CVM INSTRUCTION NO. 542, OF DECEMBER 20, 2013, WITH AMENDMENTS INTRODUCED BY CVM INSTRUCTIONS NO. 599/18 AND 604/18.

Provides for the provision of securities custody services.

THE PRESIDENT OF THE SECURITIES AND EXCHANGE COMMISSION - CVM makes public that the Collegiate Board, in a meeting held on December 4, 2013, in view of the provisions of Art. 1, item VI; Art. 8, item I; and Art. 24 of Law No. 6,385, of December 7, 1976, and Arts. 41 and 293 of Law No. 6,404, of December 15, 1976, APPROVED the following Instruction:

CHAPTER I – DEFINITIONS AND SCOPE

Art. 1 The securities custody service must be provided by legal entities authorized by the CVM in accordance with this Instruction.

§ 1 Custody services may be provided:
I – to investors, when the custodian is contracted for the safekeeping of securities owned by them, in accordance with item I of § 2; and II – to issuers of non-book-entry securities in accordance with item II of § 2.

§ 2 The provision of securities custody services comprises:
I – in the case of services provided to investors:
a) the conservation, control, and reconciliation of securities positions in custody accounts held in the name of the investor; b) the processing of movement instructions received from investors or persons legitimized by contract or mandate; and c) the processing of events affecting the securities held in custody; and II – in the case of services provided to issuers:
a) the physical safekeeping of non-book-entry securities; and b) the carrying out of procedures and records necessary to effectuate and apply the central deposit regime to the securities.

§ 3 This Instruction:
I – does not apply to positions held in derivative markets; and II – applies to promissory notes and other instruments that, in the event of public distribution, are subject to the competence of the CVM.

§ 4 For the purposes of item II of § 1, other institutions that, as holders or creditors of the securities, are responsible for their distribution to the market are equated to the issuer.

Art. 2 The custodian providing services to investors may maintain links with central depositories for the maintenance of investors' assets in central deposit accounts, in the manner of the regulation that provides for the provision of central deposit services for securities.

Sole Paragraph. In the case of the main text, the positions maintained in the custody accounts referred to in item I, letter “a”, of § 2 of Art. 1 must correspond, for the securities subject to central deposit, to those maintained by the central depository.

CHAPTER II – AUTHORIZATION FOR THE PROVISION OF CUSTODY SERVICES

Section I – Requirements for Registration

Art. 3 Commercial banks, multiple banks, or investment banks, savings banks, brokerage or distribution companies for securities and financial assets, and entities providing clearing and settlement services and central deposit of securities may request authorization to provide securities custody services.

Art. 4 The interested party seeking the authorization referred to in Art. 3 must:
I – establish and maintain operational and technological capacity for the performance of its activities, with a view to the satisfactory provision of custody services, in particular regarding the guarantee of the quality and confidentiality of information; and II – establish and maintain secure and adequate computerized processes and systems for the exercise of its activities, in order to allow the recording, processing, and control of positions and custody accounts.

§ 1 The processes and systems referred to in this article must be compatible with the size, characteristics, and volume of the operations for which the applicant is responsible, as well as with the nature and type of the securities held in custody.

§ 2 The applicant must demonstrate economic and financial capacity compatible with the operations to be carried out.

§ 3 In the event that the applicant requests authorization to provide a physical safekeeping service for securities, it must maintain a structure for safekeeping, with restricted access, and security mechanisms that guarantee the integrity of the securities.

Section II – Authorization Request

Art. 5 The request for authorization to act as a custodian must be submitted through the presentation of a petition accompanied by the documents described in Annex 5.

Art. 5 The request for authorization to act as a custodian must be sent to the Superintendence of Market and Intermediary Relations – SMI, through the presentation of a petition accompanied by the documents described in Annex 5.

• Art. 5 with wording given by CVM Instruction No. 599, of July 27, 2018.

Sole Paragraph. The CVM may request the applicant for additional elements and information.

Sole Paragraph. The SMI may request the applicant for additional elements and information.

• Sole Paragraph with wording given by CVM Instruction No. 599, of July 27, 2018.

Art. 6 The authorization must be automatically granted if the request is not denied by the CVM within 90 (ninety) days from its presentation, via protocol.

Art. 6 The authorization must be automatically granted if the request is not denied by the SMI within 90 (ninety) days from its presentation, via protocol.

• Art. 6 with wording given by CVM Instruction No. 599, of July 27, 2018.

§ 1 The period referred to in the main text may be interrupted only once, in the event that the CVM requests the applicant for additional documents and information related to the authorization request, starting a new period of 90 (ninety) days from the fulfillment of the requirements.

