Normative Instruction BCB No. 559

Open Finance - Customer Experience - IN

NORMATIVE INSTRUCTION BCB No. 559, OF 4 DECEMBER 2024

Normative document revoked by Normative Instruction BCB No. 637, of 13/6/2025.

Announces version 7.0 of the Customer Experience Manual in Open Finance.

The Heads of the Department of Regulation of the Financial System (Denor) and the Department of Information Technology (Deinf), exercising the powers conferred upon them by art. 23, item I, subparagraph "a", of the Internal Rules of the Central Bank of Brazil, annexed to Resolution BCB No. 340, of 21 September 2023, based on art. 3, item V, of Resolution BCB No. 32, of 29 October 2020,

R E S O L V E :

Art. 1 This Normative Instruction announces version 7.0 of the Customer Experience Manual in Open Finance, mandatory for participating institutions, as per the Annex.

Sole paragraph. The manual referred to in the main section, in its most recent version, shall be available on the Open Finance page of the Central Bank of Brazil's website and on the Open Finance Portal in Brazil, maintained by the financial institutions and payment institutions that make up the Open Finance Governance Structure referred to in art. 44, § 1, of Joint Resolution No. 1, of 4 May 2020.

Art. 2 Normative Instruction BCB No. 463, of 10 April 2024, published in the Official Gazette of the Union of 11 April 2024, is hereby revoked.

Art. 3 This Normative Instruction shall enter into force on the date of its publication.

GILNEU FRANCISCO ASTOLFI VIVAN HAROLDO JAYME MARTINS FROES CRUZ Head of Denor Head of Deinf

ANNEX TO NORMATIVE INSTRUCTION BCB No. 559, OF 4 DECEMBER 2024

Customer Experience Manual in Open Finance Version 7.0

Summary of Changes

Date

Version

Description of Changes

4/12/2024

7.0

Inclusion of the journey for sharing the payment transaction initiation service without redirection in subsection 4.1.3

Terms of Use

This manual defines the basic principles of the customer experience in Open Finance, complementing the current regulations on the subject.

This manual will be periodically reviewed and updated in order to maintain compatibility with the regulations, as well as to incorporate improvements resulting from the evolution of Open Finance.

More detailed information and examples of the application of this manual can be found on the Open Finance Portal in Brazil (https://openfinancebrasil.org.br/), maintained by the financial institutions and payment institutions that make up the Open Finance Governance Structure referred to in art. 44, § 1, of Joint Resolution No. 1, of 2020.

Suggestions, criticisms, or requests for clarification of doubts regarding the content of this document may be sent to the Central Bank of Brazil through the institution's official channels.

References

The specifications contained in this manual are based on, reference, and complement, where applicable, the following documents:

• I - Joint Resolution No. 1, of 4 May 2020, which provides for the implementation of Open Finance, in which concepts, objectives, principles, and other obligations for participating institutions are established;

• II - Circular No. 4.015, of 4 May 2020, which provides for the scope of data and services of Open Finance;

• III - Resolution BCB No. 32, of 29 October 2020, which establishes the technical requirements and operational procedures for the implementation of Open Finance;

• IV - Resolution BCB No. 406, of 2 August 2024, which provides for the sharing of the payment transaction initiation service without redirection to other environments; and

• V - Law No. 13.709, of 14 August 2018 (General Personal Data Protection Law - LGPD).

Normative acts under the competence of the National Monetary Council or the Central Bank of Brazil can be accessed on the Central Bank of Brazil's website (www.bcb.gov.br), through the "Search for regulations" option.

1. Introduction

This manual aims to ensure that the customer experience when sharing data and services among Open Finance participating institutions is safe, agile, accurate, and convenient. Consumers of financial products and services will only have confidence to authorize the sharing of data and services if their experience is consistent with their expectations and if the information about the process is presented to them in a clear and intuitive manner, allowing their consent for data and services sharing to be unequivocal and well-informed. For this to happen, it is essential that the sharing journey takes place in a secure environment, with the fewest possible frictions.

