Normative Instruction BCB No. 374 of April 26, 2023

Resolution No. 222

NORMATIVE INSTRUCTION BCB No. 374, OF APRIL 26 OF 2023

Publishes procedures, deadlines, documents and information necessary for the instruction of authorization requests related to the operation of Financial Market Systems (SMF) within the scope of the Brazilian Payments System (SPB), and the types of changes in SMFs and their regulations that represent relevant risk to their security, their efficiency or their solidity and to the normal operation of the SPB or the National Financial System (SFN).

The heads of the Departments of Financial System Organization (Deorf) and of Banking Operations and Payment Systems (Deban), in the use of the attributions conferred upon them by arts. 23, item I, letter “a”, 96, item XII, and 111, item II, letter “a”, of the Internal Regulations of the Central Bank of Brazil, annexed to Ordinance No. 84.287, of February 27, 2015, based on arts. 4º, § 1º, and 6º of BCB Resolution No. 304, of March 20, 2023,

R E S O L V E:

CHAPTER I
OF THE OBJECT AND SCOPE OF APPLICATION

Art. 1º The procedures, documents, deadlines and information necessary for the instruction of authorization requests related to the operation of Financial Market Systems (SMF) within the scope of the Brazilian Payments System (SPB), and the types of changes in SMFs and their regulations that represent relevant risk to their security, their efficiency or their solidity and to the normal operation of the SPB or the National Financial System (SFN) are hereby published.

CHAPTER II
INSTRUCTION OF THE PROCESSES

Section I
General Provisions

Art.
2º The authorization requests referred to in this Normative Instruction shall be filed with the Central Bank of Brazil, addressed to the Department of Financial System Organization (Deorf), in accordance with current regulation, accompanied by the relevant documents and information.

§ 1º Excluded from the provision of the caput are authorizations related to changes in SMFs and their regulations provided for in art. 21, whose requests shall be filed in accordance with §1º of said article.

§ 2º For the purposes of instruction of the requests referred to in the caput, independence of the qualified independent company hired to carry out the assessments provided for in arts. 7º, Item VI, 8º, Item V, 9º, Item VI, 10, Item V, 11, Item IV, and 12, Item V, is understood as the non-existence of:

§ 2º For the purposes of instruction of the requests referred to in the caput, independence of the qualified independent company hired to carry out the assessments provided for in arts. 7º, item VII, 8º, item V, 9º, item VII, 10, item V, 11, item IV, and 12, item V, is understood as the non-existence of: (Amended, as of 8/1/2024, by Normative Instruction BCB No. 448, of 4/1/2024.)

~~I - direct or indirect participations of the hiring company in the share capital of the hired company and vice-versa in a percentage that exceeds 15% (fifteen percent) of the society's net worth; and~~

I - direct or indirect participations of the hiring company in the share capital of the hired company, or of the hired company in the hiring company, in a percentage that exceeds 15% (fifteen percent) of the society's net worth; and (Amended by Normative Instruction BCB No. 596, of 24/3/2025.)

~~II - link between member of statutory body of the requesting institution and the hired company.~~

~~II - link between member of statutory body of the requesting institution and the hired company and vice-versa.~~ ~~(Amended, as of 8/1/2024, by Normative Instruction BCB No. 448, of 4/1/2024.)~~

II - link between member of statutory body of the requesting institution and the hired company or link between member of statutory body of the hired company and the requesting entity. (Amended by Normative Instruction BCB No. 596, of 24/3/2025.)

Art. 3º Financial Market System Operating Institutions (IOSMFs) must include in the Information System on Entities of Interest of the Central Bank (Unicad) the information necessary for the instruction of processes.

Art. 4º The document models provided for in this Normative Instruction are available in the Financial System Organization Manual (Sisorf), accessible through the Central Bank of Brazil's internet page.

Section II
Authorization for Operation of a Settlement System

Subsection I
Phase 1

Art.
5º In Phase 1, of Proposal Analysis, the authorization request for operation must be instructed with the following documents and information:

I - request, in the form of model Sisorf 8.24.10.1;

II - business plan, in accordance with the provisions of Annex I, containing the description of the business and evidence that the IOSMF has adequate and sufficient organizational, technical, operational and financial capacity and structure to support all activities it intends to exercise;

III - bylaws or articles of association of the IOSMF;

IV - declarations signed by the IOSMF regarding:

a) its administrators and other members of statutory or contractual bodies, regarding their technical competence and compliance with the other conditions provided for in BCB Resolution No. 304, of 2023, in the form of model Sisorf 8.24.20.1;

b) the policies provided for in BCB Resolution No. 304, of 2023, in the form of model Sisorf 8.24.20.2;

c) the internal regulations provided for in BCB Resolution No. 304, of 2023, in the form of model Sisorf 8.24.20.3;

d) the outsourcing of relevant services, in the form of model Sisorf 8.24.20.4;

e) the preparation of reports provided for in BCB Resolution No. 304, of 2023, in the form of model Sisorf 8.24.20.5;

~~V - draft of the settlement system regulation, as provided for in Chapter II of Title V of the Regulation Annexed to BCB Resolution No. 304, of 2023;~~

V - draft of the settlement system regulation, as provided for in Chapter II of Title V of the Regulation Annexed to BCB Resolution No. 304, of 2023, except for documents that exclusively regulate the aspects provided for: (Amended, as of 8/1/2024, by Normative Instruction BCB No. 448, of 4/1/2024.)

a) in items III, XVI and XVIII of art. 102; and (Included, as of 8/1/2024, by Normative Instruction BCB No. 448, of 4/1/2024.)

b) in item XV of art. 102 regarding non-financial risks; (Included, as of 8/1/2024, by Normative Instruction BCB No. 448, of 4/1/2024.)

VI - flowchart(s) that represent(s), both summarized and in detail, the expected settlement process; and

VII - documents and information regarding the contracting of relevant processing, data storage and cloud computing services provided abroad, in accordance with the provisions of Annex IV, when involving contracting of relevant processing, data storage and cloud computing services provided abroad, in cases of non-existence of an agreement for exchange of information between the Central Bank of Brazil and the supervisory authorities of the countries where the services will be provided, as provided for in § 1º of art. 71 of BCB Resolution No. 304, of 2023.

VIII - the recovery plan, with the identification of scenarios that may prevent the IOSMF from executing its critical activities and recovery strategies, highlighting aspects related to the rules to be complied with by participants and including loss allocation and the need for financial resource injection, when applicable. (Included, as of 8/1/2024, by Normative Instruction BCB No. 448, of 4/1/2024.)

Sole paragraph. In cases where the request referred to in the caput has as the applicant an institution that already holds authorization from the Central Bank of Brazil to operate an SMF: (Included, as of 8/1/2024, by Normative Instruction BCB No. 448, of 4/1/2024.)

I - for items II and III of the caput, only the information that needs to be prepared or altered solely to support the request in question must be presented; (Included, as of 8/1/2024, by Normative Instruction BCB No. 448, of 4/1/2024.)

II - for item IV of the caput, only the declarations associated with information that needs to be prepared or altered solely to support the request in question must be presented; and (Included, as of 8/1/2024, by Normative Instruction BCB No. 448, of 4/1/2024.)

III - for item VII of the caput, only the documents or information that need to be prepared or altered solely to support the request in question must be presented. (Included, as of 8/1/2024, by Normative Instruction BCB No. 448, of 4/1/2024.)

Subsection II
Phase 2

Art.
6º In Phase 2, of Proposal Implementation Analysis, the authorization request must be instructed, within a period of 240 (two hundred and forty) days counted from the favorable manifestation of the Central Bank of Brazil regarding the proposal referred to in art. 5º, with the following documents and information:

I - request, in the form of model Sisorf 8.24.10.2;

II - readiness declaration, in the form of model Sisorf 8.24.20.6, accompanied by, at minimum:

a) report of business continuity tests, to be prepared or ensured by Internal Audit, respecting the provisions of Section V of Chapter VI of Title IV and Chapter I of Title V of the Regulation Annexed to BCB Resolution No. 304, of 2023;

b) report that evidences the availability, capacity and performance of the settlement system, to be prepared or ensured by Internal Audit, respecting the provisions of Section V and Section VI of Chapter VI of Title IV and Chapter I of Title V of the Regulation Annexed to BCB Resolution No. 304, of 2023;

c) cyber security test report, to be prepared or ensured by Internal Audit, respecting the provisions of Section VII of Chapter VI of Title IV of the Regulation annexed to BCB Resolution No. 304, of 2023;

d) list of active system change demands (evolutionary and corrective maintenance and similar), as well as list with the backlog of defects identified during the performance of tests of the systems that will support the activity exercised; and

e) images or videos of the facilities to be used in the operation of the entity, in particular, monitoring rooms for information technology operation and information and cyber security;

III - production implementation plan, encompassing description of the strategy for system implementation (preliminary procedures, change to production environment, rollback forecast, support to participants, etc.);

IV - functional test schedule, with forecast of scenarios that consider the perspective of both the settlement system and its participants and that significantly represent the main processes of the settlement system; and

V - proof of compliance with the net worth provided for in the business plan, through the presentation of:

a) proof of capital social integration, in the case of a company constituted in the last 12 months (considering the date of the request of art. 5º, I);

b) copy of the accounting statements of the last three fiscal years of the IOSMF, audited by an independent auditor, in the case of a company already in activity; and

c) updated balance sheet of the IOSMF, signed by the accountant.

