RESOLUTION BCB NO. 265, OF NOVEMBER 25, 2022

Dispenses with the risk management structure, the capital management structure, and the information disclosure policy of a prudential conglomerate classified as Type 3 and classified in Segment 2 (S2), Segment 3 (S3), or Segment 4 (S4).

Dispenses with the risk management structure, the capital management structure, and the information disclosure policy of an institution classified as Type 3 and classified in Segment 2 – S2, Segment 3 – S3, or Segment 4 – S4. (Amended, effective January 1, 2025, by Resolution BCB No. 447, of December 19, 2024.)

The Collegiate Board of the Central Bank of Brazil, in a session held on November 16, 2022, based on arts. 9, item II, and 15 of Law No. 12,865, of October 9, 2013, and taking into account the provisions of art. 14 of Resolution No. 4,282, of November 4, 2013,

RESOLVES:

Art. 1. This Resolution dispenses with the risk management structure, the capital management structure, and the information disclosure policy of a prudential conglomerate classified as Type 3 and classified in Segment 2 (S2), Segment 3 (S3), or Segment 4 (S4), in accordance with Resolution BCB No. 197, of March 11, 2022.

Art. 1. This Resolution dispenses with the risk management structure, the capital management structure, and the information disclosure policy of an institution classified as Type 3 and classified in Segment 2 – S2, Segment 3 – S3, or Segment 4 – S4, in accordance with Resolution BCB No. 436, of November 28, 2024. (Amended, effective January 1, 2025, by Resolution BCB No. 447, of December 19, 2024.)

CHAPTER I

SCOPE

Art. 2. The lead payment institution of a prudential conglomerate classified as Type 3 and classified in S2, S3, or S4 must implement:

Art. 2. The Type 3 institution classified in S2, S3, or S4 must implement: (Amended, effective January 1, 2025, by Resolution BCB No. 447, of December 19, 2024.)

I - a continuous and integrated risk management structure;

II - a continuous capital management structure; and

III - an information disclosure policy on:

a) the continuous and integrated risk management structure;

b) the continuous capital management structure;

c) the calculation of the amount of risk-weighted assets (RWA), in accordance with Resolution BCB No. 200, of March 11, 2022; and

d) the adequacy of Reference Equity (PR), in accordance with Resolution BCB No. 199, of March 11, 2022.

§ 1. The management structures referred to in the main text must be:

I - compatible with the business model, the nature of operations, and the complexity of the institution's products, services, activities, and processes;

II - proportional to the size and relevance of exposure to risks, according to criteria defined by the institution;

III - adequate to the institution's risk profile and systemic importance; and

IV - capable of assessing risks arising from macroeconomic conditions and the markets in which the institution operates.

§ 2. Each management structure referred to in the main text must be unified for the institutions comprising the same prudential conglomerate, as defined in Resolution BCB No. 168, of December 1, 2021.

§ 3. The establishment of requirements for risk management does not constitute permission for a payment institution to carry out operations or services prohibited by law, regulation, or administrative act, or dependent on prior authorization from the Central Bank of Brazil.

§ 3. The establishment of requirements for risk management does not constitute permission for a Type 3 institution to carry out operations or services prohibited by law, regulation, or administrative act, or dependent on prior authorization from the Central Bank of Brazil. (Amended, effective January 1, 2025, by Resolution BCB No. 447, of December 19, 2024.)

§ 4. The institutions referred to in the main text must adopt a prospective posture regarding risk management and capital management.

§ 5. It is the responsibility of the lead institution of the prudential conglomerate to comply with the obligations set forth in this Resolution. (Added, effective January 1, 2025, by Resolution BCB No. 447, of December 19, 2024.)

CHAPTER II

RISK APPETITE STATEMENT (RAS)

Art. 3. Risk appetite levels must be documented in the Risk Appetite Statement (RAS).

Sole Paragraph. For the purpose of preparing the RAS, the following must be considered:

I - the levels of risk that the institution is willing to assume, in accordance with art. 4, main text, discriminated by risk type and, where applicable, by different time horizons;

II - the institution's capacity to manage risks effectively and prudently;

III - the institution's strategic objectives; and

IV - the competitiveness conditions and the regulatory environment in which the institution operates.

CHAPTER III

RISK MANAGEMENT STRUCTURE

Section I

Requirements of the Risk Management Structure

Art. 4. The risk management structure must identify, measure, assess, monitor, report, control, and mitigate:

I - credit risk, as defined in art. 19, to which the institution is subject in a relevant manner;

II - market risk, as defined in art. 23, to which the institution is subject in a relevant manner;

III - interest rate risk for instruments classified in the banking book (IRRBB), as defined in art. 30, to which the institution is subject in a relevant manner;

IV - operational risk, as defined in art. 34;

V - liquidity risk, as defined in art. 39;

VI - social risk, as defined in art. 41;

VII - environmental risk, as defined in art. 42;

VIII - climate risk, as defined in art. 43;

IX - other relevant risks, according to criteria defined by the institution, including those not covered in the calculation of the amount of risk-weighted assets (RWA).

IX - country risk and transfer risk, as defined in art. 46-A, to which the institution is subject in a relevant manner; and (Amended, effective January 1, 2024, by Resolution BCB No. 332, of June 29, 2023.)

X - other relevant risks, according to criteria defined by the institution, including those not covered in the calculation of the amount of risk-weighted assets (RWA). (Added, effective January 1, 2024, by Resolution BCB No. 332, of June 29, 2023.)

§ 1. Risk management must be integrated, enabling the identification, measurement, assessment, monitoring, reporting, control, and mitigation of adverse effects resulting from interactions between the risks mentioned in the main text.

§ 2. For the purposes of the provision in § 1, interactions between the risks mentioned in the main text and the risk of use of the institution's products and services in the practice of money laundering or terrorist financing must also be considered, in accordance with regulations issued by the Central Bank of Brazil.

Art. 5. The risk management structure must provide for:

I - policies and strategies for risk management, clearly documented, which establish limits and procedures intended to maintain exposure to risks in compliance with the levels set in the RAS;

II - effective processes for tracking and timely reporting of exceptions to risk management policies, limits, and risk appetite levels set in the RAS;

III - systems, routines, and procedures for risk management;

IV - periodic assessment of the adequacy of the systems, routines, and procedures referred to in item III;

V - policies, processes, and controls adequate to ensure the prior identification of risks inherent to:

a) new products and services;

b) relevant modifications in existing products or services;

c) significant changes in processes, systems, operations, and the institution's business model;

d) hedging strategies and risk-taking initiatives;

e) significant corporate reorganizations; and

f) changes in macroeconomic outlooks;

VI - roles and responsibilities for risk management purposes, clearly documented, which establish attributions for the institution's personnel at their various levels, including outsourced service providers;

VII - a stress testing program, as defined in art. 9;

VIII - continuous assessment of the effectiveness of risk mitigation strategies used, considering, among other aspects, the results of stress tests;

IX - policies and strategies, clearly documented, for business continuity management;

X - timely managerial reports for the board of the lead institution, the risk committee, and the board of directors, when existing, covering:

X - timely managerial reports for the institution's board, the risk committee, and the board of directors, when existing, covering: (Amended, effective January 1, 2025, by Resolution BCB No. 447, of December 19, 2024.)

a) aggregated values of exposure to the risks referred to in art. 4 and their main determinants;

b) adherence of risk management to the terms of the RAS and the policies and limits mentioned in the main text, item I;

c) assessment of the systems, routines, and procedures, referred to in the main text, item IV, including any deficiencies of the risk management structure and actions to correct them;

d) actions to mitigate risks and assessment of their effectiveness;

e) degree of dissemination of the risk management culture within the institution; and

f) premises and results of stress tests.

§ 1. The policies for risk management referred to in the main text, item I, must provide for:

I - necessary authorizations and appropriate and timely actions by the board of the lead institution and, where applicable, the board of directors, in case of exceptions to policies, procedures, limits, and terms of the RAS;

I - necessary authorizations and appropriate and timely actions by the institution's board and, where applicable, the board of directors, in case of exceptions to policies, procedures, limits, and terms of the RAS; and (Amended, effective January 1, 2025, by Resolution BCB No. 447, of December 19, 2024.)

II - instruments, financial services, and hedging strategies with intended use by the institution, in compliance with the terms of the RAS.

§ 2. The systems referred to in the main text, item III, include information systems adequate to assess, measure, and report, under normal or stress conditions, the size, composition, and quality of exposures, considering the risks incurred by the institution.

§ 3. The reporting produced by the information systems referred to in § 2 must:

I - reflect the institution's risk profile and liquidity needs;

II - be available, periodically and in a manner adequate for use, to the board and to the board of directors, when existing;

III - explicitly state the deficiencies or limitations of risk estimates and the premises adopted in quantitative models and scenarios.

§ 4. The policies referred to in the main text, item I must be compatible with the other policies established by the institution, including the Social, Environmental, and Climate Responsibility Policy (PRSAC) and the compliance policy.

Art. 6. The following must be disseminated to the institution's personnel at their various levels, including relevant outsourced service providers, in language and degree of information compatible with their area of operation:

I - the risk appetite documented in the RAS and its connection with the activities and routine risk-taking decisions;

II - procedures for reporting occurrences related to non-compliance with the risk appetite levels set in the RAS;

III - the policies, strategies, processes, and limits provided for in the risk management structure.

