Explanatory Note to CVM Resolution 50

INTRODUCTION
This Explanatory Note aims to provide more detailed clarifications regarding the implementation of CVM Resolution No. 50, of August 31, 2021, among which stand out:
a) the insertion of the Risk-Based Approach as the main governance tool for the prevention of money laundering, terrorist financing and the financing of the proliferation of weapons of mass destruction (AML/CFT/CPF), which results in the need, by regulated agents:
(i) to structure an AML/CFT/CPF Policy;
(ii) to periodically prepare an internal risk assessment; and (iii) to reformulate their rules, procedures and internal controls; b) the improvement of the functions of the director responsible for the regulation, as well as the presentation of duties linked to senior management; c) the definition of the steps linked to the conduct of the "Know Your Client" Policy, including the detailing of routines related to the full knowledge of the beneficial owner; and d) the greater detailing of the alert signals to be monitored and the points that must integrate the analysis of the atypical operation or situation that was detected, as well as the presentation of the minimum elements that must integrate a report to the Financial Activities Control Council – COAF.

It should be noted that the content of this Explanatory Note is aligned with Circular Letters already published by the technical areas of the CVM, as well as with publications from FATF and the Basel Committee.
Furthermore, it is worth alerting that the issuance of this Explanatory Note does not restrict or replace the future dissemination of Circular Letters that may be deemed pertinent.

CONSIDERATIONS ON THE ROLE OF THE RESPONSIBLE DIRECTOR AND SENIOR MANAGEMENT Paragraph 2 of Article 4 of CVM Resolution No. 50, of 2021, establishes that the legal entities mentioned in items I and III of Article 3 that belong to the same financial conglomerate must establish mechanisms for information exchange between their internal control areas in their AML/CFT/CPF policies. It is worth noting that it is possible to adopt a single policy for the entire conglomerate; in this case, it is important to detail the institutions covered and the respective peculiarities of each of them. The intent of the regulation is to address the risk that failures in communication between internal control units prevent compliance with the obligations provided for in the provision, regardless of whether or not a single policy is adopted for the conglomerate. Naturally, the exchange of information must consider the relevance of the risk identified in each case, always in alignment with the respective internal risk assessment, as per Section II of Chapter II of CVM Resolution No. 50, of 2021. Note that such a provision does not conflict with Paragraphs 4 and 5 of Article 8, especially when it is clear that maintaining a single, or more directors, to perform the duties described in the Resolution will be a choice of the institutions that make up the financial conglomerate. In any case, it must be emphasized that the director responsible for the Resolution must have broad, unrestricted and timely access to any information related to the regulated entity's activity in the capital market, thereby enabling the data necessary for the exercise of their duties and those of their employees, especially regarding the effective management of money laundering, terrorist financing and financing of the proliferation of weapons of mass destruction (AML/CFT/CPF) risks, to be used effectively and timely. The persons responsible for AML/CFT/CPF risk management and internal audit activities, where applicable, must base their analyses on all information they deem relevant,

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP Code: 20050-901 – Brazil - Tel.: (21) 3554-8686 Rua Cincinato Braga, 340/2nd, 3rd and 4th Floors, Bela Vista, São Paulo/ SP – ZIP Code: 01333-010 – Brazil - Tel.: (11) 2146-2000 including, when appropriate, restricted or even confidential information obtained through internal mechanisms, which enable such access, as well as information from direct lines of the whistleblowing channel. Thus, in no situation can the legal entities listed in items I to III of Article 3 allege any type of access restriction to any corporate data by the aforementioned director, such as – for example – issues arising from an eventual confidentiality regime (legal, commercial, among others), or other legal restrictions, such as events within the scope of the General Data Protection Law or resulting from regulations governing the existence of activity segregation (Chinese Wall) between some areas of the aforementioned institution. The manner in which such data will be made available to the director responsible for the Resolution and his employees should be an integral part of the institution's rules, procedures and internal controls. Furthermore, the systems responsible for the institution's internal data flow should be guided to avoid the possibility that the routines inherent to AML/CFT/CPF risk management may be prejudiced by eventual information asymmetry, the untimely receipt of data or even the non-receipt of some information. In other words, it is essential to implement adequate internal communication processes, thereby enabling the responsible director and his employees to access any sensitive information related to AML/CFT/CPF risk management without delay. It is worth alerting that senior management must not only be aware of its duties set forth in Section II of Chapter III of the Resolution, but must also ensure that:
a) it is timely aware of compliance risks related to AML/CFT/CPF; b) the responsible director has independence, autonomy and sufficient technical knowledge to fully comply with his duties, as well as has full access to all information he deems necessary for the respective AML/CFT/CPF risk governance to be carried out; c) the systems responsible for collecting, updating and storing information related to the "Know Your Client" Policy described in Chapter IV of the Resolution are adequate for the purpose to which they are destined;

