Normative Instruction BCB No. 590 of February 5, 2025

Resolution No. 222

NORMATIVE INSTRUCTION
BCB NO. 590, OF FEBRUARY 5, 2025

Amends the BCB Normative Instruction No. 330, of November 24, 2022, which consolidates the procedures for registering corporate information in the System of Information on Entities of Interest of the Central Bank (Unicad) established by BCB Resolution No. 209, of March 22, 2022, establishing procedures for the registration of a contracted company as provided for in Article 5 of Joint Resolution No. 6, of May 23, 2023.

The Head of the Financial System Monitoring Department – Desig, in the exercise of the authority granted by Article 23, item I, letter “a”, of the Internal Regulations of the Central Bank of Brazil, published through BCB Resolution No. 340, of September 21, 2023, based on Article 85, item I, letter “b”, of said Regulations, in view of the provisions of Joint Resolution No. 6, of May 23, 2023, CMN Resolution No. 4,893, of February 26, 2021, and BCB Resolutions No. 85, of April 8, 2021, No. 209, of March 22, 2022, and No. 343, of October 4, 2023,

RESOLVES:

Article 1. The BCB Normative Instruction No. 330, of November 24, 2022, published in the Official Gazette of the Union on November 25, 2022, shall enter into force with the following amendments:

“Section VIII
Of the registration of a contracted company for the provision of data and information sharing services regarding fraud indicators

Article 10-C. For the purposes of compliance with the provisions of Article 15 of CMN Resolution No. 4,893, of February 26, 2021, and Article 15 of BCB Resolution No. 85, of April 8, 2021, the contracting of a company for the provision of data and information sharing services regarding fraud indicators, provided for in Article 5 of Joint Resolution No. 6, of May 23, 2023, must be registered in Unicad in the “Links” module, option “Inclusion”, in the following fields:

I - CNPJ of the contracting financial institution;

II - CNPJ of the contracted company;

III - service start date;

IV - service end date, if applicable;

V - observations, if necessary.

§ 1. If the institution opts not to contract a company as provided for in the main text, it must inform its CNPJ in the fields related to items I and II.

§ 2. The registration referred to in the main text must be carried out within ten days after the contracting of services or in the case of non-contracting thereof.” (NR)

Article 2. This Normative Instruction enters into force on March 3, 2025.

Article 2. This Normative Instruction enters into force on March 3, 2025, producing effects from May 2, 2025. (Wording given by BCB Normative Instruction No. 592, of 3/19/2025.)

ANDRÉ MAURÍCIO TRINDADE DA ROCHA

NOTE

The System of Information on Entities of Interest of the Central Bank - Unicad, established by BCB Resolution No. 209, of March 22, 2022, was instituted with the objective of maintaining, in a single database, corporate information on financial institutions, other institutions authorized to operate, and natural and legal persons who are subject to some type of authorization or registration by the Central Bank of Brazil, or who are of interest to this Autarchy.

2. On May 23, 2023, Joint Resolution No. 6 was published, which establishes requirements for sharing data and information regarding fraud indicators to be observed by financial institutions, payment institutions, and other institutions authorized to operate by the Central Bank of Brazil, except for consortium administrators.

3. The aforementioned Resolution also establishes that institutions may contract a company to provide the service of sharing data and information regarding fraud indicators. Furthermore, it considered this service relevant for the purposes of applying current regulation on the contracting of processing and data storage services and cloud computing by financial institutions, payment institutions, and other institutions authorized to operate by the Central Bank of Brazil.

4. CMN Resolution No. 4,893, of February 26, 2021, and BCB Resolution No. 85, of April 8, 2021, which establish the cybersecurity policy and the requirements for contracting processing and data storage services and cloud computing to be observed by institutions authorized to operate by the Central Bank of Brazil, establish that the contracting of relevant processing, data storage, and cloud computing services must be communicated to the Central Bank of Brazil, and that this communication must be carried out within ten days after the contracting of the services.

5. In light of this, the present Normative Instruction aims to establish the procedures for registering in Unicad the corporate information relating to the company contracted to provide the service of sharing data and information regarding fraud indicators.

6. Decree No. 10,411, of June 30, 2020, regulates the conduct of regulatory impact analysis – AIR as a prerequisite for the issuance of a normative act. However, in its Article 4, the aforementioned Decree establishes the circumstances for exemption from conducting an AIR. The present Normative Instruction falls under the circumstance provided for in item III - normative act considered to have low impact.

7. Considering that Unicad is a system for registering corporate information on natural and legal persons of interest to the Central Bank of Brazil, I understand that for the purposes of compliance with the provisions of CMN Resolution No. 4,893, of 2021, and BCB Resolution No. 85, of 2021, Unicad is the most appropriate place to register the information of companies contracted based on Article 5 of Joint Resolution No. 6, of 2023, and that it generates the lowest cost, both for the institutions and for the Central Bank of Brazil itself.

8. It is important to highlight that this proposal was presented to trade entities in a consultation sent on November 27, 2024, with no objection from those involved.

9. Thus, based on the provisions of paragraphs 6 to 8, I understand that the issuance of the present Normative Instruction is exempt from conducting a regulatory impact analysis.

ANDRÉ MAURÍCIO TRINDADE DA ROCHA
Head of the Financial System Monitoring Department – Desig