CVM Resolution 35 of May 26, 2021, with Amendments Introduced by Resolutions CVM No. 134/22, 179/23, and 209/24

SECURITIES AND EXCHANGE COMMISSION OF BRAZIL (CVM) Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686 Rua Cincinato Braga, 340/2nd, 3rd and 4th Floors, Bela Vista, São Paulo/SP – ZIP: 01333-010 – Brazil - Tel.: (11) 2146-2000 SCN Q.02 – Bl. A – Corporate Financial Center Building, S.404/4th Floor, Brasília/DF – ZIP: 70712-900 – Brazil - Tel.: (61) 3327-2030/2031 www.cvm.gov.br

CVM RESOLUTION NO. 35, OF MAY 26, 2021, WITH THE AMENDMENTS INTRODUCED BY CVM RESOLUTIONS NO. 134/22, 179/23, AND 209/24.

Establishes norms and procedures to be observed in the intermediation of operations carried out with securities in regulated securities markets and revokes CVM Deliberation No. 105, of January 22, 1991, and CVM Instructions No. 51, of June 9, 1986, CVM No. 333, of April 6, 2000, CVM No. 505, of September 27, 2011, CVM Instruction No. 526, of September 21, 2012; CVM Instruction No. 581, of September 29, 2016; CVM Instruction No. 612, of August 21, 2019; and CVM Instruction No. 618, of January 28, 2020.

THE PRESIDENT OF THE SECURITIES AND EXCHANGE COMMISSION OF BRAZIL – CVM makes public that the Board, in a meeting held on May 25, 2021, in view of the provisions of arts. 8, I, 15, §1, 16, and 18, II, letters “a” and “c”, of Law No. 6.385, of December 7, 1976, as well as arts. 5 and 14 of Decree No. 10.139, of November 28, 2019, APPROVED the following Resolution:

CHAPTER I – SCOPE AND PURPOSE Art. 1. This Resolution provides for the intermediation of operations carried out with securities in regulated securities markets. Sole Paragraph. This Resolution does not apply to commodity brokers, whose activities are regulated in specific legislation.

CHAPTER II – DEFINITIONS Art. 2. For the purposes of this Resolution, the following are considered: I – principal or client: the natural or legal person, investment fund, investment club, or non-resident investor, in whose name operations with securities are carried out; II – sensitive data or information: data or information so classified by the intermediary, observing the provisions of the sole paragraph of art. 42; III – internal controls director: statutory director responsible for the activities provided for in item II of art. 5; IV – director responsible for compliance with the rules established by this Resolution: statutory director responsible for the provision in item I of art. 5; V – self-regulatory entity: entity responsible for the self-regulation of the organized markets referred to in the regulation that governs regulated securities markets; VI – relevant cybersecurity incident: incident that affects critical business processes, or sensitive data or information, and has a significant impact on clients; VII – intermediary: the institution authorized to act as a member of the distribution system, on its own account and on behalf of third parties, in the negotiation of securities in regulated securities markets; VIII – clearing member or agent: the financial institution or institution equivalent to it responsible, vis-à-vis those to whom it provides services and vis-à-vis the clearing and settlement entity, for the clearing and settlement of securities operations under its responsibility; IX – offer: act by which the intermediary manifests the intention to carry out a transaction with a security, for itself, for its clients, or other persons with whom it maintains a contractual relationship, registering the necessary terms and conditions in the negotiation system of the entity administering organized markets; X – order: prior act by which the client determines that an intermediary negotiate or register an operation with a security, in accordance with art. 12, in its name and under the conditions it specifies; XI – intermediary’s management bodies: bodies so defined in its bylaws or articles of incorporation; XII – related persons: a) administrators, employees, operators, and other representatives of the intermediary who perform intermediation or operational support activities; b) autonomous agents who provide services to the intermediary; b) investment advisors who provide services to the intermediary; • Letter “b” with wording given by CVM Resolution No. 179, of February 14, 2023. c) other professionals who maintain, with the intermediary, a service provision contract directly related to the activity of intermediation or operational support; d) natural persons who are, directly or indirectly, controlling or participate in the corporate control of the intermediary; e) companies controlled, directly or indirectly, by the intermediary or by persons related to it; f) spouse or partner and minor children of the persons mentioned in letters “a” to “d”; and g) clubs and investment funds whose majority of quotas belong to related persons, unless managed discretely by unrelated third parties; XIII – business continuity plans: written action plans that define the procedures and systems necessary to continue or restore the intermediary’s operation in the event of interruption of critical business processes; XIV – critical business processes: processes and operational activities whose unplanned interruption or unavailability may cause significant negative impact on the intermediary’s business, observing the provisions of § 1 of art. 38; XV – relevant services: services related to the critical business processes referred to in art. 38; XVI – critical systems: term defined in art. 39; and XVII – current account system: system for recording financial movements of clients with the intermediary. Sole Paragraph. The references in this Resolution to the term client encompass acts originating from its attorney-in-fact, legal representative, or person authorized by it, according to its registration.

