CVM Instruction No. 626 of May 15, 2020 - Rules for the Establishment and Operation of an Experimental Regulatory Environment (Regulatory Sandbox)

SECURITIES AND EXCHANGE COMMISSION OF BRAZIL (CVM) Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686 Rua Cincinato Braga, 340/2nd, 3rd and 4th Floors, Bela Vista, São Paulo/SP – ZIP: 01333-010 – Brazil - Tel.: (11) 2146-2000 SCN Q.02 – Bl. A – Corporate Financial Center Building, S.404/4th Floor, Brasília/DF – ZIP: 70712-900 – Brazil - Tel.: (61) 3327-2030/2031 www.cvm.gov.br CVM INSTRUCTION NO. 626, OF MAY 15, 2020 Establishes the rules for the establishment and operation of an experimental regulatory environment (regulatory sandbox). THE PRESIDENT OF THE SECURITIES AND EXCHANGE COMMISSION OF BRAZIL – CVM, makes public that the Board of Directors, in a meeting held on April 8, 2020, based on the provisions of Arts. 8, II; 16; 18, I; 19; 21; 23 and 26 of Law No. 6.385, of December 7, 1976, APPROVED the following Instruction: CHAPTER I – SCOPE AND PURPOSE Art. 1. This Instruction regulates the establishment and operation of an experimental regulatory environment (“regulatory sandbox”), in which participating legal entities may receive temporary authorizations to test innovative business models in activities in the securities market regulated by the Securities and Exchange Commission. Sole Paragraph. The implementation of the regulatory sandbox aims to serve as an instrument to provide: I – promotion of innovation in the capital market; II – guidance to participants on regulatory matters during the development of activities to increase legal certainty; III – reduction of costs and time to maturity for developing innovative products, services, and business models; IV – increased visibility and traction for innovative business models, with possible positive impacts on their attractiveness to venture capital; V – increased competition among service providers and financial product suppliers in the securities market;

SECURITIES AND EXCHANGE COMMISSION OF BRAZIL (CVM) Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686 Rua Cincinato Braga, 340/2nd, 3rd and 4th Floors, Bela Vista, São Paulo/SP – ZIP: 01333-010 – Brazil - Tel.: (11) 2146-2000 SCN Q.02 – Bl. A – Corporate Financial Center Building, S.404/4th Floor, Brasília/DF – ZIP: 70712-900 – Brazil - Tel.: (61) 3327-2030/2031 www.cvm.gov.br CVM INSTRUCTION NO. 626, OF MAY 15, 2020 2 VI – financial inclusion resulting from the launch of less costly and more accessible financial products and services; and VII – improvement of the regulatory framework applicable to regulated activities. Art. 2. For the purposes of this Instruction, the following are understood: I – regulatory bodies: the Securities and Exchange Commission, the Central Bank of Brazil, the Private Insurance Superintendence, and the National Superintendence of Complementary Pension, when not specified individually; II – temporary authorization: authorization granted on a temporary basis for the development of a specific regulated activity, under a regime different from that ordinarily provided for in the applicable regulations, through the waiver of regulatory requirements and with the prior establishment of conditions, limits, and safeguards aimed at protecting investors and ensuring the proper functioning of the securities market; III – Sandbox Committee: a group composed of CVM staff responsible for conducting specific activities related to the regulatory sandbox provided for in this Instruction; and IV – innovative business model: an activity that, cumulatively or not: a) uses innovative technology or makes innovative use of technology; or b) develops a product or service that is not yet offered or has a different arrangement from what is currently being offered in the securities market. § 1. The innovative business model referred to in item IV must have the potential to promote efficiency gains, cost reduction, or expanded access for the general public to securities market products and services. § 2. The composition and operation of the Sandbox Committee shall be governed by a Presidential Ordinance of the CVM.

