Normative Instruction BCB No. 443 — Publishes rules and schedule for control points in the Open Finance security profile change process

Cosif - Contas direcionamento microcrédito - Cta

NORMATIVE INSTRUCTION BCB NO. 443, OF DECEMBER 20, 2023

Publishes rules and schedule for control points in the process of changing the security profile of Open Finance.

The Heads of the Department of Supervision of Cooperatives and Non-Bank Institutions (Desuc) and the Department of Banking Supervision (Desup), using the authority granted to them by Article 23, item I, letter "a" of the Internal Regulations of the Central Bank of Brazil, annexed to Resolution BCB 340, of September 21, 2023, based on Articles 46, item II, and 51, items IX and XI, both of Joint Resolution No. 1, of May 4, 2020.

RESOLVE:

Art. 1º This Normative Instruction publishes rules and a schedule for control points of a stage in the process of changing the security profile of Open Finance, which, in compliance with Normative Instruction BCB 305, of September 15, 2022, establishes the security and interoperability guidelines that must be applied to the APIs (Applications Programming Interface) of Open Finance.

Art. 2º In one of the stages of the implementation schedule for creating the new security profile, as established by the Open Finance Governance Structure, the DCMs (Dynamic Client Management) must be carried out, in which, bilaterally, the Institutions inform the standards used and recognized by each Institution. This step is critical for the proper interoperability of Open Finance and must comply with the rules and control points established in this Normative Instruction.

Art. 3º The stage mentioned in the previous paragraph ends on 4/14/2024 and must be observed by all active participants in Open Finance.

DCM Milestones to be met by relevant participants

Art. 4º In their roles as initiator/receiver, the institutions and conglomerates related in Arts. 8 and 9 must respect the milestones established in Art. 5 for carrying out DCM with the main brands of the Institutions related in Art. 10.

I – All Institutions listed in Art. 10 must be the object of DCM that integrates the metrics of Art. 5. However, each initiator/receiver may use its own criteria to identify the main brands of the holding/transmitting Institutions. However, brands with DCR (Dynamic Client Registration), which represents the first bilateral registration, occurred in 2024, must be included in the schedule.

Art. 5º The DCM process by the participants listed in Arts. 8 and 9 must follow the following schedule:

Date	Description
3/26/2024	Successfully complete 10% of the DCMs foreseen in Art. 4.
3/27/2024	Carry out proof tests of the DCMs considered to reach the goal of 3/26/2023.
4/1/2024	Successfully complete 30% of the DCMs foreseen in Art. 4.
4/2/2024	Carry out proof tests of the DCMs considered to reach the goal of 4/1/2024
4/4/2024	Successfully complete 70% of the DCMs foreseen in Art. 4.
4/5/2024	Carry out proof tests of the DCMs considered to reach the goal of 4/4/2024
4/9/2024	Successfully complete 95% of the DCMs foreseen in Art. 4.
4/10/2024	Carry out proof tests of the DCMs considered to reach the goal of 4/9/2024
4/11/2024	Successfully complete 100% of the DCMs foreseen in Art. 4.
4/12/2024	Carry out proof tests of 100% of the DCMs foreseen in Art. 4.

Art. 6º For the performance of proof tests, after each DCM successfully completed:

I – If the initiator has technical conditions, it must validate if the journey remains operational and if it is possible to successfully carry out a payment initiation;

II – If the receiver has technical conditions, it must validate if the journey remains operational;

III – The receiver must validate if it is possible to consume data from active consents;

IV – Evidence of these tests must be kept available to the Central Bank of Brazil.

Art. 7º If a new DCM with the old profile is carried out for a brand already counted as successful in the milestones established in Art. 5, the milestone must be disregarded in the following milestones, until a DCM with the new security profile is carried out again.

Art. 8º The initiators and/or receivers that must respect the milestones established in Art. 5 are the conglomerates and institutions listed below:

I - Banco do Brasil;

II – Bradesco;

III – Itaú;

IV - Mercado Pago;

V - Nu Pagamentos;

VI – PicPay;

VII – Santander;

VIII - U4C.