CHAPTER III – INTERMEDIATION IN REGULATED MARKETS Art. 3. The intermediation of operations in regulated securities markets is exclusive to institutions authorized to act as members of the distribution system, on their own account and on behalf of third parties, in the negotiation of securities in regulated securities markets. Art. 4. The intermediary must adopt and implement: I – adequate and effective rules for compliance with the provisions of this Resolution; and II – procedures and internal controls with the objective of verifying the implementation, application, and effectiveness of the rules mentioned in item I. § 1. The rules, procedures, and internal controls referred to in this article must: I – be written; II – be verifiable; and III – be available for consultation by the persons mentioned in art. 2, item XII, letters “a” to “c”, by CVM, by the entities administering the organized markets in which the intermediary is authorized to operate, and by the self-regulatory entity, if applicable. § 2. Non-compliance with the provisions of items I and II of the caput is considered not only the non-existence or insufficiency of the rules, procedures, and controls referred to therein, but also their non-implementation or inadequate implementation for the purposes provided for in this Resolution. § 3. Evidence of inadequate implementation of the rules, procedures, and internal controls includes: I – the repeated occurrence of failures; and II – the absence of recording of the application of the methodology, in a consistent and verifiable manner. § 4. Without prejudice to the responsibility of the directors referred to in items I and II of the caput of art. 5, the management bodies of the intermediaries are responsible for: I – approving the rules and procedures referred to in the caput; and II – supervising the compliance and effectiveness of the procedures and internal controls referred to in the caput. Art. 5. The intermediary must designate: I – a statutory director responsible for compliance with the rules established by this Resolution; and II – a statutory director responsible for the supervision of the procedures and internal controls provided for in item II of the caput of art. 4. § 1. The appointment or replacement of the statutory directors referred to in items I and II must be reported to CVM and to the entities administering the organized markets in which the intermediary is authorized to operate, if applicable, within 7 (seven) business days. § 2. The functions referred to in items I and II of the caput cannot be performed by the same statutory director. § 3. The function referred to in item II of the caput cannot be performed concurrently with functions related to the trading desk of the intermediary. § 4. Without prejudice to the provision of item II of the caput and § 2 of this article, the intermediary may assign to a specific director the responsibility for compliance with the obligations provided for in Chapters XI and XII of this Resolution, provided that: I – the performance of the accumulated functions by the director does not give rise to a conflict of interest; and II – the responsibility assigned to each director is stated in the information security policy provided for in arts. 41, item II, and 45. § 5. The directors referred to in items I and II of the caput must act with probity, good faith, and professional ethics, employing, in the exercise of their functions, all care and diligence expected of a professional in their position. § 6. The internal controls director must send a report to the management bodies of the intermediary, by the last business day of April of each year, containing, at minimum: I – detailed and updated description: a) of the internal controls implemented, informing the types of controls existing and the activities and operations covered; b) of the methodology applied for the choice and execution of audits, indicating, for example, monitoring mechanisms, parameters used for verification of abnormalities or failures, as well as criteria established for the selection of samples; and c) of the procedures carried out for the analysis of deficiencies found; II – detailing of the tests performed and the conclusions obtained regarding the efficiency and effectiveness of the internal controls to ensure compliance with the provisions of Chapters IV to VIII and X to XIII of this Resolution involving: a) client registration activities, transmission and execution of orders, specification of principals, operations with related persons, transfer of operations, payment and receipt of funds, conduct rules, and maintenance of files, covering both the intermediary’s performance in the stock market and in the organized over-the-counter market; and b) monitoring of information technology infrastructure, provided for in Chapters XI and XII, with emphasis on the cybersecurity program referred to in art. 45; III – recommendations regarding any deficiencies that have been identified during the reference period of the report by the intermediary, by CVM, by the entity administering the market in which it is authorized to operate, and by the self-regulatory entity, with the establishment of action plans and remediation schedules for correction, when applicable; IV – risk assessment for the intermediary regarding its internal controls and regarding its vulnerability to cyberattacks; and V – statement by the director responsible for compliance with the rules established by this Resolution regarding the deficiencies found, containing, at minimum: a) regarding each of the deficiencies that have been identified in the previous year, including those identified by CVM, by the entity administering the market in which it is authorized to operate, and by the self-regulatory entity, information on the progress or on the eventual conclusion of the planned actions to remedy them; b) regarding the deficiencies pointed out in previous reports, inform whether the remediation schedules were implemented and the result of the actions adopted to remedy the deficiencies; c) reasoned assessment of the intermediary’s evolution in compliance with the requirements of this Resolution during the reporting period; and d) assessment of the adequacy of the business continuity plan, indicating the needs for improvement, when necessary. § 7. All activities mentioned in item II of § 6 must be included in the annual report, even if they are not applicable to the intermediary’s internal processes, are of low relevance, or offer low risk in the context of the intermediary’s activities, only the reason justifying the absence of mention of the conclusions of the tests performed in these cases being presented. § 8. If the intermediary has assigned the responsibility for compliance with the obligations provided for in Chapters XI and XII of this Resolution to a specific director, in accordance with § 4, the report referred to in § 6 must also include its statement in accordance with letters “a”, “b”, “c”, and “d” of item V of § 6 of this article. § 9. The report referred to in § 6 must be available at the intermediary’s headquarters for consultation by CVM, by the entity administering the market in which it is authorized to operate, and by the self-regulatory entity, if applicable, its submission not being necessary, except when requested by CVM and by the entities mentioned in this paragraph.