~~Sole paragraph. The period referred to in the caput may be extended, at the discretion of the Central Bank of Brazil, upon justified request by the interested party.~~

§ 1º The period referred to in the caput may be extended, at the discretion of the Central Bank of Brazil, upon justified request by the interested party. (Transformed into § 1º by Normative Instruction BCB No. 596, of 24/3/2025.)

§ 2º The Central Bank may dispense with the presentation of one or more documents provided for in Phase 2 when there is sufficient evidence, by other means or documents presented, of compliance with the requirements for authorization. (Included by Normative Instruction BCB No. 596, of 24/3/2025.)

Section III
Authorization for the Exercise of the Activity of Centralized Deposit of Financial Assets

Subsection I
Phase 1

Art.
7º In Phase 1, of Proposal Analysis, the authorization request for the exercise of the activity of centralized deposit of financial assets must be instructed with the following documents and information:

I - request, in the form of model Sisorf 8.24.10.1;

III - bylaws or articles of association of the IOSMF;

IV - declarations signed by the institution regarding:

b) the policies provided for in BCB Resolution No. 304, of 2023, in the form of model Sisorf 8.24.20.2;

c) the internal regulations provided for in BCB Resolution No. 304, of 2023, in the form of model Sisorf 8.24.20.3;

d) the outsourcing of relevant services, in the form of model Sisorf 8.24.20.4; and

e) the preparation of reports provided for in BCB Resolution No. 304, of 2023, in the form of model Sisorf 8.24.20.5;

~~V - draft of the centralized deposit system regulation, as provided for in Chapter II, of Title V of the Regulation Annexed to BCB Resolution No. 304, of 2023;~~

V - draft of the centralized deposit system regulation, as provided for in Chapter II, of Title V of the Regulation Annexed to BCB Resolution No. 304, of 2023, except for documents that exclusively regulate the aspects provided for in items III, XV, XVI and XVIII of art. 102, and in item III of art. 104; (Amended, as of 8/1/2024, by Normative Instruction BCB No. 448, of 4/1/2024.)

VI - flowchart(s) that represent(s), both summarized and in detail, the expected centralized deposit process;

VII - assessment, to be carried out by a qualified independent company, in accordance with the provisions of Annex II, which ensures the conformity of the regulation referred to in item V of the caput with the regulation applicable to the exercise of the activity of centralized deposit of financial assets and with the regulation applicable to the financial assets that will be eligible for centralized deposit by the system~~~~; and

VII - assessment, carried out by a qualified independent company, in accordance with the provisions of
Annex II, which ensures the conformity of the regulation referred to in item V of the
caput with the regulation applicable to the exercise of the activity of centralized deposit of financial assets and with the regulation applicable to the financial assets that will be eligible for centralized deposit by the system, as well as with the Convention referred to in Chapter VII of BCB Resolution No. 339, of 2023, in the case of requests involving book-entry promissory notes; and (Amended by Normative Instruction BCB No. 596, of 24/3/2025.)

VIII - documents and information regarding the contracting of relevant processing, data storage and cloud computing services provided abroad, in accordance with the provisions of Annex IV, when involving contracting of relevant processing, data storage and cloud computing services provided abroad, in cases of non-existence of an agreement for exchange of information between the Central Bank of Brazil and the supervisory authorities of the countries where the services will be provided, as provided for in § 1º of art. 71 of BCB Resolution No. 304, of 2023.

III - for item VIII of the caput, only the documents or information that need to be prepared or altered solely to support the request in question must be presented. (Included, as of 8/1/2024, by Normative Instruction BCB No. 448, of 4/1/2024.)

Subsection
II
Phase 2

Art. 8º In Phase 2, of
Proposal Implementation Analysis, the authorization request must be instructed, within a period of 180 (one hundred and eighty) days counted from the favorable manifestation of the Central Bank of Brazil regarding the proposal referred to in art. 7º, with the following documents and information:

I - request, in the form of model Sisorf 8.24.10.2;

II - readiness declaration, in the form of model Sisorf 8.24.20.7, accompanied by, at minimum:

b) report that evidences the availability, capacity and performance of the centralized deposit system, to be prepared or ensured by Internal Audit, respecting the provisions of Section V and Section VI of Chapter VI of Title IV and Chapter I of Title V of the Regulation annexed to BCB Resolution No. 304, of 2023;

e) images or videos of the facilities to be used in the operation of the entity, in particular, monitoring rooms for information technology operation and information and cyber security; and

f) test reports that prove the capacity of the interested party to duly provide information to the Central Bank of Brazil, in accordance with the terms agreed with the Department of Financial System Monitoring (Desig), if applicable;

IV - functional test schedule, with forecast of scenarios that consider the perspective of both the centralized deposit system of financial assets and its participants and that significantly represent the main processes of the centralized deposit system of financial assets;

V - assessment, to be carried out by a qualified independent company, in accordance with the provisions of Annex III, which ensures operational and functional aptitude regarding the adequate level of security and reliability of the implemented operational infrastructure and the adherence of the implemented system to its regulation; and

V - evaluation, carried out by a qualified independent company, in accordance with the provisions of Annex III, which ensures operational and functional fitness regarding the adequate level of security and reliability of the implemented operational infrastructure and the adherence of the implemented system to its regulations; and (Wording given by Instruction Normative BCB No. 596, of 3/24/2025.)

VI - proof of compliance with the minimum net worth limit, according to the amount set forth in the business plan, through the presentation of:

a) proof of capital social integration, in the case of a company constituted in the last 12 months (considering the date of the request under art. 7, I);

b) copy of the accounting statements of the last three fiscal years of the IOSMF, audited by an independent auditor, in the case of an already active company; and

c) updated balance sheet of the IOSMF, signed by the accountant.

~~Sole Paragraph. The deadline referred to in the caput may be extended, at the discretion of the Central Bank of Brazil, upon justified request by the interested party.~~

§ 1º The deadline referred to in the caput may be extended, at the discretion of the Central Bank of Brazil, upon justified request by the interested party. (Transformed into § 1º by Instruction Normative BCB No. 596, of 3/24/2025.)

§ 2º The Central Bank may waive the presentation of one or more documents provided for in Phase 2 when there is sufficient evidence of compliance with the authorization requirements. (Included by Instruction Normative BCB No. 596, of 3/24/2025.)

§ 3º In requests involving book-entry promissory notes, the document provided for in item V of the caput must be replaced by the declaration of success in the homologation tests referred to in Chapter VIII of Resolution BCB No. 339, of 2023, in the form of model Sisorf 8.24.20.10. (Included by Instruction Normative BCB No. 596, of 3/24/2025.)

Section IV Authorization for the Exercise of the Activity of Registration of Financial Assets

Subsection I Phase 1

Art. 9º In Phase 1, of Proposal Analysis, the authorization request for the exercise of the activity of registration of financial assets must be accompanied by the following documents and information:

I - request, in the form of model Sisorf 8.24.10.1;

II - business plan, in accordance with the provisions of Annex I, containing the description of the business and evidence that the IOSMF has adequate and sufficient organizational, technical, operational, and financial capacity and structure to support all activities it performs;

III - bylaws or articles of association of the IOSMF;

IV - declarations signed by the institution regarding:

a) its administrators and other members of statutory or contractual bodies, regarding their technical competence and compliance with the other conditions provided for in Resolution BCB No. 304, of 2023, in the form of model Sisorf 8.24.20.1;

b) the policies provided for in Resolution BCB No. 304, of 2023, in the form of model Sisorf 8.24.20.2;

c) the internal regulations provided for in Resolution BCB No. 304, of 2023, in the form of model Sisorf 8.24.20.3;

d) the outsourcing of relevant services, in the form of model Sisorf 8.24.20.4; and

e) the preparation of reports provided for in Resolution BCB No. 304, of 2023, in the form of model Sisorf 8.24.20.5;

~~V - draft of the registration system regulations, as provided for in Chapter II, of Title V of the Regulation Annex to Resolution BCB No. 304, of 2023;~~

V - draft of the registration system regulations, as provided for in Chapter II, of Title V of the Regulation Annex to Resolution BCB No. 304, of 2023, except for the documents that regulate exclusively the aspects provided for in items III, XV, XVI, and XVIII of art. 102; (Wording given, from 1/8/2024, by Instruction Normative BCB No. 448, of 1/4/2024.)

