CVM Resolution No. 249 of October 13, 2026

CVM RESOLUTION NO. 249, OF OCTOBER 13, 2026

Establishes, on an experimental basis, the DLT CVM Pilot Program intended to conduct tests in the securities market through distributed ledger technology (DLT) networks, comprising experimental operations of issuance, offering, trading, settlement, and post-trade processing of securities on networks admitted to participate in the Program.

The PRESIDENT OF THE SECURITIES COMMISSION – CVM makes public that the Board, in a meeting held on October 7, 2026, based on the provisions of Articles 8, items I, II, and III, 15, 18, 21, and 24 of Law No. 6,385, of December 7, 1976, and considering the work of the Tokenization Working Group – GTT, established by CVM/PTE Ordinance No. 177, of July 15, 2026, APPROVED the following Resolution:

CHAPTER I – SCOPE, PURPOSE, AND EXPERIMENTAL NATURE

Article 1. The DLT CVM Pilot Program is hereby established, a testing program intended to conduct experimental operations of issuance, offering, distribution, trading, bookkeeping, custody, centralized deposit, and settlement of securities on distributed ledger technology (DLT) networks admitted under the terms of this Resolution.

§ 1. The experimental operations may involve any of the species of securities referred to in Article 2 of Law No. 6,385, of 1976, such as shares, debentures, receivables certificates, investment fund shares, and other titles or collective investment contracts.

§ 2. The DLT CVM Pilot Program falls within the scope of the work of the Tokenization Working Group – GTT, established by CVM/PTE Ordinance No. 177, of July 15, 2026, and shall observe the deadlines established therein.

§ 3. The activities developed within the scope of the DLT CVM Pilot Program:

I – are of an experimental nature, prohibiting the participation of real investors, the use of securities effectively issued or in circulation, and the movement of real financial resources;

II – do not represent authorization to exercise regulated activities, such as conducting a public distribution offering, administering organized securities markets, providing bookkeeping, custody, or centralized deposit services for securities, intermediating securities, or any other activity subject to registration, authorization, or accreditation before the CVM;

III – do not generate acquired rights to the continuity of tests or legitimate expectation of approval, authorization, or future regulatory treatment; and

IV – do not imply a manifestation by the CVM regarding the compliance, viability, security, or regulatory adequacy of technologies, arrangements, algorithms, smart contracts, or business models tested;

V – do not render irregular other market initiatives not covered by the Program.

Article 2. The DLT CVM Pilot Program aims to:

I – assess the technical, operational, and legal feasibility of issuing, offering, trading, bookkeeping, custody, settlement, and post-trade processing of securities through distributed ledger technology, including in a comparative manner between private and public permissioned networks;

II – test interoperability and connectivity arrangements between participants of the test network, to the extent provided for in cases approved by the Management Committee;

III – identify risks, vulnerabilities, and regulatory gaps associated with the adoption of DLT in the securities market, including regarding information security, network governance, settlement purpose, data protection, and operational resilience in the face of technical failures;

IV – support, with evidence, the work of the GTT and the formulation of possible proposals for normative or legal improvement on the matter; and

V – foster cooperation between the CVM, market participants, self-regulatory entities, and other authorities with regulatory competence over DLT-based infrastructures.

Article 3. The design of test networks, the design of test cases, and the formulation of normative or legal proposals shall observe the following guiding principles:

I – transposition of control mechanisms: the governance mechanisms, weights, and checks and balances inherent to the capital market must, whenever possible, be translated into the logical architecture of the network, the parametrization of the rights and duties of agents, and the smart contracts or native functionalities employed;

II – auditable privacy, traceability, and identification: the confidentiality of transactional data and the privacy of data subjects, where applicable, must be preserved without prejudice to the identification and traceability of the beneficial owner by regulators and other competent authorities;

III – informational symmetry: the distribution, access, and visualization of data on the network must prevent informational asymmetries, observing information protected by legal secrecy, and curb practices that favor certain agents to the detriment of other agents or the integrity of the market;

IV – supervision from conception: the networks must contemplate native access and visibility profiles for the regulator, possibly including audit access means with real-time reading and monitoring interfaces, without dependence or interference from third-party intermediation; and

V – operational resilience: the architecture, smart contracts, and integrations with oracles must undergo security checks, providing clear mechanisms for incident handling, according to each participant's internal policies and scheduled updates.

Sole paragraph. The observance of the principles set forth in this article will be considered in the analysis of proposals, the monitoring of experiments, and the final evaluation of results.