RULES, PROCEDURES AND INTERNAL CONTROLS
The nature and extent of AML/CFT/CPF rules, procedures and internal controls will depend on a series of factors, including the scope, scale and complexity of the regulated entity's activity in the securities market.
This includes, but is not limited to, the following:
a) the diversity of its operations; b) the geographic location; c) the client base; d) the profile of the products and activities offered; and e) the degree of risk associated with the peculiarities inherent to all business lines (for example, to what extent there is, or is not, direct relationship with the investor, or commercial relationship with other persons who are part of items I to III of Article 3 of the Resolution). Therefore, AML/CFT/CPF risk management must necessarily:
a) prioritize the monitoring of the institution's products and services that are more vulnerable to AML/CFT/CPF risks, customizing, whenever necessary, rules, procedures and internal controls for the specific treatment of an event with a higher probability of damage; b) ensure the existence of a regular process for reviewing all routines for assessing and managing these risks, taking into account the environment in which the institution operates; c) verify, before offering new products or services, or even the use of new technologies, the existence of prior assessments and the respective proposal of adequate AML/CFT/CPF risk controls;

"KNOW YOUR CLIENT" POLICY
The "Know Your Client" Policy is one of the main pillars of AML/CFT/CPF and must be understood as the adoption of a minimum of 4 (four) distinct stages, namely:
a) client identification; b) registration; c) the conduct of due diligence; and d) the process of identifying the beneficial owner.
Client identification comprises the implementation of adequate procedures to ensure their real identity, given that it is the preliminary moment to the start of the investor's relationship with the institution. There is, at minimum, the need to certify that the investor actually possesses an identity document number or respective registration with the CNPJ (Corporate Taxpayer Registry). In the case of non-resident investors, regardless of the use of simplified registration, this information must also include the "CVM code" number. It is worth emphasizing that this first contact will not necessarily be carried out in person, within the institution's premises. Often this moment will be marked by the use of various technologies, so the routines related to this stage must observe, for the purposes of future risk classification, that the continuity of the relationship with this client can, in fact, be conducted in non-face-to-face environments. Parallel to this, this is also the moment when qualification procedures must enable a first approach in the preliminary collection and validation of some relevant information from this investor, which will likely be necessary for the adequate future monitoring of their transactions.

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP Code: 20050-901 – Brazil - Tel.: (21) 3554-8686 Rua Cincinato Braga, 340/2nd, 3rd and 4th Floors, Bela Vista, São Paulo/ SP – ZIP Code: 01333-010 – Brazil - Tel.: (11) 2146-2000 Thus, in accordance with Paragraph 2 of Article 5 of the Resolution, it must be possible to demonstrate the attempt to, for example, verify if the natural person client is a Politically Exposed Person (PEP). In the event that the investor is a legal entity, identify whether this investor is controlled by a PEP, or, alternatively, whether it can be classified as a non-profit organization, in accordance with current legislation. Such information, by itself, does not have any restrictive character nor is it sufficient to conclude the respective risk classification of this client. Subsequently, the process of collecting all registration information begins, in accordance with Annex B of the Resolution. At the institution's discretion, this process may be carried out through alternative registration systems, including electronically, provided that the adopted solutions satisfy the objectives of current regulations and the procedures are verifiable. For this purpose, institutions that opt for the alternative registration system must necessarily:
a) meet the essential functions of the client registration process, with evidence that the following have been guaranteed:
(i) client protection, by providing preliminary and basic information that mitigates their information asymmetry regarding contract conditions and offered services (disclosure); (ii) compliance with legal and regulatory norms, especially those related to AML/CFT/CPF, processes for adapting products to the investor's profile (suitability) and combating the use of insider information (insider trading); and (iii) the management of other risks inherent to this institution's activity in the securities market; b) increase the security and reliability of registration data through queries to official sources for validating information; c) ensure that all changes and updates within the registration are traceable and auditable; d) mitigate the risk of false or inaccurate information in the registration process; and