VI - flowchart(s) that represent, both summarily and in detail, the expected registration process;

VII - evaluation, to be carried out by a qualified independent company, in accordance with the provisions of Annex II, which ensures the compliance of the regulations referred to in item V of the caput with the regulations applicable to the exercise of the activity of registration of financial assets and with the regulations applicable to the financial assets that will be eligible for registration by the system; and

VII - evaluation, carried out by a qualified independent company, in accordance with the provisions of Annex II, which ensures the compliance of the regulations referred to in item V of the caput with the regulations applicable to the exercise of the activity of registration of financial assets and with the regulations applicable to the financial assets that will be eligible for registration by the system, as well as with the Convention referred to in Chapter VII of Resolution BCB No. 339, of 2023, in the case of requests involving book-entry promissory notes; and (Wording given by Instruction Normative BCB No. 596, of 3/24/2025.)

VIII - documents and information regarding the contracting of relevant services of processing, data storage, and cloud computing provided abroad, in accordance with the provisions of Annex IV, when involving the contracting of relevant services of processing, data storage, and cloud computing provided abroad, in cases of non-existence of an agreement for the exchange of information between the Central Bank of Brazil and the supervisory authorities of the countries where the services will be provided, as provided for in § 1º of art. 71 of Resolution BCB No. 304, of 2023.

Sole Paragraph. In cases where the request referred to in the caput has as the applicant an institution that already holds authorization from the Central Bank of Brazil to operate an SMF: (Included, from 1/8/2024, by Instruction Normative BCB No. 448, of 1/4/2024.)

I - for items II and III of the caput, only the information that needs to be elaborated or altered solely to support the request in question must be presented; (Included, from 1/8/2024, by Instruction Normative BCB No. 448, of 1/4/2024.)

II - for item IV of the caput, only the declarations associated with information that needs to be elaborated or altered solely to support the request in question must be presented; and (Included, from 1/8/2024, by Instruction Normative BCB No. 448, of 1/4/2024.)

III - for item VIII of the caput, only the documents or information that need to be elaborated or altered solely to support the request in question must be presented. (Included, from 1/8/2024, by Instruction Normative BCB No. 448, of 1/4/2024.)

Subsection II Phase 2

Art. 10. In Phase 2, of Proposal Implementation Analysis, the authorization request must be accompanied, within a period of 180 (one hundred and eighty) days counted from the favorable manifestation of the Central Bank of Brazil regarding the proposal referred to in art. 9, with the following documents and information:

I - request, in the form of model Sisorf 8.24.10.2;

II - readiness declaration, in the form of model Sisorf 8.24.20.7, accompanied by, at minimum:

a) report of business continuity tests, to be elaborated or ensured by Internal Audit, respecting the provisions in Section V of Chapter VI of Title IV and in Chapter I of Title V of the Regulation Annex to Resolution BCB No. 304, of 2023;

b) report that evidences the availability, capacity, and performance of the registration system, to be elaborated or ensured by Internal Audit, respecting the provisions in Section V and Section VI of Chapter VI of Title IV and in Chapter I of Title V of the Regulation Annex to Resolution BCB No. 304, of 2023;

c) report of cybersecurity tests, to be elaborated or ensured by Internal Audit, respecting the provisions in Section VII of Chapter VI of Title IV of the Regulation Annex to Resolution BCB No. 304, of 2023;

d) list of active system change demands (evolutionary and corrective maintenance and the like), as well as a list with the backlog of defects identified during the performance of tests of the systems that will support the activity performed;

e) images or videos of the facilities to be used in the operation of the entity, especially monitoring rooms for information technology and cybersecurity operations; and

III - production implementation plan, encompassing a description of the strategy for the implementation of the systems (preliminary procedures, change to production environment, rollback forecast, support to participants, etc.);

IV - functional test roadmap, with forecast of scenarios that consider the perspective of both the financial asset registration system and its participants and that significantly represent the main processes of the financial asset registration system;

V - evaluation, to be carried out by a qualified independent company, in accordance with the provisions of Annex III, which ensures operational and functional fitness regarding the adequate level of security and reliability of the implemented operational infrastructure and the adherence of the implemented system to its regulations; and

VI - proof of compliance with the minimum net worth limit, according to the amount set forth in the business plan, through the presentation of:

a) proof of capital social integration, in the case of a company constituted in the last 12 months (considering the date of the request under art. 9, I);

b) copy of the accounting statements of the last three fiscal years of the IOSMF, audited by an independent auditor, in the case of an already active company; and

c) updated balance sheet of the IOSMF, signed by the accountant.

~~Sole Paragraph. The deadline referred to in the caput may be extended, at the discretion of the Central Bank of Brazil, upon justified request by the interested party.~~

Section V Authorization for Inclusion of Financial Asset in the List of Financial Assets Subject to Central Depository or Registration

Subsection I Phase 1

Art. 11. In Phase 1, of Proposal Analysis, the authorization request for alterations in the regulations that provide for the inclusion of financial assets in the list of financial assets subject to central depository or registration within the scope of central depository or registration systems, respectively, must be accompanied by the following documents and information:

I - request, in the form of model Sisorf 8.24.10.3;

II - explanatory document that encompasses the main aspects related to the intended alteration, containing, at minimum:

a) Marketing Plan, in accordance with the provisions of Item II of art. 1º of Annex I;

b) listing of all IOSMF documents that must be altered due to the authorization request, followed by a brief summary of the alterations;

~~c) for each intended alteration classified by the IOSMF as strategic for the authorization request, excerpt of the document containing this alteration and indication of the document name;~~

c) for each intended alteration classified by the IOSMF as strategic for the authorization request, excerpt of the document containing this alteration and indication of the document name, except for the documents referred to in item III; (Wording given, from 1/8/2024, by Instruction Normative BCB No. 448, of 1/4/2024.)

d) evaluation, to be elaborated by the second line of defense, of the risks associated with the alterations resulting from the authorization request, encompassing controls and contingencies established or intended to be established for each of the mapped risks; and

e) expected schedule, focusing on the planned stages and the execution time of these;

~~III - draft,~~ ~~with~~ ~~indication of the altered sections, of the new regulations of the central depository or registration system, as provided for in Chapter II of Title V of the Regulation Annex to Resolution BCB~~ ~~n~~~~º 304, of 2023; and~~

III - draft, with indication of the altered sections, of the new regulations of the central depository or registration system, as provided for in Chapter II of Title V of the Regulation Annex to Resolution BCB No. 304, of 2023, except for the documents that regulate exclusively the aspects provided for in items III, XV, XVI, and XVIII of art. 102; and (Wording given, from 1/8/2024, by Instruction Normative BCB No. 448, of 1/4/2024.)

IV - evaluation, to be carried out by a qualified independent company, in accordance with the provisions of Annex II, which ensures the compliance of the system regulations referred to in item III with the regulations applicable to the exercise of the activity of registration or central depository of financial assets, as the case may be, and with the regulations applicable to the financial asset to be included in the list of assets eligible for registration or central depository by the system.

IV - evaluation, carried out by a qualified independent company, in accordance with the provisions of Annex II, which ensures the compliance of the system regulations referred to in item III with the regulations applicable to the exercise of the activity of registration or central depository of financial assets, as the case may be, and with the regulations applicable to the financial asset to be included in the list of assets eligible for registration or central depository by the system, as well as with the Convention referred to in Chapter VII of Resolution BCB No. 339, of 2023, in the case of requests involving book-entry promissory notes. (Wording given by Instruction Normative BCB No. 596, of 3/24/2025.)