CHAPTER IV – CLIENT REGISTRATION Art. 6. The intermediary must carry out and maintain the registration of its clients with the minimum content determined in specific legislation. § 1. Client registration may be carried out and maintained in an electronic system. § 2. The electronic system for maintaining client registration referred to in § 1 must: I – enable the intermediary to have immediate access to registration data; and II – use technology capable of fully complying with the provisions of this Resolution and specific norms regarding client registration. § 3. Intermediaries must identify persons authorized to issue orders on behalf of more than one principal and inform the organized market administering entities in which they operate in accordance with the terms and standards established by them. Art. 7. The client registration maintained by the intermediary must allow the identification of the date and content of all changes and updates performed. Sole Paragraph. Without prejudice to other procedures and controls adopted due to art. 39, the intermediary must ensure that electronic registration systems contain complete and sufficient audit trails to ensure the tracking of additions, changes, and deletions, and that they allow the identification, at minimum: I – the responsible user; II – the date and time of the occurrence of the event; and III – whether the event constitutes an addition, change, or deletion. Art. 8. The intermediary must keep the registration of its clients updated with the organized market administering entities in which it operates and with the corresponding clearing and settlement entities, if applicable, in accordance with the terms and standards established by them. Art. 9. The intermediary is permitted to use a unified registration if it is part of a financial conglomerate. Sole Paragraph. Unified registration is understood as an electronic system for storing information and documentation for shared use. Art. 10. The intermediary may only effect a change of client address upon express order of the holder, and must keep it on file in accordance with art. 48. Art. 11. Without prejudice to the responsibilities applicable to the intermediary under this Resolution, the preparation and maintenance of client registrations may, with CVM approval, be carried out in a centralized manner by the organized market administering entities, by the clearing and settlement entities, and by the entities representing market participants.

CHAPTER V – ORDERS Section I – Transmission of Orders Art. 12. The intermediary may only execute a transaction or register an operation with securities for a client upon its prior order, and under the established conditions, except for the exceptions provided for in law or in the norms issued by CVM and by the entity administering the organized market in which the intermediary is authorized to operate. § 1. The order may be transmitted: I – by telephone or other voice transmission systems; II – in writing, including orders received in person, by email, or by other electronic messaging systems; or III – by electronic negotiation systems for direct market access (DMA). § 2. All orders must be registered, identifying the time of their receipt, the client who issued them, and the conditions for their execution. § 3. The client’s registration must identify the forms of order transmission authorized by the client. § 4. The intermediary must identify and register the issuer of the order, whether transmitted by the client, by its attorney-in-fact, legal representative, or by a person authorized by the client, upon its transmission in accordance with items I and II of § 1 of this article. Art. 13. The intermediary must archive the records of the orders transmitted by clients and the conditions under which they were executed, regardless of their form of transmission. Sole Paragraph. Without prejudice to other procedures and controls adopted due to art. 43, the intermediary must have specific archiving procedures for data and voice records related to transmitted orders that guarantee: I – the confidentiality, authenticity, integrity, and availability of information; II – compliance with the provisions of the sole paragraph of art. 7; and III – the maintenance of backup copies in an environment distinct from that intended for the storage of the information referred to in the caput, under secure storage, access, and preservation conditions. Art. 13-A. In accordance with the regulation of the organized stock market administering entity, upon receiving orders that require the adoption of special procedures, the intermediary must: I – alert its clients about the need to carry out special procedures; II – obtain an express declaration from the selling client regarding: a) the lack of knowledge of any relevant information about the issuer of the security that has not been disclosed to the public; b) the existence of a link with controlling shareholders or with the administration of the issuer of the security; and c) the total quantity of securities involved in the operation; and III – immediately inform the organized stock market administering entity, for the adoption of the procedures provided for. • Art. 13-A included by CVM Resolution No. 134, of June 10, 2022.

Subsection I – Recording of Orders Art. 14. The intermediary operating in an organized market must maintain a recording system of all dialogues maintained with its clients, including through representatives, in order to record orders transmitted by telephone or other voice transmission systems. § 1. Without prejudice to the provisions of art. 13, the recording system referred to in the caput must maintain control of the telephone lines and extensions used by each user. § 2. The entities administering organized markets must adopt a regulation on the recording system referred to in the caput and carry out its inspection. § 3.

---

[RegAlert note: the English text above is a translation of the first 24,000 characters of a 106,252-character original (23% of the document). The remainder was not translated. The complete original-language text is stored with this document.]