RESOLUTION BCB No. 260, OF 22 NOVEMBER 2022

~~Provides for the internal control systems of consortium administrators and payment institutions authorized to operate by the Central Bank of Brazil.~~

Provides for the internal control systems of consortium administrators, payment institutions, securities brokerage firms, securities distribution firms, and foreign‑exchange brokerage firms authorized to operate by the Central Bank of Brazil.

Provides for the internal control systems of consortium administrators, payment institutions, securities brokerage firms, securities distribution firms, foreign‑exchange brokerage firms and virtual‑asset service providers authorized to operate by the Central Bank of Brazil. (Amended by Resolution BCB No. 552, of 3/3/2026.)

The Collegiate Board of the Central Bank of Brazil, in a session held on 22 November 2022, based on arts. 6 and 7, item III, of Law No. 11.795, of 8 October 2008, art. 9, items II and IX, paragraph "b", and art. 15 of Law No. 12.865, of 9 October 2013,

RESOLVES:

CHAPTER I

OF THE OBJECT AND SCOPE OF APPLICATION

~~Art. 1. This Resolution provides for the internal control systems of consortium administrators and payment institutions authorized to operate by the Central Bank of Brazil.~~

Art. 1. This Resolution provides for the internal control systems of the following institutions authorized to operate by the Central Bank of Brazil: (Amended, as of 1/3/2024, by Resolution BCB No. 368, of 25/1/2024.)

I – consortium administrators; (Included, as of 1/3/2024, by Resolution BCB No. 368, of 25/1/2024.)
II – payment institutions; (Included, as of 1/3/2024, by Resolution BCB No. 368, of 25/1/2024.)
III – securities brokerage firms; (Included, as of 1/3/2024, by Resolution BCB No. 368, of 25/1/2024.)
~~IV – societies distributors of securities and values;~~ [(Included, as of 1/3/2024, by Resolution BCB No. 368, of 25/1/2024.)]
IV – securities distribution firms; (Amended by Resolution BCB No. 552, of 3/3/2026.)
~~V – foreign‑exchange brokerage firms.~~ [(Included, as of 1/3/2024, by Resolution BCB No. 368, of 25/1/2024.)]
V – foreign‑exchange brokerage firms; and (Amended by Resolution BCB No. 552, of 3/3/2026.)
VI – virtual‑asset service providers. (Included by Resolution BCB No. 552, of 3/3/2026.)

CHAPTER II

OF INTERNAL CONTROL SYSTEMS

Section IDa – Mandatory and Objectives

Art. 2. Consortium administrators and payment institutions authorized to operate by the Central Bank of Brazil must implement and maintain internal control systems compatible with their nature, size, complexity, structure, risk profile and business model.

Art. 2. The institutions mentioned in Art. 1 must implement and maintain internal control systems compatible with their nature, size, complexity, structure, risk profile and business model. (Amended, as of 1/3/2024, by Resolution BCB No. 368, of 25/1/2024.)

Art. 3. Internal control systems must aim to achieve the objectives of:

I – performance: related to the efficiency and effectiveness in the use of resources in the activities carried out;
II – information: related to the voluntary or mandatory, internal or external disclosure of financial, operational and managerial information that is useful for the decision‑making process;
III – compliance: related to compliance with legal, regulatory provisions and internal policies and codes.

Section IIDas – Essential Characteristics

Art. 4. Internal control systems must:

I – be continuous and effective, covering control activities for all business levels and for all risks to which the institution is exposed; [(Amended, as of 1/3/2024, by Resolution BCB No. 368, of 25/1/2024.)]
II – integrate the routine activities of the relevant areas of the institution; [(Amended, as of 1/3/2024, by Resolution BCB No. 368, of 25/1/2024.)]
III – be reviewed and updated periodically.