§ 1 The period referred to in the main text may be interrupted only once, in the event that the SMI requests the applicant for additional documents and information related to the authorization request, starting a new period of 90 (ninety) days from the fulfillment of the requirements.

• § 1 with wording given by CVM Instruction No. 599, of July 27, 2018.

§ 2 To meet the requirements referred to in § 1, a period not exceeding 60 (sixty) days must be granted.

Section III – Denial of Authorization Request

Art. 7 The request for authorization to provide securities custody services will be denied if:
I – it is not accompanied by the documents necessary for its appraisal, or if the documents and additional information requested by the CVM are not provided within the period fixed in § 2 of Art. 6; I – it is not accompanied by the documents necessary for its appraisal, or if the documents and additional information requested by the SMI are not provided within the period fixed in § 2 of Art. 6;

• Item I with wording given by CVM Instruction No. 599, of July 27, 2018.

II – false information is identified in the documents presented; III – inaccurate information is identified in the documents presented, which, due to its extent or content, proves relevant for the appraisal of the authorization request; IV – the applicant fails to demonstrate financial capacity or technical and operational conditions necessary for the exercise of the activity; or V – the applicant fails to meet any other requirement or condition established in this Instruction.

Sole Paragraph. The denial decision referred to in this article is subject to appeal, in the manner and within the timeframes established in the current regulation.

Section IV – Cancellation of Authorization

Art. 8 The granted authorization may be cancelled:
I – at the request of the custodian;
II – by decision of the CVM, after an administrative process in which the right to defense and full defense are ensured, in the following cases:
II – by decision of the SMI, after an administrative process in which the right to defense and full defense are ensured, in the following cases:

• Item II with wording given by CVM Instruction No. 599, of July 27, 2018.

a) when it is found that the authorization to provide securities custody services was obtained through false declarations or other illicit means; or b) when it becomes evident that the custodian does not meet the requirements and conditions established in this Instruction; and III – when the custodian is declared bankrupt, undergoes judicial or extrajudicial liquidation, or is dissolved.

§ 1 In the case provided for in item I of the main text, the custodian must present evidence to the CVM that it has returned to investors or transferred, by direct instruction or in the form of the respective contract, to another custodian all the securities it held in its custody.

§ 1 In the case provided for in item I of the main text, the custodian must present evidence to the SMI that it has returned to investors or transferred, by direct instruction or in the form of the respective contract, to another custodian all the securities it held in its custody.

• § 1 with wording given by CVM Instruction No. 599, of July 27, 2018.

§ 2 In the cases of cancellation of authorization referred to in items II and III of the main text, the custodian must immediately transfer to the investor, or to the person indicated by them, the securities, data, and documents related to the services provided up to the moment of cancellation.

§ 3 In any of the cases referred to in items I to III of the main text, the custodian must, when applicable, immediately inform the central depositories that provide central deposit services for the securities held in custody of the occurrence of the cancellation.

CHAPTER III – PROVISION OF CUSTODY SERVICES

Art. 9 The provision of custody services must be the subject of a specific contract, entered into between the investor or the issuer, as applicable, and the custodian, which must provide, at minimum, for:
I – in the case of services provided to investors, the procedure for transmitting orders between the investor and the custodian, for the purposes of authorizations and manifestations referred to in this Instruction; II – the procedure for physical safekeeping of securities, when applicable; III – the possibility of hiring third parties; and IV – the description of risks inherent to custody services.

Sole Paragraph. The contract entered into with investors may cover the provision of asset control services and others involving the consolidation of investors' positions, including in other assets, and the provision of related services.

Art. 10. The obligations arising from the provision of custody services persist while the custody service contract is in force.

§ 1 The custodian must carry out the transfer of the securities, as well as any rights and burdens attached to them, to the custodian indicated by the investor, observing the nature of each asset, its form of holding and transfer, and the procedures established by the central depository, if applicable.

§ 2 The transfer of securities to another custodian must follow reasonable procedures, considering the needs of investors and the security of the process, and must be carried out within a maximum of 2 (two) business days counted from the receipt, by the custodian, of the valid request formulated by the investor.

§ 3 The custodian must:
I – publish, on its website, the documents necessary for the transfer referred to in § 2; and II – inform the client, within the period provided in § 2, of the non-conformity of the documentation delivered for the purpose of effectuating the transfer.

• § 3 included by CVM Instruction No. 604, of December 13, 2018.

