Joint Resolution No. 21

The Central Bank of Brazil, pursuant to art. 9 of Law No. 4.595, of 31 December 1964, hereby makes public that its Board of Directors, in a session held on 14 October 2026, and the National Monetary Council, in a session held on 22 October 2026, based on arts. 4, caput, item VIII, of the aforementioned Law, 9-A, caput, item I, of Law No. 4.728, of 14 July 1965, and 9, caput, item II, of Law No. 12.865, of 9 October 2013,

H A V E R E S O L V E D :

Art. 1 Joint Resolution No. 1, of 4 May 2020, published in the Official Gazette of the Union of 5 May 2020, shall come into force with the following amendments:

"Art. 2 ..............................................................

.........................................................................

II - client: any natural person or legal entity that maintains a relationship for the purpose of the provision of financial services or the performance of financial operations with the institutions referred to in this Joint Resolution, including for the performance of payment transactions;

.........................................................................

XIV - original creditor institution: creditor institution of the operation subject to portability;

XV - proposing institution: receiving institution of the operation subject to portability;

XVI - integrating institution: data-receiving institution that enters into a partnership agreement for the transmission of data originating from Open Finance to a partner entity;

XVII - partner entity: entity that enters into a partnership agreement with an integrating institution for the receipt of data originating from Open Finance;

XVIII - economic group: group composed of the controlling entity and all its subsidiaries, directly or indirectly; and

XIX - decoupled approval flow: data or service sharing procedure in which the consent request is made in the environment of the data-receiving institution or the payment transaction initiating institution and the consent approval occurs subsequently in the environment of the data-transmitting institution or the account-holding institution, without automatic redirection." (NR)

"Art. 8 ..............................................................

Sole paragraph. .......................................................

.........................................................................

III - occur successively; and

..................................................................." (NR)

"Art. 9 ...............................................................

.........................................................................

§ 1 ...................................................................

§ 2 The request for sharing of data and services referred to in art. 5, caput, item I, subitems "c" and "d", and item II, subitem "a", is permitted without redirection to other environments or electronic systems referred to in item III of the caput, within the scope of decoupled approval flows, subject to the provisions of specific regulations.

§ 3 The stages of requesting and approving consent within the scope of decoupled approval flows may be performed at different times and, when applicable, by different users." (NR)

Art. 15. .............................................................

........................................................................

§ 2 The data-transmitting institution or account-holding institution is prohibited from proposing to the client the revocation of consent.

.......................................................................

§ 5 In cases of well-founded suspicion of fraud, the institution that detects the fraud must consider the consent void, as well as observe the provisions of § 4 and the other procedures provided for in the regulations in force in relation to the revocation of consent." (NR)

"Art. 31. The participating institution is responsible for the reliability, integrity, availability, security, performance and confidentiality in relation to the sharing of data and services in which it is involved, as well as for compliance with the legislation and regulations in force." (NR)

"Art. 32. Participating institutions must designate a director responsible for the sharing referred to in this Joint Resolution.

.............................................................." (NR)

"Art. 33. The institutions referred to in art. 1 must prepare a report regarding the sharing of data and services in which they were involved and their performance in Open Finance.

§ 1 The minimum content, periodicity and other complementary requirements regarding the report mentioned in the caput shall be defined by the Central Bank of Brazil.

§ 2 The report mentioned in the caput, subject to the provisions of art. 48-A, must be submitted to those responsible for the compliance and internal audit areas and to the risk committee of the institution.

§ 3 In the event that the institution does not have a risk committee, the report mentioned in the caput must be submitted to the person responsible for the risk management area at the institution.

§ 4 The director responsible for the sharing referred to in art. 32 must sign the report mentioned in the caput." (NR)

"Art. 36. Any contract established by a participating institution that provides for the sharing of:

• I - registration or transaction data of clients referred to in art. 5, caput, item I, subitems "c" and "d" obtained within the scope of Open Finance; or

• II - data derived from processing, analysis or modeling of the data referred to in item I that remain identifying or allow the identification of the natural person or legal entity client, such as credit notes or scores.

........................................................................

§ 1º-A In the contract referred to in the caput, the parties assume the roles of integrating institution and partner entity, as defined in art. 2º, caput, items XVI and XVII.