Sole Paragraph. The dissemination of the information referred to in the main text must be carried out through a structured communication process.

Art. 7. Models for risk management, when used and relevant, must be submitted to periodic assessment regarding:

I - the adequacy and robustness of the premises and methodologies used;

II - their performance, including the comparison, where applicable, between estimated and observed losses (backtesting).

Sole Paragraph. The assessment of the models referred to in the main text cannot be carried out by the unit responsible for their development nor by the unit that assumes risks.

Art. 8. The institution must maintain a sufficient quantity of technically qualified professionals in areas subject to risk-taking.

Section II

Stress Testing Program

Art. 9. For the purposes of the stress testing program, the following are considered:

I - stress testing program: coordinated set of processes and routines, equipped with its own methodologies, documentation, and governance, with the main objective of identifying the institution's potential vulnerabilities;

II - stress test: exercise, with defined purpose, of prospective assessment of the potential impacts of adverse events and circumstances on the institution or on a specific portfolio;

III - sensitivity analysis: stress testing methodology that allows assessing the impact resulting from variations in a specific relevant parameter on the institution's capital, its liquidity, or the value of a portfolio;

IV - scenario analysis: stress testing methodology that allows assessing, over a determined period, the impact resulting from simultaneous and coherent variations in a set of relevant parameters on the institution's capital, its liquidity, or the value of a portfolio; and

V - second-order effects: adverse consequences resulting from responses by the institution and the market to the originally defined scenario.

Art. 10. The requirements of the stress testing program are:

I - to cover the relevant risks mentioned in art. 4;

II - to assess the impact of significant risk concentrations;

III - to use, in a manner adequate to the needs of risk management, the following stress testing methodologies:

a) sensitivity analysis; and

b) scenario analysis;

IV - to provide for the use of premises and parameters that are adequately severe; and

V - to be clearly documented, with detailing of the following aspects:

a) governance and processes of the program;

b) purpose, frequency, and methodology of each stress test;

c) actions listed to correct weaknesses pointed out by the program, including the assessment of their feasibility in stress situations;

d) methodologies for defining relevant scenarios, when the scenario analysis methodology is used;

e) role played by the institution's specialists in definitions related to stress tests; and

f) methodological limitations of stress tests, including those related to model selection, their premises, and the databases used.

Sole Paragraph. In carrying out the stress testing program, the contribution of specialists from the relevant areas of the institution must be considered, including those in risk-taking, risk management, economics, finance, and capital management.

Art. 11. The institution must ensure, regarding the stress testing program:

I - the use of its results in the identification, measurement, assessment, monitoring, control, and mitigation of the institution's risks;

II - its use to assist in the assessment of the adequacy and robustness of the premises and methodologies used in the models referred to in art. 7, when used.

Art. 12. Stress tests must:

I - be carried out in an integrated manner for the various risks and business units of the institution, considering:

a) the different levels of aggregation of exposures, according to the purpose of the tests; and

b) the prudential conglomerate as a whole;

II - consider the adverse effects resulting from interactions between risks and provide for the use of a common scenario, when the scenario analysis methodology is used.

Art. 13. In the process of elaborating scenarios, when the scenario analysis methodology is used, the following must be considered, when relevant:

I - historical and hypothetical elements;

II - short-term and long-term risks, idiosyncratic and systemic, of national and external origin;

III - interaction between risks;

IV - risks associated with the prudential conglomerate as a whole and with each institution that integrates it;

V - risk of the institution coming to provide financial support to an entity that does not integrate its conglomerate;

VI - asymmetries, non-linearities, second-order effects, and breakage of correlations and other premises.

§ 1. Each scenario elaborated and its severity must be consistent with the purposes of the respective stress test.

§ 2. The low probability of the occurrence of a scenario does not necessarily imply its exclusion from the stress testing program.

Art. 14. The systems mentioned in art. 5, item III, used within the scope of the stress testing program, must be flexible to allow:

I - inclusion and alteration of scenarios, when the scenario analysis methodology is used;

II - incorporation of changes in the business model; and

III - aggregation of operations by risk factors, counterparties, and business lines.

Art. 15. The results of the stress testing program must be incorporated:

I - into the institution's strategic decisions;

II - into the revision of risk appetite levels;

III - into the revision of policies, strategies, and limits established for the purposes of risk management and capital management;

IV - into the structured communication process referred to in art. 6;

V - into the assessment of the institution's capital and liquidity levels and into the preparation of respective contingency plans; and

VI - into the capital adequacy assessment, referred to in art. 48, item VI.

Art. 16. The board of the lead institution and the board of directors, when existing, must actively engage in the stress testing program, indicating the guidelines to be followed and approving scenarios, when the scenario analysis methodology is used.

Art. 16. The institution's board and the board of directors, when existing, must actively engage in the stress testing program, indicating the guidelines to be followed and approving scenarios, when the scenario analysis methodology is used. (Amended, effective January 1, 2025, by Resolution BCB No. 447, of December 19, 2024.)

Art. 17. The Central Bank of Brazil may determine:

I - adjustments in the institution's stress testing program, including the use of scenarios different from those originally established and the carrying out of additional stress tests, if deficiencies are identified in this program; and

II - carrying out of stress tests based on scenarios provided by it.

§ 1. The provision in item II of the main text applies both to stress tests required on an occasional basis and to stress tests required with periodicity defined by the Central Bank of Brazil. (Added, effective December 1, 2025, by Resolution BCB No. 484, of June 26, 2025.)

§ 2. Information regarding the results of the stress tests referred to in item II of the main text must be forwarded to the Central Bank of Brazil in the format defined by it. (Added, effective December 1, 2025, by Resolution BCB No. 484, of June 26, 2025.)

Section III

Business Continuity Management

Art. 18. The policies for business continuity management referred to in art. 5, item IX, must establish:

I - a process for business impact analysis that includes:

a) identification, classification, and documentation of critical business processes;

b) assessment of the potential effects of interruption of the processes mentioned in item "a";

II - strategies to ensure the continuity of the institution's activities and limit losses resulting from the interruption of critical business processes;

III - business continuity plans that establish procedures and estimated deadlines for resumption and recovery of activities in case of interruption of critical business processes, as well as necessary communication actions;

IV - tests and reviews of business continuity plans with adequate periodicity.

§ 1. The policy and business continuity plans must consider services provided by third parties, when relevant.

§ 2. The managerial reports mentioned in art. 5, item X, must include the results of the tests and reviews referred to in the main text, item IV.

Section IV

Credit Risk Management

Art. 19. For the purposes of this Resolution, credit risk is defined as the possibility of occurrence of losses associated with:

I - non-compliance by the counterparty with its obligations as agreed;

II - devaluation, reduction of remunerations, and expected gains in a financial instrument resulting from the deterioration of the credit quality of the counterparty, the intervenor, or the mitigating instrument;

III - restructuring of financial instruments; or

IV - recovery costs of exposures characterized as problematic assets, in accordance with art. 22.

§ 1. For the purposes of credit risk management, the following are considered:

I - counterparty:

a) the borrower;

b) the guarantor;

c) the issuer of a security or financial instrument acquired;

d) the end-user vis-à-vis the issuer of a post-paid payment instrument;

e) the issuer vis-à-vis the acquirer of a payment instrument; and

f) the institution indebted to another institution resulting from an interoperability agreement between different payment arrangements; and

II - restructuring of financial instruments: renegotiation that implies the granting of advantages to the counterparty as a result of the deterioration of its credit quality or of the credit quality of the intervenor or the mitigating instrument.

II - restructuring of financial instruments: renegotiation in accordance with art. 2, item XXI, of Resolution BCB No. 219, of March 30, 2022. (Amended, effective January 1, 2025, by Resolution BCB No. 332, of June 29, 2023.)

§ 2º The advantages mentioned in § 1, item II, include those added to the original financial instruments or formalized in new instruments used for settlement or refinancing of those.

§ 2º (Revoked, effective January 1, 2025, by Resolution BCB No. 332, of June 29, 2023.)

§ 3º The definition of credit risk includes:

I - counterparty credit risk, understood as the possibility of losses arising from the non-compliance with obligations related to the settlement of operations involving bilateral flows, including the trading of financial assets or derivatives;

II - country risk, understood as the possibility of losses related to the non-compliance with obligations associated with a counterparty or mitigating instrument located outside the Country, including sovereign risk, where the exposure is assumed before the central government of a foreign jurisdiction;

II - (Revoked, effective January 1, 2024, by Resolution BCB No. 332, of June 29, 2023.)

III - transfer risk, understood as the possibility of occurrence of obstacles in the foreign exchange conversion of values received outside the Country associated with an operation subject to credit risk;

III - (Revoked, effective January 1, 2024, by Resolution BCB No. 332, of June 29, 2023.)

IV - the possibility of occurrence of disbursements to honor financial guarantees provided;

V - the possibility of losses associated with the non-compliance with obligations as agreed by the intervenor, provider of the mitigating instrument, or collection agent;

VI - concentration risk, understood as the possibility of losses associated with significant exposures:

a) to the same counterparty;

b) to counterparties with activity in the same economic sector, geographic region, or segment of products or services;

c) to counterparties whose revenues depend on the same type of commodity or activity;

d) to financial instruments whose risk factors, including currencies and indexers, are significantly related;

e) associated with the same type of financial product or service; and

f) whose risk is mitigated by the same type of instrument.

