Resolution No. 498

RESOLUTION
BCB No. 498, of 5 September 2025

Regulates, within the National Financial System and the Brazilian Payment System, the requirements, procedures and conditions for the accreditation of Information Technology Service Provider – PSTI and provides other measures.

The Collegiate Board of the Central Bank of Brazil, in a session held on 3 September 2025, based on art. 10 of Law No. 4,595, of 31 December 1964, and art. 10 of Law No. 10,214, of 27 March 2001,

RESOLVES:

Art. 1º This Resolution establishes the requirements, procedures and conditions for the accreditation of Information Technology Service Provider – PSTI for the provision of data‑processing services for access to the National Financial System Network – RSFN.

Parágrafo único. The accreditation addressed by this Resolution does not constitute authorization for the economic activity of PSTI, nor does it alter the legal and contractual duties of the PSTI towards its clients and partners.

§ 1º The accreditation addressed by this Resolution does not constitute authorization for the economic activity of PSTI, nor does it alter the legal and contractual duties of the PSTI towards its clients and partners. (Transformed into § 1º by Resolution BCB No. 547, of 30/1/2026.)

§ 2º Entities that provide data‑processing services for access to RSFN exclusively to institutions that belong to the same economic group are not subject to the provisions of this norm, but must ensure operational segregation and observe the applicable technical and security requirements. (Included by Resolution BCB No. 547, of 30/1/2026.)

Art. 2º For the purposes of this Resolution, the following definitions apply:

I – electronic data communication: process of transferring information between computer systems;

II – RSFN: data‑communication structure intended to support the flow of information within the National Financial System – SFN for authorized services;

II – RSFN: data‑communication structure intended to support the flow of information within the National Financial System – SFN and the Brazilian Payment System – SPB for authorized services; (Text given by Resolution BCB No. 547, of 30/1/2026.)

III – PSTI: accredited entity capable of providing data‑processing services for access to RSFN to financial institutions and other institutions supervised by the Central Bank of Brazil; and (Text given by Resolution BCB No. 547, of 30/1/2026.)

IV – administrators: the managing partners and the directors. (Included by Resolution BCB No. 547, of 30/1/2026.)

---

CHAPTER I

OF ACCREDITATION

Art. 3º The accreditation of a PSTI by the Central Bank of Brazil is subject to the applicant meeting the following requirements:

I – adherence to the principles and rules of the RSFN;

II – proof of the regular incorporation of the PSTI; (Text given by Resolution BCB No. 547, of 30/1/2026.)

III – proof of non‑applicability of the prohibitions established in art. 6º;

III – (Revoked by Resolution BCB No. 547, of 30/1/2026.)

IV – proof of technical‑operational capacity to provide data‑processing services for access to RSFN, observing the requirements set out in this Resolution and the technical standards concerning electronic data communication within the SFN and SPB established by the Department of Information Technology – Deinf of the Central Bank of Brazil; (Text given by Resolution BCB No. 547, of 30/1/2026.)

V – designation of the administrators, observed the provisions of arts. 5º, 5º‑A, 5º‑B and 11; (Text given by Resolution BCB No. 547, of 30/1/2026.)

VI – (Revoked by Resolution BCB No. 547, of 30/1/2026.)

VII – compliance with the conditions set out in art. 5º by the controllers, in the case of a PSTI organized as a corporation or limited liability company; (Text given by Resolution BCB No. 547, of 30/1/2026.)

VIII – paid‑in share capital and net equity of at least R$15,000,000.00 (fifteen million reais), with the Central Bank of Brazil able to require a higher amount proportionate to the projected volume of operations, the number of clients and the risk profile of the PSTI; (Text given by Resolution BCB No. 547, of 30/1/2026.)

IX – proof of the establishment of mechanisms provided for in Chapter III; (Text given by Resolution BCB No. 547, of 30/1/2026.)

X – proof of technical‑operational capacity to provide information to the Central Bank of Brazil as set out in Chapter IV;

XI – information‑security certification in an internationally recognized standard; (Text given by Resolution BCB No. 547, of 30/1/2026.)

XII – proof of contracting an independent external audit aimed at annual assessments in information security and, when applicable, in anti‑money‑laundering and terrorism‑financing, with reports sent to the Central Bank of Brazil and the contracting institutions; (Text given by Resolution BCB No. 547, of 30/1/2026.)

XIII – proof of contracting civil‑liability and operational‑risk insurance with minimum coverage defined by the Central Bank of Brazil, including fraud and cyber‑security incidents; and

XIV – (Revoked by Resolution BCB No. 547, of 30/1/2026.)

XV – proof of establishing procedures for providing, to the Central Bank of Brazil and the contracting institutions, the reports prepared by the independent audit from the annual information‑security assessments and, when applicable, from anti‑money‑laundering and terrorism‑financing assessments. (Included by Resolution BCB No. 547, of 30/1/2026.)