CHAPTER IV – CODE OF CONDUCT

Art. 11. The securities owned by investors must be kept in individualized custody accounts in their name, segregated from other accounts and positions owned by the custodian.

Art. 12. The custodian must:
I – exercise its activities with good faith, diligence, and loyalty towards the interests of investors, being prohibited from privileging its own interests or those of persons linked to it; II – take all necessary measures for the identification of the ownership of the securities, for the guarantee of their integrity, and for certainty regarding the origin of the instructions received; III – ensure the proper safekeeping and regular movement of the securities held in custody, in accordance with the instructions received, and the adequate processing of events related to them, through the implementation of electronic and documentary execution and control systems; IV – promote the acts necessary for the registration of liens or rights over securities held in custody, taking all necessary measures for their adequate formalization; V – permanently ensure the quality of its computerized processes and systems, measuring and maintaining records of accesses, errors, incidents, and interruptions in its operations; VI – guarantee the physical security of its equipment and facilities, by establishing data and information security standards that protect them from access by unauthorized personnel; VII – have sufficient and technically capable human resources to carry out the processes and operate the systems involved in the provision of custody services; VIII – keep updated the operational manuals, the general description of the systems to be adopted in the provision of services, the flowchart of routines, program documentation, quality controls, and physical and logical security regulations; and IX – implement and keep updated a contingency plan that ensures business continuity and the provision of services.

§ 1 The custodian providing services to investors must, in addition to the provisions of the main text:
I – carry out daily reconciliation between the positions maintained in the custody accounts and those provided by the central depository, ensuring that the securities held in custody and the rights derived from these securities are registered in the name of the investor with the central depository, when applicable; and II – maintain confidentiality regarding the characteristics and quantities of the securities owned by investors.

§ 2 The custodian providing services to issuers, in addition to the provisions of the main text, must:
I – verify compliance with the formal and creation requirements of the securities; II – verify the observance of the specific transfer mechanisms of each security, according to its nature and in accordance with the central depository's regulation, for the constitution of the central deposit; III – carry out the acts within its competence for deposit and withdrawal movements of the securities in the central deposit service, in accordance with the regulations of the central depositories; IV – be responsible for the physical safekeeping of the instruments and documents representing the securities subject to central deposit; V – refrain from practicing or giving effect to any act of disposal involving the securities subject to central deposit outside the central depository's environment, except if by instruction of the central depository itself; VI – pass on to the central depository the information and resources related to events affecting the securities submitted to the central deposit service that are within its competence; VII – identify the owner of the security at the time of its submission to the central deposit and, subsequently, in cases where necessary, from information provided by the central depositories; VIII – adopt the reconciliation procedures established by the central depository; and IX – hold inventoriable records of the securities kept under its physical safekeeping, in which the following information must appear:
a) nature, type, and class of the security; b) record of deposit and withdrawal movements; and c) record of information transfers and payments and receipts of financial resources related to events affecting the securities.

CHAPTER V – INFORMATION PROVISION

Art. 13. The custodian providing services to investors must make available or send, as applicable, to investors information that allows the identification and verification of events that occurred with the securities, containing, at minimum, the consolidated position of securities, their movement, and the events that affect the investor's position.

§ 1 The information provided in the main text must be made available or sent, as applicable, by the 10th (tenth) day of the month following the end of the month in which the movement occurred.

§ 2 The information provided in the main text may be made available or sent by one of the following forms, according to the criteria established by the CVM in accordance with the Instruction that provides for the provision of central deposit services for securities:
I – consultation of an electronic system with restricted access on the worldwide web; II – sending to the investor's electronic address recorded in the system referred to in Art. 12, with recognized security standards; or III – sending to the investor's postal address recorded in the system referred to in Art. 12.

§ 3 By the end of February of each year, the information provided in the main text relating to the previous year must be made available or sent to the investor.

§ 4 In cases where the custodian provides other related services, in accordance with the sole paragraph of Art. 9, the information provided to investors may include information about positions held by them in other financial assets or in derivative markets.

Art. 14. The custodian must carry out and maintain the registration of investors with the minimum content determined in the applicable regulation.

§ 1 The investor registration may be carried out and maintained in an electronic system.

§ 2 The electronic system for maintaining client registration referred to in § 1 must:
I – allow immediate access by the custodian to the registration data; and II – use technology capable of fully complying with the provisions of this Instruction and the specific regulations regarding client registration.

§ 3 The investor registration maintained by the custodian must allow the identification of the date and content of all alterations and updates performed.