Art. 20. Connected counterparties must constitute a single counterparty for the purposes of credit risk management.

§ 1º Connected counterparties are those that share credit risk vis-à-vis the institution, including through a control relationship.

§ 2º For the purposes of this Resolution, the control relationship must be verified upon the occurrence of at least one of the following criteria:

I - one of the counterparties holds, directly or indirectly, more than 50% (fifty percent) of the voting capital of the other counterparty;

II - a voting agreement between a counterparty and other participants in the other counterparty ensures preponderance in the social deliberations of the participating counterparty;

III - a counterparty holds the power to elect or dismiss the majority of the administrators of the other counterparty; or

IV - a counterparty holds preponderance in the operational management decisions of the other counterparty.

§ 3º The criteria used for the identification of each group of connected counterparties must be documented.

§ 4º Exceptionally, the institution may not consider connected counterparties by control relationship as a single counterparty, provided that the absence of sharing of credit risk is demonstrated and documented.

§ 5º For the purposes of credit risk management, the Central Bank of Brazil may consider, at its discretion, two or more counterparties as connected, if it verifies the existence of sharing of credit risk between them.

Art. 21. The management structure referred to in art. 5 must additionally provide, for credit risk:

I - the management of exposures with similar characteristics, both at the individual and aggregate level, covering aspects such as significant sources of credit risk, identification of the counterparty or intervenor, form of aggregation of exposures, and use of mitigating instruments;

II - policies that establish criteria for the identification of significant risk factors for the purposes of concentration risk management;

III - mechanisms for the management of credit risk of:

a) instruments classified in the trading portfolio mentioned in art. 24;

a) instruments classified in the trading portfolio mentioned in art. 26; (Amended, effective July 1, 2023, by Resolution BCB No. 306, of March 23, 2023.)

b) instruments classified in the banking portfolio mentioned in art. 24, § 2º;

b) instruments classified in the banking portfolio mentioned in art. 26, § 2º; (Amended, effective July 1, 2023, by Resolution BCB No. 306, of March 23, 2023.)

IV - management of the credit risk of exposures not recorded in the institution's balance sheet;

V - use of relevant and consistent information for the assessment and measurement of credit risk;

VI - estimation, according to consistent and verifiable criteria, of expected losses associated with credit risk, as well as comparison of estimated values with actually observed losses;

VII - criteria for re-evaluation of the credit quality of counterparties, intervenors, and mitigating instruments;

VIII - observed the accounting regulation in force, mechanisms for provisioning levels to be sufficient in view of the expected losses referred to in item VI;

IX - adequate assessment regarding risk retention in operations of sale or transfer of financial assets;

X - establishment of limits for exposure to concentration risk referred to in art. 19, § 3º, item VI;

XI - policies and procedures, clearly documented, to monitor the total indebtedness of the counterparty, considering all risk factors, including that associated with exposures in foreign currency not protected by hedge;

XII - criteria and procedures, clearly defined and documented, accessible to those involved in the processes of granting and monitoring operations subject to credit risk, including:

a) prior analysis, execution, and renegotiation of operations subject to credit risk;

b) collection and documentation of information necessary for a complete understanding of the credit risk involved in the operations;

c) periodic assessment of the sufficiency degree of mitigating instruments;

d) detection of signs and prevention of deterioration of the counterparty's credit quality;

e) treatment of exceptions to the limits and to the credit risk appetite levels set in the RAS;

f) collection and receipt of credits;

g) recovery of exposures characterized as problem assets, in accordance with art. 22;

XIII - criteria, clearly defined and documented, for the board of directors to deliberate on the assumption of exposure to credit risk:

a) that exceeds the concentration limit, in absolute value or proportional to the PR, established in the risk management policies;

b) incompatible with the institution's risk profile or with the products and services offered by it;

XIV - system for classifying exposures according to the nature of the operation and credit risk, through consistent and verifiable criteria, considering aspects such as:

a) economic-financial situation, as well as other updated registration information of the counterparty and the intervenor, if existing;

b) use of instruments that provide effective mitigation of the credit risk associated with the operation;

c) period of delay in fulfilling financial obligations as agreed;

XV - criteria and procedures for the identification, monitoring, and control of exposure characterized as a problem asset, in accordance with art. 22;

XVI - documentation and storage of information regarding losses associated with credit risk, including those related to restructuring, in accordance with art. 19, § 1º, item II, and credit recovery;

XVII - information systems capable of identifying and aggregating, in a continuous manner, the exposures subject to the concentration risk defined in art. 19, § 3º, item VI.

§ 1º The estimation of expected loss, referred to in the caput, item VI, must consider:

I - the classification of the exposure according to the provisions in the caput, item XIV;

II - the current macroeconomic environment and changes expected in the short term;

III - the probability that the exposure will be characterized as a problem asset;

IV - the expectation of credit recovery, including the granting of advantages, execution costs, and timeframes.

IV - the expectation of credit recovery, including the granting of advantages, execution costs, and timeframes; and (Amended, effective January 1, 2025, by Resolution BCB No. 332, of June 29, 2023.)

V - the impacts of country risk and transfer risk, referred to in art. 46-A, on the probability mentioned in item III and on the expectation of credit recovery mentioned in item IV. (Included, effective January 1, 2025, by Resolution BCB No. 332, of June 29, 2023.)

§ 2º The expected loss estimate must be reviewed semi-annually or:

I - monthly, if the exposure presents delay in payment of charges or amortizations;

II - immediately, upon the characterization of the exposure as a problem asset.

§ 3º The management reports referred to in art. 5, item X, must address the following additional aspects regarding credit risk:

I - the segregated reporting by jurisdiction of exposures subject to country risk and transfer risk, as defined in art. 19, § 3º, items II and III;

I - (Revoked, effective January 1, 2024, by Resolution BCB No. 332, of June 29, 2023.)

II - the assessment and expectation of performance of exposures to credit risk, addressing their classification and respective provisions;

III - the exposures subject to the concentration risk defined in art. 19, § 3º, item VI;

IV - information regarding significant exposures characterized as problem assets, including characteristics, history, and recovery prospects;

V - information on the execution of mitigators and exposures in restructuring.

Art. 22. For the purposes of credit risk management, the exposure must be characterized as a problem asset when at least one of the following events is verified:

Art. 22. For the purposes of credit risk management, the characterization and de-characterization of exposure as a problem asset must occur in accordance with art. 3 of Resolution BCB No. 219, of 2022. (Amended, effective January 1, 2025, by Resolution BCB No. 332, of June 29, 2023.)

I - the respective obligation is overdue for more than ninety days;

I - (Revoked, effective January 1, 2025, by Resolution BCB No. 332, of June 29, 2023.)

II - there are indications that the respective obligation will not be fully honored without recourse to guarantees or collateral.

II - (Revoked, effective January 1, 2025, by Resolution BCB No. 332, of June 29, 2023.)

§ 1º The indications that an obligation will not be fully honored include:

I - the institution considers that the counterparty no longer has financial capacity to honor the obligation under the agreed conditions;

II - the institution, regardless of regulatory requirement, recognizes significant deterioration in the credit quality of the borrower or counterparty in accounting;

III - the operation relating to the exposure is restructured, in accordance with art. 19, § 1º, item II;

IV - the institution files for bankruptcy or takes similar action against the counterparty; and

V - the counterparty requests or suffers any type of judicial measure that limits, delays, or prevents the fulfillment of its obligations under the agreed conditions.

§ 1º (Revoked, effective January 1, 2025, by Resolution BCB No. 332, of June 29, 2023.)

§ 2º Exposures characterized as problem assets can only have this condition changed in the face of evidence of the counterparty's resumption of the capacity to honor its obligations under the agreed conditions.

§ 2º (Revoked, effective January 1, 2025, by Resolution BCB No. 332, of June 29, 2023.)

§ 3º The criteria for the evidence referred to in § 2º must be previously established by the institution and clearly documented.

§ 3º (Revoked, effective January 1, 2025, by Resolution BCB No. 332, of June 29, 2023.)

Section VOn the Management of Market Risk and IRRBB

Art. 23. For the purposes of this Resolution, market risk is defined as the possibility of occurrence of losses resulting from fluctuations in the market values of instruments held by the institution.

Sole paragraph. The definition referred to in the caput includes:

I - the risk of variation in interest rates and stock prices, for instruments classified in the trading portfolio; and

II - the risk of foreign exchange variation and commodity prices (commodities), for instruments classified in the trading portfolio or in the banking portfolio.

Art. 24. Instruments subject to market risk, as defined in art. 23, must be managed by a trading desk structure.

§ 1º For the purposes of this Resolution, the following are defined:

I - trading desk as a group of traders or trading books with clearly defined and documented business strategies and organization, subject to the institution's market risk management process; and

II - trading book as the specific managerial unit for the management of a given trading activity of instruments.

§ 2º The trading desk structure must be defined and documented by the institution taking into account its organizational structure and the criteria and procedures established by the Central Bank of Brazil.

§ 3º The granularity of the trading desk structure must be adequate to the institution's trading volume and the types of instruments traded.