Subsection II Phase 2

Art. 12. In Phase 2, of Proposal Implementation Analysis, the authorization request must be accompanied, within a period of 180 (one hundred and eighty) days counted from the favorable manifestation of the Central Bank of Brazil regarding the proposal referred to in art. 11, with the following documents and information:

I - request, in the form of model Sisorf 8.24.10.4;

II - readiness declaration, in the form of model Sisorf 8.24.20.8, accompanied by, at minimum:

a) report of business continuity tests, to be elaborated or ensured by Internal Audit, respecting the provisions in Section V and Section VI of Chapter V of Title IV and in Chapter I of Title V of the Regulation Annex to Resolution BCB No. 304, of 2023;

b) report that evidences the availability, capacity, and performance of the central depository or registration system, to be elaborated or ensured by Internal Audit, respecting the provisions in Section V and Section VI of Chapter V of Title IV and in Chapter I of Title V of the Regulation Annex to Resolution BCB No. 304, of 2023;

IV - functional test roadmap, with forecast of scenarios that consider the perspective of both the financial asset registration or central depository system and its participants and that significantly represent the main processes of the system; and

V - evaluation, carried out by a qualified independent company, in accordance with the provisions of Annex III, which ensures operational and functional fitness regarding the adequate level of security and reliability of the implemented operational infrastructure and the adherence of the implemented system to its regulations. (Wording given by Instruction Normative BCB No. 596, of 3/24/2025.)

~~Sole Paragraph. The deadline referred to in the caput may be extended, at the discretion of the Central Bank of Brazil, upon justified request by the interested party.~~

Section VI Authorization for Exclusion of Financial Asset from the List of Financial Assets Subject to Central Depository or Registration

Subsection I Phase 1

Art. 13. In Phase 1, of Proposal Analysis, the authorization request for alterations in the regulations that provide for the exclusion of financial assets from the list of financial assets subject to central depository or registration within the scope of central depository or registration systems, respectively, must be accompanied by the following documents and information:

I - request, in the form of model Sisorf 8.24.10.5;

II - justified justification, which must highlight the strategic, corporate, and economic-financial aspects that underlie the decision of the IOSMF;

III - proof that the IOSMF notified its participants, through its website and other available means, regarding the intention to file the request referred to in this article, with a minimum advance of 30 (thirty) days from the date of said request, as provided for in § 4º of art. 10 of Resolution BCB No. 304, of 2023;

IV - plan for closing or transfer of activities, respecting the provisions of art. 10 of the Regulation Annex to Resolution BCB No. 304, of 2023, containing, at minimum, the planned actions and schedule; and

V - declaration of responsibility, in the form of model Sisorf 8.24.20.9.

Subsection II Phase 2

Art. 14. In Phase 2, of Proposal Implementation Analysis, the authorization request must be accompanied, within a period of 180 (one hundred and eighty) days counted from the favorable manifestation of the Central Bank of Brazil regarding the proposal referred to in art. 13, with the following documents and information:

I - application, in the format of Sisorf model 8.24.10.6; and

II - documents that prove the completion of the wind-down or transfer plan for the activities referred to in item IV of Article 13.

~~Single Paragraph. The deadline referred to in the main text may be extended, at the discretion of the Central Bank of Brazil, upon justified request by the interested party.~~

§ 1º The deadline referred to in the main text may be extended, at the discretion of the Central Bank of Brazil, upon justified request by the interested party. (Transformed into § 1º by Instruction Normative BCB No. 596, of 3/24/2025.)

§ 2º The Central Bank may waive the presentation of one or more documents required for Phase 2 when there is sufficient evidence of compliance with the authorization requirements. (Included by Instruction Normative BCB No. 596, of 3/24/2025.)

Section VII
Cancellation of Authorization for Operation of a Clearing System

Subsection I
Phase 1

Article 15. In Phase 1, of the Proposal Analysis, the request for cancellation of the authorization for operation of a clearing system must be accompanied by the following documents and information:

I - application, in the format of Sisorf model 8.24.10.5;

II - reasoned justification, which must highlight the strategic, corporate, and economic-financial aspects that underpin the decision of the IOSMF;

III - proof that the IOSMF notified its participants, through its website and other available means, regarding the intention to file the request referred to in this article, with a minimum advance notice of 30 (thirty) days from the date of said request, as provided in § 4º of Article 10 of Resolution BCB No. 304, of 2023;

IV - wind-down or transfer plan for the activities, respecting the provisions of Article 10 of the Regulation annexed to Resolution BCB No. 304, of 2023, containing, at a minimum, the planned actions and schedule; and

V - statement of responsibility, in the format of Sisorf model 8.24.20.9.

Subsection II
Phase 2

Article 16. In Phase 2, of the Proposal Implementation Analysis, the authorization request must be accompanied, within a period of 180 (one hundred and eighty) days counted from the favorable manifestation of the Central Bank of Brazil regarding the proposal referred to in Article 15, by the following documents and information:

I - application, in the format of Sisorf model 8.24.10.6; and

II - documents that prove the completion of the wind-down or transfer plan for the activities referred to in Item IV of Article 15.

~~Single Paragraph. The deadline referred to in the main text may be extended, at the discretion of the Central Bank of Brazil, upon justified request by the interested party.~~

Section VIII
Cancellation of Authorization for Exercise of Centralized Deposit of Financial Assets Activities

Subsection I
Phase 1

Article 17. In Phase 1, of the Proposal Analysis, the request for cancellation of the authorization for exercise of centralized deposit or financial asset registration activities must be accompanied by the following documents and information:

I - application, in the format of Sisorf model 8.24.10.5;

II - reasoned justification, which must highlight the strategic, corporate, and economic-financial aspects that underpin the decision of the IOSMF;

III - proof that the IOSMF notified its participants, through its website and other available means, regarding the intention to file the request referred to in this article, with a minimum advance notice of 30 (thirty) days from the date of said request, as provided in § 4º of Article 10 of Resolution BCB No. 304, of 2023;

V - statement of responsibility, in the format of Sisorf model 8.24.20.9.

Subsection II
Phase 2

Article 18. In Phase 2, of the Proposal Implementation Analysis, the authorization request must be accompanied, within a period of 180 (one hundred and eighty) days counted from the favorable manifestation of the Central Bank of Brazil regarding the proposal referred to in Article 17, by the following documents and information:

I - application, in the format of Sisorf model 8.24.10.6; and

II - documents that prove the completion of the plan referred to in Item III of Article 17.

~~Single Paragraph. The deadline referred to in the main text may be extended, at the discretion of the Central Bank of Brazil, upon justified request by the interested party.~~

Section IX
Cancellation of Authorization for Exercise of Financial Asset Registration Activities

Subsection I
Phase 1

Article 19. In Phase 1, of the Proposal Analysis, the request for cancellation of the authorization for exercise of centralized deposit or financial asset registration activities must be accompanied by the following documents and information:

I - application, in the format of Sisorf model 8.24.10.5;

II - reasoned justification, which must highlight the strategic, corporate, and economic-financial aspects that underpin the decision of the IOSMF;

III - proof that the IOSMF notified its participants, through its website and other available means, regarding the intention to file the request referred to in this article, with a minimum advance notice of 30 (thirty) days from the date of said request, as provided in § 4º of Article 10 of Resolution BCB No. 304, of 2023;

V - statement of responsibility, in the format of Sisorf model 8.24.20.9.

Subsection II
Phase 2

Article 20. In Phase 2, of the Proposal Implementation Analysis, the authorization request must be accompanied, within a period of 180 (one hundred and eighty) days counted from the favorable manifestation of the Central Bank of Brazil regarding the proposal referred to in Article 19, by the following documents and information:

I - application, in the format of Sisorf model 8.24.10.6; and

II - documents that prove the completion of the wind-down or transfer plan for the activities referred to in Item IV of Article 19.

