the International Organization of Securities Commissions – IOSCO.

Sole paragraph. It is incumbent upon the organized market administrator entity to define the minimum content of the simplified registration and possess control mechanisms that guarantee compliance with the provisions of this article.

Art. 10. The norms established by the organized market administrator entities for compliance with this Section must contemplate, at minimum, the following:
I – obligation to conclude a written contract between Brazilian intermediaries and foreign intermediaries, which must contemplate the following minimum content:
a) obligation of the foreign intermediary institution to present to the Brazilian intermediary, to the organized market administrator entity of which it is a participant, or directly to the CVM, within the established deadlines, the registration information duly updated capable of meeting the requirements present in the CVM regulation that disposes of client registration within the securities market; b) clause that establishes the subjection of the contract to Brazilian laws, and the competence of the Brazilian Judiciary to hear any lawsuits filed due to controversies derived from the contract, admitting the existence of an arbitration commitment, in which it is stipulated that the arbitration must take place in Brazil; and c) clause that imposes termination in case of non-compliance with the obligation to provide registration information of non-resident investors upon request of the Brazilian intermediary, the organized market administrator entity, or a Brazilian public body with inspection powers. II – prohibition of the use of simplified registration by any intermediaries for clients who act through a foreign intermediary institution that has failed to comply with the obligation to provide information on non-resident investors; III – deadlines and form of communication, by the Brazilian intermediary to the organized market administrator entity in which it is authorized to operate, regarding the conclusion, termination, or alteration of the contract referred to in item I of the caput, as well as regarding the non-compliance with any stipulations contained therein; and IV – inclusion of the verification of compliance of the contracts referred to in item I of the caput and of the compliance, by the intermediaries, of the pertinent norms in the work program of the self-regulatory department of the organized market administrator entity.

Sole paragraph. The organized market administrator entities must:
I – submit the norms mentioned in the caput to CVM approval before their entry into force; and II – keep available to the CVM an updated list of contracts concluded between foreign intermediary institutions and Brazilian intermediaries subject to their self-regulation.

Art. 11. The provisions of arts. 9º and 10 apply, insofar as applicable, to central depositories, to clearing and settlement entities, and to the respective participants of these entities.

---

[RegAlert note: the English text above is a translation of the first 24,000 characters of a 72,673-character original (33% of the document). The remainder was not translated. The complete original-language text is stored with this document.]