§ 1º The adherence referred to in item I of the caput shall be effected through the signing of a Term of Adhesion and Responsibility, executed by the legal representative of the PSTI using a digital certificate issued by a certification authority of the Brazilian Public Key Infrastructure – ICP‑Brasil.

§ 2º The PSTI must annually demonstrate, in the form and on the date stipulated by the Central Bank of Brazil, that the requirements set out in items I to XIII of the caput remain satisfied.

§ 2º (Revoked by Resolution BCB No. 547, of 30/1/2026.)

§ 3º The PSTI that fails to comply with the obligation set out in § 2º shall be subject to the de‑accreditation provided for in art. 7º, caput, item II.

§ 3º (Revoked by Resolution BCB No. 547, of 30/1/2026.)

§ 4º In proving the requirements referred to in the caput, the Central Bank of Brazil may require that they be attested by a reasonable‑assurance report prepared by an independent audit registered with the Securities and Exchange Commission. (Included by Resolution BCB No. 547, of 30/1/2026.)

§ 5º The independent audit contracted by the institution, if applicable, must have technical, administrative and operational capacity compatible with the performance of the reasonable‑assurance work foreseen in this Resolution. (Included by Resolution BCB No. 547, of 30/1/2026.)

Art. 4º The PSTI must maintain economic‑financial capacity compatible with the critical nature of the services provided and the operational risks assumed.

Art. 4º (Revoked by Resolution BCB No. 547, of 30/1/2026.)

Art. 4º‑A For the purposes of this Resolution, the following definitions apply: (Included by Resolution BCB No. 547, of 30/1/2026.)

I – controller: person who, individually or together with other members of a control group in which they participate, holds shareholder rights corresponding to a majority of the voting capital of the institution: (Included by Resolution BCB No. 547, of 30/1/2026.)

a) in the case of a natural person, directly or indirectly; or (Included by Resolution BCB No. 547, of 30/1/2026.)

b) in the case of a legal entity, directly or, if indirectly, provided that:

1. it is at the last level of the control chain of the institution; and

2. its controllers are not identifiable in the manner provided for in this item;

II – control group: group of persons linked by voting agreement or common control that assume the role of controller of the institution, as defined in item I. (Included by Resolution BCB No. 547, of 30/1/2026.)

§ 1º The entity at the last level of the control chain of the institution, in cases of direct or indirect participation, is the foreign‑based financial or similar institution responsible for the global consolidation of the financial group. (Included by Resolution BCB No. 547, of 30/1/2026.)

§ 2º The definitions of controller apply to the holders of voting rights. (Included by Resolution BCB No. 547, of 30/1/2026.)

§ 3º When the control of the company is not identified according to the criteria mentioned in items I and II of the caput, the Central Bank of Brazil may use other elements to identify the controllers, among them:

I – majority of votes in the meeting or assembly deliberations and the power to elect the majority of directors; or

II – effectiveness in conducting the corporate business.

§ 4º The Central Bank of Brazil may require the signing of a shareholders’ or quota‑holders’ agreement, expressly defining direct or indirect corporate control. (Included by Resolution BCB No. 547, of 30/1/2026.)

§ 5º For the purposes of this article, the possible assignment of multiple votes to one or more classes of ordinary shares shall be considered. (Included by Resolution BCB No. 547, of 30/1/2026.)

§ 6º Investment funds are not admitted as controllers or members of a control group of a PSTI. (Included by Resolution BCB No. 547, of 30/1/2026.)

Art. 4º‑B The Central Bank of Brazil may:

I – archive the accreditation request without merit assessment if:

a) it verifies that the object or the elements forming the basis of the request have been altered during the process; or

b) there is non‑compliance with the deadlines established in the current regulation; or

c) it identifies that the requirements to complement the file were not met within the stipulated period; or

d) the controllers or administrators fail to attend the Central Bank’s interview summons; or

e) the file is inconsistent with the format required by the current regulation.

II – deny the accreditation request if it discovers:

a) circumstances that could affect the reputation of the controllers or administrators; or

b) falsity or omission in the statements and documents submitted in the process or discrepancy between them and the facts or data uncovered in the analysis; or

c) failure to meet any of the requirements or conditions established in this Resolution, or the applicant’s inability to demonstrate compliance; or

d) non‑compliance, by the audit referred to in art. 3º, caput, item XII, with the requirements set out in art. 3º, § 5º, and the audit standards and procedures determined by the Securities and Exchange Commission and the Federal Accounting Council. (Included by Resolution BCB No. 547, of 30/1/2026.)

Single paragraph. In the cases covered by item II of the caput, the Central Bank of Brazil may, before deciding, grant a deadline for interested parties to manifest. (Included by Resolution BCB No. 547, of 30/1/2026.)