CHAPTER II – DEFINITIONS

Article 4. For the purposes of this Resolution, it is considered:

I – distributed ledger technology (DLT): a set of protocols, infrastructures, and technologies that allow the recording, sharing, synchronization, validation, and storage of data and transactions in a distributed network among multiple access means;

II – DLT CVM Pilot Program: the testing program referred to in Article 1, comprising the admitted test networks, the nodes operated by participants, the access nodes made available to the CVM, and possible orchestration and interoperability mechanisms between networks;

III – test network: a DLT network, of private or public architecture, proposed by a legitimized proponent and admitted under the terms of this Resolution for the execution of experimental operations;

IV – proponent: an association representing entities authorized by the CVM or a self-regulatory entity participating in the Tokenization Working Group – GTT that presents a test network proposal, individually or in a consortium;

V – network manager: the proposing association, or consortium of proponents, responsible for administering the test cases that include the applications and the chosen network(s) that best meet the functioning of the admitted test network applications;

VI – participant: a legal entity admitted to execute experimental operations in a test network, under the terms of Chapter V;

VII – experimental operation: a transaction recorded in a test network that reproduces, for exclusive testing purposes, stages of the securities lifecycle, without producing legal or patrimonial effects outside the testing environment;

VIII – test token: a digital representation, recorded in a test network, of a fictitious security or fictitious financial resources, devoid of economic value and legal efficacy outside the testing environment;

IX – test case: a structured set of experimental operations, with defined scope, participants, operational parameters, premises, and expected results;

X – CVM access means to test networks: connection to the test network, regardless of its technical denomination in the adopted architecture (audit node, observer node, read participant, or equivalent solution), made available by the network manager and ensuring the CVM’s integral monitoring of the tests, through read-only access to all records of experimental operations, without participation in the consensus mechanism, transaction validation, block production, or any other network decision-making process; and

XI – oracle: a mechanism, service, or entity that provides the distributed ledger technology network or smart contracts with data or information from sources external to the network;

XII – smart contract: a computer program registered and executed on a distributed ledger technology network that, upon verification of the parametrized conditions therein, automatically executes, in whole or in part, operations, transfers, or other functions related to tokens and the rights and duties of agents; and

XIII – orchestration mechanism: a technological solution that coordinates the execution of operations involving more than one test network or system.

CHAPTER III – GOVERNANCE

Article 5. The DLT CVM Pilot Program operates under the coordination, supervision, and control of the CVM, through a Management Committee.

§ 1. The Management Committee is formed by the members of the CVM from the Tokenization Working Group – GTT, designated under the terms of a specific PTE Ordinance.

§ 2. It is the responsibility of the Management Committee to:

I – receive test network proposals and the respective CVM access means, verify their formal regularity, and publish the list of admitted test networks;

II – approve the evaluation methodology, test plan, schedule, and test cases for each admitted network;

III – deliberate on the suspension, total or partial, and exclusion of test networks and participants, and on the interruption of test cases;

IV – define security controls applicable to test networks, including regarding the CVM access means;

V – monitor the execution of tests, provide guidance, receive and analyze the reports referred to in Chapter VII; and

VI – report to the Board, through the GTT coordination, on the progress and results of the program.

Article 6. The CVM may develop the DLT CVM Pilot Program, in whole or in part, in collaboration with other bodies and entities of the public administration with sectoral regulatory competence, including for the purposes of testing interoperability with experimental platforms maintained by them.

CHAPTER IV – TEST NETWORK PROPOSALS AND ADMISSION

Article 7. May present a test network proposal and act as network managers, provided they are participating in the Tokenization Working Group – GTT:

I – associations representing entities authorized, registered, or accredited by the CVM to operate in the securities market; and

II – self-regulatory entities of the securities market.

Sole paragraph. The legitimized entities referred to in the main text may present a proposal individually or jointly, in a consortium, in which case the proposal shall indicate the lead entity, responsible for interlocution with the Management Committee, without prejudice to the responsibility of all consortium members for the duties provided for in this Resolution.