~~Single Paragraph. The deadline referred to in the main text may be extended, at the discretion of the Central Bank of Brazil, upon justified request by the interested party.~~

Section X
Changes to SMF and their Regulations

Subsection I
Changes that Represent Risk

Article 21. Changes to SMF and their regulations regarding the following are considered to represent relevant risk to the safety, efficiency, or solidity and normal functioning of the Brazilian Payments System (SPB) or the National Financial System (SFN), in accordance with Article 4º, §1º, of the Regulation annexed to Resolution BCB No. 304, of 2023, and must therefore be submitted for prior authorization:

I - new interconnections between SMF, operated or not by the same IOSMF;

II - new connections of the SMF with stock exchanges or with organized over-the-counter markets;

III - the contracting of relevant processing, data storage, and cloud computing services provided abroad, in cases where there is no agreement for the exchange of information between the Central Bank of Brazil and the supervisory authorities of the countries where the services will be provided, as provided in § 1º of Article 71 of Resolution BCB No. 304, of 2023;

IV - materially significant changes to the aspects of the regulations of clearing systems referred to in items I, VI, VII, X, XI, XII, XIV, XV, and XVII of Article 102 of the Regulation annexed to Resolution BCB No. 304, of 2023;

V - materially significant changes to the aspects of the regulations of clearing systems listed in items I to XI of Article 103 of the Regulation annexed to Resolution BCB No. 304, of 2023;

VI - extension of the authorized settlement periods, respecting the provisions of Article 115 of the Regulation annexed to Resolution BCB No. 304, of 2023;

VII - settlement in financial accounts held by participants in clearing houses or in service providers for clearing and settlement referred to in § 1º of Article 118 of the Regulation annexed to Resolution BCB No. 304, of 2023;

VIII - settlement in institutions with financial accounts held at the Central Bank of Brazil referred to in § 2º of Article 118 of the Regulation annexed to Resolution BCB No. 304, of 2023;

IX - materially significant changes to the business continuity plan to enable the transfer of funds in a clearing system or settlement institution with financial accounts held at the Central Bank of Brazil referred to in the single paragraph of Article 119 of the Regulation annexed to Resolution BCB No. 304, of 2023;

X - transfer of foreign currencies in accounts held at settlement institutions referred to in Article 120 of the Regulation annexed to Resolution BCB No. 304, of 2023;

XI - transfer of financial assets and securities in accounts held by clearing houses or by service providers for clearing and settlement in their respective central depositories, referred to in Article 121 of the Regulation annexed to Resolution BCB No. 304, of 2023*;

XII - new operations settleable by physical delivery of goods referred to in Article 122 of the Regulation annexed to Resolution BCB No. 304, of 2023;

XIII - materially significant changes to the rules and procedures regarding participant default referred to in Article 124 of the Regulation annexed to Resolution BCB No. 304, of 2023;

XIV - continuation of services previously provided by foreign central counterparties whose recognition was cancelled, referred to in § 1º of Article 130 of the Regulation annexed to Resolution BCB No. 304, of 2023;

XV - orderly wind-down plan for the provision of services by foreign central counterparties referred to in § 2º of Article 130 of the Regulation annexed to Resolution BCB No. 304, of 2023;

XVI - aggregation of positions and guarantees of clients of the same participant referred to in the single paragraph of Article 131 of the Regulation annexed to Resolution BCB No. 304, of 2023;

XVII - changes to the order of use of resources referred to in Articles 136 and 137 of the Regulation annexed to Resolution BCB No. 304, of 2023;

XVIII - reduction of the minimum requirements for coverage of credit and liquidity risks referred to, respectively, in Articles 137 and 150 of the Regulation annexed to Resolution BCB No. 304, of 2023;

XIX - materially significant changes to the mechanisms and procedures for loss allocation and the safeguard replenishment plan referred to in Article 138 of the Regulation annexed to Resolution BCB No. 304, of 2023;

XX - expansion of the list of accepted guarantees, to include personal guarantees, currencies not settled by the clearing system, or financial assets and securities not accepted as guarantees in liquidity lines routinely offered by the central banks issuing the currencies settled by the clearing system, provided that the credit, liquidity, and market risks of the new guarantees are potentially greater than those of similar guarantees currently accepted;

XXI - expansion of the list of jurisdictions in which guarantees abroad are accepted;

XXII - materially significant changes to the concentration limits of guarantees referred to in Article 142 of the Regulation annexed to Resolution BCB No. 304, of 2023;

XXIII - materially significant changes to the operational limits referred to in Article 147 of the Regulation annexed to Resolution BCB No. 304, of 2023;

XXIV - materially significant changes to the rules and procedures necessary for settlement to occur on the expected date, referred to in Article 151 of the Regulation annexed to Resolution BCB No. 304, of 2023; and

XXV - materially significant changes to the models, scenarios, and parameters adopted for the calculation of credit and liquidity risks to which clearing houses and service providers for clearing and settlement are exposed, including, when applicable, calculations related to guarantees, required margins, the amount of minimum qualified liquid resources, as well as other safeguards, as applicable.

§ 1º Authorization requests regarding changes to SMF or their regulations referred to in the items of the main text must be filed with the Central Bank of Brazil, in accordance with current regulation, accompanied by the relevant documents and information, directed to:

I - Department of Financial System Organization (Deorf), in the case of items I to III; or

II - Department of Banking Operations and Payment System (Deban), in the case of Items IV to XXV.

§ 2º Authorization requests referred to in item II of § 1º will be analyzed with respect to the settlement system, the mechanisms and procedures for managing and containing credit and liquidity risks, including those intended to ensure settlement certainty, when applicable, and those related to the constitution, administration, and execution of guarantees.

§ 3º Waiver of prior authorization does not exempt the IOSMF from compliance with the norms applicable to the matter, nor from making changes to the SMF and its regulation, at any time, by determination of the Central Bank of Brazil.

§ 4º Changes to SMF and their regulations that, although falling under items IV to XXV, aim only at compliance with normative changes or supervisory determinations are not subject to authorization by the Central Bank of Brazil, but must be reported to the Department of Banking Operations and Payment System (Deban) prior to their entry into force, in accordance with Article 181 of the Regulation annexed to Resolution BCB No. 304, of 2023.

~~§ 5º Authorization requests referred to in items IV, V, IX, XIII, XIX, and XXII to XV of the main text must be formulated with an assessment of the materiality of the proposed changes.~~

§ 5º Authorization requests referred to in items IV, V, IX, XIII, XIX, and XXII to XXV of the main text must be formulated with an assessment of the materiality of the proposed changes. (Wording given, effective from 1/8/2024, by Instruction Normative BCB No. 448, of 1/4/2024.)

§ 6º The authorization request referred to in item I of the main text does not apply to interoperability contractual arrangements whose defining mechanisms are supported by conventions or formal agreements entered into between IOSMFs authorized to exercise centralized deposit or financial asset registration activities; (Included, effective from 1/8/2024, by Instruction Normative BCB No. 448, of 1/4/2024.)

§ 7º The authorization request referred to in item I of the main text extends to interconnections between a clearing system and a system for centralized deposit or securities registration. (Included, effective from 1/8/2024, by Instruction Normative BCB No. 448, of 1/4/2024.)

Subsection II
Changes that Imply Conversion of the Request

Article 22. Qualitatively significant changes to the activities exercised within the scope of the SMF, in accordance with § 3° of Article 4º of the Regulation annexed to Resolution BCB No. 304, of 2023, that imply conversion to the authorization request referred to in items I, II, or III of Article 4º of the Regulation annexed to Resolution BCB No. 304, of 2023, are considered to be:

I - merger of activities exercised in two or more SMF into one SMF;

II - change or assumption of a contracting party, by the clearing house or service provider for clearing and settlement, in a clearing system already authorized by the Central Bank of Brazil;

III - replacement or significant changes to the models referred to in item XXV of Article 21; and

IV - inclusion of operations with financial assets, securities, or foreign currencies for settlement in a clearing system that result in a significant modification in the volume and nature of the transactions or, at the discretion of the Central Bank of Brazil, pose a risk to the solidity and normal functioning of the National Financial System (SFN) or the Brazilian Payments System (SPB).

Subsection III
Phase 1

Article 23. In Phase 1, of the Proposal Analysis, the authorization request for changes to SMF and their regulations referred to in Article 21 must be accompanied by the following documents and information:

I - application, in the format of Sisorf model 8.24.10.7;

II - explanatory document covering the main aspects related to the intended change:

a) motivation (market, financial, prudential, etc.), to be presented in an extensive manner;

b) comparison of the current process vis-a-vis the intended one, containing flowcharts (when applicable) and concrete examples;

c) listing of all IOSMF documents that will need to be altered due to the authorization request, followed by a brief summary of the changes;

~~d) for each intended change classified by the IOSMF as strategic for the authorization request, an excerpt of the document containing this change and indication of the document name;~~

d) for each intended change classified by the IOSMF as strategic for the authorization request, an excerpt of the document containing this change and indication of the document name, except for the documents referred to in item VI; (Wording given, effective from 1/8/2024, by Instruction Normative BCB No. 448, of 1/4/2024.)

e) assessment, to be prepared by the second line of defense, of the risks associated with the changes resulting from the authorization request, also covering controls and contingencies established or intended to be established for each of the mapped risks; and

f) expected schedule, focusing on the planned stages and the execution time of these.