Art. 4º‑C The Central Bank of Brazil may review the decision on matters addressed by this Resolution, considering the relevance of the facts, based on the circumstances of each case and the public interest, if it verifies:

I – falsity or omission in the statements and documents presented in the process or discrepancy between them and the facts or data uncovered;

II – pre‑existing circumstances capable of affecting the assessment of compliance with the requirements and conditions; or

III – non‑compliance, by the audit referred to in art. 3º, caput, item XII, with the requirements set out in art. 3º, § 5º, and the audit standards and procedures determined by the Securities and Exchange Commission and the Federal Accounting Council. (Included by Resolution BCB No. 547, of 30/1/2026.)

§ 1º In the event of a control transfer, assumption of the controller role, or occurrence of any situation described in the caput, the Central Bank of Brazil may require the operation to be regularized, under penalty of PSTI de‑accreditation. (Included by Resolution BCB No. 547, of 30/1/2026.)

§ 2º In the situations described in the caput, the Central Bank of Brazil shall notify the institution to comment on the identified irregularity. (Included by Resolution BCB No. 547, of 30/1/2026.)

Art. 5º The requirements for assuming the controller role and exercising the administrator function, in addition to other requirements established by legislation and current regulation, are:

I – have an unblemished reputation, in the case of natural persons; (Text given by Resolution BCB No. 547, of 30/1/2026.)

---

II

• be resident in the country, in the case of administrator; Text given by Resolution BCB No. 547, of 30/1/2026.

III - not have been declared bankrupt or insolvent, unless rehabilitated; and

III - not be declared bankrupt or insolvent; Text given by Resolution BCB No. 547, of 30/1/2026.

IV - prove, through a certificate from an independent auditor registered with the Securities and Exchange Commission, regular tax registration with the Federal Revenue Service and absence of serious restrictions in delinquent registries that compromise its ability to manage or control the PSTI.

IV

• not be prevented by special law, nor convicted of bankruptcy crime, tax evasion, prevarication, active or passive corruption, extortion, embezzlement against the popular economy, public faith, property or the National Financial System, nor sentenced to a penalty that bars, even temporarily, access to public offices; Text given by Resolution BCB No. 547, of 30/1/2026.

V - not be declared disabled or suspended from holding positions in statutory or contractual bodies in institutions authorized to operate by the Central Bank of Brazil or in complementary pension entities, insurance companies, capitalization societies, publicly held companies or entities subject to supervision by the Securities and Exchange Commission; and Included by Resolution BCB No. 547, of 30/1/2026.

VI - not have its name been the object of a prior decision of denial or revision of decision due to the presentation of false, omitted or discrepant statements of the corresponding facts in a request before the Central Bank of Brazil, in the three years preceding the instruction of the request under analysis. Included by Resolution BCB No. 547, of 30/1/2026.

Sole paragraph. The Central Bank of Brazil, in the analysis of the processes covered by this Resolution, considering the circumstances of each concrete case and the context of the facts, may exceptionally waive, upon duly justified public interest, the fulfillment of the requirements and conditions established for entry into the role of controller or for the exercise of the function of administrator. Included by Resolution BCB No. 547, of 30/1/2026.

Art. 5º-A In verifying compliance with the reputation requirement, mentioned in art. 5º, caput, item I, the existence of the following shall be considered: [Included by Resolution BCB No. 547, of 30/1/2026.]

I - criminal process or police inquiry; [Included by Resolution BCB No. 547, of 30/1/2026.]
II - judicial or administrative process that has relation with the National Financial System, the Consortia System, the Brazilian Payment System or the provision of virtual asset services; [Included by Resolution BCB No. 547, of 30/1/2026.]
III - process related to insolvency, liquidation, intervention, bankruptcy or judicial recovery; [Included by Resolution BCB No. 547, of 30/1/2026.]
IV - default of obligations; and [Included by Resolution BCB No. 547, of 30/1/2026.]
V - other situations, occurrences or analogous circumstances. [Included by Resolution BCB No. 547, of 30/1/2026.]

Sole paragraph. In the analysis of the situations and occurrences provided in the caput, relevance, gravity, recurrence and the circumstances of each case shall be considered. [Included by Resolution BCB No. 547, of 30/1/2026.]

Art. 5º-B Administrators must have technical training compatible with the functions to be exercised during the term. [Included by Resolution BCB No. 547, of 30/1/2026.]

§ 1º Proof of compliance with the technical training requirement of administrators, mentioned in the caput, involves the competencies and qualifications necessary for the exercise of the functions, compatible with the nature, size, complexity and risks incurred by the PSTI. [Included by Resolution BCB No. 547, of 30/1/2026.]