SECURITIES AND EXCHANGE COMMISSION OF BRAZIL (CVM) Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686 Rua Cincinato Braga, 340/2nd, 3rd and 4th Floors, Bela Vista, São Paulo/SP – ZIP: 01333-010 – Brazil - Tel.: (11) 2146-2000 SCN Q.02 – Bl. A – Corporate Financial Center Building, S.404/4th Floor, Brasília/DF – ZIP: 70712-900 – Brazil - Tel.: (61) 3327-2030/2031 www.cvm.gov.br CVM INSTRUCTION NO. 626, OF MAY 15, 2020 3 CHAPTER II – RULES FOR ACCESS TO THE REGULATORY SANDBOX Section I – Participant Admission Process Art. 3. The participant admission process for the regulatory sandbox shall begin with a market notice, published on the CVM website, which shall indicate: I – the schedule for receiving and analyzing proposals; and II – the eligibility criteria and the content required for the proposals to be presented, as well as the applicable selection and prioritization criteria, in accordance with Art. 11. § 1. The notice referred to in the main text must be approved by the Board of Directors and: I – must indicate the maximum number of proposers that may be selected to participate in the regulatory sandbox; and II – may restrict admission to those who carry out one or more regulated activities defined by the CVM. § 2. The Sandbox Committee may, exceptionally and with justification, exceed the limitation referred to in item I of § 1, when it verifies that the monitoring of activities by the CVM will not be compromised. § 3. The publication of the notice referred to in the main text does not generate any right or expectation of right for any participants, proposers, or other interested parties in the sandbox, and the CVM may suspend it at any time before the granting of temporary authorizations. Art. 4. The Sandbox Committee may establish complementary procedures for the participant admission process, aimed at: I – analyzing sandbox participation proposals that involve activities regulated by more than one regulatory body; and

SECURITIES AND EXCHANGE COMMISSION OF BRAZIL (CVM) Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686 Rua Cincinato Braga, 340/2nd, 3rd and 4th Floors, Bela Vista, São Paulo/SP – ZIP: 01333-010 – Brazil - Tel.: (11) 2146-2000 SCN Q.02 – Bl. A – Corporate Financial Center Building, S.404/4th Floor, Brasília/DF – ZIP: 70712-900 – Brazil - Tel.: (61) 3327-2030/2031 www.cvm.gov.br CVM INSTRUCTION NO. 626, OF MAY 15, 2020 4 II – enabling joint tests of innovative business models in foreign jurisdictions, in partnership with regulatory authorities from countries that have similar or compatible experimental regulatory environments. Section II – Eligibility Criteria Art. 5. The minimum eligibility criteria for participation in the regulatory sandbox are: I – the regulated activity must fall under the concept of an innovative business model; II – the proposer must demonstrate possessing sufficient technical and financial capabilities to develop the intended activity in an experimental regulatory environment; III – the administrators and direct or indirect controlling partners/shareholders of the proposer cannot: a) be disqualified or suspended from holding positions in financial institutions and other entities authorized to operate by the regulatory bodies; b) have been convicted of bankruptcy crimes, malfeasance, corruption, extortion, embezzlement, money laundering, or concealment of assets, rights, and values, against the popular economy, the economic order, consumer relations, public faith, or public property, the national financial system, or a criminal penalty that prohibits, even temporarily, access to public office, by a final and unappealable decision, except in the case of rehabilitation; and c) be prevented from administering or disposing of their assets due to a judicial or administrative decision; IV – the proposer cannot be prohibited from: a) contracting with official financial institutions; and b) participating in bidding processes aimed at acquisitions, alienations, execution of works and services, and concessions of public services, within the scope of federal, state, district, and municipal public administration and indirect public administration entities;