........................................................................

§ 5º It is prohibited to enter into or maintain a partnership contract referred to in the caput:

• I - between institutions authorized to operate by the Central Bank of Brazil;

• II - with an entity not authorized to operate by the Central Bank of Brazil that is part of an economic group in which an institution authorized to operate by the Central Bank of Brazil that does not participate in Open Finance participates, in the case of data sharing referred to in art. 5º, caput, item I;

• III - with the objective that the partner entity acts on behalf of the integrating institution for the purposes of sharing the data referred to in the caput; and

• IV - with a partner entity that, in its nomenclature, uses terms characteristic of the nomenclature of institutions of the National Financial System or of the Brazilian Payment System or similar expressions in the vernacular or in a foreign language.

§ 5º-A In the event that, after entering into the partnership contract, any event arises that triggers any of the prohibitions provided for in items I, II and IV of § 5º, the parties must adopt measures to terminate the partnership contractual relationship referred to in art. 38, caput, item XIX, within a maximum period of six months, counted from the event referred to in this paragraph.

........................................................................

§ 7º The processing of data by the institutions that enter into the partnership contract referred to in the caput must last only the time necessary for the purpose of the consent, and the provision of information to the data subject regarding this is mandatory, and, upon its termination, the data must be eliminated, in accordance with the current legislation on personal data protection.

§ 8º Prior to the sharing referred to in the caput, the integrating institution must:

• I - identify the client; and

• II - obtain the client's consent expressly and in relation to each partner entity, observing the provisions of art. 38-A.

§ 9º The consent referred to in item II of § 8º must be given in the environment of the integrating institution.

§ 10. The provisions of the caput apply, including, to the sharing of data between a participating institution and an entity not authorized to operate by the Central Bank of Brazil belonging to the same economic group.

§ 11. The provisions of the caput do not apply to the sharing of data with an entity that acts exclusively as an operator, under the terms of art. 5º, caput, item VII, of Law No. 13.709, of 14 August 2018." (NR)

"Art. 37. The integrating institution, prior to entering into a partnership contract, must adopt procedures that include:

........................................................................

II - the verification of the capacity of the potential partner entity to ensure:

• a) compliance with the legislation and regulations in force, including the technical and operational requirements to be defined by the Central Bank of Brazil for contracting partnerships;

........................................................................

• c) the confidentiality, integrity, availability and recovery of shared data;

• d) adherence to certifications required by the integrating institution for the execution of data sharing, including those established under the terms of art. 44, caput, item I, subitem "b";

• e) the integrating institution's access to reports prepared by an independent auditor, hired by the potential partner entity, relating to the procedures and controls to be used in the sharing and processing of data by the partner entity;

........................................................................

• g) the quality of access controls aimed at protecting shared data.

........................................................................

§ 3º The integrating institution must have the resources and competencies necessary for the management of the partnership and the adequate monitoring of the partner entity, including the analysis of information and the use of the resources provided under the terms of item II, subitem "f", of the caput.

§ 4º The procedures referred to in the caput must include the assessment of the legislation and regulations of the countries and the region in each country to which the client data may be sent, observing the parameters mentioned in art. 36, § 3º, if the contracting includes sharing abroad, as well as the provisions of the current legislation.

§ 5º The verification of the capacity of the partner entity, referred to in item II of the caput, must be attested by an independent auditor registered with the Securities and Exchange Commission of Brazil, in compliance with rules to be defined by the Central Bank of Brazil regarding the required documentation.

§ 6º The independent auditor must have technical, administrative and operational capacity compatible with the performance of the activity provided for in § 5º." (NR)

Art. 38. .............................................................

........................................................................

• III - the indication of the countries and the region in each country to which the client data may be sent;

• IV - the adoption of security measures for the reception and storage by the partner entity of the shared client data;

• V - the integrating institution's access to:

  • a) information provided by the partner entity, aiming to verify compliance with the provisions of items III and IV;

  • b) information relating to the certifications and reports of the independent auditor, cited in art. 37, caput, item II, subitems "d" and "e", and § 5º; and

........................................................................