Throughout this manual, some expressions will be frequently used, among which:

• I - simple data and services sharing journey: sequence of data or services sharing steps carried out by a single client, natural or legal person;

• II - multiple data and services sharing journey: sequence of data or services sharing steps when the authorization of more than one client is required, such as in the case of legal entity accounts, where the requesting client initiates the sharing of data or services and approving clients (representatives or attorneys-in-fact of the legal entity) must authorize it; and

• III - consent management environment: environment made available by participating institutions in their electronic channels for the client to view and manage consents already granted or pending, including for the purpose of revocation.

The expressions mentioned are used with the purpose of facilitating the understanding of this manual and do not necessarily need to be used during the steps of the sharing request.

2. General provisions on customer experience in Open Finance

Participating institutions are prohibited from creating obstacles or adopting mechanisms that, in any way, impair the fluidity of the customer journey or encourage them, voluntarily or involuntarily, to give up data or service sharing within the scope of Open Finance. Such obstacles or mechanisms include, for example, the offering of products and services to the customer during any Open Finance journeys, the insertion of unnecessary, duplicated or redundant screens, steps or information, or the use of language that may generate uncertainty or that negatively affects, directly or indirectly, the customer's perception of the credibility and security of Open Finance or of the other participating institutions.

The prohibition applies to all stages of the customer journey in Open Finance relating to data and services already typified or that may be typified within the scope of the ecosystem, as well as to information relating to the sharing journey disclosed on the different communication channels of the participating institutions with their customers.

Participating institutions must ensure that their customers experience the best experience in Open Finance journeys. In order to achieve this objective, participating institutions that also offer access to their products and services through an application must also offer Open Finance journeys on that channel.

The provisions hereby established must be expressly included in the Customer Experience Guide, the subject of section 4 of this manual.

3. Principles of customer experience in Open Finance

Based on the provisions of Joint Resolution No. 1 of 2020, the principles of customer experience in Open Finance are considered to be:

• I - security and privacy;

• II - agility;

• III - convenience and control; and

• IV - transparency.

3.1 Security and privacy

The sharing of data and services in Open Finance must be carried out in a secure environment that guarantees the privacy of the customer's personal data, in compliance with current legislation and regulations, especially the normative acts dealing with the security and privacy of personal data.

During the sharing journey, the customer must be properly informed about the security of the process, with the aim of obtaining consent for the sharing of their registration and transactional data, as well as the payment transaction initiation service.

3.2 Agility

The process of sharing data and services in Open Finance must have a duration compatible with its objectives and the level of complexity, ensuring the conditions necessary for free choice and decision-making by the customer. An unnecessarily long process can cause the customer to give up, while any precariousness in the provision of information does not allow for adequate decision-making.

The process of sharing data and services must occur in a successive and uninterrupted manner. Therefore, the stages of the sharing request must not be interrupted until their conclusion, nor must they require unnecessary actions on the part of the customer.

In cases of multiple journey of data and service sharing, confirmation of the sharing will only occur after the process is completed by all customers involved in the sharing, who will not need to do so simultaneously or immediately, subject to ensuring the security and transparency of the process, including with regard to the deadlines necessary for its conclusion.

3.3 Convenience and control

The sharing of data and services in Open Finance must be carried out for specific purposes and in a manner convenient and accessible to the customer, including with regard to the access channels of the participating institutions. The customer must be assured the necessary conditions for exercising control over their personal data shared in Open Finance. In this sense, the sharing journey must be customer-centered, taking into account their profile, needs, objectives and expectations, with the provision of information and consent management environments, including for the revocation of consent when they deem it timely and appropriate, respecting the deadlines defined in current regulations.

Open Finance participating institutions may not create additional steps or use more rigorous authentication and confirmation methods to confirm the sharing of data and services within the scope of Open Finance.

In multiple-authorization journeys of legal entities, the powers and authorizations already constituted and defined for account movement in their internal policies, such as articles of association, articles of incorporation or other related documents, must be used for the purposes of sharing data and services, so that data-transmitting and account-holding institutions are prohibited from requiring the constitution of specific powers and authorizations for the purposes of sharing data and services within the scope of Open Finance.