III - analysis prepared by the IOSMF regarding the potential effect of the authorization request on the safety and efficiency of the SMF and the IOSMF and on the solidity and normal functioning of the Brazilian Payments System (SPB) or the National Financial System (SFN) referred to in § 2º of Article 4º of the Regulation annexed to Resolution BCB No. 304, of 2023;

IV - in the case of the request referred to in item I of Article 21, documentation presenting, in an extensive manner, the intended interconnection model;

V - in the case of the requests referred to in items I and II of Article 21, contractual instruments or equivalents entered into between the IOSMF and other IOSMFs, foreign central counterparties, entities administering organized markets, or settlement institutions;

~~VI - draft, with indication of the altered sections, of the new SMF regulation, as provided in Chapter II, of Title V of the Regulation annexed to Resolution BCB No. 304, of 2023;~~

VI - draft, with indication of the altered sections, of the new SMF regulation, as provided in Chapter II, of Title V of the Regulation annexed to Resolution BCB No. 304, of 2023, except for documents that exclusively regulate the aspects provided for in: (Wording given, effective from 1/8/2024, by Instruction Normative BCB No. 448, of 1/4/2024.)

a) items III, XVI, and XVIII of Article 102; (Included, effective from 1/8/2024, by Instruction Normative BCB No. 448, of 1/4/2024.)

b) item XV of Article 102 regarding non-financial risks; and (Included, effective from 1/8/2024, by Instruction Normative BCB No. 448, of 1/4/2024.)

c) item III of Article 104; (Included, effective from 1/8/2024, by Instruction Normative BCB No. 448, of 1/4/2024.)

VII - in the case of the request referred to in item XXI of Article 21, document attesting to compliance with the provisions of Article 141 of the Regulation annexed to Resolution BCB No. 304, of 2023; and

VIII - in the case of the request referred to in item III of art. 21, documents and information regarding the hiring of relevant services for processing, data storage, and cloud computing provided abroad, in accordance with the provisions of Annex IV.

Sole paragraph. In the case of exemption from the documentation provided for in item III, the Central Bank of Brazil will notify the IOSMF of the exemption.

Subsection IVDa
Phase 2

Art. 24. In Phase 2, the Analysis of the Implementation of the Proposal, the authorization request must be accompanied, within a period of 180 (one hundred and eighty) days counted from the favorable manifestation of the Central Bank of Brazil regarding the proposal referred to in art. 23, with the following documents and information:

I - application, in the form of model Sisorf 8.24.10.8;

II - readiness declaration, in the form of model Sisorf 8.24.20.8, accompanied by, at minimum:

a) in the case of requests referred to in items I to III of art. 21, a report on business continuity tests, when this is impacted to any extent, to be prepared or ensured by Internal Audit, respecting the provisions of Section V of Chapter VI of Title IV and Chapter I of Title V of the Regulation annexed to Resolution BCB No. 304, of 2023;

b) in the case of requests referred to in items I to III of art. 21, a report that evidences the availability, capacity, and performance of the Financial Market System (SMF), when these disciplines are impacted to any extent, to be prepared or ensured by Internal Audit, respecting the provisions of Section V and Section VI of Chapter VI of Title IV and Chapter I of Title V of the Regulation annexed to Resolution BCB No. 304, of 2023;

c) in the case of requests referred to in items I to III of art. 21, a report on cybersecurity tests, when this is impacted to any extent, to be prepared or ensured by Internal Audit, respecting the provisions of Section VII of Chapter VI of Title IV of the Regulation annexed to Resolution BCB No. 304, of 2023; and

d) in the case of requests referred to in items I to III of art. 21, a list of active change requests for the system(s) (evolutionary and corrective maintenance, etc.), as well as a list with the backlog of defects identified during the testing of the systems that will support the activity performed.

III - production deployment plan, encompassing a description of the strategy for deploying the systems (preliminary procedures, migration to the production environment, rollback forecast, support for participants, etc.);

IV - functional test report, to be prepared or ensured by Internal Audit, executed from scenarios that have considered the perspective of both the SMF and its participants and that have significantly represented the main changes in the SMFs and their regulations; and

V - certification or homologation plan with the participants.

~~Sole paragraph.~~ ~~The period referred to in the caput may be extended, at the discretion of the Central Bank of Brazil, upon justified request by the interested party.~~

§ 2º The Central Bank may exempt the presentation of one or more documents provided for in Phase 2 when there is sufficient evidence of compliance with the authorization requirements. (Included by Instruction Normative BCB No. 596, of 3/24/2025.)

CHAPTER III
FINAL PROVISIONS

Art. 25. Instruction Normative BCB No. 224, of January 4, 2022, is hereby revoked.

Art. 26. This Instruction Normative enters into force on May 2, 2023.

Carolina Pancotto Bohrer Rogério Antônio Lucca Head of Deorf Head of Deban

ANNEX I

BUSINESS PLAN CONTENT

Art. 1º The business plan must encompass, at minimum:

I - Introduction, containing:

a) Executive Summary of the Project, describing, in a summarized manner:

Objective;
Motivation;
Target audience;
Market opportunities that justify the undertaking;
Net Equity projected by the IOSMF to support all activities it intends to perform;
Information on the capital structure and financing sources of the business;
Presentation of expected financial results that demonstrate the viability of the undertaking;
Flowchart and summarized exposure of the intended operation, containing (if applicable):

i. summary of activities performed and planned functionalities;

ii. basic structure of intended participation;

iii. basic structure of intended accounts; and

iv. list of operations subject to the financial asset.

Classification of activities to be performed by the SMF in relation to the PFMI (PS, SSS, CCP, CSD and/or TR);
Need for opening a settlement account, indicating the intended settlement modalities (applicable only for PS and SSS);
Exposure of interconnections with other SMFs and of connections with stock exchanges and organized over-the-counter markets (if applicable);
Specific relationship of the payment instruments, financial assets, or securities that will be the object of settlement or accepted for centralized deposit or registration, citing the laws and sublegal norms that regulate the payment instrument, financial asset, or security; and
Identification of financial assets to be registered for which the service of constituting liens and encumbrances will be offered, demonstrating, for this purpose, that adequate interoperability mechanisms have been implemented with all Systems of registration authorized by the Central Bank of Brazil, as required by current regulation.

b) History of the IOSMF:

organizational chart of the corporate composition of the entity, explicitly showing, at all levels of participation, natural person and legal entity participants, and the respective quantities and species of shares or quotas held, until it is evident who the final controllers are;
identification of the members of the control group, with their respective corporate participations;
complete organizational chart of the conglomerate, containing the identification of all societies with the National Registry of Legal Entities (CNPJ) number, or, if foreign, with the Tax Identification Number (NIF), the name of the country where the headquarters is located, and respective percentages of voting and total capital held;
if the IOSMF is already active in the market, briefly describe its history, also citing which Financial Market Systems (SMFs) it already operates, which activities it already performs, which assets are registered, which are deposited, for which assets it offers liens and encumbrances, etc.;

II - Marketing Plan, presenting information on:

a) the activities to be performed;

b) the target audience;

c) the market and competition analysis;

d) detailed description of the business;

e) the market opportunities that justify the undertaking;

III - Operational Plan, encompassing:

a) the Organizational Structure;

b) Legal Risk;

c) Corporate Governance, addressing at minimum:

the corporate governance structure;
the bodies;
the administrators; and
the corporate governance policy;

d) the risk management, internal controls, and compliance structure, addressing, at minimum:

the structure;
the bodies;
the policies;
Internal Audit; and
Independent Audit.

e) General Business Risk;

f) Custody Risks and Investment Risks;

g) Operational Risk, addressing, at minimum:

the Operational Risk management structure;
the policies;
fraud management;
management of outsourcing of relevant services;
business continuity;
technological infrastructure and information technology service management; and
information and cybersecurity.

h) Efficiency and Effectiveness;

i) Communication Procedures and Standards;

j) Disclosure of rules, procedures, and market data; and

k) Out-of-Standard Operations;

IV - financial plan that demonstrates the economic-financial viability of the undertaking, from which must appear, at minimum:

a) Net Equity of the Institution;

b) Capital structure and financing sources;

c) Summarized presentation of expected financial results that demonstrate the viability of the undertaking

d) Description of critical variables for the success of the undertaking, as well as the construction of three scenarios (base, conservative, and ideal), in which it is possible to verify the impact generated by changes in these variables on the results obtained;

ANNEX II

COMPLIANCE ASSESSMENT CONTENT OF THE REGULATION

Art. 1º For the purpose of compliance with the provisions of arts. 7, Item VII, 9, Item VII, and 11, Item IV, an assessment performed by a qualified independent company with competence and experience in preparing legal compliance reports within the Brazilian Payments System (SPB) shall be forwarded, preferably in the area of financial assets related to central depositories and financial asset registrars.

