Resolution BCB No. 343 – Provides for the necessary measures for the execution of the sharing of data and information on indications of fraud addressed by Joint Resolution No. 6, of 23 May 2023

RESOLUTION
BCB No. 343, OF OCTOBER 4, 2023

Provides for the necessary measures for the execution of the sharing of data and information on indications of fraud addressed by Joint Resolution No. 6, of 23 May 2023.

The Collegiate Board of the Central Bank of Brazil, in session held on 4 October 2023, pursuant to art. 9 of Law No. 4,595, of 31 December 1964, based on arts. 9‑A of Law No. 4,728, of 14 July 1965, 9, paragraph II, of Law No. 12,865, of 9 October 2013, and considering the provision of art. 9 of Joint Resolution No. 6, of 23 May 2023,

RESOLVES:

CHAPTER I

OF THE OBJECT AND SCOPE OF APPLICATION

Art. 1 This Resolution provides for the necessary measures for the execution of the sharing of data and information on indications of fraud addressed by Joint Resolution No. 6, of 23 May 2023, to be observed by financial institutions, payment institutions and other institutions authorized to operate by the Central Bank of Brazil.

Sole paragraph. The provisions of this Resolution do not apply to consortium administrators.

Art. 1‑A The data to be shared and the information on indications of fraud include indications of the activity of natural or legal persons as operators of unauthorized betting, as addressed in art. 24‑A, caput, paragraph I, of Law No. 14,790, of 29 December 2023. (Included by Resolution BCB No. 569, of 19/5/2026.)

CHAPTER II

MINIMUM SCOPE OF DATA AND INFORMATION TO BE RECORDED

Art. 2 The institutions mentioned in art. 1 must consider for the recording of the data and information referred to in art. 2, § 1, paragraph I, of Joint Resolution No. 6, 2023, at minimum, the indications of occurrences or attempts of fraud in the following activities carried out by the institutions:

I – opening of deposit accounts or payment accounts;

II – provision of payment service, observed the provision of § 1;

III – maintenance of deposit account or payment account; and

III – maintenance of deposit or payment account; (Amended by Resolution BCB No. 552, of 3/3/2026.)

IV – contracting of credit operation.

IV – contracting of credit operation; and (Amended by Resolution BCB No. 552, of 3/3/2026.)

IV – contracting of credit operation; (Amended by Resolution BCB No. 569, of 19/5/2026.)

V – provision of virtual asset services. (Included by Resolution BCB No. 552, of 3/3/2026.)

V – provision of virtual asset services; and (Amended by Resolution BCB No. 569, of 19/5/2026.)

VI – provision of financial and payment services to natural or legal persons as operators of unauthorized betting, as addressed in art. 24‑A, caput, paragraph I, of Law No. 14,790, of 29 December 2023. (Included by Resolution BCB No. 569, of 19/5/2026.)

§ 1 The provision of payment service referred to in paragraph II of caput includes:

§ 1 The provision of payment services referred to in paragraphs II and VI of the caput includes:

I – transfers between accounts within the same institution;

II – Electronic Available Transfer (TED);

III – payment transactions using checks;

IV – instant payment transactions (Pix);

V – transfers via Credit Document (DOC);

VI – payment slips; and

VII – cash withdrawals.

§ 2 The registration referred to in the caput does not apply to confidential data and information, under special legislation, related to indications of the crimes of “money laundering” or concealment of assets, rights and values and of terrorism financing, as provided in art. 2, § 7, of Joint Resolution No. 6, 2023.

Art. 3 The data and information to be recorded referred to in art. 2, § 2, of Joint Resolution No. 6, 2023, must contain, at minimum, the following details:

I – identification of who, according to available indications, would have executed or attempted to execute the fraud, when applicable:

a) full name and CPF (Individual Taxpayer Registry) number; or

b) corporate name, CNPJ (National Registry of Legal Entities) number, trade name and, when available, CPF of legal representatives;