Additionally, data-transmitting and account-holding institutions that make available, in their channels, mechanisms for duly constituted legal representatives before the institutions themselves to authorize or delegate powers to other persons, must include, in these mechanisms, the possibility of authorization or delegation of powers for sharing data and services within the scope of Open Finance.

3.4 Transparency

The customer must receive clear, objective and adequate information during the process of sharing data and services. The data-receiving institution must inform the customer clearly and in a timely manner about which data will be shared, including data relating to products or services that may be contracted by the customer or commercialized by the data-transmitting institution in the future, and the reasons why such data will be necessary for the purposes in question, in addition to other mandatory information provided for in the applicable regulations. In the case of service sharing, it must always be transparent to the customer during the journey which participating institution is responsible for providing that service, as well as the conditions of the service being provided.

Unnecessary or excessively complex information may generate doubts and insecurities for the customer, who may abandon the sharing due to a lack of understanding of the process. Therefore, the information provided to the customer must be sufficient and accurate so that their decision-making is unequivocal and well-informed.

The language used must be simple and understandable, regardless of the customer's level of prior knowledge about financial products and services. The terms and expressions used in this manual and in the other normative acts issued by the Central Bank of Brazil related to Open Finance may be replaced by others considered more appropriate for the understanding of all Open Finance customers, provided that their meanings are maintained.

4. Customer Experience Guide

In accordance with Resolution BCB No. 32, of 2020, the Structure Responsible for the Governance of Open Finance must make available to participating institutions and to the general public the Customer Experience Guide, which will bring together operational procedures and mandatory requirements for all participating institutions in their interaction with their customers during the sharing journey, observing the provisions of this manual and the applicable regulations on Open Finance. The availability of this document, in its most current version, must be carried out through the Open Finance Portal in Brazil.

The Guide must be periodically reviewed and updated by the Structure Responsible for the Governance of Open Finance, which must maintain transparent control of the published versions. The publication of new versions of the document must be accompanied by usability tests with customers representative of the Open Finance target audience, as well as communicated in a timely manner to the participating institutions and to the Central Bank of Brazil, which may determine adjustments and corrections.

It is permitted for the Guide to establish principles and requirements additional to those set forth in this manual. However, its content must be in compliance with the provisions of the applicable legislation and regulations.

4.1 Content of the Customer Experience Guide

The Customer Experience Guide must provide for, at a minimum:

4.1.1 Simple data sharing journey

The content of this journey must cover, at a minimum:

• I - the identification of the customer

At this stage, the data-receiving institution must identify the customer, as required by the applicable regulations.

• II - the determined purposes of the consent

At this stage, the data-receiving institution must inform the customer of the purpose(s) and the service(s) associated with the data sharing.

• III - the selection of the data subject to sharing at the data-receiving institution

The customer must be able to select the data they wish to share, observing the data groupings defined based on art. 11 of Joint Resolution No. 1, of 2020.

The customer must be informed about which data are necessary for the purpose of the sharing and, as applicable, which would be optional. The optional data must correspond to a determined purpose, even if secondary to the main purpose. The customer must also be informed of the reasons why such data are necessary for the purpose(s) in question.

The presentation of a "Terms and Conditions" feature, or similar, is permitted, provided that no additional action by the customer is required to accept the terms.

• IV - the selection of the data sharing period

The customer must be able to select the period for which they wish to share the selected data, observing the purpose and other aspects established in the specific Open Finance regulations.

• V - the selection of the data-transmitting institution

The customer must be able to select the data-transmitting institution. A search mechanism must be made available that provides an agile and clear selection of the desired institution. All participating institutions for the purposes of data sharing in Open Finance duly registered in the Participants Directory maintained by the Structure Responsible for the Governance of Open Finance must be listed.

• VI - the redirection to the environment of the data-transmitting institution

The customer must be informed that they are being securely redirected to the environment of the selected data-transmitting institution. It must be clear to the customer that the sharing is not yet complete and that additional steps are necessary for it to take effect.