Art. 25. Each trading desk referred to in art. 24 must manage exclusively instruments subject to market risk.

Art. 26. The trading portfolio is formed by instruments, including derivatives, held for trading purposes and that meet the following conditions:

I - are free from legal impediments to sale; and

II - are evaluated daily at market value, according to criteria defined by the regulation in force.

§ 1º Adjustments to the market value of the instrument resulting from the evaluation referred to in item II of the caput must be recognized in counterpart to an adequate revenue or expense account, in the period's results of the institutions.

§ 2º Instruments not classified in the trading portfolio must constitute the banking portfolio.

§ 3º Instruments subject to temporary legal impediments may be classified in the trading portfolio, provided they are documented based on consistent and verifiable criteria.

Art. 27. In extraordinary situations duly justified, the Central Bank of Brazil may authorize, according to criteria and procedures established by it, the exceptional classification of instruments that meet the provisions of art. 26 in the banking portfolio or the reclassification of instruments between the trading and banking portfolios.

Art. 28. The institution must establish clearly defined policies to determine which instruments will be included in the trading portfolio, as well as procedures to ensure that the classification criteria in this portfolio are observed consistently.

§ 1º In the event that the institution does not maintain a trading portfolio, the policy and procedures referred to in the caput must ensure the non-existence of instruments held with trading intent.

§ 2º In the definition of the policy and procedures referred to in the caput, the criteria established by the Central Bank of Brazil must be observed.

Art. 29. For the purposes of this Resolution, internal risk transfer corresponds to the internal registration of an operation with derivatives that allows the transfer of risks within the banking portfolio, between the banking portfolio and the trading portfolio, or within the trading portfolio, of the same prudential conglomerate.

§ 1º Internal risk transfers between the banking portfolio and the trading portfolio or within the trading portfolio must be registered in trading desks.

§ 2º To produce effects in the capital requirement, internal risk transfers from the banking portfolio to the trading portfolio must be registered in a trading desk dedicated and previously authorized by the Central Bank of Brazil.

§ 3º The criteria and procedures regarding internal risk transfers will be established by the Central Bank of Brazil, including with regard to the production of effects in the capital requirement.

Art. 30. IRRBB is defined as the risk, current or prospective, of the impact of adverse movements in interest rates on the capital and results of the financial institution, for instruments classified in the banking portfolio.

Art. 31. The management structure referred to in art. 5 must additionally provide, for market risk and IRRBB:

I - systems that consider all significant sources of risk and use reliable market and liquidity data, both internal and external;

II - adequate documentation of:

a) reclassifications of instruments between the trading and banking portfolios; and

b) internal risk transfers, including those that do not produce effects for capital requirement purposes.

Sole paragraph. For the purposes of this Resolution, internal risk transfer corresponds to the internal registration of risk transfer within the banking portfolio, between the banking portfolio and the trading portfolio, or within the trading portfolio, of the same institution.

Art. 32. The management of IRRBB must provide:

I - assessment and control of its main determinants, including the mismatch between assets and liabilities, with respect to maturities, rates, indexers, and currencies; and

II - identification, measurement, and control of this risk based on methodologies that are consistent with the characteristics of the banking portfolio and that consider the maturity, liquidity, and risk sensitivity of instruments classified in this portfolio.

§ 1º For institutions classified in S2 or S3, the identification, measurement, and control of IRRBB referred to in the caput, item II, must be based on economic value and financial intermediation result approaches.

§ 2º Without prejudice to the provisions of § 1º, the Central Bank of Brazil may define specific methodologies and minimum requirements to be observed in the identification, measurement, and control of IRRBB, including those based on economic value and financial intermediation result approaches.

§ 3º For the purposes of this Resolution, the following are considered:

I - economic value approaches: assessments of the impact of changes in interest rates on the present value of cash flows of instruments classified in the institution's banking portfolio; and

II - financial intermediation result approaches: assessments of the impact of changes in interest rates on the financial intermediation result of the institution's banking portfolio.

§ 4º IRRBB appetite levels must be documented in the RAS for each approach referred to in § 3º.

Art. 33. The management reports referred to in art. 5, item X, must address the following additional aspects regarding IRRBB:

I - results of IRRBB measurement based on economic value and financial intermediation result approaches;

II - assumptions used in the modeling of:

a) embedded options;

b) changes in the temporal structure of cash flows of deposits without defined contractual maturity; and

c) currency aggregation.

Section VIOperation Risk Management

Art. 34. For the purposes of this Resolution, operational risk is defined as the possibility of occurrence of losses resulting from external events or failure, deficiency, or inadequacy of internal processes, people, or systems.

§ 1º The definition referred to in the caput includes legal risk associated with inadequacy or deficiency in contracts entered into by the institution, sanctions due to non-compliance with legal provisions, and indemnities for damages to third parties resulting from the activities developed by the institution.

§ 2º Among operational risk events, the following are included:

I - internal fraud;

II - external fraud;

III - labor demands and deficient workplace safety;

IV - inappropriate practices regarding end-users, clients, products, and services;

V - damage to physical assets owned or used by the institution;

VI - situations that cause the interruption of the institution's activities or the discontinuity of services provided, including payments;

VII - failures in systems, processes, or information technology (IT) infrastructure;

VIII - failures in execution, compliance with deadlines, or management of the institution's activities, including those related to payment arrangements.

§ 3º For payment activities, the failures mentioned in § 2º include:

I - failures in the protection and security of sensitive data related to both end-user credentials and other information exchanged for the purpose of executing payment transactions;

II - failures in the identification and authentication of the end-user in a payment transaction;

III - failures in the authorization of payment transactions; and

IV - failures in the initiation of payment transactions.

Art. 35. The management structure referred to in Art. 5º must additionally provide, for operational risk:

I - policies establishing decision criteria regarding the outsourcing of services and the selection of providers, including the minimum contractual conditions necessary to mitigate operational risk;

II - allocation of adequate resources to assess, manage, and monitor operational risk arising from services outsourced that are relevant to the regular functioning of the institution;

III - implementation of an IT governance structure consistent with the risk appetite levels established in the RAS;

IV - IT systems, processes, and infrastructure that:

a) ensure the integrity, security, and availability of stored, processed, or transmitted data and of the information systems used;

b) contain mechanisms for the protection and security of networks, websites, servers, and communication channels, with a view to reducing vulnerability to digital attacks;

c) adopt procedures to monitor, track, and restrict access to sensitive data, networks, systems, databases, and security modules;

d) monitor failures in data security and end-user complaints regarding the same; and

e) are adequate to the needs and changes in the business model, both under normal circumstances and during periods of stress;

V - a consistent and comprehensive process for:

a) timely collection of relevant information for the operational risk database;

b) classification and aggregation of identified relevant operational losses; and

c) timely analysis of the root cause of each relevant operational loss;

VI - periodic performance of scenario analyses with the objective of estimating the institution's exposure to rare and high-severity operational risk events;

VII - review of data security and confidentiality measures, especially after the occurrence of failures and prior to changes in infrastructure or procedures;

VIII - preparation of reports indicating procedures for the correction of identified failures;

IX - performance of tests that ensure the robustness and effectiveness of the adopted data security measures;

X - segregation of functions in information technology environments intended for development, testing, and production.

§ 1º For payment activities, the structure referred to in the caput must additionally provide:

I - adequate identification of the end-user;

II - processes to ensure that all payment transactions can be adequately tracked;

III - monitoring and authorization mechanisms for payment transactions, with the objective of preventing fraud, detecting, and blocking suspicious transactions in a timely manner;

IV - specific evaluations and filters to identify transactions considered high-risk;

V - notification to the end-user regarding any non-execution of a transaction;

VI - mechanisms that allow the end-user to verify if the transaction was executed correctly;

VII - identification, assessment, management, monitoring, and mitigation of the risk arising from the participation of a sub-acquirer in the settlement process of payment transactions, in the case of an acquiring institution; and

VIII - monitoring and control mechanisms for failures in the initiation of payment transactions, segregating, at a minimum, the following events:

a) initiation of unauthorized payment transaction;

b) non-execution of payment transaction initiation;

c) incorrect execution of payment transaction initiation; and

d) delay in the initiation of payment transaction.

§ 2º In the case of outsourcing IT services, including those related to the security of payment services offered, the respective service provision contract must stipulate that:

I - the contractor must comply with the provisions of items IV and VII to X of the caput and with the provisions of § 1º;

II - the contracting party will have access to the data and information regarding the services provided;

III - the Central Bank of Brazil will have access to:

a) agreements signed;

b) documentation and information regarding the services provided; and

c) the contractor's premises.

§ 3º The results of the scenario analyses referred to in the caput, item VI, must be considered in the review of the risk management structure and in capital allocation.

Art. 36. The institution must establish an operational risk database containing values associated with operational losses, including provisions and expenses related to each loss event, and other operational risk data.

§ 1º For the purposes of this Resolution, operational loss is defined as the quantifiable value associated with the operational risk events mentioned in Art. 34.

§ 2º The operational risk database must include operational losses associated with credit risk, market risk, social risk, environmental risk, and climate risk, regardless of whether they also appear in other databases.

§ 3º The database referred to in the caput must be considered in the management of operational risk.

Art. 37. The management reports referred to in Art. 5º, item X, must include information regarding relevant operational losses.