Article 8. Proposals must be submitted to the Management Committee within 15 business days, counted from the publication of this Resolution, accompanied by the concrete submission of the CVM access means for each test network, capable of connection, and shall contain, at minimum:

I – the description of the proposed DLT network, specifying whether private or public permissioned, including architecture, protocol, consensus mechanism, permissioning model, interoperability, connectivity, and information security controls that meet, according to the applicable functional requirement, the concepts of availability, integrity, and confidentiality, as well as other technical standards adopted and, where applicable, their compatibility with recognized international standards;

II – the indication and technical specification of the CVM access means to be used for integral monitoring of the tests, including connection means, consultation, and record extraction, and the schedule for their availability;

III – the list of participants indicated for the execution of experimental operations, by category;

IV – the proposed test cases and execution schedule, compatible with the deadlines of Article 21;

V – the plan for segregating the test environment from production environments;

VI – the indication of the technical responsible person of the proponent or consortium before the Management Committee; and

VII – the demonstration of how the test network and proposed test cases observe the guiding principles of Article 3.

§ 1. The CVM access means submitted under the terms of the main text must meet the following minimum requirements:

I – connection via a data circuit with end-to-end encryption, sufficient minimum availability to meet the requirements of the business model, secure and stable, with encrypted communications and access authentication with an audit trail, through credentials for exclusive use by the CVM;

II – read-only access, in real time, to all records of experimental operations, including transactional data, smart contract states, and respective metadata;

III – consultation and record extraction functionalities in a structured format readable by machines, including through programmable interfaces (APIs) for monitoring;

IV – complete audit trails with timestamps, allowing the complete reconstruction of experimental operations;

V – continuous availability throughout the entire testing period, with a technical support channel maintained by the network manager and timely restoration in case of unavailability;

VI – read-only access, prohibiting any functionality that allows the CVM to insert, alter, or validate transactions or interfere with the operation of the test network;

VII – operation without dependence on third-party intermediation for CVM access, under the terms of Article 3, item V; and

VIII – observance of technical requirements, connectivity standards, and complementary security controls defined by the Management Committee, under the terms of Article 5, § 2, item IV.

§ 2. The technical documentation and credentials for the access means referred to in § 1 must be delivered to the CVM together with the proposal.

Article 9. Having met the requirements of this Resolution, the admission of test networks by the Management Committee is automatic, without a limit on the number.

§ 1. The verification by the Management Committee is restricted to compliance with the requirements of this Resolution, comprising:

I – the legitimacy of the proponent, under the terms of Article 7;

II – the timeliness of the submission, under the terms of Article 8, main text;

III – the minimum content of the proposal, under the terms of Article 8, main text, and items I to VII; and

IV – the compliance, by the CVM access means, with the minimum requirements of Article 8, §§ 1 and 2.

§ 2. If curable non-compliance is found, the Management Committee shall set a deadline of up to three business days for remediation, without prejudice to the deadline referred to in Article 21.

§ 3. The CVM access means will be rejected, by a reasoned decision of the Management Committee, if the minimum requirements of Article 8, §§ 1 and 2, are not met, even after the remediation period, in which case the respective test network will not be admitted.

§ 4. The list of admitted test networks will be published on the CVM’s internet page.

CHAPTER V – PARTICIPANTS AND ADHERENCE

Article 10. The participants in the experimental operations are indicated by the network managers, who are responsible for their selection, qualification, and continued presence in the test network, observing the provisions of this Resolution, or the following may be admitted individually:

I – securities bookkeepers;

II – securities custodians;

III – central depositories;

IV – entities administering organized securities markets;

V – intermediaries integrated into the securities distribution system;

VI – participative investment platforms, under CVM Resolution No. 88; and

VII – at the discretion of the Management Committee, issuers registered with the CVM, including securitization companies, exclusively for the execution of test cases involving the experiment of issuing securities.

§ 1. Admission presupposes that the participant holds a valid registration, authorization, or accreditation before the CVM compatible with the intended category of participation, subject to the provisions of § 3.

§ 2. Alternatively to the provisions of § 1, the network manager, when existing, shall ensure that each participant is technically and operationally capable of executing the test cases assigned to them.

§ 3. The Management Committee may, exceptionally and with reasoned justification, admit the participation of entities without registration before the CVM, acting jointly and under the responsibility of the network manager or an admitted participant under items I to VI of the main text.

Article 11. Participation is formalized through the signing of the Adhesion Term contained in Annex A by the network manager or individually, through which they declare their voluntary, integral, and unconditional agreement with this Resolution and with the decisions of the Management Committee.

Sole paragraph: The network manager shall bind the participants of its test network, through its own private instrument, to the duties provided for in this Resolution, responding before the CVM for its respective compliance.

Article 12. The presentation of a proposal and participation in the DLT CVM Pilot Program:

I – are voluntary and unpaid;

II – are at the exclusive expense of the proponents, network managers, and participants, including regarding development, connection, operation, and demobilization costs; and

III – do not generate, for the CVM, any duty to indemnify or reimburse expenses, investments, or losses of any nature.