The redirection cannot involve any action by the customer, being merely informative in nature, and must include the following:

• a) journeys initiated at the data-receiving institution on a desktop device: the redirection must occur, preferably, to the same device; and

• b) journeys initiated at the data-receiving institution on a mobile device:

  • 1. in the case of data-transmitting institutions belonging to conglomerates subject to customer journey monitoring, in accordance with the Open Finance Monitoring Manual, the redirection must occur directly to the application of the transmitting institution without passing through browsers; and

  • 2. the other data transmitting institutions not covered by the customer journey monitoring, as per the Open Finance Monitoring Manual, should preferably observe the redirection to their applications.

The conglomerates classified under item 1 may submit to the Central Bank of Brazil substantiated requests for the exemption of specific institutions or brands where mandatory redirection to the application could harm their customers' journey.

Exceptionally, if the customer does not have the transmitting institution's application installed on the mobile device, the redirection must be made to the institution's environment in the browser or to the application store, always on the same device.

• VII - customer authentication at the data transmitting institution

The customer must authenticate at the data transmitting institution. The customer must be able to recognize that they are in the environment of the institution with which they already have a relationship and that the credentials used for authentication are not visible and will not be shared with the data receiving institution.

As established by Joint Resolution No. 1, of 2020, the procedures and controls for customer authentication must be compatible with those applicable to access to electronic service channels already made available by the transmitting institution. This compatibility covers, among others, the authentication factors, the number of steps and the duration of the procedure.

• VIII - confirmation of sharing by the customer at the data transmitting institution

The customer must confirm the sharing at the data transmitting institution. At a minimum, the identification of the data receiving institution, the validity period of the consent and the data that will be subject to sharing must be presented to the customer for verification.

All origins or groupings of data presented to the customer must be pre-selected, so that customer action is only required if they wish to exclude one or more items from the scope to be shared (opt-out).

The selection of data groupings for sharing cannot be changed in the transmitting institution's environment. Selections in the transmitting institution's environment must be restricted to the origin of the data.

Exceptionally in the case of credit, investment and foreign exchange operations, the data must be presented in single groupings that encompass all the different modalities of existing products or services, including modalities not contracted by the customer or that are not yet commercialized by the institution, and the possibility of selection by the customer of the origin of the data (modalities, submodalities, or specific contracts) for sharing is prohibited.

Any detailed breakdown of the data subject to sharing must be hidden by default. A resource (button, link, among others) must be made available so that the customer, if they wish, can access the detailed breakdown of the data that will be shared.

The data sharing journey in the data transmitting institution's environment must not contain a "Terms and Conditions" resource, or similar. The aforementioned resource may, at the institution's discretion, be included in the transmitting institution's Consent Management environment, addressed in subsection 4.1.5 of this manual.

• IX - redirection to the data receiving institution's environment

The customer must be informed that they are being securely redirected to the data receiving institution's environment and that this step is necessary to complete the sharing. The redirection cannot involve any customer action, being merely informative, and must occur to the same electronic channel of the data receiving institution used by the customer in the initial step of the journey.

Institutions subject to the obligation of redirection to the application without passing through browsers, as set forth in item VI of this subsection, when acting as data receivers, must implement the redirection provided for in this step also without passing through browsers.

• X - the completion of the data sharing request

The customer must be notified by the data receiving institution about the completion of the data sharing request. The communication must include, at a minimum, the purpose(s), the term and the data of the sharing.

4.1.2 Simple journey for sharing payment transaction initiation service with redirection

The content of this journey must cover, at a minimum:

• I - customer identification

The payment transaction initiating institution must identify the customer, as required by current regulations.

• II - selection of the account-holding institution

The customer must be able to select the institution where they hold the account that will be used for payment. A search mechanism must be made available that provides an agile and clear selection of the desired institution. All participating institutions for the purpose of sharing the payment transaction initiation service in Open Finance duly registered as account-holding institutions in the Participants Directory maintained by the Open Finance Governance Responsible Structure with published APIs for offering the product must be listed.