Art. 38. The institution must ensure the adequate training of all employees and relevant outsourced service providers on operational risk.

Section VIIDo Liquidity Risk Management

Art. 39. For the purposes of this Resolution, liquidity risk is defined as:

I - the possibility that the institution will not be able to efficiently honor its expected and unexpected, current and future obligations, including those arising from collateral commitments, without affecting its daily operations or incurring significant losses;

II - the possibility that the institution will not be able to trade a position at market price, due to its large size relative to the volume normally traded or due to some discontinuity in the market; and

III - the inability to convert electronic currency into physical or book currency at the time of the user's request.

III - the possibility that the institution issuing electronic currency will not be able to convert it into physical or book currency at the time of the user's request. (Revised, effective 1/7/2023, by BCB Resolution No. 306, of 3/23/2023.)

Art. 40. The management structure referred to in Art. 5º must additionally provide, for liquidity risk:

I - policies, strategies, and processes that ensure:

a) identification, measurement, assessment, monitoring, reporting, control, and mitigation of liquidity risk across different time horizons, including intraday, in normal or stress situations, including the daily assessment of operations with settlement terms of less than ninety days;

b) maintenance of an adequate stock of liquid assets that can be quickly converted into cash in stress situations;

c) maintenance of an adequate funding profile relative to the liquidity risk of the institution's assets and off-balance sheet exposures; and

c) maintenance of an adequate funding profile relative to the liquidity risk of the institution's assets and off-balance sheet exposures; (Revised, effective 1/9/2025, by BCB Resolution No. 477, of 5/30/2025.)

d) adequate diversification of funding sources; and

d) adequate diversification of funding sources; and (Revised, effective 1/9/2025, by BCB Resolution No. 477, of 5/30/2025.)

e) the timely transfer of liquidity among institutions within the same prudential conglomerate, in normal or stress situations; and (Added, effective 1/9/2025, by BCB Resolution No. 477, of 5/30/2025.)

II - a liquidity contingency plan.

§ 1º Liquidity risk management must consider all operations practiced in the financial and capital markets, as well as possible contingent or unexpected exposures, including those associated with settlement services, the provision of guarantees and collateral, and contracted and unused credit and liquidity lines.

§ 2º The institution must consider liquidity risk individually in the jurisdictions where it operates and in the currencies to which it is exposed, observing any restrictions on the transfer of liquidity and the convertibility between currencies, such as those caused by operational problems or by impositions made by a country.

§ 3º The liquidity contingency plan referred to in the caput, item II, must be regularly updated and establish responsibilities, strategies, and procedures, clearly defined and documented, to address stress situations.

§ 4º The institution must timely identify statutory or contractual restrictions and any impediments, including legal and regulatory, that may hinder liquidity transfers, as well as establish measures to mitigate their effects. (Added, effective 1/9/2025, by BCB Resolution No. 477, of 5/30/2025.)

§ 5º For the purposes of this Resolution, jurisdiction is considered the perimeter that delimits the operation of the financial regulatory and supervisory authority over a set of institutions. (Added, effective 1/9/2025, by BCB Resolution No. 477, of 5/30/2025.)

Section VIIIDo Social Risk, Environmental Risk, and Climate Risk Management

Art. 41. For the purposes of this Resolution, social risk is defined as the possibility of losses to the institution caused by events associated with the violation of fundamental rights and guarantees or acts harmful to common interests.

§ 1º For the purposes of this Resolution, common interest is that associated with a group of people legally or factually linked by the same cause or circumstance, when not related to the definition of environmental risk, transition climate risk, or physical climate risk.

§ 2º Examples of social risk events are the occurrence or, as applicable, the indications of the occurrence of:

I - act of harassment, discrimination, or prejudice based on personal attributes, such as ethnicity, race, color, socioeconomic status, family situation, nationality, age, sex, sexual orientation, gender identity, religion, belief, disability, genetic or health condition, and ideological or political stance;

II - practice related to work in conditions analogous to slavery;

III - irregular, illegal, or criminal exploitation of child labor;

IV - practice related to human trafficking, sexual exploitation, or criminal profit from prostitution;

V - non-compliance with social security or labor legislation, including legislation regarding health and workplace safety, without prejudice to the provisions of Art. 34;

VI - irregular, illegal, or criminal act that negatively impacts indigenous and quilombola peoples or traditional communities, including the invasion or irregular, illegal, or criminal exploitation of their lands;

VII - act harmful to public heritage, historical heritage, cultural heritage, or urban order;

VIII - irregular, illegal, or criminal practice associated with food or products potentially harmful to society, subject to specific legislation or regulation, including pesticides, substances capable of causing dependence, nuclear or radioactive materials, firearms, and ammunition;

IX - irregular, illegal, or criminal exploitation of natural resources, relative to the violation of a right or fundamental guarantee or an act harmful to common interest, including water, forest, energy, and mineral resources, including, when applicable, the installation and dismantling of respective facilities;

X - irregular, illegal, or criminal treatment of personal data, without prejudice to the provisions of Art. 34;

XI - environmental disaster resulting from human intervention, relative to the violation of a right or fundamental guarantee or an act harmful to common interest, including dam rupture, nuclear accident, or spill of chemicals or waste into the water;

XII - change in legislation, regulation, or the action of government bodies, associated with a right or fundamental guarantee or common interest, that negatively impacts the institution; and

XIII - act or activity that, despite being regular, legal, and non-criminal, negatively impacts the institution's reputation, as it is considered harmful to common interest.

Art. 42. For the purposes of this Resolution, environmental risk is defined as the possibility of losses to the institution caused by events associated with environmental degradation, including the excessive use of natural resources.

Sole Paragraph. Examples of environmental risk events are the occurrence or, as applicable, the indications of the occurrence of:

I - irregular, illegal, or criminal conduct or activity against fauna or flora, including deforestation, setting fire to woods or forests, degradation of biomes or biodiversity, and practice associated with trafficking, cruelty, abuse, or mistreatment of animals;

II - irregular, illegal, or criminal pollution of the air, water, or soil;

III - irregular, illegal, or criminal exploitation of natural resources, relative to environmental degradation, including water, forest, energy, and mineral resources, including, when applicable, the installation and dismantling of respective facilities;

IV - non-compliance with environmental licensing conditions;

V - environmental disaster resulting from human intervention, relative to environmental degradation, including dam rupture, nuclear accident, or spill of chemicals or waste into the soil or water;

VI - change in legislation, regulation, or the action of government bodies, resulting from environmental degradation, that negatively impacts the institution; and

VII - act or activity that, despite being regular, legal, and non-criminal, negatively impacts the institution's reputation, resulting from environmental degradation.

Art. 43. For the purposes of this Resolution, climate risk, in its transition risk and physical risk aspects, is defined as:

I - transition climate risk: possibility of losses to the institution caused by events associated with the transition process to a low-carbon economy, in which greenhouse gas emissions are reduced or compensated and natural mechanisms for capturing these gases are preserved; and

II - physical climate risk: possibility of losses to the institution caused by events associated with frequent and severe weather events or long-term environmental changes, which may be related to changes in climate patterns.

Sole Paragraph. Examples of climate risk events are:

I - within the scope of transition climate risk:

a) change in legislation, regulation, or the action of government bodies, associated with the transition to a low-carbon economy, that negatively impacts the institution;

b) technological innovation associated with the transition to a low-carbon economy that negatively impacts the institution;

c) change in the supply or demand for products and services, associated with the transition to a low-carbon economy, that negatively impacts the institution; and

d) unfavorable perception by customers, the financial market, or society in general that negatively impacts the institution's reputation regarding its degree of contribution to the transition to a low-carbon economy; and

II - within the scope of physical climate risk:

a) extreme weather conditions, including drought, flooding, storm, cyclone, frost, and forest fire; and

b) permanent environmental change, including sea level rise, scarcity of natural resources, desertification, and change in rainfall or temperature patterns.

Art. 44. The management structure referred to in Art. 5º must additionally provide, for social risk, environmental risk, and climate risk:

I - mechanisms for the identification and monitoring of social, environmental, and climate risks incurred by the institution as a result of its products, services, activities, or processes and the activities performed by:

a) the institution's counterparties, as defined in Art. 19, § 1º, item I;

b) entities controlled by the institution, according to the criteria established in § 2º of this article; and

c) the institution's suppliers and outsourced service providers, when relevant, based on criteria established by the institution;

II - identification, assessment, classification, and measurement of social, environmental, and climate risk based on consistent and verifiable criteria and information, including publicly accessible information;

III - recording of relevant data for management, including, when available, data regarding losses incurred by the institution, disaggregated, as applicable, into social risk, environmental risk, or climate risk, with respective detail of values, nature of the event, geographic region, defined based on clear and verifiable criteria, and economic sector associated with the exposure;

IV - timely identification of political, legal, regulatory, technological, or market changes, including significant changes in consumption preferences, that may significantly impact the social, environmental, or climate risk incurred by the institution, as well as procedures for mitigating these impacts;

V - monitoring of concentrations of exposures to economic sectors or geographic regions, defined based on consistent and verifiable criteria, most susceptible to suffering or causing social, environmental, or climate damage, and, when appropriate, establishment of limits for these exposures;

VI - timely identification of negative perception by customers, the financial market, and society in general regarding the institution's reputation, when this perception may significantly impact the social, environmental, and climate risk incurred by it; and

VII - performance of scenario analysis, within the stress testing program referred to in Art. 5º, item VII, that consider hypotheses of changes in climate patterns and transition to a low-carbon economy.