SECURITIES AND EXCHANGE COMMISSION OF BRAZIL (CVM) Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686 Rua Cincinato Braga, 340/2nd, 3rd and 4th Floors, Bela Vista, São Paulo/SP – ZIP: 01333-010 – Brazil - Tel.: (11) 2146-2000 SCN Q.02 – Bl. A – Corporate Financial Center Building, S.404/4th Floor, Brasília/DF – ZIP: 70712-900 – Brazil - Tel.: (61) 3327-2030/2031 www.cvm.gov.br CVM INSTRUCTION NO. 626, OF MAY 15, 2020 5 V – the proposer must demonstrate the capacity to establish, at a minimum, mechanisms for: a) protection against cyberattacks and unauthorized logical access to its systems; b) production and retention of records and information, including for audit and inspection purposes; and c) prevention of money laundering and terrorist financing; and VI – the innovative business model must have been preliminarily validated through means such as proof of concept or prototypes, and cannot be in a purely conceptual development phase. Sole Paragraph. Foreign legal entities are permitted to participate in the regulatory sandbox provided for in this Instruction, subject to the eligibility criteria set forth in this Art. 5. Section III – Submission of Proposals Art. 6. The proposer must submit a formal proposal to participate in the regulatory sandbox containing, at a minimum: I – description of the activity to be developed and the aspects that characterize it as an innovative business model, necessarily including: a) the market niche to be served by the offered service or product; b) expected benefits in terms of efficiency gains, cost reduction, or expanded access for the general public to securities market products and services; c) the metrics planned for performance measurement and the frequency of assessment; and d) the preliminary validation of the innovative business model, in accordance with item VI of Art. 5.

SECURITIES AND EXCHANGE COMMISSION OF BRAZIL (CVM) Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686 Rua Cincinato Braga, 340/2nd, 3rd and 4th Floors, Bela Vista, São Paulo/SP – ZIP: 01333-010 – Brazil - Tel.: (11) 2146-2000 SCN Q.02 – Bl. A – Corporate Financial Center Building, S.404/4th Floor, Brasília/DF – ZIP: 70712-900 – Brazil - Tel.: (61) 3327-2030/2031 www.cvm.gov.br CVM INSTRUCTION NO. 626, OF MAY 15, 2020 6 II – indication of the intended regulatory requirement waivers and the reasons why, in its view, they are necessary for the development of the regulated activity subject to the requested temporary authorization; III – suggestions for conditions, limits, and safeguards that may be established by the CVM, alone or jointly with another regulatory body, for the purpose of mitigating risks arising from operating under a waiver of regulatory requirements, for example: a) limitations on the number of clients; b) maximum volume of transactions; c) mechanisms to receive and respond to complaints from clients and investors; d) additional transparency measures regarding the communication rules provided for in this Instruction; and e) restriction of the securities that may be traded; IV – analysis of the main risks associated with its operations, including those related to: a) cybersecurity; b) personal data treatment; and c) prevention of money laundering and terrorist financing; V – procedures necessary for going live, necessarily including an indicative operational schedule; VI – contingency plan for the orderly discontinuation of the regulated activity, for any reason, including the treatment to be given to clients, investors, or interested parties, as applicable; and

SECURITIES AND EXCHANGE COMMISSION OF BRAZIL (CVM) Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686 Rua Cincinato Braga, 340/2nd, 3rd and 4th Floors, Bela Vista, São Paulo/SP – ZIP: 01333-010 – Brazil - Tel.: (11) 2146-2000 SCN Q.02 – Bl. A – Corporate Financial Center Building, S.404/4th Floor, Brasília/DF – ZIP: 70712-900 – Brazil - Tel.: (61) 3327-2030/2031 www.cvm.gov.br CVM INSTRUCTION NO. 626, OF MAY 15, 2020 7 VII – documents and information necessary to verify compliance with the eligibility criteria, as well as the selection and prioritization criteria, as published in the market notice referred to in the main text of Art. 3. § 1. The suggestions for risk mitigation referred to in item III must present solutions and possible remedial measures for any damages caused to clients, investors, and interested parties during the period of participation in the regulatory sandbox, including, if applicable, any contracted insurance. § 2. The proposer shall: I – indicate, in a justified manner, the information contained in the proposal whose disclosure could represent a competitive advantage to other economic agents, and which, therefore, must be treated by the CVM as confidential, protected under the legal hypotheses of confidentiality; and II – expressly state consent to the possibility of the CVM sharing its information, including those falling under item I, with potential third parties who may assist the CVM in analyzing the proposals, subject to the terms provided for in Art. 10. Section IV – Analysis of Proposals Art. 7. Proposals for participation in the regulatory sandbox received on time shall be analyzed by the Sandbox Committee. § 1. In analyzing the received proposals, the Sandbox Committee may request additional information or clarifications to remedy any formal defects identified preliminarily and to support the analysis of the received proposals. § 2. The request for information referred to in § 1 shall be formulated with specific requests and shall grant a reasonable deadline for the proposer's response.