Art. 5. Internal control systems must provide for:

I – Aspects related to control culture:

a) definition of employee responsibilities in the internal control systems and the means for their effective fulfillment;
b) mandatory timely communication to the appropriate managerial level, by employees, of:
1. operational problems;
2. situations of non‑compliance with conduct standards defined by the institution mentioned in Art. 1; [(Amended, as of 1/3/2024, by Resolution BCB No. 368, of 25/1/2024.)]
3. violations of the institution’s policies or of legal and regulatory provisions; [(Amended, as of 1/3/2024, by Resolution BCB No. 368, of 25/1/2024.)]
c) prohibitions on setting performance targets that encourage risk‑taking inconsistent with levels determined by senior management;
d) formalization of the commitment to ethics and integrity, including compliance with the code of ethics or an equivalent document;
e) disclosure of the code of ethics or equivalent document;

II – Aspects related to risk identification and assessment:

a) means to continuously identify and assess internal and external factors that may adversely affect the achievement of the objectives of the institution mentioned in Art. 1 and, when applicable, of the economic group to which it belongs; [(Amended, as of 1/3/2024, by Resolution BCB No. 368, of 25/1/2024.)]
b) periodic review and updating of internal control systems, including measures related to new or previously unaddressed risks;
c) measures to mitigate non‑tolerated and uncontrolled risks;
d) analysis of the potential occurrence of fraud in activities carried out at all business levels;

III – Aspects related to control activities and segregation of functions:

a) policies and control procedures, as well as verification of their compliance;
b) review and monitoring of relevant activities by appropriate managerial levels;
c) appropriate activity controls for the different departments or business areas;
d) physical controls of valuable assets, such as restricted access, dual custody and periodic inventories;
e) verification of compliance with exposure limits and monitoring of non‑compliance situations;
f) system of approvals and authorizations for sensitive transactions and of verification and reconciliation;
g) appropriate segregation of functions assigned to members of the institution mentioned in Art. 1, to avoid conflicts of interest; [(Amended, as of 1/3/2024, by Resolution BCB No. 368, of 25/1/2024.)]
h) independent identification and monitoring of areas that may have potential conflicts of interest, with periodic review of responsibilities and functions that could generate such conflicts;
i) controls that aim to prevent the institution mentioned in Art. 1 from involvement in improper or illegal activities, especially those related to social, environmental and climate risks; [(Amended, as of 1/3/2024, by Resolution BCB No. 368, of 25/1/2024.)]
j) procedures and controls provided for in current legislation and regulations, aiming at preventing the use of the financial system for money‑laundering, concealment of assets, rights and values, and terrorist financing;
k) controls for the prevention, detection, investigation and correction of fraud;

IV – Aspects related to information and communication:

a) effective communication channels that ensure employees, according to their level of operation, have access to understandable, reliable, timely and relevant information for performing their tasks and fulfilling their responsibilities;
b) adequate information flows so that objectives, strategies, expectations, policies and procedures established by superiors reach employees and relevant information is shared among organizational components;
c) methodologies for recording and maintaining internal information of the institution mentioned in Art. 1, such as financial, operational and compliance data; [(Amended, as of 1/3/2024, by Resolution BCB No. 368, of 25/1/2024.)]
d) guidelines for the use of external information sources and for disclosure to the external public about market events and conditions relevant to decision‑making;
e) reliable information systems and respective security measures and independent monitoring for their maintenance;
f) requirements related to appropriate processing of electronic‑format information and provision of an adequate audit trail;
g) periodic security tests for information and technology systems; [(Amended, as of 1/1/2025, by Resolution BCB No. 431, of 13/11/2024.)]
h) business continuity and recovery plans for situations where service provision by the institution mentioned in Art. 1 is interrupted due to events beyond its control, including the use of remote physical facilities and services provided by third parties; [(Amended, as of 1/3/2024, by Resolution BCB No. 368, of 25/1/2024.)]
i) measures to ensure the provision of correct documents, data and information in accordance with deadlines and conditions established in legal or regulatory norms, including through the implementation of a process to verify the quality of the information provided; [(Included, as of 1/1/2025, by Resolution BCB No. 431, of 13/11/2024.)]

V – Aspects related to monitoring:

a) continuous monitoring of the effectiveness of internal control systems and the main risks associated with the activities of the institution mentioned in Art. 1; [(Amended, as of 1/3/2024, by Resolution BCB No. 368, of 25/1/2024.)]
b) periodic assessments, including by internal audit, of the effectiveness of internal control systems and the main risks associated with the activities of the institution mentioned in Art. 1; [(Amended, as of 1/3/2024, by Resolution BCB No. 368, of 25/1/2024.)]
c) systematic follow‑up of activities developed, to evaluate, at a minimum, whether:
1. the objectives of the institution mentioned in Art. 1 are being achieved; [(Amended, as of 1/3/2024, by Resolution BCB No. 368, of 25/1/2024.)]
2. the established limits and applicable legislation and regulation are being complied with; and
3. any identified deviations are promptly corrected;
d) updating of assumptions, methodologies and risk‑management models; and
e) methodology and channels for reporting deficiencies in internal controls to responsible parties, the board and the board of directors, when existing, in case of material failures.