§ 1º When the hypothesis of occurrence of a social, environmental, or climate risk event implies the possibility of loss related to another risk mentioned in Art. 4º, caput, risk management and compliance with minimum prudential requirements, when applicable, must be observed for each of the risks involved.

§ 2º For the purposes of the caput, item I, item "b", the institution's control relationship over an entity occurs when at least one of the following criteria is met:

I - the institution holds more than 50% (fifty percent) of the voting capital of the entity;

II - a voting agreement ensures the institution's predominance in the entity's social deliberations;

III - the institution holds the power to elect or dismiss the majority of the entity's administrators; or

IV - the institution holds predominance in the operational management decisions of the entity.

§ 3º For the purposes of the caput, item III, the establishment of exclusive databases is not required, provided that the respective information can be extracted for the management of social, environmental, and climate risk.

Art. 45. The treatment of interactions between social risk, environmental risk, and climate risk, within the integrated management referred to in this Resolution, and between these and other risks incurred by the institution must include:

I - criteria, clearly documented and verifiable, for identifying social, environmental, and climate risk as a source of significant risk mentioned in Art. 4º, caput;

II - mechanisms for considering aspects related to social, environmental, and climate risk in the granting, classification, and monitoring of operations subject to credit risk, as defined in Art. 19, including:

a) due diligence in identifying the counterparty;

b) definition of indicators for the qualification and periodic classification of the counterparty according to social, environmental, and climate risk;

c) assessment and monitoring of possible impacts on the counterparty's credit quality in the event of social, environmental, or climate risk events; and

d) criteria for the periodic assessment of the sufficiency of guarantees, collateral, and other credit risk mitigants in the event of social, environmental, or climate risk events;

III - assessment of the impact of social, environmental, and climate risk on positions subject to market risk and IRRBB, as defined in Arts. 23 and 30, respectively, based on criteria established by the institution;

IV - policies, strategies, and procedures for mitigating operational risk, as defined in Art. 34, that may be associated with an event of social, environmental, or climate risk, including:

a) establishment of minimum conditions in contracts signed by the institution to mitigate legal risk, as defined in Art. 34, § 1º;

b) definition of decision criteria regarding the outsourcing of services and the selection of providers, in accordance with Art. 35, item I, which consider aspects of social, environmental, and climate risk; and

c) consideration of aspects related to social risk, environmental risk, and climate risk in the scenario analysis referred to in Article 35, item VI, with the objective of estimating the institution's exposure to rare and high-severity operational risk events; and

V - policies, strategies, and procedures for mitigating liquidity risk, as defined in Article 39, which may be associated with an event of social risk, environmental risk, or climate risk, including:

a) assessment of the impact of social risk, environmental risk, and climate risk on the stock of liquid assets and funding sources, as referred to in Article 40, item I, letters “b” and “d”; and

b) within the framework of the liquidity contingency plan, as referred to in Article 40, item II, establishment of responsibilities, strategies, and procedures to address stress situations associated with the possibility of occurrence of events of social risk, environmental risk, or climate risk.

Sole Paragraph. The indicators referred to in the main text, item II, letter “b”, must consider, among other aspects:

I - the most relevant economic sectors of the counterparty's operations;

II - the most relevant geographic regions of the counterparty's operations, defined based on clear and verifiable criteria;

III - the economic sectors and geographic regions of the operations, when such identification is possible; and

IV - when relevant, based on criteria established by the institution:

a) the counterparty's compliance history with specific legislation applicable to its activities, products, and services;

b) the counterparty's capacity to manage social, environmental, and climate risks incurred by it, including the existence, with the counterparty, of a governance structure compatible with this process and monitoring of risks associated with its suppliers and outsourced service providers; and

c) the existence of a report prepared by an independent specialized audit firm hired by the counterparty, addressing its procedures and controls regarding social, environmental, and climate aspects.

Article 46. The management reports referred to in Article 5, item X, must address the following additional aspects regarding social risk, environmental risk, and climate risk:

I - data on relevant losses incurred, in accordance with Article 44, item III; and

II - information on concentrations of social, environmental, and climate risk, as referred to in Article 44, item V.

Section IXOn the Management of Country Risk and Transfer Risk

(Section IX included, effective 1/1/2024, by BCB Resolution No. 332, of 6/29/2023.)

Article 46-A. For the purposes of this Resolution, it is defined:

I - country risk as the possibility of occurrence of losses associated with events related to a foreign jurisdiction, including also:

a) sovereign risk, in the case of exposure assumed towards the central government of a foreign jurisdiction; and

b) indirect country risk, in the case of an event related to a foreign jurisdiction different from that where the counterparty or the issuer of a risk-mitigating instrument associated with exposure assumed by the institution is located, when the counterparty or the issuer may be significantly impacted by the respective event; and

II - transfer risk as the possibility of occurrence of obstacles in the foreign exchange conversion of resources necessary to settle an obligation towards the institution, in cases where these resources are located in a jurisdiction different from that where the respective settlement will be carried out.

Sole Paragraph. For the purposes of the provision in the main text, item I, letter “b”, the definition of counterparty established in Article 19, § 1, item I, applies.

(Article 46-A included, effective 1/1/2024, by BCB Resolution No. 332, of 6/29/2023.)

Article 46-B. The management structure referred to in Article 5 must additionally provide, for country risk and transfer risk:

I - mechanisms for managing country risk and transfer risk by counterparty, by jurisdiction, and, in the existence of relevant common risk factors, by a set of jurisdictions, defined based on clear and verifiable criteria;

II - processes for the timely identification of political, legal, regulatory, market, and other changes that may significantly impact the country risk and transfer risk incurred by the institution, as well as procedures for mitigating these impacts;

III - recording of relevant data for managing country risk and transfer risk, including, when available, data regarding respective losses incurred by the institution; and

IV - monitoring of significant concentrations of exposure to country risk and transfer risk.

§ 1 The management referred to in the main text must also consider, when relevant, interdependent operations and operations carried out between institutions belonging to the same prudential conglomerate.

§ 2 The management reports referred to in Article 5, item X, must additionally address, for country risk and transfer risk, the reporting of relevant exposures, grouped, as applicable, by jurisdiction and, in the existence of relevant common risk factors, by a set of jurisdictions.

(Article 46-B included, effective 1/1/2024, by BCB Resolution No. 332, of 6/29/2023.)

CHAPTER IV
OF THE CAPITAL MANAGEMENT STRUCTURE

Article 47. For the purposes of this Resolution, capital management is defined as the continuous process of:

I - monitoring and controlling the capital maintained by the institution;

II - assessing the need for capital to face the risks to which the institution is exposed; and

III - planning capital targets and needs, considering the institution's strategic objectives.

Article 48. The capital management structure must provide:

I - policies and strategies for capital management, clearly documented, establishing procedures intended to maintain the RWA, Tier 1, and Core Capital at levels compatible with the risks incurred and with the minimum regulatory requirement;

II - systems, routines, and procedures for capital management;

III - assessment of the impacts on capital of the results of the stress testing program referred to in Article 5, item VII;

IV - capital plan;

V - capital contingency plan;

VI - assessment of capital adequacy;

VII - timely management reports for the board of directors of the lead institution, the risk committee, and the board of directors, when existing, addressing:

VII - timely management reports for the institution's board of directors, the risk committee, and the board of directors, when existing, addressing: (Wording given, effective 1/1/2025, by BCB Resolution No. 447, of 12/19/2024.)

a) any deficiencies in the capital management structure and actions to correct them; and

b) adequacy of the levels of RWA, Tier 1, and Core Capital to the risks incurred.

§ 1 The capital contingency plan referred to in the main text, item V, must be regularly updated and establish responsibilities, strategies, and procedures, clearly defined and documented, to address stress situations.

§ 2 The assessment of capital adequacy must be carried out according to the Simplified Internal Capital Adequacy Assessment Process (IcaapSimp), for institutions classified in S2.

Article 49. The capital plan, mentioned in Article 48, item IV, must be consistent with the institution's strategic planning, cover a minimum horizon of three years, and provide:

I - capital targets and projections; and

II - main sources of the institution's capital.

Sole Paragraph. In preparing the capital plan, the following must be considered:

I - threats and opportunities related to the economic and business environment;

II - projections of asset and liability values, off-balance sheet operations, as well as revenues and expenses;

III - growth or market share targets;

IV - profit distribution policy; and

V - terms of the RAS.

Article 50. If the institution's assessment of capital needs points to a value above the minimum requirements for RWA, Tier 1, and Core Capital, the institution must maintain capital compatible with the results of its internal assessments.

Article 50. If the institution's assessment of capital needs points to a value above the minimum requirements for RWA, Tier 1, and Core Capital, it must maintain capital compatible with the results of its internal assessments. (Wording given, effective 1/1/2025, by BCB Resolution No. 447, of 12/19/2024.)

CHAPTER V
OF THE GOVERNANCE OF MANAGEMENT STRUCTURES AND INFORMATION DISCLOSURE POLICY

Section IOn Risk Management

Article 51. The risk management activity must be executed by a specific unit in the institution referred to in Article 2.