§ 4 The custodian must keep the investor registration updated in the centralized information system maintained by the central depository, when applicable, in the terms and standards established by it.

CHAPTER VI – RULES, PROCEDURES, AND INTERNAL CONTROLS

Section I – General Rules

Art. 15. The custodian must adopt and implement:
I – adequate and effective rules for compliance with the provisions of this Instruction; and II – procedures and internal controls with the objective of verifying the implementation, application, and effectiveness of the rules mentioned in item I.

§ 1 The rules, procedures, and internal controls referred to in this article must:
I – be written;
II – be verifiable; and
III – be available for consultation by the CVM, the central depositories with which the custodian maintains a link in accordance with Art. 2, the entities administering the organized markets in which the custodian is authorized to operate, and their respective self-regulatory departments, if applicable.

§ 2 Non-compliance with the provisions of items I and II of the main text is considered not only the non-existence or insufficiency of the rules, procedures, and controls referred to therein, but also their non-implementation or inadequate implementation for the purposes provided for in this Instruction.

§ 3 Evidence of inadequate implementation of rules, procedures, and internal controls includes:
I – the repeated occurrence of failures; and
II – the absence of recording of the application of the methodology, in a consistent and verifiable manner.

Section II – Responsible Director

Art. 16. The custodian must indicate:
I – a statutory director responsible for compliance with the standards established by this Instruction; and II – a statutory director responsible for supervising the procedures and internal controls provided for in item II of the main text of Art. 15.

§ 1 The appointment or replacement of the statutory directors referred to in items I and II must be reported to the CVM, the central depositories, and the entities administering the organized markets in which the custodian is authorized to operate, if applicable, within 7 (seven) business days.

§ 2 The functions referred to in items I and II of the main text cannot be held cumulatively by the same statutory director and cannot be performed jointly with functions that may, in any way, be considered conflicting with them, it being possible to indicate, for such purposes, the same directors indicated for the same purposes due to the Instruction that establishes standards and procedures to be observed in operations carried out with securities in regulated securities markets.

§ 3 The directors referred to in items I and II must act with probity, good faith, and professional ethics, employing, in the exercise of their functions, the care and diligence expected of a professional in their position.

Art. 17. The director referred to in item II of Art. 16 must, by the last business day of April:
I – send to the governing body of the custodian a report relating to the previous year, containing:
a) the conclusions of the internal audit reports; b) its recommendations regarding any deficiencies, with the establishment of remediation schedules, if applicable; and c) its statement regarding the deficiencies found in previous verifications and the measures planned, according to a specific schedule, or effectively adopted to remedy them; and II – send to the governing body of the custodian and to the CVM the report on the description, design, and operational effectiveness of controls (type 2), relating to the previous year, issued by an independent auditor registered with the CVM, prepared in accordance with NBC TO 3402 approved by the Federal Council of Accountancy. II – REVOKED

• Item II revoked by CVM Instruction No. 604, of December 13, 2018.

Sole Paragraph. The report referred to in item I must be available, for the CVM and for the central depositories with which the custodian maintains a link, if applicable, at the custodian's headquarters.

Section III – Hiring of Third Parties

Art. 18. The custodian may hire third parties:
I – to perform activities regulated by this Instruction; and II – to perform instrumental or ancillary tasks to the activities regulated by this Instruction, such as the physical safekeeping of securities.

§ 1 Only custodians authorized by the CVM, in accordance with Art. 5 of this Instruction, may be the object of the hiring referred to in item I of the main text.

§ 2º The hiring of third parties, as described in the main text, does not alter the responsibilities of the custodian, who remains responsible for fulfilling the obligations assumed towards third parties and for the provisions of this Instruction and the rules established by the central depository, where applicable.

§ 3º Contracts entered into for the purposes of item I of the main text must contain a clause stipulating joint and several liability between the contracting custodian and the contracted third parties for any damages caused to unitholders due to conduct contrary to the law, regulations, and normative acts issued by the CVM.

§ 4º The custodian must adopt rules, procedures, and internal controls adequate to ensure security and mitigate conflicts of interest in the event of hiring third parties and, as applicable, to allow for their effective control over the movement of securities subject to physical custody.

Section IV – Audit

Art. 19. The custodian must maintain an internal audit structure.

§ 1º Reports produced by internal audit must be kept updated and available to the CVM.

§ 2º The CVM may determine the performance of specific extraordinary audits if there is evidence that the processes and systems used are not meeting, or may not come to meet, their purposes.