• III - information about the payment transaction or the configuration of a recurrence, in the case of successive payments

At a minimum, the following information must be requested or presented to the customer:

• a) in the case of single payments:

  • 1. the payment amount;

  • 2. the payment method, in accordance with the payment services addressed in art. 6 of Circular No. 4.015, of 2020;

  • 3. the data of the payment recipient, in accordance with the parameters referring to the payment method;

  • 4. the payment date; and

  • 5. the amount of the fee charged for the payment transaction initiation service, when applicable; and

• b) in the case of setting up recurrence for successive payments:

  • 1. the payment amount, when applicable, being optional in cases of successive payment transactions in which the agreed amount is variable;

  • 2. the payment method, in accordance with the payment services addressed in art. 6 of Circular No. 4.015, of 2020;

  • 3. the future payment dates, when applicable;

  • 4. the frequency of the transactions or the conditions that trigger them;

  • 5. the consent term, when applicable;

  • 6. limits, when applicable;

  • 7. the data of the payment recipient, in accordance with the parameters referring to the payment method; and

  • 8. the amount of the fee charged for the payment transaction initiation service, when applicable.

In addition to the minimum information for payment transaction initiation set out above, the data set out in the regulations or instruments that govern the operation of the payment arrangement referring to the respective payment transaction and other data established in the specifications available on the Open Finance Brazil Portal must be observed in general.

At this stage, the presentation of a "Terms and Conditions" resource, or similar, is permitted, provided that no additional action by the customer is required to accept the terms.

• IV - redirection to the environment of the account-holding institution

The customer must be informed that they are being securely redirected to the environment of the selected account-holding institution. It must be clear to the customer that the payment is not yet completed and that additional steps are necessary for it to be effected. The customer must also be informed about the maximum time they have to confirm the transaction.

The redirection cannot require any action by the customer, being merely informative, and must include the following:

• a) journeys initiated at the payment transaction initiating institution on a desktop device: redirection must preferably occur to the same device; and

• b) journeys initiated at the payment transaction initiating institution on a mobile device:

  • 1. in the case of account-holding institutions belonging to conglomerates subject to customer journey monitoring, in accordance with the Open Finance Monitoring Manual, redirection must occur directly to the account-holding institution's app without passing through browsers; and

  • 2. the other account-holding institutions not covered by customer journey monitoring, in accordance with the Open Finance Monitoring Manual, must preferably redirect to their apps.

Exceptionally, if the customer does not have the account-holding institution's app installed on their mobile device, redirection must be made to the institution's environment in the browser or to the app store, always on the same device.

It is emphasized that there is no obligation to develop an app for institutions that do not offer this channel to their customers. In the latter case, the institution's channel in the browser may be used.

• V - customer authentication at the account-holding institution

The customer must authenticate at the account-holding institution. The customer must be able to recognize that they are in the environment of the institution with which they already have a relationship and that the credentials used for authentication are not visible and will not be shared with the payment transaction initiating institution.

As established by Joint Resolution No. 1, of 2020, the procedures and controls for customer authentication must be compatible with those applicable to access to the electronic service channels already made available by the account-holding institution. This compatibility covers, among others, the authentication factors, the number of steps and the duration of the procedure.

• VI - confirmation of sharing by the customer at the account-holding institution

The customer must confirm the payment at the account-holding institution. If they hold more than one account associated with the credentials with which they authenticated, the customer must be able to select the account they wish to use for the payment transaction.

At a minimum, the information listed in items 1 to 4 of subitem "a" and 1 to 7 of subitem "b" of item III of this subsection, which deal with the payment transaction information stage, must be presented to the customer for confirmation. Additionally, the amount of the fee charged by the account-holding institution when carrying out the payment transaction, when applicable, must be presented to the customer.

The payment transaction initiation service sharing journey in the account-holding institution's environment must not contain a "Terms and Conditions" resource, or similar. The aforementioned resource may, at the institution's discretion, be included in the account-holding institution's Consent Management environment, addressed in subsection 4.1.5 of this manual.