§ 1 The unit referred to in the main text must be segregated from business units and the unit executing the internal audit activity.

§ 2 The unit referred to in the main text must have a sufficient number of experienced and qualified risk management professionals who meet the following requirements:

I - possess knowledge of the market and the institution's products and services;

II - have regular access to capacity building and training;

III - be capable of questioning the risks assumed in operations carried out by business units; and

IV - understand the limitations and uncertainties related to the methodologies used in the risk management structure.

Article 52. The lead institution must appoint a Chief Risk Officer (CRO) responsible for the specific unit referred to in Article 51.

Article 52. The institution must appoint a Chief Risk Officer – CRO responsible for the specific unit referred to in Article 51. (Wording given, effective 1/1/2025, by BCB Resolution No. 447, of 12/19/2024.)

§ 1 The CRO's responsibilities include:

I - supervision of the development, implementation, and performance of the risk management structure, including its improvement;

II - responsibility for the adequacy, to the RAS and the institution's strategic objectives, of the policies, processes, reports, systems, and models used in risk management;

III - responsibility for the adequate training of members of the specific unit referred to in Article 51 regarding the policies, processes, reports, systems, and models of the risk management structure, even if developed by third parties;

IV - support and participation in the strategic decision-making process related to risk management and, when applicable, capital management, assisting the board of directors.

IV - support and participation in the strategic decision-making process related to risk management and, when applicable, capital management, assisting the board of directors; and(Wording given, effective 1/7/2023, by BCB Resolution No. 319, of 5/18/2023.)

V - responsibility for compliance with the provisions of BCB Resolution No. 319, of May 18, 2023, which establishes maximum exposure limits per client and maximum concentrated exposure limits. (Included, effective 1/7/2023, by BCB Resolution No. 319, of 5/18/2023.)

§ 2 Provided that the absence of conflict of interest is ensured, it is admitted that the CRO performs other functions in the institution, including the assessment of capital adequacy referred to in Article 48, item VI.

§ 3 The institution's bylaws, or equivalent, must expressly provide for the CRO's responsibilities.

§ 4 The lead institution must establish adequate conditions for the CRO to exercise its responsibilities independently and to report, directly and without the presence of board members, to the risk committee, the institution's chief executive, and the board of directors.

§ 4 The institution must establish adequate conditions for the CRO to exercise its responsibilities independently and to report, directly and without the presence of board members, to the risk committee, the institution's chief executive, and the board of directors. (Wording given, effective 1/1/2025, by BCB Resolution No. 447, of 12/19/2024.)

§ 5 The CRO must be assured access to the information necessary to fulfill its responsibilities.

§ 6 The appointment and dismissal of the CRO must be approved by the board of directors of the lead institution.

§ 6 The appointment and dismissal of the CRO must be approved by the board of directors of the institution. (Wording given, effective 1/1/2025, by BCB Resolution No. 447, of 12/19/2024.)

§ 7 The lead institution must designate the name of the CRO to the Central Bank of Brazil.

§ 7 The institution must designate the name of the CRO to the Central Bank of Brazil. (Wording given, effective 1/1/2025, by BCB Resolution No. 447, of 12/19/2024.)

§ 8 The dismissal of the CRO must be promptly disclosed on the lead institution's website, and the reasons for this fact must be communicated to the Central Bank of Brazil, which may request additional information.

§ 8 The dismissal of the CRO must be promptly disclosed on the institution's website, and the reasons for this fact must be communicated to the Central Bank of Brazil, which may request additional information. (Wording given, effective 1/1/2025, by BCB Resolution No. 447, of 12/19/2024.)

Article 53. The lead institution must constitute a risk committee.

Article 53. The institution must constitute a risk committee. (Wording given, effective 1/1/2025, by BCB Resolution No. 447, of 12/19/2024.)

§ 1 The risk committee's responsibilities include:

I - proposing, with a minimum annual frequency, recommendations to the board of directors on matters referred to in Article 56, item II;

II - assessing the levels of risk appetite set in the RAS and strategies for their management, considering risks individually and in an integrated manner;

III - supervising the performance and effectiveness of the CRO;

IV - supervising the compliance, by the institution's board of directors, with the terms of the RAS;

V - assessing the degree of adherence of the risk management structure's processes to the established policies; and

VI - maintaining records of its deliberations and decisions.

§ 2 The risk committee must be composed of at least three members.

§ 3 The institution's bylaws, or equivalent, must expressly provide, regarding the risk committee, for the following aspects:

I - the maximum number of members;

II - operating rules, including responsibilities and minimum meeting frequency;

III - the form of accountability to the board of directors;

IV - the term of office of members, when fixed.

§ 4 It is a condition for exercising the function of a member of the risk committee not to be and not have been, in the last six months, the institution's CRO or a member of the audit committee.

§ 5 The risk committee must be composed, in the majority, by members who:

I - are not and have not been employees of the institution in the last six months;

II - are not spouses, or relatives in the direct line, collateral line, or by affinity, up to the second degree, of the persons referred to in item I;

III - do not receive from the institution any other type of remuneration that does not result from the exercise of the function of member of the risk committee or the board of directors;

IV - possess proven experience in risk management;

V - do not control the institution and do not participate in decisions at the executive level.

§ 6 The risk committee must be chaired by a member who meets the requirements listed in § 5 and who is not and has not been, in the last six months, the chairman of the board of directors or any other committee of the institution.

§ 7 The risk committee must coordinate its activities with the audit committee, in order to facilitate information exchange, necessary adjustments to the risk governance structure, and the effective treatment of risks to which the institution is exposed.

§ 8 The board of directors of a lead institution not subject to the constitution of a risk committee under the main text must assume the responsibilities mentioned in § 1, items I, II, III, V, and VI.

§ 8 The board of directors of an institution not subject to the constitution of a risk committee under the main text must assume the responsibilities mentioned in items I, II, III, V, and VI of § 1. (Wording given, effective 1/1/2025, by BCB Resolution No. 447, of 12/19/2024.)

Section IIOncapital Management

Article 54. The capital management activity must be executed by a specific unit in the institution referred to in Article 2.

§ 1 The unit referred to in the main text must be segregated from the unit executing the internal audit activity.

§ 2 The unit referred to in the main text must have a sufficient number of experienced and qualified professionals who have regular access to capacity building and training for the purposes of capital management.

Article 55. The lead institution must appoint a director responsible for the capital management structure.

Article 55. The institution must appoint a director responsible for the capital management structure. (Wording given, effective 1/1/2025, by BCB Resolution No. 447, of 12/19/2024.)

§ 1 It is admitted that the director referred to in the main text performs other functions, except those that constitute a conflict of interest.

§ 2 The lead institution must designate to the Central Bank of Brazil the name of the director referred to in the main text.

§ 2 The institution must designate to the Central Bank of Brazil the name of the director referred to in the main text. (Wording given, effective 1/1/2025, by BCB Resolution No. 447, of 12/19/2024.)

§ 3 The responsibilities of the director referred to in the main text include:

I - supervision of the development, implementation, and performance of the capital management structure, including its improvement; and

II - responsibility for the processes and controls related to the calculation of the RWA amount, for the calculation of the minimum requirements for RWA, Tier 1, and Core Capital, and for compliance with the Core Capital Add-on.

Section IIIDuties of the Board of Directors and Board of Executive Officers

Article 56. It is the responsibility of the lead institution's board of directors, for the purposes of risk management and capital management:

Article 56. It is the responsibility of the institution's board of directors, for the purposes of risk management and capital management: (Wording given, effective 1/1/2025, by BCB Resolution No. 447, of 12/19/2024.)

I - set the institution's risk appetite levels in the RAS and review them, with the assistance of the risk committee, the board of directors, and the CRO;

II - approve and review, with a minimum annual frequency:

a) the policies, strategies, and risk management limits referred to in Article 5, item I;

b) the capital management policies and strategies referred to in Article 48, item I;

c) the stress testing program referred to in Article 5, item VII;

d) the business continuity management policies referred to in Article 5, item IX;

e) the liquidity contingency plan, as referred to in Article 40, item II;

f) the capital plan referred to in Article 48, item IV;

g) the capital contingency plan referred to in Article 48, item V; and

g) the capital contingency plan referred to in Article 48, item V; (Wording given, effective 1/7/2023, by BCB Resolution No. 306, of 3/23/2023.)

h) the information disclosure policy referred to in Article 64;

h) the information disclosure policy referred to in Article 64; and (Wording given, effective 1/7/2023, by BCB Resolution No. 306, of 3/23/2023.)

i) the policies referred to in Article 28; (Included, effective 1/7/2023, by BCB Resolution No. 306, of 3/23/2023.)

III - ensure the institution's adherence to risk management policies, strategies, and limits;

IV - ensure the timely correction of deficiencies in the risk management structure and the capital management structure;

V - approve significant changes, resulting from the risks referred to in Article 5, item V, in the institution's policies and strategies, as well as in its systems, routines, and procedures;

VI - authorize, when necessary, exceptions to the policies, procedures, limits, and risk appetite levels set in the RAS;

VII - promote the dissemination of risk management culture in the institution;

VIII - ensure adequate and sufficient resources for the exercise of risk management and capital management activities, in an independent, objective, and effective manner;

IX - establish the organization and duties of the risk committee, observing the provisions of this Resolution;

X - ensure that the remuneration structure adopted by the institution does not incentivize behaviors incompatible with the risk appetite levels set in the RAS;

XI - ensure that the institution maintains adequate and sufficient levels of capital and liquidity.