SECURITIES AND EXCHANGE COMMISSION OF BRAZIL (CVM) Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686 Rua Cincinato Braga, 340/2nd, 3rd and 4th Floors, Bela Vista, São Paulo/SP – ZIP: 01333-010 – Brazil - Tel.: (11) 2146-2000 SCN Q.02 – Bl. A – Corporate Financial Center Building, S.404/4th Floor, Brasília/DF – ZIP: 70712-900 – Brazil - Tel.: (61) 3327-2030/2031 www.cvm.gov.br CVM INSTRUCTION NO. 626, OF MAY 15, 2020 8 § 3. The receipt and analysis of proposals originating from admission processes of other regulatory bodies for their respective sandboxes are admitted, even if the deadline defined by the CVM for registrations has already expired. Art. 8. Late proposals or those deemed ineligible for admission to the regulatory sandbox shall be rejected by the Sandbox Committee through the presentation of a justification to the proposer. Sole Paragraph. Proposals are considered ineligible if they are ineligible or if they have not provided the necessary information for the analysis referred to in Art. 7. Art. 9. Proposals deemed by the Sandbox Committee as eligible for admission to the regulatory sandbox shall be included in an analysis report to be presented to the Board of Directors, which shall contain, for each proposal, at a minimum: I – description of the innovative business model to be tested; II – temporary authorization to be granted; III – recommendation of regulatory requirement waivers deemed by the Sandbox Committee as necessary and sufficient for the development of the regulated activity; and IV – proposal of conditions, limits, and safeguards to be imposed by the CVM to mitigate identified risks. Art. 10. The Sandbox Committee may interact with third parties, such as universities, researchers, representative entities, and associations, with the objective of establishing partnerships, cooperation agreements, or conventions, for the purpose of carrying out the analysis referred to in Art. 7 and the analysis report referred to in the main text of Art. 9. Sole Paragraph. The third parties referred to in the main text must observe the legal hypotheses of confidentiality of the information contained in the participation proposals to which they have access, and confidential treatment must be provided for in the legal instruments referred to in the main text.

SECURITIES AND EXCHANGE COMMISSION OF BRAZIL (CVM) Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686 Rua Cincinato Braga, 340/2nd, 3rd and 4th Floors, Bela Vista, São Paulo/SP – ZIP: 01333-010 – Brazil - Tel.: (11) 2146-2000 SCN Q.02 – Bl. A – Corporate Financial Center Building, S.404/4th Floor, Brasília/DF – ZIP: 70712-900 – Brazil - Tel.: (61) 3327-2030/2031 www.cvm.gov.br CVM INSTRUCTION NO. 626, OF MAY 15, 2020 9 Art. 11. If the number of proposals deemed eligible for admission to the regulatory sandbox is greater than the maximum number of proposers that may be selected to participate in the sandbox, in accordance with item I of § 1 and § 2 of Art. 3, the Sandbox Committee shall include in the analysis report referred to in the main text of Art. 9 motivated recommendations for selection and prioritization for acceptance of the proposals. Sole Paragraph. Without prejudice to the observance of other selection and prioritization criteria, to be expressly informed in the market notice provided for in Art. 3, main text, the eventual selection and prioritization for acceptance of proposals must observe the following criteria: I – presence and relevance of technological innovation in the business model; II – stage of business development, prioritizing activities that are already in operation or ready to go live; III – magnitude of the expected benefit for clients and other interested parties; IV – potential impact or contribution to the development of the securities market; V – potential for financial inclusion considering, among other aspects, the expansion of public access or improvement in the quality of use of the product or service; and VI – conduct of the innovative business model primarily within the Brazilian securities market, even if the activities may also take place in other jurisdictions. Art. 12. The Board of Directors shall decide on the granting of the requested authorizations, weighing, among other aspects, the CVM's institutional objectives of development and protection of the capital market. § 1. Temporary authorizations shall be granted to approved proposals through a CVM Resolution, which must contain, for each participant, at a minimum: I – the name of the company or entity;

