Region

Jurisdiction

Regulator

2011-09-27

Added 2026-06-18 · Updated 2026-08-16

CVM Instruction 612 (Revoked)

CVM Instruction 612 amends, adds, and revokes provisions in CVM Instruction No. 505 of 2011 and revokes CVM Instruction No. 380 of 2002. The regulation updates definitions for intermediaries, mandates internal controls and cybersecurity incident reporting, and establishes specific requirements for order transmission, recording, and Direct Market Access (DMA) systems. It also modifies rules regarding related-party transactions, payment methods, and the archival of records.

Brazil

Comissão de Valores Mobiliários

SECURITIES AND EXCHANGE COMMISSION OF BRAZIL (CVM) Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686 Rua Cincinato Braga, 340/2nd, 3rd and 4th Floors, Bela Vista, São Paulo/SP – ZIP: 01333-010 – Brazil - Tel.: (11) 2146-2000 SCN Q.02 – Bl. A – Corporate Financial Center Building, S.404/4th Floor, Brasília/DF – ZIP: 70712-900 – Brazil - Tel.: (61) 3327-2030/2031 www.cvm.gov.br

CVM INSTRUCTION NO. 612, OF AUGUST 21, 2019, WITH THE CHANGES INTRODUCED BY CVM INSTRUCTION NO. 618/20

Amends, adds, and revokes provisions to CVM Instruction No. 505, of September 27, 2011, and revokes CVM Instruction No. 380, of December 23, 2002.

THE PRESIDENT OF THE SECURITIES AND EXCHANGE COMMISSION OF BRAZIL - CVM makes public that the Board, in a meeting held on July 31, 2019, based on the provisions of Art. 18, item II, letters “a” and “c” of Law No. 6.385, of December 7, 1976, APPROVED the following Instruction:

Art. 1. Arts. 1, 3 to 5, 12 to 18, 20, 21, 24, 25, 27, 28, 31 to 36 and 38, the titles of the subsections preceding Arts. 14 and 15, and the title of the chapter and section preceding Art. 24 of CVM Instruction No. 505, of September 27, 2011, shall enter into force with the following wording:

“Art. 1. ............................................... .............................................................. II – REVOKED. .............................................................. V – order: a prior act by which the client determines that an intermediary shall negotiate or register an operation with a security, in accordance with Art. 12, in its name and under the conditions specified; VI – ...................................................... a) administrators, employees, operators, and other agents of the intermediary who perform intermediary or operational support activities;

CVM INSTRUCTION NO. 612, OF AUGUST 21, 2019 2 .............................................................. VII – offer: an act by which the intermediary manifests the intention to conduct a transaction with a security, for itself, for its clients, or other persons with whom it maintains a contractual relationship, registering the necessary terms and conditions in the trading system of the entity administering organized markets; VIII – current account system: system for recording the financial movements of clients with the intermediary; IX – self-regulatory entity: entity responsible for the self-regulation of the organized markets referred to in the regulation that disciplines the regulated markets for securities; X – intermediary’s administration bodies: bodies thus defined in its bylaws or articles of association; XI – director responsible for compliance with the rules established by this Instruction: statutory director responsible for the provision of item I of Art. 4; XII – internal controls director: statutory director responsible for the activities provided for in item II of Art. 4; XIII – business continuity plans: written action plans that define the procedures and systems necessary to continue or restore the intermediary’s operation in the event of interruption of critical business processes; XIV – critical business processes: processes and operational activities whose unplanned interruption or unavailability may cause significant negative impact on the intermediary’s business, observed the provisions of § 1 of Art. 35-A; XV – critical systems: term defined in Art. 35-B;

CVM INSTRUCTION NO. 612, OF AUGUST 21, 2019 3 XVI – relevant cybersecurity incident: incident that affects critical business processes, or sensitive data or information, and has significant impact on clients; XVII – relevant services: services related to the critical business processes referred to in Art. 35-A; and XVIII – sensitive data or information: data or information thus classified by the intermediary, observed the provisions of the sole paragraph of Art. 35-E. Sole paragraph. The references in this Instruction to the term client encompass acts originating from its attorney, legal representative, or person authorized by it, according to its registration.” (NR)