• VI - the obligation of the partner entity to notify the integrating institution about the subcontracting of services related to sharing, observing the provisions of item XII;

• VII - the permission for the Banco Central do Brasil to access the partnership contracts and the information regarding the shared data, as well as the independent auditor's reports, referred to in item XX and art. 37, caput, item II, subitem "e", and § 5º;

• VIII - the adoption of measures by the integrating institution, as a result of a determination by the Banco Central do Brasil;

.........................................................................

• X - the obligation of the partner entity to keep the integrating institution permanently informed about any limitations that may affect the sharing or the compliance with the legislation and regulations in force;

• XI - the procedures for handling demands forwarded by the client referred to in art. 34;

• XII - the prohibition of sub-delegation of the partnership contract to third parties;

• XIII - the prohibition for the partner entity to enter into contracts, or in any other way establish a business model, for the sharing, with third parties, of data obtained through the partnership contract, including those referred to in art. 36, caput, item II;

• XIV - the procedures for the client's consent for data sharing, observing the provisions of art. 38-A;

• XV - the procedures for consent management by the partner entity, observing the provisions of art. 38-A;

• XVI - the obligation that the partner entity observes, in the processing of client data, the provisions of art. 36, § 7º;

• XVII - the prohibition for the partner entity to adopt measures aimed at reverse engineering or equivalent procedures aimed at reconstructing transactional data of individual or legal entity clients;

• XVIII - the adoption of timely measures by the integrating institution aimed at interrupting the sharing of data with the partner entity as a result of incidents of data security breach or limitations to compliance with the legislation and regulations in force;

• XIX - the adoption of measures in the event of termination of the contractual partnership relationship, with due transparency to clients about the consequences regarding the consents obtained; and

• XX - the verification of the partner entity's capacity, attested by an independent auditor registered with the Comissão de Valores Mobiliários, at a frequency of at least annually, observing the requirement referred to in art. 37, § 6º, as well as rules to be defined by the Banco Central do Brasil regarding the required documentation.

§ 1º ................................................................

• I - the provision of services, by the partner entity, of customer service activities on behalf of the integrating institution, as provided in the regulations on correspondents in the Country; and

........................................................................

• III - data processing and storage and cloud computing, in accordance with specific regulations.

§ 2º The roles and responsibilities mentioned in item II of the caput must include the duty of the partner entity and the integrating institution to inform the client that the partner entity does not act on behalf of the integrating institution, for the purposes of sharing.

§ 3º The obligation referred to in item X of the caput must include the communication of incidents of security breach of shared data and the measures adopted by the partner entity for their prevention and resolution.

§ 4º The contract mentioned in the caput must provide, in the event of the decree of a resolution regime, by the Banco Central do Brasil, of the integrating institution:

• I - the obligation of the partner entity to grant full and unrestricted access to the person responsible for the resolution regime to the partnership contracts and the information mentioned in item VII of the caput that are in the possession of the partner entity.

................................................................" (NR)

"Art. 38-A. The integrating institution must ensure:

• I - the clear identification of the partner entity during the process of obtaining and managing the client's consent; and

• II - the observance, at a minimum, of the rules for obtaining and revoking consent for data sharing defined in arts. 10, 11, 12, 14 and 15.

Sole paragraph. The Banco Central do Brasil may define guidelines and procedures related to the client's consent within the scope of partnership contracts, as well as the information that must be presented to the client during the consent stage." (NR)

"Art. 38-B. The integrating institution must provide information for the monitoring of partnerships in accordance with the minimum form, content and frequency to be defined by the Banco Central do Brasil." (NR)

"Art. 39. The integrating institution is responsible for the reliability, integrity, availability, security, performance and confidentiality of the sharing and of the shared data, as well as for compliance with the legislation and regulations in force.

Sole paragraph. If, after the celebration, the situation prohibited by art. 36, § 5º, item I, occurs, until the partnership contract is terminated, each institution becomes responsible for the technological environment and electronic system made available by it, including the records generated during the execution of the procedures related to consent and data sharing." (NR)

"Section V

Of the Monitoring and Control Mechanisms" (NR)

"Art. 40. The institutions referred to in art. 1º must establish monitoring and control mechanisms with a view to ensuring the reliability, availability, integrity, security, performance and confidentiality referred to in arts. 31 and 39, as well as the implementation and effectiveness of the requirements referred to in this Joint Resolution, including:

........................................................................