Art. 2º The assessment must include a report encompassing the following aspects:

I - intended activity, being centralized deposit or registration of financial assets;

II - list of legal and sublegal norms related to the activity referred to in item I that supported the assessment;

III - list of financial assets that will be the object of centralized deposit or registration;

IV - identification of the financial assets that will be used for collateral and/or guarantee purposes related to the assets referred to in item III and that are subject to mandatory registration or centralized deposit, in accordance with current laws and regulations;

V - identification of the financial assets referred to in item III whose regulation issued by the Central Bank of Brazil requires IOSMFs to adhere to conventions;

VI - list of legal and sublegal norms related to the financial assets referred to in item III that supported the assessment;

~~VII - list of the documents of the requesting institution and the system that were subject to confrontation with the norms referred to in items II and VI;~~

VII - list of the documents of the requesting institution and the system that were subject to confrontation with the norms referred to in items II and VI, and with the convention referred to in Chapter VII of Resolution BCB No. 339, of 2023, in the case of requests involving book-entry promissory notes; (Wording given by Instruction Normative BCB No. 596, of 3/24/2025.)

VIII - table that relates, for each of the obligations imposed on the requesting institution or its system by the norms referred to in items II and VI:

a) type, number, and date of issuance of the norm;

b) location in the norm (title, chapter, section, article, item, clause, item, etc.) where the obligation is found;

c) normative obligation;

d) excerpts from the documents of the requesting institution and the system that attest to compliance with the normative obligation;

e) locations (document, section, article, item, page, etc.) where the excerpts referred to in clause "d" are found;

f) additional information that the contracted company deems pertinent to clarify the compliance referred to in clause "d";

IX - conclusion of the contracted company regarding the compliance of the system's regulation with the regulation applicable to the exercise of the activity of registration or centralized deposit of financial assets and with the regulation applicable to the financial assets eligible for registration or deposit.

§ 1º For the purpose of compliance with item VIII of the caput, the listing of normative obligations imposed on the requesting institution or its system must be done with the maximum possible specificity, and for this purpose, articles, paragraphs, clauses, items, or subitems may be divided into more than one obligation.

~~§ 2º The report referred to in the caput must be accompanied by the working papers, related to the requesting institution and the system, that supported it.~~

§ 2º The report referred to in the caput must be accompanied by the working papers, related to the requesting institution and the system, that supported it. (Wording given by Instruction Normative BCB No. 596, of 3/24/2025.)

Art. 2º-A When the authorization request involves book-entry promissory notes, the report must also encompass the following aspects: (Included by Instruction Normative BCB No. 596, of 3/24/2025.)

I - table that relates, for each of the obligations imposed on the requesting institution or its system by the convention: (Included by Instruction Normative BCB No. 596, of 3/24/2025.)

a) location in the convention (for example: title, chapter, section, article, item, clause, item, etc.) where the obligation to be fulfilled is located; (Included by Instruction Normative BCB No. 596, of 3/24/2025.)

b) obligation to be fulfilled; (Included by Instruction Normative BCB No. 596, of 3/24/2025.)

c) excerpts from the documents of the requesting institution and the system that attest to compliance with the obligation; (Included by Instruction Normative BCB No. 596, of 3/24/2025.)

d) locations (document, section, article, item, page, etc.) where the excerpts referred to in clause "c" are found; (Included by Instruction Normative BCB No. 596, of 3/24/2025.)

e) additional information that the contracted company deems pertinent to clarify the compliance referred to in clause "c"; (Included by Instruction Normative BCB No. 596, of 3/24/2025.)

II - conclusion of the contracted company regarding the compliance of the system's regulation with the convention. (Included by Instruction Normative BCB No. 596, of 3/24/2025.)

Art. 3º The assessment report must contain:

I - the identification of the technical responsible for the assessment activities performed; and

II - the history of the contracted company and the technical responsible regarding competence and experience in relation to the assessment performed, indicating previous works carried out in this area, certifications, courses taken, among other documents that contribute to such proof.

Art. 4º If the report presents a reservation that does not allow the contracted company to conclude on the total compliance of the system's regulation with the applicable regulation and there is a disagreement between the contracted company and the requesting institution regarding this reservation, a report with said reservation may be presented by the requesting institution to the Central Bank of Brazil, provided that:

Art. 4º If the report presents a reservation that does not allow the contracted company to conclude on the total compliance of the system's regulation with the applicable regulation or with the convention referred to in Chapter VII of Resolution BCB No. 339, of 2023, in the case of requests involving book-entry promissory notes, and there is a disagreement between the contracted company and the requesting institution regarding the reservation, a report with said reservation may be presented by the requesting institution to the Central Bank of Brazil, provided that: (Wording given by Instruction Normative BCB No. 596, of 3/24/2025.)

~~I - the report of the contracted company identifies for which normative obligations the condition of compliance was not fully satisfied, explaining the reasons for such; and~~

I - the report of the contracted company identifies for which normative obligations or of the convention referred to in Chapter VII of Resolution BCB No. 339, of 2023, in the case of requests involving book-entry promissory notes, the condition of compliance was not fully satisfied, explaining the reasons for such; and (Wording given by Instruction Normative BCB No. 596, of 3/24/2025.)

II - the requesting institution forwards a document containing its arguments regarding the reservation pointed out, clarifying the reasons that led it to maintain in its documents the aspects that, according to the reservation of the contracted company, are not in total compliance with the normative obligations or with the convention referred to in Chapter VII of Resolution BCB No. 339, of 2023, in the case of requests involving book-entry promissory notes. (Wording given by Instruction Normative BCB No. 596, of 3/24/2025.)

Sole paragraph. In the situation referred to in the caput, the Central Bank of Brazil will evaluate the set of information and documents presented to base the decision regarding the compliance or non-compliance with the provisions of arts. 7, Item VII, 9, Item VII, and 11, Item IV.

ANNEX III

OPERATIONAL AND FUNCTIONAL FITNESS ASSESSMENT CONTENT

Art. 1º For the purpose of compliance with the provisions of arts. 8, Item V, 10, Item V, and 12, Item V, an assessment performed by a qualified independent company with competence and experience in the assessment of Information Technology (IT) and Information Security (IS) processes shall be forwarded.

Art. 2º The assessment must include a report encompassing the following aspects:

I - conclusion of the contracted company regarding operational and functional fitness concerning the adherence of the implemented system to its regulation, which must be supported, at minimum:

a) in the result of functional tests whose object comprises scenarios that consider the perspective of both the system and its participants and that significantly represent the main processes of the system established in regulation; and

b) in the result of non-functional tests whose object comprises the verification of compliance with goals and other technical and operational characteristics established in regulation;

II - conclusion of the contracted company regarding operational and functional fitness concerning the adequate level of security and reliability of the implemented operational infrastructure, which must be supported, at minimum, in the assessment of the following aspects:

a) management of outsourcing of services related to operational infrastructure;

b) business continuity management (policies, plans, tests, contingencies, communication, culture, etc.);

c) IT service management (availability, capacity, performance, incidents, problems, changes, etc.);

d) information and cybersecurity management (confidentiality, integrity, availability, policies, plans, identification, protection, detection, response, recovery, tests, culture, etc.);

e) architecture management, consisting of business processes, information, data, application, and technology architecture layers to effectively and efficiently execute the company's strategies by creating models and practices that describe the baseline and target architectures; and

f) integration of the managements referred to in clauses "a" to "e".

§ 1º The process associated with out-of-standard operations and the reconciliation process must be included in the scope of the functional tests referred to in item I of the caput.

§ 2º Regarding the managements referred to in clauses "b" and "c" of item II of the caput, the contingency processing center must present, at minimum, the same processing capacity as the main center.

§ 3º Regarding the management referred to in clause "c" of item II of the caput, the processing centers must be capable of processing, at minimum, the volume of business projected for the first twenty-four months of operation.

~~§ 4º The report referred to in the caput must be accompanied by the working papers, related to the requesting institution and the system, that supported it.~~

§ 4º The report referred to in the caput must be accompanied by the working papers, related to the requesting institution and the system, that supported it. (Wording given by Instruction Normative BCB No. 596, of 3/24/2025.)

Art. 3º The assessment report must contain:

a) the identification of the technical responsible for the assessment activities performed; and

b) the history of the contracted company and the technical responsible regarding competence and experience in relation to the assessment performed, indicating previous works carried out in this area, certifications, courses taken, among other documents that contribute to such proof.