“Art. 3. ............................................... § 1. ....................................................... .............................................................. III – be available for consultation by the persons mentioned in Art. 1, item VI, letters “a” to “c”, of CVM, by the entities administering the organized markets in which the intermediary is authorized to operate, and by the self-regulatory entity, if applicable. .............................................................. § 4. Without prejudice to the responsibility of the directors referred to in items I and II of the caput of Art. 4, the intermediary’s administration bodies are responsible for: I – approving the rules and procedures referred to in the caput; and

CVM INSTRUCTION NO. 612, OF AUGUST 21, 2019 4 II – supervise the compliance and effectiveness of the internal controls and procedures referred to in the caput.” (NR)

“Art. 4. .............................................. ............................................................... § 3-A. Without prejudice to the provisions of item II of the caput and § 2 of this article, the intermediary may assign to a specific director the responsibility for compliance with the obligations provided for in Chapters VIII-A and VIII-B of this Instruction, provided that: I – the performance of the accumulated functions by the director does not give rise to a conflict of interest; and II – the responsibility assigned to each director is stated in the information security policy provided for in Art. 35-D. ............................................................... § 5. The internal controls director must send a report to the intermediary’s administration bodies, by the last business day of April of each year, containing, at minimum: I – detailed and updated description: a) of the internal controls implemented, informing the types of controls existing and the activities and operations covered; b) of the methodology applied for the choice and execution of audits, indicating, for example, monitoring mechanisms, parameters used for verification of abnormalities or failures, as well as criteria established for the selection of samples; and

CVM INSTRUCTION NO. 612, OF AUGUST 21, 2019 5 c) of the procedures carried out for the analysis of deficiencies found; II – detailing of the tests performed and the conclusions obtained regarding the efficiency and effectiveness of internal controls to ensure compliance with the provisions of Chapters III to IX of this Instruction involving: a) client registration activities, transmission and execution of orders, specification of principals, transactions with related parties, pass-through of operations, payment and receipt of funds, code of conduct, and maintenance of files, covering both the intermediary’s activity in the stock market and in the organized over-the-counter market; and b) monitoring of information technology infrastructure, provided for in Chapters VIII-A and VIII-B, highlighting the cybersecurity program referred to in Art. 35-H; III – recommendations regarding any deficiencies that have been identified in the reference year of the report by the intermediary, by the CVM, by the market administrator in which it is authorized to operate, and by the self-regulatory entity, with the establishment of action plans and remediation schedules for correction, when applicable; IV – risk assessment for the intermediary regarding its internal controls and its vulnerability to cyberattacks; and V – statement by the director responsible for compliance with the rules established by this Instruction regarding the deficiencies found, containing, at minimum: a) regarding each of the deficiencies that have been identified in the previous year, including those identified by the CVM, by the market administrator in which it is authorized to operate, and by the self-regulatory entity,

CVM INSTRUCTION NO. 612, OF AUGUST 21, 2019 6 information on the progress or on the eventual conclusion of the planned actions to remedy them; b) regarding the deficiencies pointed out in previous reports, inform whether the remediation schedules were implemented and the results of the actions adopted to remedy the deficiencies; c) reasoned evaluation on the intermediary’s evolution in compliance with the requirements of this Instruction during the reporting period; and d) evaluation on the adequacy of the business continuity plan, indicating the needs for improvement, when necessary. § 6. All activities mentioned in item II of § 5 must be included in the annual report, even if they are not applicable to the intermediary’s internal processes, are of low relevance, or offer low risk in the context of the intermediary’s activities, only the reason justifying the absence of mention of the conclusions of the tests performed in these cases being presented. § 7. If the intermediary has assigned the responsibility for compliance with the obligations provided for in Chapters VIII-A and VIII-B of this Instruction to a specific director, in the manner of § 3-A, the report referred to in § 5 must also include its statement in accordance with letters “a”, “b”, “c” and “d” of item V of § 5 of Art. 4. § 8. The report referred to in § 5 must be available at the intermediary’s headquarters for consultation by the CVM, by the market administrator in which it is authorized to operate, and by the self-regulatory entity, if applicable, its submission not being necessary, except when requested by the CVM and the entities mentioned in this paragraph.” (NR)

“Art. 5. ...............................................