II – description of the indications of the occurrence or attempt of fraud:

a) date of execution of the indication of the occurrence or attempt of fraud;

b) time of execution of the indication of the occurrence or attempt of fraud, when available;

c) location of execution of the indication of the occurrence or attempt of fraud, when available;

d) activity related to the indication of the occurrence or attempt of fraud referred to in the caput of art. 2;

e) payment transaction amount, if the activity referred to in sub‑letter “d” relates to the provision of a payment service;

f) contracted amount, if the activity referred to in sub‑letter “d” relates to the contracting of a credit operation;

g) description of the cause or procedure that gave rise to the indication of the occurrence or attempt of fraud related to the activity mentioned in sub‑letter “d”, when available;

h) form of interaction or channel used for the execution of the indication of the occurrence or attempt of fraud, when available;

i) identification of the electronic device used in the execution of the indication of the occurrence or attempt of fraud, when available;

j) indication whether the client acted in the indication of the occurrence or attempt of fraud, observed the provision of § 3; and

k) specification whether it is an indication of occurrence or an indication of attempt of fraud;

III – identification of the institution responsible for the recording of the data and information:

a) institution name; and

b) institution CNPJ; and

IV – identification of the recipient account data and its holder, when the activity referred to in sub‑letter “d” of paragraph II of the caput relates to the provision of a payment service involving transfer or payment of resources:

a) identifier of the institution;

b) branch code, if any;

c) account number;

d) account type; and

e) identification of the holder(s) of the recipient account:

1. full name and CPF; or

2. corporate name, CNPJ, trade name and, when available, CPF of legal representatives.

§ 1 The detailing of sub‑letter “d” of paragraph II of the caput:

I – does not remove the need for the institution to describe the cause or procedure that gave rise to the indication of occurrence or attempt of fraud, referred to in sub‑letter “g” of paragraph II of the caput, when available; and

II – includes the identification of the payment service as provided in § 1 of art. 2, when the activity referred to in sub‑letter “d” of paragraph II of the caput relates to the provision of a payment service.

§ 2 The account type referred to in sub‑letter “d” of paragraph IV of the caput covers checking deposit accounts, savings deposit accounts or prepaid payment accounts, under current regulation.

§ 3 The client’s action referred to in sub‑letter “j” of paragraph II of the caput, determined by the institution mentioned in art. 1, is independent of whether it was induced by third parties.

§ 4 In the case related to art. 2, caput, paragraph VI, the identification referred to in paragraph I of the caput must refer to unauthorized betting operators. (Included by Resolution BCB No. 569, of 19/5/2026.)

CHAPTER III

MEASURES FOR THE SHARING OF DATA AND INFORMATION ON INDICATIONS OF FRAUD

Section I – Deadline for registration of data and information and for the compliance statement

Art. 4 The operational procedures for the sharing of data and information referred to in art. 2 of Joint Resolution No. 6, 2023, must include the registration of data and information on indications of occurrences or attempts of fraud within a maximum of 24 (twenty‑four) hours counted from the moment of identification by the institutions mentioned in art. 1 of the indication of occurrence or attempt of fraud in their activities.

Sole paragraph. The maximum period mentioned in the caput also applies to the alteration and deletion of the recorded data and information on indications of occurrences or attempts of fraud, counted from the moment the institution identifies the need to alter or delete such data and information.

Art. 5 The electronic system referred to in art. 2, § 1, of Joint Resolution No. 6, 2023, must have functionality to allow the institutions mentioned in art. 1 to make a compliance statement, by the 15th (fifteenth) day of each month:

I – of the registration of data and information on indications of occurrences or attempts of fraud of the previous month; or

II – of the absence of any indication of occurrence or attempt of fraud in the previous month.

§ 1 The compliance statement referred to in the caput must be documented by the institutions mentioned in art. 1.

§ 2 The provision in paragraph I of the caput includes alterations and deletions of the recorded data and information on indications of occurrences or attempts of fraud.

Section II – Interoperability between electronic systems

Art. 6 To ensure interoperability with other electronic systems implemented in compliance with Joint Resolution No. 6, 2023, when existing, the institutions must adopt, at minimum, the following measures:

I – provide standardized layouts of files, rules, procedures, technologies and other resources necessary for the exchange of information between electronic systems;

II – maintain the uniqueness of the record of data and information on indications of occurrences or attempts of fraud referred to in art. 2, § 1, paragraph I, of Joint Resolution No. 6, 2023;

III – guarantee the exchange of information necessary to identify the electronic system that stores the unique record referred to in paragraph II; and

IV – provide secure access to the data and information stored in the electronic system identified under paragraph III.

§ 1 The provision in paragraph I of the caput must be documented.