SECURITIES AND EXCHANGE COMMISSION OF BRAZIL (CVM) Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686 Rua Cincinato Braga, 340/2nd, 3rd and 4th Floors, Bela Vista, São Paulo/SP – ZIP: 01333-010 – Brazil - Tel.: (11) 2146-2000 SCN Q.02 – Bl. A – Corporate Financial Center Building, S.404/4th Floor, Brasília/DF – ZIP: 70712-900 – Brazil - Tel.: (61) 3327-2030/2031 www.cvm.gov.br CVM INSTRUCTION NO. 626, OF MAY 15, 2020 10 II – the authorized activity and regulatory waivers granted; III – the conditions, limits, and safeguards associated with the exercise of the authorized activity; and IV – the start date of the temporary authorization. § 2. Temporary authorizations shall be granted for a period of up to 1 (one) year, renewable for up to 1 (one) additional year. § 3. The renewal request shall be submitted to the Sandbox Committee at least 90 (ninety) days before the expiration of the temporary authorization period, indicating a well-founded justification regarding the necessity and relevance of the renewal. § 4. The Board of Directors shall decide on the temporary authorization renewal request at least 30 (thirty) days before the expiration of the granted authorization period. § 5. The renewal request shall be considered automatically approved if not reviewed by the Board of Directors within the deadline indicated in § 4. CHAPTER III – MONITORING Art. 13. Once temporary authorizations are granted by the Board of Directors, the Sandbox Committee shall monitor the progress of the activities developed by the participant within the regulatory sandbox in accordance with § 2. § 1. The monitoring carried out by the Sandbox Committee, in accordance with the main text, does not waive or restrict the supervision of technical areas over the different activities regulated by the CVM, and all involved parties must observe a routine of exchanging information regarding the legal entity participating in the regulatory sandbox and the development of its activities. § 2. For the purposes of the Sandbox Committee's monitoring, the legal entity participating in the regulatory sandbox shall:

SECURITIES AND EXCHANGE COMMISSION OF BRAZIL (CVM) Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686 Rua Cincinato Braga, 340/2nd, 3rd and 4th Floors, Bela Vista, São Paulo/SP – ZIP: 01333-010 – Brazil - Tel.: (11) 2146-2000 SCN Q.02 – Bl. A – Corporate Financial Center Building, S.404/4th Floor, Brasília/DF – ZIP: 70712-900 – Brazil - Tel.: (61) 3327-2030/2031 www.cvm.gov.br CVM INSTRUCTION NO. 626, OF MAY 15, 2020 11 I – make available representatives with managerial responsibilities to meet in person or remotely, periodically; II – grant access to relevant information, documents, and other materials related to the business, including those regarding its development and achieved results, whenever requested; III – cooperate in discussing solutions for the improvement of its regulation and supervision resulting from the monitoring of the activity developed under temporary authorization; IV – communicate the materialization of risks foreseen and unforeseen during the development of activities; V – communicate the intention to make relevant changes or adjustments to the innovative business model as a result of the progress of the tests; VI – periodically demonstrate compliance with the established conditions, limits, and safeguards; and VII – report client complaints and present measures to address frequent cases and cases of greater relevance. § 3. During the monitoring period, the participant may submit to the Sandbox Committee a well-founded request for expansion or alteration of the granted regulatory requirement waivers, or for revision of the agreed conditions, limits, and safeguards, which shall be submitted to the Board of Directors for consideration. § 4. The Sandbox Committee may establish additional mechanisms for monitoring participants jointly with other regulatory bodies or with competent regulatory authorities from foreign jurisdictions. CHAPTER IV – COMMUNICATION Art. 14. All