CVM INSTRUCTION NO. 612, OF AUGUST 21, 2019 7 ................................................................ § 3 REVOKED. § 4. Intermediaries must identify the persons authorized to issue orders on behalf of more than one principal and inform the market administrator entities in which they operate in accordance with the terms and standards established by them.”(NR)

“Art. 12. The intermediary may only execute a transaction or register an operation with securities for a client upon its prior order, and under the conditions established, except for the exceptions provided for in Law or in the rules issued by the CVM and by the market administrator entity in which the intermediary is authorized to operate. § 1. The order may be transmitted: I – by telephone or other voice transmission systems; II – in writing, including orders received in person, by electronic mail, or by other electronic messaging systems; or III – by electronic direct market access (DMA) trading systems. § 2. All orders must be registered, identifying the time of their receipt, the client who issued them, and the conditions for their execution. § 3. The client registration must identify the forms of order transmission authorized by the client. § 4. The intermediary must identify and register the issuer of the order, whether it is transmitted by the client, by its attorney, legal representative, or by a person

CVM INSTRUCTION NO. 612, OF AUGUST 21, 2019 8 authorized by the client, upon its transmission in accordance with items I and II of § 1 of this article.”(NR)

“Art. 13. ............................................ Sole paragraph. Without prejudice to other procedures and controls adopted due to Art. 35-F, the intermediary must have specific procedures for archiving records of data and voice related to transmitted orders that guarantee: I – the confidentiality, authenticity, integrity, and availability of information; II – compliance with the provisions of the sole paragraph of Art. 5-A; and III – the maintenance of backup copies in an environment distinct from that intended for the storage of the information referred to in the caput, under secure storage, access, and preservation conditions.”(NR)

“Subsection I – Recording of Orders Art. 14. The intermediary that operates in an organized market must maintain a system for recording all dialogues held with its clients, including through agents, in order to record orders transmitted by telephone or other voice transmission systems. .............................................................”(NR)

“Subsection III - Orders Transmitted by Direct Market Access Trading Systems

CVM INSTRUCTION NO. 612, OF AUGUST 21, 2019 9 Art. 15. The intermediary may receive orders from its clients through electronic direct market access trading systems in accordance with the conditions and rules established by the entities administering organized markets. § 1. The intermediary that receives orders from its clients under the conditions provided for in the caput must: I – adopt procedures to seek the identification of the origin of the orders and ensure the tracking of their issuer; and II – maintain a pre-operational risk management control system, including the establishment and monitoring of operational limits and parameters to identify transmission of orders resulting from error. § 2. The risk management control systems must allow for the monitoring, control, and adoption of measures aimed at adjusting orders that exceed the operational limits established by the intermediary for each client.”(NR)

“Art. 16. The intermediary and the non-resident portfolio administrator may only be users of electronic direct market access trading system terminals if they meet the following requirements: .............................................................”(NR)

“Art. 17. The entities administering organized markets must adopt a regulation on the operation of electronic direct market access trading systems. .............................................................

CVM INSTRUCTION NO. 612, OF AUGUST 21, 2019 10 § 2. In the rules referred to in the caput, the market administrator entities must establish that intermediaries that are not persons authorized to operate must submit, through an express contractual provision, to their self-regulatory power, regarding the rules on the use of electronic direct market access trading systems.”(NR)

“Art. 18. The operations resulting from orders transmitted through electronic direct market access trading systems must be supervised by the market administrator entities and by the self-regulatory entity in accordance with specific regulation. Sole paragraph. The self-regulatory entity must include the operations referred to in the caput in its work program.”(NR)

“Art. 20. ............................................ ............................................................. § 4. The rules referred to in the caput and their amendments must be previously informed to clients and be available on the intermediary’s page on the worldwide web, in the applications, and in other interfaces offered to its clients, in an easily accessible location.”(NR)

“Art. 21. The intermediary must archive the rules referred to in Art. 20, as well as any amendments to such rules, with the market administrator entity in which it is authorized to operate and with the self-regulatory entity, prior to their entry into force, in the form and timeframes established by these entities. .............................................................”(NR)

“CHAPTER V – RELATED PARTIES”(NR) Section I – REVOKED.