Art. 9º If, at the end of February 2024, there are other Relevant Institutions (95% of the stock of active consents for data sharing and/or 95% of initiated transactions) they will also be subject to this schedule and will be individually contacted by the Central Bank Supervision, by 3/11/2024.

Art. 10. The holding and/or transmitting institutions that must be considered for the purposes established in Art. 4 are:

I - Banco do Brasil;

II – Bradesco;

III – CAIXA;

IV - C6;

V – Itaú;

VI - Mercado Pago;

VII - Nu Pagamentos;

VIII – PicPay;

IX – Santander.

Art. 11. The list of holding/transmitting institutions will not be supplemented with other institutions.

Ticket compliance goals

Art. 12. In the period from 3/25/2024 to 4/14/2024, tickets must be formalized in the service desk regarding:

I - Incidents in DCR/DCMs;

II - Incidents with suspicion that they are offshoots of the DCR/DCMs. Examples of possible scenarios that fit into this item are generalized errors of invalid token and invalid scope that did not occur before the aforementioned DCR/DCMs;

Art. 13. The tickets related in Art. 12:

Art. 13. The tickets mentioned in Art. 12: (Redacted by Normative Instruction BCB No. 457, of 3/19/2024.)

I - Referent to DCMs that integrate the milestones of Art. 4 must be classified in the most appropriate category, but reclassified as unavailability, with an incident response goal for unavailability, in accordance with IN BCB 359, of March 3, 2023;

I - Referent to DCR/DCMs referred to in Art. 4, must be classified in the most appropriate category, but have their response goal redefined to a maximum period of 1 business day; (Redacted by Normative Instruction BCB No. 457, of 3/19/2024.)

II - Not fitting the milestones of Art. 4 must be classified in the most appropriate category, but reclassified as service quality degradation, with an incident response goal for incidents that do not cause service unavailability with the type of incident service quality degradation in accordance with IN BCB 359/2023;

II - Not fitting the terms of Art. 4, must be classified in the most appropriate category, but have their response goal redefined to a maximum period of 2 business days; (Redacted by Normative Instruction BCB No. 457, of 3/19/2024.)

III - Requests for reclassification to incident types with a response goal exceeding the period established in this Normative Instruction must be denied;

IV - If the institution that opened the ticket identifies that the cause of the error lies in the implementation under its responsibility or in the eventuality of a decision to implement a workaround in the implementation under its responsibility, the ticket must be updated and closed on the same day.

Art. 14. This Normative Instruction enters into force on February 1, 2024.

Harold Paquete Espínola Filho Belline Santana

Head of the Department of Supervision of Cooperatives and Non-Bank Institutions Head of the Department of Banking Supervision

TECHNICAL NOTE

Justifies the proposal to publish rules and schedule for control points in the process of changing the security profile of Open Finance.

This Technical Note justifies the proposal for the issuance of a normative instruction, which establishes rules and a schedule for control points in the process of changing the security profile of Open Finance, as provided for in Articles 46, item II, and 51, items IX and XI, both of Joint Resolution No. 1, of May 4, 2020.

2. In compliance with the provisions of Art. 5 of Law No. 13.874, of September 20, 2019, Decree No. 10.411, of June 30, 2020, determines that proposals for normative acts of general interest of economic agents formulated by federal direct, autarchic, and foundation administrative bodies and entities, as well as by collegial bodies through the body or entity responsible for providing them with administrative support, must be preceded by a Regulatory Impact Analysis (RIA).

3. However, it is worth highlighting that the proposal to publish rules and a schedule for control points in the process of changing the security profile of Open Finance does not cause significant impacts for the set and participating institutions of Open Finance as it deals with the definition of rules and control points for an already established schedule. In this sense, according to Art. 4, item III, of the aforementioned Decree, the normative act now proposed is exempt from the preparation of an RIA as it is considered low impact.

For your consideration.

Rodrigo Monteiro

Deputy Head of the Department of Supervision of Cooperatives and Non-Bank Institutions

Ricardo Seviere Zeni

Deputy Head of the Department of Banking Supervision

Agreed.

Harold Paquete Espínola Filho

Head of the Department of Supervision of Cooperatives and Non-Bank Institutions

Belline Santana

Head of the Department of Banking Supervision