• II - the compliance with the monitored items established in the regulation of the Central Bank of Brazil and in the documentation of the convention referred to in art. 44; and

.................................................................." (NR)

"Art. 41. The institution's monitoring and control mechanisms must cover the assessment of the monitored items established in the regulation of the Central Bank of Brazil.

Sole paragraph. The convention referred to in art. 44 may define monitored items complementary to those referred to in the caput, as well as mechanisms for transparency and disclosure of such items to the public." (NR)

Art. 44. .............................................................

.........................................................................

§ 8º The execution of the services by the Open Finance Governance Structure, within the scope of the convention referred to in the caput and under the terms of § 1º, does not remove the responsibility of the institutions participating in Open Finance for complying with their regulatory obligations, nor their duty to monitor and supervise the services provided by the Open Finance Governance Structure. (NR)

"Art. 48-A. The board of directors and the executive board of the institutions referred to in art. 1º must actively engage in the implementation, operation, monitoring and improvement of Open Finance, in order to ensure the achievement of the objectives referred to in art. 3º, observing that:

I - it is incumbent upon the board of directors to:

• a) take note of the report mentioned in art. 33;

• b) establish strategic guidelines for the monitoring and control mechanisms referred to in art. 40;

• c) ensure compliance with the provisions of the regulation relating to Open Finance, including in the convention referred to in art. 44;

• d) ensure that preventive and corrective measures are taken in a timely manner when failures of any nature are identified, including non-conformities in relation to the monitored items; and

• e) provide the necessary means to ensure that activities related to Open Finance are carried out properly, under the terms of this Joint Resolution; and

• II - it is incumbent upon the executive board to ensure the implementation and effectiveness of the monitoring and control mechanisms referred to in art. 40." (NR)

"Art. 48-B. For institutions that do not have a board of directors, the responsibilities, attributions and competencies provided for in this Joint Resolution must be assigned to the institution's executive board. (NR)

"Art. 48-C. The responsibilities, attributions and competencies of the board of directors and the executive board of the institution defined in this Joint Resolution may not be delegated. (NR)

Art. 49. .............................................................

........................................................................

• V - the report referred to in art. 33;

........................................................................

• VII - the procedures and documents relating to the verification of the capacity of the potential partner entity, referred to in art. 37, § 1º;

..................................................................." (NR)

Art. 51. ..............................................................

........................................................................

• IV - the requirement of certifications and other technical requirements to be required of a partner entity, by the integrating institution;

..................................................................." (NR)

"Art. 52. The Central Bank of Brazil may, in a reasoned decision:

• I - veto or impose restrictions on the sharing of data referred to in art. 36, when it finds, at any time, non-compliance with the provisions of this Joint Resolution, establishing a deadline for the adaptation of processes; and

• II - determine the suspension or termination of the partnership contract in cases that affect the security or soundness of the National Financial System or the Brazilian Payment System." (NR)

"Art. 52-A. The institutions referred to in art. 1º that, as of the date of publication of Joint Resolution No. 21, of 22 October 2026, have contracts in force that provide for the sharing of data referred to in art. 36 must submit to the Central Bank of Brazil:

• I - the list of partner entities with which they have contracts in force, by 1 December 2026; and

• II - information regarding the adaptation of existing contracts and consents to compliance with this Joint Resolution, observing the schedule to be defined by the Central Bank of Brazil.

Sole paragraph. The Central Bank of Brazil may define technical requirements for the adaptation mentioned in item II of the caput." (NR)

Art. 2º The following provisions of Joint Resolution No. 1, of 4 May 2020, published in the Official Gazette of the Union of 5 May 2020, are revoked:

• I - from art. 33:

  • a) items I, II, III, IV and V of § 1º; and

  • b) items I and II of § 2º;

• II - § 1º of art. 36;

• III - from art. 37:

  • a) subitem "b" of item II of the caput; and

  • b) § 2º;

• IV - from art. 38:

  • a) item II of § 1º; and

  • b) item II of § 4º; and

• V - art. 53.

Art. 3 This Joint Resolution enters into force on the date of its publication. GABRIEL MURICCA GALÍPOLO President of the Central Bank of Brazil