CVM INSTRUCTION NO. 612, OF AUGUST 21, 2019 11 Art. 24. REVOKED

“Art. 25. ............................................ § 1. ...................................................... ............................................................. II – to persons related to the intermediary, regarding operations in an organized market in which the intermediary is not a person authorized to operate; III – to persons related to the intermediary, regarding operations in which the intermediary does not participate in the distribution of the publicly offered securities; and IV – to negotiations intermediated by an institution contractually obliged to provide information to the intermediary about operations carried out by related persons, and which holds express authorization from the related persons for such provision of information. .............................................................” (NR)

“Art. 27. The payment, under any title, of funds to intermediaries by clients must be made by bank transfer, payment arrangement authorized by the Central Bank of Brazil, or check in the client’s name.” (NR)

“Art. 28. The payment of funds to clients by intermediaries must be made by bank transfer, payment arrangement authorized by the Central Bank of Brazil, or check in the intermediary’s name. .............................................................” (NR)

CVM INSTRUCTION NO. 612, OF AUGUST 21, 2019 12 “Art. 31. ............................................ Sole paragraph. .................................. ............................................................. III – establish mechanisms to inform the client that the intermediary and the persons related to it are acting in a conflict of interest and the sources of this conflict, before carrying out an operation.”(NR)

“Art. 32. ............................................ ............................................................. III – maintain a current account system for recording all financial movements of its clients; IV – inform the CVM whenever it verifies the occurrence or indications of violation of the legislation incumbent upon the CVM to supervise, within a maximum period of 5 (five) business days from the occurrence or identification, without prejudice to communication to the entities administering the organized markets in which it is authorized to operate or to the self-regulatory entity, maintaining records of the evidence found; ............................................................. VII – differentiate in brokerage notes, invoices, and posting notices sent to clients, the values resulting from brokerage from those related to other services provided by the intermediary and from the fees and emoluments charged by the entities administering organized markets or by other third parties, if applicable; VIII – supply its clients with information and documents related to the transactions carried out in the form and timeframes established in their internal rules;

CVM INSTRUCTION NO. 612, OF AUGUST 21, 2019 12 .............................................................” (NR)

“Art. 33. ............................................ ............................................................. III – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; IV – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; V – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; VI – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; VII – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; VIII – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; IX – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; X – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; XI – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; XII – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; XIII – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; XIV – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; XV – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; XVI – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; XVII – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; XVIII – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; XIX – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; XX – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; XXI – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; XXII – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; XXIII – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; XXIV – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; XXV – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; XXVI – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; XXVII – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; XXVIII – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; XXIX – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; XXX – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; XXXI – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; XXXII – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; XXXIII – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; XXXIV – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; XXXV – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; XXXVI – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; XXXVII – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; XXXVIII – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; XXXIX – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds; XL – maintain a system for recording the financial movements of clients, distinguishing them from the intermediary’s own funds;

CVM INSTRUCTION NO. 612, OF AUGUST 21, 2019 13 .............................................................” (NR)

“Art. 34. ............................................ ............................................................. .............................................................” (NR)

“Art. 35. ............................................ ............................................................. .............................................................” (NR)

“Art. 35-A. ........................................ ............................................................. .............................................................” (NR)

“Art. 35-B. ........................................ ............................................................. .............................................................” (NR)

“Art. 35-C. ........................................ ............................................................. .............................................................” (NR)

“Art. 35-D. ........................................ ............................................................. .............................................................” (NR)

“Art. 35-E. ........................................ ............................................................. .............................................................” (NR)

“Art. 35-F. ........................................ ............................................................. .............................................................” (NR)

“Art. 35-G. ........................................ ............................................................. .............................................................” (NR)

“Art. 35-H. ........................................ ............................................................. .............................................................” (NR)

“Art. 36. ............................................ ............................................................. .............................................................” (NR)

“Art. 38. ............................................ ............................................................. .............................................................” (NR)

Art. 2. This Instruction enters into force on the date of its publication.

Art. 3. CVM Instruction No. 380, of December 23, 2002, is revoked.

EDUARDO ANDRADE COSTA President

[RegAlert note: the English text above is a translation of the first 24,000 characters of a 50,334-character original (48% of the document). The remainder was not translated. The complete original-language text is stored with this document.]