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP Code: 20050-901 – Brazil - Tel.: (21) 3554-8686 Rua Cincinato Braga, 340/2nd, 3rd and 4th Floors, Bela Vista, São Paulo/ SP – ZIP Code: 01333-010 – Brazil - Tel.: (11) 2146-2000 e) implement a permanent process for collecting and updating clients' registration data, and that allows timely access to such information. Note that, in any case, the information will be declared by the client themselves, and must then undergo a validation process by the institution, through public or private databases of recognized reliability, and such query can be carried out in both environments. Thus, discrepancies eventually pointed out during the analysis and validation process of the registration data provided must be resolved with the clients and treated by the respective areas and hierarchical instances responsible for approving and maintaining the relationship with clients. Note that, regardless of the existence or non-existence of discrepancies in the registration databases, the institution must always be proactive and base such routines on items II and III of Article 4, Paragraphs 1 and 3 of Article 11, and item I of Article 17. To achieve the previously emphasized principles, institutions that opt for the alternative registration system must observe:
a) the maintenance of the content, date, time, origin and identification of the person responsible for providing and updating all registration information carried out during a period of, at least, 5 (five) years; b) the system's ability to retroactively go back to a previous date, for a minimum period of 5 (five) years, in order to show the data contained in the active registration on that date; c) security controls and procedures that allow blocking access to registration data by unauthorized persons, as well as the identification of users who accessed or made changes to registration data during a period of, at least, five years; d) alert and blocking mechanisms for the performance of new operations by clients with outdated registrations, except in the cases of requests for account closure or alienation or redemption of assets, always observing the terms of Paragraph 3 of Article 11, as well as Articles 16 to 18 of the Resolution; and e) description of analytical procedures and approval processes that demonstrate the additional due diligence appropriate for:

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP Code: 20050-901 – Brazil - Tel.: (21) 3554-8686 Rua Cincinato Braga, 340/2nd, 3rd and 4th Floors, Bela Vista, São Paulo/ SP – ZIP Code: 01333-010 – Brazil - Tel.: (11) 2146-2000 (i) confirming clients' registration data, keeping them updated and monitoring the operations performed by them, in order to prevent the use of the account by third parties and identify the beneficial owners of the operations; (ii) identifying politically exposed persons, as well as non-profit organizations; and (iii) attempting, within the limits of the institution's duties, to identify the origin of the resources involved in the transactions of clients and beneficiaries identified as politically exposed persons. It is worth reiterating here that the client's or their attorney's signature on the registration can be carried out digitally, which links the digital certificate to the electronic document being signed, in this case, the registration form, or, in the case of electronic systems, by which registration is carried out with the typing of registration data directly by the investor, future client, supplemented by other mechanisms, provided that the adopted procedures allow confirming the client's identification with precision. Once the phase of collecting registration information is concluded, the continuous conduct of due diligence begins, which will last throughout the entire commercial relationship with the client, aiming to:
a) reinforce the verification of the truthfulness of the collected information; b) collect supplementary information, when applicable; as well as c) keep them updated, in the event of detection of a new fact that justifies anticipating the period established by the institution for registration updates.
In the conduct of these continuous due diligences, efforts must be made and evidenced in the search for supplementary information to properly classify and manage AML/CFT/CPF risks for this client. The search for additional data should initially encompass all areas of the institution, as well as other information potentially available in other entities that may be part of the same financial conglomerate, in accordance with Paragraph 2 of Article 4 of the Resolution. Nevertheless, the institution must, within its risk-based approach methodology, permanently evaluate how supplementary information will be obtained from third parties outside the financial conglomerate, if applicable, observing any confidentiality or access restriction regimes provided for in legislation.