CHAPTER VII – OFFENSES AND PENALTIES

Art. 20. A serious offense, for the purposes of the provisions of § 3º of art. 11 of Law No. 6.385, of December 7, 1976, is considered to be the exercise of activities regulated by this Instruction by a person not authorized or authorized based on false declarations or documents, as well as the violation of the norms contained in arts. 1º, 2º, 9º to 16 and 22 of this Instruction.

CHAPTER VIII – FINAL PROVISIONS

Art. 21. Participants of central depositories who, upon the entry into force of this Instruction, provide custody services, and are not registered with the CVM under CVM Instruction No. 89, of November 8, 1988, must, by the date of entry into force of this Instruction, obtain the corresponding custodian registration.

§ 1º The registration referred to in the main text is obtained by presenting the information and documents referred to in items I and II of article 1º of Annex 5, within the timeframes and procedures established by the Superintendence of Market and Intermediary Relations – SMI.

§ 2º Participants of central depositories referred to in the main text who, by the entry into force of this Instruction, have not obtained custodian registration through the procedure referred to in § 1º must:

I – submit a registration request in the form of art. 5º of this Instruction; and

II – until obtaining the corresponding authorization, refrain from performing any acts inherent to the custody activity of securities.

Art. 22. A custodian who is already registered, whose registration request has already been filed with the CVM, or who obtains registration in the form of § 1º of art. 21 must adapt to the provisions of this Instruction within up to 1 (one) year and 6 (six) months after the entry into force of the regulation.

§ 1º It is incumbent upon SMI to establish rules and procedures for the adaptation of custodians to the provisions of this Instruction, defining intermediate deadlines for compliance with obligations and the corresponding forms of proof.

§ 2º A custodian who fails to prove, in the form and within the deadlines established according to § 1º, their adaptation to the provisions of this Instruction must have their authorization cancelled by an act of SMI.

Art. 23. The custodian must maintain, for a minimum period of 5 (five) years, or for a longer period as expressly determined by the CVM in the event of an administrative process, all documents and information required by this Instruction, as well as all internal and external correspondence, all reports, and opinions related to the exercise of their activities.

Sole paragraph. The documents and information referred to in the main text may be stored in physical or electronic media, with the substitution of documents by their respective digitized images being admitted.

Art. 24. This Instruction enters into force on July 1, 2014.

Signed original by
LEONARDO P. GOMES PEREIRA
President

ANNEX 5

Application for Authorization for the Securities Custody Service

Art. 1º The application for authorization to provide securities custody services must be accompanied by the following documents and information:

I – corporate name, registration in the National Registry of Legal Entities – CNPJ, complete address of the headquarters, telephone numbers, fax, email address and website of the institution, and signature cards of the legal representatives;

II – constituent acts and subsequent modifications, duly updated and complying with legal formalities;

III – document intended to demonstrate that the applicant possesses adequate organizational, technical, operational, and financial capacity to perform securities custody services, meeting, at a minimum, the following requirements:

a) description of the main characteristics of the computerized processes and systems that must be used in providing the services, with specification of the operational routines intrinsic and extrinsic to the systems, as well as the relevant internal procedures and controls;

b) description of the custody account structure;

c) summary description of security standards regarding facilities, equipment, and data;

d) description of human resources allocated to the activity, with specification of the functions and positions necessary for its performance;

e) policies for segregation of duties, physical access control, password usage, and employee training;

f) contingency plan to ensure business continuity and service provision, and systems for file and database recovery; and

g) copies of software licensing and development contracts entered into between the applicant and the company owning the system or responsible for its development, in the event that the systems were not developed by the applicant.

IV – functional organizational chart of the area dedicated to custody, specifying the functions and responsibilities of the people who comprise it and the regime of segregation of duties;

V – name and qualifications of the legal representatives of the applicant;

VI – copy of the minutes of the meeting of the board of directors or executive board that appointed the directors responsible for complying with the standards established in this Instruction and for supervising the internal procedures and controls of the securities custody services;

VII – list of companies in which the custodian holds share participation, including indirectly controlled or affiliated companies;

VIII – model of the securities custody service provision contract; and

IX – designation of the independent audit company registered with the CVM that performs the operational audit of the custody service to be provided, as well as a declaration of its independence from the audited institution;

IX – REVOKED

• Item IX revoked by CVM Instruction No. 604, of December 13, 2018.

X – report on the description, design, and operational effectiveness of controls (type 1), issued by an independent auditor registered with the CVM, prepared in accordance with NBC TO 3402 approved by the Federal Accounting Council.

X – REVOKED

• Item X revoked by CVM Instruction No. 604, of December 13, 2018.