• VII - redirection to the environment of the payment transaction initiating institution

The customer must be informed that they are being securely redirected to the environment of the payment transaction initiating institution and that this step is necessary to complete the sharing. The redirection cannot require any action by the customer, being merely informative, and must occur to the same electronic channel of the payment transaction initiating institution used by the customer in the initial stage of the journey.

Institutions subject to the obligation of redirection to the app without passing through browsers, as set out in item IV of this subsection, when acting as payment transaction initiators, must implement the redirection provided for in this stage also without passing through browsers.

• VIII - effecting the payment transaction

The payment transaction initiating institution must present proof of completion of the payment transaction, whether single or successive. Proof must be presented to the customer containing at least the information listed in item III of this subsection, which deals with the stage of information about the payment transaction.

4.1.3 Simple payment transaction initiation service sharing journey without redirection

The simple payment transaction initiation service sharing journey without redirection consists of two stages: account linking and payment transaction.

4.1.3.1 Account linking stage

The content of this journey must include at least:

• I - customer identification

The payment transaction initiating institution must identify the customer, as required by current regulations.

• II - selection of the account-holding institution

The customer must be able to select the institution where they hold the account that will be linked for carrying out payment transactions. A search mechanism must be provided that enables agile and clear selection of the desired institution. The account-holding institutions with mandatory implementation must be listed, in accordance with Resolution BCB No. 406 of 2024, art. 6, and those that optionally join the service.

• III - redirection to the account-holding institution's environment

The customer must be informed that they are being securely redirected to the environment of the selected account-holding institution. It must be clear to the customer that the account linking is not yet complete and that additional steps are necessary for its completion. The customer must also be informed of the maximum time they have to confirm the linking.

All provisions set forth in subsection 4.1.2, item IV, apply.

• IV - customer authentication at the account-holding institution

All provisions set forth in subsection 4.1.2, item V, apply.

• V - presentation of information about account linking

Information about the account linking to be performed must be presented to the customer. The information must include at least:

• a) user identification;

• b) identification of the initiating institution;

• c) the five-year validity period of the consent, as required by current regulations, which the customer must be able to reduce or extend;

• d) the maximum amounts per transaction and per day:

  • 1. the field for the maximum amount per transaction of R$500.00 filled in, which the customer must be able to reduce; and

  • 2. the field for the maximum amount per day not filled in, which the customer must have the option to enter an amount; and

• e) identification of the source account.

The customer must be informed that the Pix transaction limits established at the institution holding the linked account will be respected.

Participating institutions with bilateral contracts may present a higher per-transaction limit, in accordance with the sole paragraph of art. 7 of Resolution BCB No. 406 of 2024.

• VI - confirmation of sharing by the customer at the account-holding institution:

The customer must confirm the account linking at the account-holding institution upon viewing the information listed in items "a" to "e" of item V of subsection 4.1.3.1, which deals with information about account linking.

If the customer holds more than one account associated with the credentials with which they authenticated, the customer must be able to select the account they wish to use for the linking.

The payment transaction initiation service sharing journey in the account-holding institution's environment must not contain a "Terms and Conditions" feature, or similar. That feature may, at the institution's discretion, be included in the Consent Management environment of the account-holding institution, addressed in subsection 4.1.5 of this manual.

• VII - redirection to the payment transaction initiating institution's environment

The customer must be informed that they are being securely redirected to the payment transaction initiating institution's environment and that this step is necessary to complete the account linking. The redirection must occur to the same electronic channel of the payment transaction initiating institution used by the customer in the initial stage of the journey.

Institutions subject to the obligation to redirect to the app without passing through browsers, as set forth in item IV of subsection 4.1.2, when acting as payment transaction initiators, must implement the redirection provided for in this stage also without passing through browsers.

• VIII - creation of keys on the electronic device

The customer must be informed that, to complete the account linking, they must validate the generation of security keys using their credentials registered on the device (biometrics, password, etc.).

• IX - completion of account linking

The payment transaction initiating institution must confirm the account linking.

The customer must be informed that the summary of the linking request will be available for consultation in the consent management environment (linked accounts) and that revocation can be done at any time, with an indication of where to perform this action.