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP Code: 20050-901 – Brazil - Tel.: (21) 3554-8686 Rua Cincinato Braga, 340/2nd, 3rd and 4th Floors, Bela Vista, São Paulo/ SP – ZIP Code: 01333-010 – Brazil - Tel.: (11) 2146-2000 It is worth clarifying that, as already defined in the Resolution, a beneficial owner is considered a natural person or natural persons who, individually or jointly, possess, control or significantly influence, directly or indirectly, a client on whose name a transaction is being conducted or from which they benefit. Thus, when the process of identifying the beneficial owner is applicable, the minimum reference value must be noted, which was defined at 25% (twenty-five percent) of the share capital of legal entities or of the net equity of investment funds and other entities in the cases covered by items II to V of Article 1 of Annex B, without prejudice to the eventual use of simplified registration as provided for in Annex C. This parameter must be aligned with the results of the internal risk assessment and may be lower than this percentage in situations of higher risk. Furthermore, it must be observed that the process of identifying one or more beneficial owners goes beyond the parameters defined in the concepts of control or ownership. Sometimes the causal link of this identification should focus on the act or effect of significant influence, regarding which there may be one or more people who actually participate in the strategic decision-making of that investor, and who do not necessarily, for example, compose the corporate structure of a company, nor will they appear as its administrators or even employees. Another point to be verified is that in many situations in legal entities, or even in legal arrangements of non-resident investors, the beneficial owner will be solely the one who ultimately benefits directly or indirectly from the assets owned by that client, without necessarily there being any formal record that he is part of the shareholders' register, or even the register of administrators or employees. All of the above reinforces the need for continuous due diligence aiming at full knowledge of the client, including understanding their legal nature and decision-making process, in a risk-based approach, and within the limits of the institution's duties. Regarding specifically the simplified registration of non-resident investors, provided for in Annex C of the Resolution, it will initially be the responsibility of the legal entities mentioned in items I to III of Article 3 of the regulation to identify the correct classification for the aforementioned foreign investor. Subsequently, the due diligence must guide the situations in which it is possible to individualize a natural person or

COMISSÃO DE VALORES MOBILIÁRIOS
Rua Sete de Setembro, 111/2-5º e 23-34º Andares, Centro, Rio de Janeiro/RJ – CEP: 20050-901 – Brasil - Tel.: (21) 3554-8686 Rua Cincinato Braga, 340/2º, 3º e 4º Andares, Bela Vista, São Paulo/ SP – CEP: 01333-010 – Brasil - Tel.: (11) 2146-2000 of natural persons as ultimate beneficiaries of these investors, and the best efforts to identify them must be evidenced. The adoption of the simplified registration for non-resident investors allows the Brazilian institution to hold a reduced amount of registration information; however, it does not exempt it from conducting the routines provided for in the investor knowledge process that have already been mentioned in this Explanatory Note. Such routines must be conducted on a permanent basis during the commercial relationship between the Brazilian institution and the non-resident investor, and do not require prior demand from the CVM or the self-regulatory entity to be implemented. Although the foreign institution may be considered the main source of the information to be collected, if the data required by CVM regulations is truly not made available by the foreign institution holding the non-resident client's information to the Brazilian institution, there is no restriction on obtaining supplementary inputs from third parties. Therefore, other information may eventually be collected from independent sources, as well as be effectively used, provided that they prove to be useful and reliable as substitutes or good references for the "Know Your Customer" process. In this context, if the necessary information is not provided by the foreign institution, or even cannot be obtained from reliable third parties, and such a gap prevents the full knowledge of the client classified as a non-resident investor, the Brazilian institution must adopt the necessary measures to, considering all hypotheses provided for in the items of Article 20 of the Resolution, after analyzing the situation in concreto according to Article 21, evaluate the relevance and opportunity of communicating the facts to COAF. Furthermore, other measures must also be adopted, such as the evaluation by the respective senior management regarding the maintenance of the commercial relationship with that non-resident investor. It is worth emphasizing that the lack of knowledge of the beneficial owner, in situations where applicable, of any Brazilian or foreign client, resident or non-resident, regardless of the use of simplified registration, must always be based on evidence that the due diligence aimed at this end was conducted, within the limits of the institution's responsibilities. The institution must observe that the lack of knowledge of the beneficial owner is not, by itself, a sufficient element for sending a communication to COAF. Consequently, such fact must provide