Art. 4º If the report presents a reservation that does not allow the contracted company to conclude on operational and functional fitness and there is a disagreement between the contracted company and the requesting institution regarding this reservation, a report with said reservation may be presented by the requesting institution to the Central Bank of Brazil, provided that:

I - the report of the contracted company identifies which aspects related to the implemented operational infrastructure present problems, explaining in detail the reasons that led to the reservation; and

II - the requesting institution forwards a document containing its arguments regarding the reservation pointed out, clarifying the reasons that led it to maintain in the implemented infrastructure the aspects that, according to the reservation of the contracted company, present problems.

Sole Paragraph. In the situation referred to in the main text, the Central Bank of Brazil will evaluate the set of information and documents presented to support the decision regarding compliance or non-compliance with the provisions of Art. 8, Item V, Art. 10, Item V, and Art. 12, Item V.

ANNEX IV

DOCUMENTS AND INFORMATION REGARDING THE CONTRACTING OF RELEVANT SERVICES FOR PROCESSING, DATA STORAGE, AND CLOUD COMPUTING PROVIDED ABROAD

Art. 1. The information required for the authorization of contracting relevant services for processing, data storage, and cloud computing provided abroad, provided for in Art. 5, Item VII, Art. 7, Item VIII, Art. 9, Item VIII, and Art. 23, Item VIII, must be presented through an explanatory document, which must include, at a minimum:

I - the name of the company to be contracted;

II - the Tax Identification Number (NIF) of the company providing the service object of the authorization request;

III - the description of the relevant services to be contracted;

IV - the indication of the countries and regions in each country where the services may be provided;

V - the schedule intended by the FMI for the contracting;

VI - a detailed description of the architecture and infrastructure of the service provider abroad;

VII - the criteria for contracting services, including relevant services for processing and data storage;

VIII - the criteria for defining a relevant service. These criteria must consider the criticality of the service and the sensitivity of the data and information to be processed, stored, and managed by the contractor.

IX - the processes established for the management of risks arising from external factors, including the risk of processing abroad;

X - risk analysis (risk factors and mitigating actions) conducted by the FMI for the contracting of a provider abroad. The analysis must include, at a minimum:

a) lack of integrity, availability, and performance of the provider;

b) failure in the architecture of the contracted solution;

c) failure in cybersecurity management processes;

d) inadequate capacity management;

XI - the description of the corporate governance structures and practices for service management adopted by the institution, considering the relevance of the service and associated risks, and presenting evidence;

XII - the description of mechanisms implemented or to be implemented to ensure that the potential service provider adopts controls to mitigate potential vulnerabilities related to the service to be provided, including in the release of new versions;

XIII - the description of the business continuity strategy planned by the FMI to ensure the continuity of the contracted service, including in cases of impossibility of maintenance or termination of the service provision contract; and

XIV - the description of how the FMI intends to handle situations of impossibility of maintenance or termination of the service provision contract, if applicable, indicating the impact analysis, as well as the controls for the effects of relevant incidents on the institution's activities in case of interruption of the provided services.

Art. 2. The following documents must also be presented:

I - the policies, strategies, and structures for risk management that include the criteria mentioned in the previous items;

II - the certifications required by the FMI from the relevant service provider;

III - the reports prepared by an independent specialized audit company contracted by the service provider, regarding the procedures and controls used in the provision of the service to be contracted;

IV - the internal audit assessment by the FMI regarding the contracting of the provider abroad.

V - evidence of the verification of the potential service provider's capacity to ensure:

a) compliance with current legislation and regulation, including with respect to data protection, cybersecurity policy, and requirements for contracting relevant services for processing and data storage and cloud computing;

b) the contracting institution's access to reports prepared by an independent specialized audit company contracted by the service provider, regarding the procedures and controls used in the provision of the services to be contracted;

c) the provision of information and management resources adequate for monitoring the services to be provided; and

d) the Central Bank of Brazil's access to conduct supervision, in the same manner as those conducted within the FMI itself;

VI - evidence of the potential service provider's capacity to ensure:

a) the institution's access to the data and information to be processed or stored by the service provider;

b) the confidentiality, integrity, availability, and recovery of the data and information processed or stored by the service provider;

c) its compliance with certifications required by the institution for the provision of the service to be contracted;

d) the identification and segregation of participants' data through physical or logical controls; and

e) the quality of access controls aimed at protecting the data and information of the institution's participants;

VII - evidence of the processes adopted, resources, and competencies used for the management of the services to be contracted;

VIII - an assurance report that the provision of services abroad will not cause harm to the regular functioning of the FMI nor hinder the action of the Central Bank of Brazil;

IX - evidence that the legislation and regulation in the countries and regions in each country where the services may be provided do not restrict or prevent the access of the contracting institutions and the Central Bank of Brazil to the data and information;

X - evidence that the relevant service provider abroad meets, at a minimum, the same requirements requested of relevant service providers located in the national territory;

XI - evidence that the relevant service provider abroad has a representation in Brazil;

XII - evidence that the foreign supervisor has the same regulatory and supervisory competencies as the FMI's supervisors as those of the Central Bank of Brazil;

XIII - evidence that the relevant service provider has, in Brazil, a contingency site with mechanisms for business continuity that allow the execution of the contracted relevant service on national territory, in the event of the materialization of risks that make the continuation of service provision abroad impossible, whereby such mechanisms must include the provision for the replication of the database and information at the domestic site and must be tested periodically;

XIV - draft contract with the service provider, which must provide, among other things:

a) the adoption of security measures for the transmission and storage of data;

b) the maintenance, while the contract is in effect, of the segregation of data and access controls for the protection of participants' information;

c) service level agreements and quality parameters to be observed during the validity of the contract, compatible with the regulatory and operational needs of the Financial Market Systems (SMF) that use the contracted services in their operation;

d) the obligation, in case of contract termination, to transfer data to the new service provider or to the contracting FMI and to delete the data by the replaced contracted company, after the transfer of data and confirmation of the integrity and availability of the received data;

e) the FMI's access to information provided by the contracted company, aiming to verify the adoption of security measures for the transmission and storage of data and the maintenance of data segregation and access controls for the protection of participants' information;

f) the FMI's access to information regarding specialized audit reports and required certifications;

g) the FMI's access to information and management resources adequate for monitoring the services to be provided;

h) the obligation of the contracted company to notify the contracting FMI about the subcontracting of relevant services for the institution;

i) the adoption of measures by the contracting FMI, as a result of determination by the Central Bank of Brazil;

j) the obligation of the contracted company to keep the contracting FMI permanently informed about any limitations that may affect the provision of services or compliance with current legislation and regulation;

k) the obligation to provide information and furnish evidence to the action of the Central Bank of Brazil, including in Portuguese, if requested;

l) permission for the Central Bank of Brazil to access the contracts and agreements entered into for the provision of services, the documentation and information regarding the services provided, the stored data and information about their processing, the data and information backups, as well as the access codes to the data and information and the reports of the certifications required by the FMI, as well as the documentation and other inputs that supported them;

m) the Central Bank of Brazil's access, for the purpose of conducting supervision processes, in the same manner as would be conducted within the FMI;

n) in the event of early maturity due to a bidding process, the obligation of the contracted company to maintain, for at least 90 (ninety) days, counted from the date of early maturity, access to the contracts, agreements, documentation, and information regarding the services provided, the stored data and information about their processing, the data and information backups, as well as the access codes that are in the possession of the contracted company;

XV - Planning of homologation tests and planning of "D-Day" (the day of start or migration to the cloud).

NOTE

This BCB Instruction Normative (IN BCB) aims to disclose the procedures, documents, deadlines, and information necessary for the instruction of authorization requests provided for in BCB Resolution No. 304, of March 20, 2023. The aforementioned resolution regulates, within the scope of the Brazilian Payments System, the functioning of settlement systems, the exercise of registration and centralized deposit activities of financial assets, the constitution of liens and encumbrances on registered or deposited financial assets, and the authorization processes related to the functioning of these systems.

Decree No. 10.411, of June 30, 2020, regulates the conduct of regulatory impact analysis (AIR) as a prerequisite for the issuance of normative acts. However, in its Article 4, the aforementioned decree establishes the hypotheses for dispensing with the conduct of AIR. This IN BCB falls under the hypothesis provided for in Item II, as it does not bring any additional requirement to that contained in the current regulation and is intended to clarify the manner of compliance with obligations defined in a hierarchically superior norm. Thus, based on Item II of Art. 4 of Decree No. 10.411, of 2020, it is understood that the issuance of this IN BCB dispenses with the conduct of AIR.

Carolina Pancotto Bohrer Rogério Antônio Lucca Head of Deorf Head of Deban

Lineage: Amended

Timeline