4.1.3.2 Payment transaction stage

The content of this journey must include at least:

• I - customer identification

The payment transaction initiating institution must identify the customer, as required by current regulations.

• II - request to initiate payment transactions with the linked account

The payment transaction initiating institution must present to the customer the possibility of making the payment using their previously linked account among the other payment options.

The payment arrangement being used must be clear to the customer.

• III - selection of the institution holding the linked account

The customer must be able to select the institution with which they have already completed the account linking step. A search mechanism must be provided that enables an agile and clear selection of the desired institution. All institutions with which the customer has already completed the account linking step at that payment transaction initiating institution and on that device must be listed.

• IV - Information about the single payment transaction

At a minimum, the following information must be requested from or presented to the customer:

• a) the payment amount;

• b) the payment method, in accordance with the payment services referred to in art. 6 of Circular No. 4.015, of 2020;

• c) the payee's data, in accordance with the parameters related to the payment method;

• d) the payment date; and

• e) the amount of the fee charged for the payment transaction initiation service, if any.

In addition to the minimum information for payment transaction initiation set out above, the data set out in the regulations or instruments that govern the operation of the payment arrangement related to the respective payment transaction and other data established in the specifications available on the Open Finance Brazil Portal must generally be observed.

The presentation of a "Terms and Conditions" resource, or similar, is permitted, provided that no additional action by the customer is required to accept the terms.

• V - the customer's confirmation of sharing at the payment transaction initiating institution

The customer must confirm the payment at the payment transaction initiating institution. The customer must be asked to confirm using their credentials registered on the device.

• VI - the completion of the payment transaction

The payment transaction initiating institution must present the receipt for the completion of the payment transaction. A receipt must be presented to the customer with, at a minimum, the information listed in item IV of subsection 4.1.3.2, which deals with the payment transaction information step.

4.1.4 Multi-level data and service sharing journey

The Guide must establish parameters for the customer experience in a multi-party data and service sharing journey, where applicable.

In this case, all customers involved in the sharing must be clearly informed about the procedures and steps necessary to complete the sharing. Additionally, approving customers must be timely notified by the data transmitting or account holding institution about the need for action to complete the data or service sharing initiated by the requesting customer.

In particular, the Guide must establish, where applicable, the maximum deadlines for action by approving customers, which must be applied uniformly by all participating institutions. Furthermore, the Guide must establish parameters for cases in which one or more approving customers do not authorize the sharing, covering at a minimum the notification to the other customers (requesting or approving) and communication to the data receiving or payment transaction initiating institution.

For the purpose of sharing data related to joint accounts of natural persons, the data transmitting institution must ensure that the data receiving institution has access to registration data only of the account holder responsible for the consent, and sharing of the registration data of the other holders of the respective account is not permitted.

The data transmitting institution must require confirmation from all account holders to complete the sharing only if access to the account's transactional information depends on the authorization of all holders.

4.1.5 Consent management environment

The Guide must establish requirements for the consent management environment of the participating institutions. In this case, the aforementioned institutions must make available on their electronic channel a specific environment for the management of the sharings in which they were involved within the scope of Open Finance.

In this environment, the customer must have simple, agile, accurate and convenient access to, at a minimum, information about consents and account links that are active or pending completion in the multi-party journey, with the possibility of searching based on criteria defined for homogeneous observance by all participating institutions.

Additionally, the customer must have the ability to consult and revoke consents, in compliance with the provisions of art. 15 of Joint Resolution No. 1, of 2020. The completion of revocation must be preceded by a confirmation screen with information about the consequences of the action.

4.1.6 Standardization of terminology used by participating institutions during the sharing journey

The Guide must standardize the terminology used by participating institutions in communication with their customers during the data and service sharing journey.

The terminology contained in the Guide must be adopted by all participating institutions, including in their communication processes to the general public associated with Open Finance, ensuring uniformity of customer experience and preventing the emergence of doubts or insecurity during data and service sharing.