Sole paragraph. The quality‑verification process referred to in item IV, letter “i”, of the caput must include the performance of specific quality tests. [(Included, as of 1/1/2025, by Resolution BCB No. 431, of 13/11/2024.)]

Section IIIDos – Periodic Reports

Art. 6. Systematic monitoring of activities related to internal control systems must be the subject of an annual report, containing:

I – an assessment of the adequacy and effectiveness of the internal control systems;
II – recommendations regarding any deficiencies, with the establishment of a remediation schedule, when applicable; and
III – the statement of the responsible parties from the corresponding areas concerning the deficiencies found in previous verifications and the measures actually taken to remedy them.

Sole paragraph. The report referred to in the caput must:

I – be submitted to the board of directors or, if nonexistent, to the management, as well as to the internal and external audit functions of the institution mentioned in Art. 1; [(Amended, as of 1/3/2024, by Resolution BCB No. 368, of 25/1/2024.)]
II – remain available to the Central Bank of Brazil for a period of five years.

CHAPTER III

OF ADMINISTRATIVE RESPONSIBILITY

Art. 7. The board of directors and senior management must be actively involved in defining internal control systems, by:

I – promoting high ethical standards and integrity;
II – establishing an organizational culture that emphasizes the relevance of internal control systems and the engagement of each employee in the internal control process;
III – maintaining an appropriate organizational structure to ensure the quality and effectiveness of internal control systems and processes; and
IV – guaranteeing adequate and sufficient resources for the exercise of activities related to internal control systems, in an independent, objective and effective manner.

Art. 8. The board of directors is responsible for ensuring that:

I – the management of the institution mentioned in Art. 1 takes the necessary measures to identify, measure, monitor and control risks according to the defined risk levels; [(Amended, as of 1/3/2024, by Resolution BCB No. 368, of 25/1/2024.)]
II – identified failures are promptly corrected;
III – the management of the institution mentioned in Art. 1 monitors the adequacy and effectiveness of internal control systems; [(Amended, as of 1/3/2024, by Resolution BCB No. 368, of 25/1/2024.)]
IV – internal control systems are implemented and maintained in accordance with this Resolution.

Sole paragraph. For the institutions mentioned in Art. 1 that do not have a board of directors, the responsibilities set out in the caput must be attributed to the management of the institution. [(Amended, as of 1/3/2024, by Resolution BCB No. 368, of 25/1/2024.)]

Art. 9. The management of the institution mentioned in Art. 1 is responsible for:

I – implementing the internal control system guidelines approved by the board of directors; and
II – monitoring the adequacy and effectiveness of the internal control system.

Art. 10. The institutions mentioned in Art. 1 must designate, before the Central Bank of Brazil, a director responsible for complying with the provisions of this Resolution. [(Amended, as of 1/3/2024, by Resolution BCB No. 368, of 25/1/2024.)]

Sole paragraph. The director referred to in the caput may perform other functions in the institution, provided there is no conflict of interest. [(Amended, as of 1/3/2024, by Resolution BCB No. 368, of 25/1/2024.)]

CHAPTER IV

GENERAL PROVISIONS

Art. 11. The Central Bank of Brazil may:

I – determine the adoption of additional controls in cases where inadequacy is found in the controls implemented by the institutions mentioned in Art. 1; and [(Amended, as of 1/3/2024, by Resolution BCB No. 368, of 25/1/2024.)]

II - impose more restrictive operational limits on consortium administrators and payment institutions that fail to observe the determination under paragraph I within the time established for that purpose.

II - impose more restrictive operational limits on the institutions mentioned in art. 1º that fail to observe the determination under paragraph I within the time established for that purpose. (Text given, effective from 1 / 3 / 2024, by Resolution BCB No. 368, of 25 / 1 / 2024.)

Art. 12. The following are revoked:

I - Circular No. 3,078, of 10 January 2002;

II - Circular No. 3,856, of 10 November 2017; and

III - paragraph III of art. 25 of Resolution BCB No. 80, of 25 March 2021.

Art. 13. This Resolution enters into force:

I - 1 January 2024, with respect to art. 10; and

II - 1 January 2023, with respect to the remaining articles.

Otávio Ribeiro Damaso
Regulation Director