CHAPTER VI – OPERATION AND EXPERIMENTAL OPERATIONS

Article 13. Test networks operate in a technological environment logically segregated from the participants' production environments, prohibiting any integration that allows the production of effects on real systems, records, accounts, or assets.

Article 14. Experimental operations are executed exclusively with test tokens and fictitious data, prohibiting the use of:

I – securities effectively issued or in circulation;

II – real financial resources, including for settlement purposes; and

III – personal data of investors or participants' clients, except for the use of anonymized or synthetic data, observing Law No. 13,709, of August 14, 2018.

§ 1. The network manager is responsible for ensuring the confidentiality of technical, commercial, or operational information considered confidential by participants, and should evaluate the need to explicitly state such obligation in its own instruments of adherence to the respective test network.

Article 15. Test cases may contemplate different species of securities and cover, among others, the experimentation of:

I – issuance and bookkeeping of securities natively registered in DLT;

II – public distribution offerings, primary and secondary, including regarding subscription, capitalization, and allocation procedures;

III – trading in organized markets and other trading environments;

IV – custody, centralized deposit, creation of liens and encumbrances, and position reconciliation;

V – settlement of operations, including through delivery versus payment mechanisms with tokens representing fictitious resources;

VI – events incident upon the experimental securities, such as payment of remuneration, amortizations, redemptions, and conversions; and

VII – supervision routines, information reporting, and audit trails accessible through the CVM access means; and

VIII – alternative integration arrangements for functions, including those in which the same entity executes, in a single DLT-based environment, two or more stages of the experimental securities lifecycle, such as issuance, bookkeeping, distribution, trading, custody, and settlement, with or without the participation of a central depository or intermediary;

Sole paragraph. The Management Committee may include other aspects to be tested within the scope of approved test networks.

Article 16. The incidence of CVM regulations governing:

I – the registration of public distribution offerings of securities;

II – the provision of securities bookkeeping services;

III – the provision of securities custody services;

IV – the activity of centralized deposit of securities;

V – the operation of organized securities markets; and

VI – the activity of intermediation in securities markets;

is hereby suspended, exclusively within the scope of experimental operations carried out in test networks and while this Resolution is in force.

CHAPTER VII – DUTIES AND REPORTS

Article 17. The duties of network managers are:

I – administer the test network and coordinate the execution of test cases according to the plan approved by the Management Committee;

II – make available and keep in operation throughout the entire testing period, the CVM access means, as indicated in the admitted proposal;" }

SECURITIES AND EXCHANGE COMMISSION OF BRAZIL (CVM) www.cvm.gov.br CVM RESOLUTION NO. 249, OF OCTOBER 13, 2026

III – send to the Management Committee, every fifteen days, a report on the experiments carried out, covering the progress of test cases, the problems identified, and the solutions found or proposed; IV – immediately communicate to the CVM security incidents, relevant failures, and any events that may compromise the tests or exceed the segregated environment, as well as the timely responses, containment, and workaround solutions; and V – ensure compliance with this Resolution by the participants of its test network.

Art. 18. The duties of the participants are:
I – execute the test cases according to the approved plan and the guidelines of the Management Committee and the network manager; II – maintain information security and access management controls compatible with the requirements defined by the Management Committee; III – ensure the traceability and integrity of the records of experimental operations and the unrestricted access of the CVM to such records; IV – keep confidential non-public information of other participants and of the network managers to which they have access due to the tests, using them exclusively for the purposes of the CVM DLT Pilot Program; V – refrain from publicly disclosing results, metrics, or conclusions of the tests without prior consent of the Management Committee; and VI – refrain from disseminating advertising or client solicitation material that suggests endorsement, approval, or certification by the CVM due to participation in the CVM DLT Pilot Program.

Art. 19. Upon completion of the testing period, the network managers will send to the Management Committee, within a period of up to ten business days, conclusive reports on the experiments carried out, covering:
I – the evaluation of the results of the test cases, the risks, and the limitations identified; II – the detailed description of activities carried out off-chain, the oracles used, and the governance of off-chain activities; and III – any proposals of a normative or legal nature that may contribute to enabling the adoption of distributed ledger technology in the securities market.