4.2 Structure of the Customer Experience Guide

The Guide must be structured in a clear and cohesive manner so that it is properly interpreted by interested parties. Additionally, the Guide must contain example screens that illustrate the steps of the customer's data and service sharing journeys.

In turn, the provisions of the Guide must be classified into, at a minimum:

• I - requirements: provisions that must be mandatorily followed by participating institutions; and

• II - recommendations: provisions for non-mandatory observation by participating institutions, but whose implementation is recommended, considering good practices for the customer experience.

In this regard, the Guide must contain requirements and recommendations applicable to the various situations of data and service sharing, covering, at a minimum:

• I - sharing of data and services by natural persons;

• II - sharing of data and services by legal entities;

• III - sharing of data and services by natural persons holding joint accounts where the consent of more than one account holder is required;

• IV - sharing of data and services by legal entities where the consent of more than one representative or attorney of the company is required; and

• V - environment for managing consents granted by natural and legal persons at participating institutions.

Brasília, 4 December 2024.

NOTE 836/2024-BCB/DENOR, OF 3 DECEMBER 2024.

It provides the basis for the proposed issuance of a normative instruction that establishes version 7.0 of the Open Finance Customer Experience Manual.

Mr. Heads of Denor and Deinf,

This Note provides the basis for the proposed issuance of a normative instruction by the Financial System Regulation Department (Denor) and the Information Technology Department (Deinf), using the authority conferred by art. 23, item I, subitem "a", of the Internal Rules of the Central Bank of Brazil, annexed to BCB Resolution No. 340, of 21 September 2023, based on art. 3, item I, of BCB Resolution No. 32, of 29 October 2020.

2. In this regard, the proposal concerns the issuance of a normative instruction that establishes version 7.0 of the Open Finance Customer Experience Manual, revoking BCB Normative Instruction No. 463, of 29 August 2023, which published version 6.0 of that manual.

3. The changes in the new version of the manual aim to clarify and define operational procedures that must be adopted by Open Finance participating institutions in order to comply with obligations established in Joint Resolution No. 1, of 4 May 2020, particularly with regard to the changes brought about by Joint Resolution No. 10, of 4 July 2024, as well as compliance with the provisions of BCB Resolution No. 406, of 2 August 2024.

4. In summary, the proposed version of the manual details guidelines for user experience in cases of payment transactions in which there is no redirection to the environment of the account-holding institution. It also includes guidelines for the prior step of linking that account to the payment-initiating institution, through a journey with redirection of the customer for authentication at the institution holding the account in question.

5. It is worth emphasizing that, in compliance with the provisions of art. 5 of Law No. 13,874, of 20 September 2019, Decree No. 10,411, of 30 June 2020, determines that proposals for normative acts of general interest to economic agents formulated by bodies and entities of the direct, autarchic, and foundational federal public administration, as well as by collegiate bodies through the body or entity responsible for providing administrative support to them, be preceded by a Regulatory Impact Analysis (RIA).

6. In this regard, it is worth noting that, as mentioned, the proposed changes refer to details of obligations already established in the cited normative acts. In addition, the provisions of the normative instruction proposed herein reflect the specifications developed by the Open Finance Governance Structure and being implemented by participating institutions.

7. Accordingly, I understand that this normative instruction is exempt from the RIA, pursuant to art. 4, item III, combined with art. 2, item II, of Decree No. 10,411, of 2020, given that the normative act can be considered of low impact.

8. Finally, considering that the specifications and details regarding the user experience in the journey detailed herein were widely discussed in bilateral meetings and in working groups of the Open Finance Governance Structure, the provisions of art. 9-A, § 2, of Decree No. 10,411, of 2020, are met, which makes social participation mechanisms mandatory in the event of exemption from RIA due to low impact, as proposed above.

For your consideration.

MARDILSON FERNANDES QUEIROZ ESTENIO DO NASCIMENTO SOBRAL Consultant of Denor Deputy Head of Deinf, substitute

Agreed.

GILNEU FRANCISCO ASTOLFI VIVAN HAROLDO JAYME MARTINS FROES CRUZ Head of Denor Head of Deinf