Normative Instruction BCB No. 121 of July 1, 2021

BNB NORMATIVE INSTRUCTION NO. 121, OF
JULY 1, 2021

Amends the BNB Normative Instructions Nos. 41, of November 5, 2020, and 70, of January 15, 2021.

The Heads of the Department of Competition and Financial Market Structure (Decem), the Department of Strategic Management and Specialized Supervision (Degef), and the Department of Financial System Regulation (Denor), in the exercise of the powers conferred upon them by Art. 23, item I, letter "a", of the Internal Regulations of the Central Bank of Brazil, annexed to Ordinance No. 84,287, of February 27, 2015, based on Arts. 8 of CMN Resolution No. 4,734, of June 27, 2019, and 15-B of Circular No. 3,952, of June 27, 2019,

R E S O L V E:

Art. 1 The BNB Normative Instruction No. 41, of November 5, 2020, shall be amended as follows:

"Art. 12. Financial institutions, acquirers, sub-acquirers, and registering entities that have had their activities suspended from June 7, 2021, in accordance with CMN Resolution No. 4,734, of June 27, 2019, and Circular No. 3,952, of June 27, 2019, must carry out a new cycle of homologatory tests, the regulations for which will be disclosed by the Central Bank of Brazil at the appropriate time." (NR)

Art. 2 The summary of the BNB Normative Instruction No. 70, of January 15, 2021, shall be amended as follows:

"Establishes the regulatory framework for the new cycle of homologatory tests to be observed by financial institutions, acquirers, and sub-acquirers, and registering entities that have had their activities suspended from June 7, 2021, or that intend to begin processing receivables operations of payment arrangements governed by CMN Resolution No. 4,734, of June 27, 2019; and amends BNB Normative Instruction No. 41, of November 5, 2020." (NR)

Art. 3 The BNB Normative Instruction No. 70, of January 15, 2021, shall be amended as follows:

"Art. 1 This Normative Instruction establishes, in consonance with the provisions of Art. 12 of BNB Normative Instruction No. 41, of November 5, 2020, the regulatory framework for the new cycle of homologatory tests to be observed by financial institutions, acquirers, and sub-acquirers, and registering entities that have had their activities suspended, from June 7, 2021, due to the unsuccessful completion of all tests provided for in the integration homologatory test plan until the date established for the declaration of readiness, or that intend to begin processing receivables operations of payment arrangements in accordance with CMN Resolution No. 4,734, of June 27, 2019, and Circular No. 3,952, of June 27, 2019, and amends said Instruction." (NR)

"Art. 2 The financial institutions, acquirers, and sub-acquirers mentioned in Art. 1 must successfully complete the set of tests defined by the registering entity with which they have a contractual relationship.

§ 1 The set of tests to be defined by the registering entity must be sufficient to:

I - ensure that the institutions' systems are suitable for the correct and secure execution of operations involving receivables of payment arrangements integrated into the Brazilian Payments System and to validate adequate compliance with current regulations; and

II - validate functional and non-functional requirements according to premises, guidelines, and definitions established in the convention of registering entities referred to in Chapter V of Circular No. 3,952, of 2019.

§ 2 Financial institutions and acquirers must keep available to the Central Bank of Brazil for a period of five years, starting from the date of closure of the tests mentioned in the main text, the documentation regarding the results of the tests they carried out.

§ 3 Registering entities must keep available to the Central Bank of Brazil for a period of five years, starting from the date of closure of the tests mentioned in the main text, the documentation regarding the results of the tests carried out by sub-acquiring institutions." (NR)

"Art. 3 The registering entities referred to in Art. 1 must submit a declaration of readiness to begin processing receivables operations of payment arrangements in accordance with Circular No. 3,952, of 2019.

§ 1 The declaration of readiness provided for in the main text must consider:

I - the successful completion of interoperability homologatory tests, as defined in item II of Art. 2 of BNB Normative Instruction No. 41, of 2020, established in the integration homologatory test plan proposed by the registering entities signatories of the convention referred to in Chapter V of Circular No. 3,952, of 2019;

II - the successful simulation of the start of production operation, with the objective of validating the configuration and sizing of the computational environment of its registration system, including connectivity with other registering entities and with the other companies involved in the operationalization of the interoperability environment; and

III - the establishment of adequate controls and processes for compliance with the operational procedures provided for in the convention, including the coordination of activities with other registering entities in opening and closing operation schedules, as well as in data processing that precedes or follows these schedules.

§ 2 The declaration of readiness provided for in the main text must be accompanied by a report containing the results of all tests carried out to validate the registration system and an internal audit report on:

I - the ability of the registration system's computational environment to meet the requirements established in current regulation; and

II - the effectiveness of actions taken to mitigate any weaknesses identified in vulnerability tests carried out on their systems to prevent cyber incidents.

§ 3 Registering entities signatories of the convention that are already operating in accordance with the provisions of current regulation must make available the computational environment and other resources necessary to enable the carrying out of the tests and simulations treated in §1.

§ 4 The making available of the computational environment and other resources necessary to enable the carrying out of the tests described in the main text must occur within 10 days after the formalization of the request to carry out interoperability tests by the registering entity that intends to begin carrying out the operations provided for in the main text.

§ 5 The set of interoperability homologatory tests proposed by the registering entities signatories of the convention must be continuously improved, through justification, in order to include test scenarios whose execution is necessary to ensure the proper functioning of the interoperability environment." (NR)

"Art. 4 The tests provided for in Arts. 2 and 3 may be carried out from:

I - August 9, 2021, in the case of financial institutions, acquirers, and sub-acquirers; and

II - August 30, 2021, in the case of registering entities." (NR)

"Art. 4-A The registering entities referred to in Chapter V of Circular No. 3,952, of 2019, must send to the Central Bank of Brazil, by August 2, 2021, the premises, guidelines, and definitions for validation of functional and non-functional requirements to be considered for the definition of the set of tests provided for in Art. 2, as well as regarding the items to be considered in the declaration of readiness, in accordance with §1 of Art. 3." (NR)

Art. 4 This Normative Instruction enters into force on the date of its publication.

Ângelo
José Mont Alverne Duarte Adalberto
Felinto da Cruz Junior
Head of Decem Head of Degef

João André
Calvino Marques Pereira
Head of Denor