Art. 57. In the absence of a board of directors, the competencies attributed to it by this Resolution shall apply to the executive management of the lead institution.

Art. 57. In the absence of a board of directors, the competencies attributed to it by this Resolution shall apply to the executive management of the institution. (Amended, effective from 1/1/2025, by Resolution BCB No. 447, of 12/19/2024.)

Art. 58. The executive management of the institution is responsible for conducting, in accordance with the policies and strategies referred to in Article 5, item I, activities that imply the assumption of risks.

Art. 58. The executive management of the institution is responsible for: (Amended by Resolution BCB No. 470, of 4/30/2025.)

I - conducting, in accordance with the policies and strategies referred to in Article 5, item I, activities that imply the assumption of risks; (Added by Resolution BCB No. 470, of 4/30/2025.)

II - approving proposals for the reclassification of instruments between trading and banking portfolios; and (Added by Resolution BCB No. 470, of 4/30/2025.)

III - requesting authorization for the establishment of a dedicated trading desk, as referred to in Article 29, § 2º, and forwarding it for information to the board of directors, if one exists. (Added by Resolution BCB No. 470, of 4/30/2025.)

Section IV
Joint Duties

Art. 59. The board of directors, the risk committee, the CRO, and the executive management of the institution must:

I - comprehensively and integratedly understand the risks that can impact the capital and liquidity of the institution;

II - understand the limitations of the information contained in the reports referred to in Article 5, item X, and Article 48, item VII, and in reports related to risk management and capital management;

III - ensure that the content of the RAS is observed by the institution;

IV - understand the limitations and uncertainties related to risk assessment, models, even those developed by third parties, and the methodologies used in the risk management structure;

V - ensure the understanding and continuous monitoring of risks by the various levels of the institution.

Art. 60. The processes related to risk management and capital management must be periodically evaluated by the institution's internal audit.

CHAPTER VI
RISK MANAGEMENT AND CAPITAL MANAGEMENT OF PRUDENTIAL CONGLOMERATES

Art. 61. The unified structure for risk management of the prudential conglomerate, as referred to in Article 2, § 2º, must consider the risks associated with the conglomerate and each institution individually, as well as identify and monitor risks associated with other entities controlled by its members or in which they participate.

Art. 62. The unified structure for capital management of the prudential conglomerate, as referred to in Article 2, § 2º, must evaluate the possible impacts on the capital and liquidity of the prudential conglomerate arising from the risks referred to in Article 4.

CHAPTER VII
TRANSPARENCY

Art. 63. An information disclosure policy must be established that demonstrates the institution's compliance with prudential requirements, as detailed by the Central Bank of Brazil.

§ 1º The disclosure policy referred to in the caput must include:

I - the specification of information to be disclosed;

II - the governance of the information disclosure process, including respective duties and chain of command;

III - the detailing of internal controls applied to ensure the fidelity of disclosed information, as well as the adequacy of its content; and

IV - the relevance criteria used for information disclosure, based on the needs of external users for economic decision-making purposes.

§ 2º The information referred to in the caput must be included in the Pillar 3 Report containing:

I - description of the continuous and integrated risk management structure;

II - description of the continuous capital management structure; and

III - detailing of the RWA amount calculation and PR adequacy.

§ 3º The Pillar 3 report of an institution issuing electronic money must demonstrate the management structure for its respective liquidity risk.

Art. 64. The lead institution must designate a director responsible for information disclosure in accordance with Article 63.

Art. 64. The institution must designate a director responsible for information disclosure in accordance with Article 63. (Amended, effective from 1/1/2025, by Resolution BCB No. 447, of 12/19/2024.)

§ 1º The duties of the director mentioned in the caput include:

I - consolidating the information to be disclosed in the Pillar 3 Report;

II - ensuring the compliance of prudential information disclosed with respect to the information contained in the management reports established in this Resolution; and

III - proposing to the board of directors updates to the information disclosure policy.

§ 2º Provided that the absence of conflict of interest is assured, it is admitted that the director responsible for information disclosure may perform other functions within the institution.

Art. 65. The composition and duties of the risk committee must be evidenced on the lead institution's website.

Art. 65. The composition and duties of the risk committee must be evidenced on the institution's website. (Amended, effective from 1/1/2025, by Resolution BCB No. 447, of 12/19/2024.)

CHAPTER VIII
SPECIFIC EXEMPTIONS BY SEGMENT

Art. 66. Institutions classified in S3 are exempt from:

I - reporting, in the management report, the degree of dissemination of risk management culture as provided in Article 5, item X, letter “e”;

II - observing the restriction referred to in Article 7, sole paragraph, in the periodic evaluation of risk management models;

III - using, in the stress testing program, the scenario analysis methodology mentioned in Article 10, item III, letter “b”;

IV - documenting, regarding the stress testing program, the provisions of Article 10, item V, letters “c” and “d”;

V - developing scenarios within the stress testing program as provided in Article 13;

VI - having flexible systems, within the stress testing program, according to the criteria established in Article 14;

VII - incorporating the results of stress tests into the structured communication process, as provided in Article 15, item IV;

VIII - managing instruments subject to market risk in a trading desk structure, as provided in Articles 24 and 25, except in cases where the institution requests authorization for the establishment of a dedicated trading desk, as referred to in Article 29, § 2º;

IX - conducting operational risk scenario analyses as provided in Article 35, item IX and § 2º;

IX - conducting operational risk scenario analyses as provided in Article 35, item VI of the caput and § 3º; (Amended, effective from 7/1/2023, by Resolution BCB No. 306, of 3/23/2023.)

X - complying with the provisions of Article 53, §§ 4º to 6º, in the constitution of the risk committee;

XI - timely identifying negative perceptions of clients, the financial market, and society in general regarding the institution's reputation, when such perception may significantly impact the social, environmental, and climate risks incurred by it, as provided in Article 44, item VI; and

XII - conducting scenario analyses, within the stress testing program, that consider hypotheses of changes in climate patterns and transition to a low-carbon economy, as provided in Article 44, item VII.

Art. 67. Institutions classified in S4 are exempt from:

I - reporting, in the management report, the degree of dissemination of risk management culture as provided in Article 5, item X, letter “e”;

II - disseminating information through a structured communication process, as provided in Article 6, sole paragraph;

III - observing the restriction referred to in Article 7, sole paragraph, in the periodic evaluation of risk management models;

IV - using, in the stress testing program, the scenario analysis methodology mentioned in Article 10, item III, letter “b”;

V - documenting, regarding the stress testing program, the provisions of Article 10, item V, letters “c”, “d”, “e” and “f”;

VI - considering the contribution of experts in carrying out the stress testing program, as provided in Article 10, sole paragraph;

VII - using the stress testing program to evaluate the adequacy and robustness of the premises and methodologies used in risk management models, as provided in Article 11, item II;

VIII - observing the criteria for conducting stress tests established in Article 12;

IX - developing scenarios within the stress testing program as provided in Article 13;

X - having flexible systems, within the stress testing program, according to the criteria established in Article 14;

XI - incorporating the results of stress tests into the structured communication process, as provided in Article 15, item IV;

XII - managing instruments subject to market risk in a trading desk structure, as provided in Articles 24 and 25, as well as documenting the reclassification of instruments between trading and banking portfolios as provided in Article 31, item II, letter “a”, and internal risk transfers as provided in Article 31, item II, letter “b”;

XIII - documenting in the RAS the IRRBB appetite levels for the economic value approaches referred to in Article 32, § 3º;

XIV - including additional aspects related to IRRBB in management reports, as provided in Article 33;

XV - implementing the information collection, classification, aggregation, and operational loss analysis processes referred to in Article 35, item V;

XVI - conducting operational risk scenario analyses as provided in Article 35, item IX and § 2º;

XVI - conducting operational risk scenario analyses as provided in Article 35, item VI and § 3º; (Amended by Resolution BCB No. 331, of 6/27/2023.)

XVII - establishing an operational risk database as provided in Article 36;

XVIII - developing the capital contingency plan mentioned in Article 48, item V;

XIX - establishing a risk committee in accordance with Article 53;

XX - timely identifying negative perceptions of clients, the financial market, and society in general regarding the institution's reputation, when such perception may significantly impact the social, environmental, and climate risks incurred by it, as provided in Article 44, item VI; and

XXI - conducting scenario analyses, within the stress testing program, that consider hypotheses of changes in climate patterns and transition to a low-carbon economy, as provided in Article 44, item VII.

CHAPTER IX
FINAL PROVISIONS

Art. 68. The following must be kept available to the Central Bank of Brazil for five years:

I - the RAS;

II - documentation related to the risk management structure;

III - documentation related to the capital management structure;

IV - the reports referred to in this Resolution.

Art. 69. If the Central Bank of Brazil identifies inadequacy or insufficiency in risk management or capital management, it may determine their improvement.

Art. 70. The risk management and capital management structures must be implemented by December 31, 2023.

Art. 71. This Resolution enters into force on July 1, 2023.

Roberto de Oliveira Campos Neto
President of the Central Bank of Brazil