§ 2 The uniqueness of the record of data and information mentioned in paragraph II of the caput requires the recording, by the same institution, of data and information on indications of occurrences or attempts of fraud exclusively in one electronic system.

Section III – Requirements for contracting the data‑sharing service

Art. 7 The institutions mentioned in art. 1, if they exercise the option referred to in art. 10, must ensure that the contract for the provision of the data‑sharing service:

I – discriminates the amounts charged for the service, according to the functionalities to be used;

II – describes the criteria for defining the amounts referred to in paragraph I of the caput;

III – provides cost estimates for functionalities whose amounts cannot be defined at the time of contract signing; and

IV – specifies any functionalities whose amounts will not be charged, when applicable.

Section IV – Technical security requirements

Art. 8 The technical security requirements for the operation of the electronic system referred to in art. 2, § 1, of Joint Resolution No. 6, 2023, include:

I – authentication, seeking to identify the institution that accessed the system’s functionalities;

II – encryption of the data and information retrieved, as a result of the access referred to in paragraph I of the caput, when applicable;

III – the execution, at least annually, of intrusion tests; and

IV – the establishment of mechanisms that allow traceability of access to the data and information.

§ 1 The intrusion tests referred to in paragraph III of the caput must be carried out independently and impartially by a natural or legal person specialized and contracted for this purpose.

§ 2 Vulnerabilities identified in the intrusion tests referred to in paragraph III of the caput must be documented and promptly addressed.

§ 3 The implementation of the security requirements referred to in this article must be compatible with the institution’s cyber security policy, as provided in current regulation.

Section V – Parameters for service level agreements

Art. 9 The detailing of parameters for service level agreements in the execution of the functionalities of the electronic system referred to in paragraph III of art. 9 of Joint Resolution No. 6, 2023, must include, at minimum:

I – annual availability of the production electronic system of at least 99.8% (ninety‑nine point eight percent);

II – targeted recovery time for the electronic system of at most 2 (two) hours;

III – response time to queries made by the institutions mentioned in art. 1 to the data and information recorded in the electronic system; and

IV – response time to queries made by other electronic systems to the data and information recorded in the electronic system for purposes of interoperability referred to in art. 6, when applicable.

Sole paragraph. The documentation regarding the parameters for service level agreements must contain:

I – the data and information that underpin the calculation of system availability and recovery time set out in paragraphs I and II of the caput; and

II – the data, information and parameters that promote efficiency in defining the response times to queries referred to in paragraphs III and IV of the caput, when applicable.

CHAPTER IV

GENERAL PROVISIONS

Art. 10 The institutions mentioned in art. 1 are responsible for complying with the measures set out in this Resolution, including when exercising the option to contract a company for the provision of the data‑sharing service, under art. 5 of Joint Resolution No. 6, 2023.

Art. 11 The institutions mentioned in art. 1 must establish monitoring and control mechanisms to ensure the effectiveness of compliance with this Resolution, in a manner compatible with art. 7 of Joint Resolution No. 6, 2023.

Art. 12 The institutions mentioned in art. 1 must keep available to the Central Bank of Brazil, for five (5) years:

I – the documentation on the compliance statement referred to in art. 5, § 1, counted from the date of such compliance;

II – the documentation referred to in art. 6, § 1, counted from the date of the last updates of such documentation;

III – the contract referred to in art. 7, counted from the date of termination of the contract;

IV – the results of the intrusion tests referred to in art. 8, caput, paragraph III, counted from the date of delivery of the test results;

V – the documentation regarding the service level agreements referred to in art. 9, sole paragraph, counted from the date of the last update of such documentation; and

VI – the data, records and information related to the application of the monitoring and control mechanisms referred to in art. 11, counted from the date of each application of the mentioned mechanisms.

Art. 13 The institutions mentioned in art. 1 must implement the provisions of arts. 5 and 9 of this Resolution by 1 February 2024.

Art. 13‑A The institutions mentioned in art. 1 must implement the measures necessary to comply with this Resolution:

I – by 30 October 2026, for the activity referred to in art. 2, caput, paragraph V; and

II – by 1 December 2026, for the activity referred to in art. 2, caput, paragraph VI.

Art. 14 This Resolution enters into force on 1 November 2023.

OTÁVIO RIBEIRO DAMASO
Regulation Director