COMISSÃO DE VALORES MOBILIÁRIOS www.cvm.gov.br CVM RESOLUTION NO. 249, OF OCTOBER 13, 2026

Sole Paragraph. At the discretion of the test network manager, it may request inputs from the participants of the network it manages, in order to be consolidated in the report mentioned in the caput.

Art. 20. The CVM may disclose aggregated information and general conclusions about the tests carried out, preserving the commercial, corporate, and industrial confidentiality of the proponents, the network managers, and the participants.

CHAPTER VIII – TESTING PERIOD, SUPERVISION, SUSPENSION, AND EXCLUSION

Art. 21. The tests on admitted networks will be carried out within a period of sixty days, counted from the first business day following the end of the period established in Art. 8, extendable by up to thirty days by decision of the Management Committee, in accordance with the deadlines established in CVM/PTE Ordinance No. 177, of 2026.

Art. 22. The supervision of the experiments will be exercised by the CVM through the access means of each test network, without prejudice to the request for additional information and documents from the network managers and participants.

Art. 23. The Management Committee may, at any time and by reasoned decision:
I – suspend or terminate test cases;
II – suspend or exclude a test network or participant that fails to comply with this Resolution or the Adhesion Term, loses an admission requirement, or whose presence compromises the security or purpose of the CVM DLT Pilot Program; and III – propose to the Collegiate Body the early termination of the CVM DLT Pilot Program.

Sole Paragraph. The voluntary withdrawal of a participant or network manager will be formalized through prior communication to the Management Committee and does not exempt them from the duties of confidentiality and reporting regarding the period of their participation.

CHAPTER IX – EVALUATION AND FINAL PROVISIONS

Art. 24. Upon receiving the conclusive reports referred to in Art. 19, the Management Committee will consolidate and submit to the Collegiate Body, through the coordination of the GTT, a final evaluation report of the CVM DLT Pilot Program, covering the results obtained, the risks identified, and recommendations regarding any proposals for normative or legal improvements, observing the deadlines of CVM/PTE Ordinance No. 177, of 2026.

Sole Paragraph. The CVM will publish a public version of the final report, except for information protected by confidentiality.

COMISSÃO DE VALORES MOBILIÁRIOS www.cvm.gov.br CVM RESOLUTION NO. 249, OF OCTOBER 13, 2026

Art. 25. Omitted cases will be decided by the Management Committee.

Art. 26. This Resolution enters into force on the date of its publication.

Signed electronically by
OTTO EDUARDO FONSECA DE ALBUQUERQUE LOBO
President

COMISSÃO DE VALORES MOBILIÁRIOS www.cvm.gov.br CVM RESOLUTION NO. 249, OF OCTOBER 13, 2026

ANNEX A
MODEL OF ADHESION TERM TO THE CVM DLT PILOT PROGRAM

By this Adhesion Term, [COMPANY NAME], registered under CNPJ no. [•], with headquarters at [•], represented herein in accordance with its constitutive instruments ("Participant"), indicated in the proposal of the test network administered by [NETWORK MANAGER / CONSORTIUM], declares, voluntarily, fully, and unconditionally, for the purposes of participation in the CVM DLT Pilot Program instituted by CVM Resolution No. [•], of [•] of [•] of 2026, that:

1. it knows and fully adheres to CVM Resolution No. [•], of 2026, to the approved test plan, and to the deliberations of the Management Committee, committing to observe them;
2. it recognizes the exclusively experimental nature of the operations carried out in the CVM DLT Pilot Program, which do not produce legal or patrimonial effects outside the test environment and do not generate rights or obligations towards third parties;
3. it recognizes that participation in the CVM DLT Pilot Program does not imply registration, authorization, accreditation, approval, endorsement, or any manifestation by the CVM regarding the regulatory compliance of technologies, arrangements, or business models, nor does it generate acquired rights or legitimate expectations of continuity or future regulatory treatment;
4. it will bear all costs and expenses arising from its participation, waiving any claim for indemnification or reimbursement against the CVM;
5. it commits to not use, within the scope of the tests, real securities, real financial resources, or personal data of investors or clients, except for anonymized or synthetic data, observing the personal data protection legislation;
6. it commits to keeping confidential non-public information of other participants and of the network managers and to not disclose the results of the tests without prior consent of the Management Committee;
7. it commits to sending to the Management Committee, within the period established in Art. 19 of the Resolution, a conclusive report on the experiments and its proposals of a normative or legal nature; and
8. it indicates as its technical representative before the Management Committee and the network manager: [NAME, POSITION, E-MAIL, TELEPHONE].

Place and date.
[Legal Representatives of the Participant]