§ 2º The Central Bank of Brazil may waive the proof of technical training referred to in the caput, in the case of an administrator whose name has already been evaluated by the Authority for the exercise of the function. [Included by Resolution BCB No. 547, of 30/1/2026.]

§ 3º Administrators may exercise their functions for a period of, at most, four years, renewable for equal periods. [Included by Resolution BCB No. 547, of 30/1/2026.]

Art. 6º Accreditation as PSTI is prohibited:

I

• to communication service operators contracted for the operation of the RSFN;

II

• to service providers contracted for the management and monitoring of the RSFN;

III - to financial institutions and other institutions supervised by the Central Bank of Brazil, except as provided in § 1º;

III

• to financial institutions and other institutions supervised by the Central Bank of Brazil; and [Text given by Resolution BCB No. 547, of 30/1/2026.]

IV - to related parties of the institutions referred to in items I to III; and

IV

• to entities that are, directly or indirectly, controlling or controlled by the institutions referred to in items I to III or that, in relation to those institutions, have a common controller. [Text given by Resolution BCB No. 547, of 30/1/2026.]

V - to entities whose controllers or administrators do not meet the integrity, reputation and technical qualification conditions provided in this Resolution.

V

• [Revoked by Resolution BCB No. 547, of 30/1/2026.]

§ 1º The institutions referred to in item III of the caput may act as PSTI exclusively to serve the other institutions belonging to the same financial conglomerate, provided operational segregation is maintained and applicable technical and security requirements are observed.

§ 1º The institutions referred to in items III and IV of the caput may provide data processing services, for access to the RSFN, exclusively to serve the other institutions belonging to the same economic group, provided operational segregation is maintained and applicable technical and security requirements are observed. [Text given by Resolution BCB No. 547, of 30/1/2026.]

§ 2º The provision in § 1º does not remove the duty of the institutions served by the institution mentioned in item III of the caput and that act as PSTI to observe the regulation in force for the contracting of processing, data storage and cloud computing services.

§ 2º The provision of § 1º does not remove the duty of the institutions served by the institutions mentioned in items III or IV of the caput and that act as PSTI to observe the regulation in force for the contracting of processing, data storage and cloud computing services. [Text given by Resolution BCB No. 547, of 30/1/2026.]

CHAPTER II

OF DISACCREDITATION

Art. 7º Disaccreditation of the PSTI may occur:

I

• at the request of the PSTI; and

II - ex officio, by the Central Bank of Brazil, in the cases provided for in this Resolution.

II

• ex officio, by the Central Bank of Brazil. [Text given by Resolution BCB No. 547, of 30/1/2026.]

Art. 8º The PSTI that wishes to submit a disaccreditation request to the Central Bank of Brazil must formally notify the contracting institutions, through specific correspondence, with a minimum advance of thirty days from the date of the request, and must present to the Central Bank of Brazil a discontinuity and transition plan for the services provided.

Art. 8º The PSTI that wishes to submit a disaccreditation request must formally notify the Central Bank of Brazil and the contracting institutions, through specific correspondence, with a minimum advance of thirty days from the date of the request. [Text given by Resolution BCB No. 547, of 30/1/2026.]

§ 1º The communication to the Central Bank of Brazil provided for in the caput must be accompanied by a document addressing the actions to be undertaken to execute the orderly exit plan provided for in art. 20. [Included by Resolution BCB No. 547, of 30/1/2026.]

§ 2º After the completion of the plan referred to in § 1º, the PSTI must request its disaccreditation from the Central Bank of Brazil. [Included by Resolution BCB No. 547, of 30/1/2026.]

Art. 9º The Central Bank of Brazil may promote the disaccreditation referred to in art. 7º, caput, item II, when it verifies, at any time, serious or recurring non‑compliance with the requirements established in this Resolution, especially regarding:

Art. 9º The Central Bank of Brazil may, after adopting the precautionary measure established in art. 32, caput, item VIII, promote the disaccreditation referred to in art. 7º, caput, item II, when it verifies, at any time, serious or recurring non‑compliance with the requirements and conditions established in this Resolution, especially regarding:

I - accreditation with the Central Bank of Brazil;

II - corporate governance, risk management and information security;

II - the provisions set out in Chapters III and IV; [Text given by Resolution BCB No. 547, of 30/1/2026.]

III - provision of information to the Central Bank of Brazil;

III - [Revoked by Resolution BCB No. 547, of 30/1/2026.]

IV - maintenance of capital, insurance and security certification requirements;

IV - [Revoked by Resolution BCB No. 547, of 30/1/2026.]

V - operational failures or security incidents that significantly compromise the integrity, availability or reliability of the RSFN or the payment services supported by it;

VI - the practice of acts that characterize fraud, deceit or bad faith in the conduct of PSTI activities;

VII - failure to meet, within the set deadline, determinations or preventive measures imposed by the Central Bank of Brazil under this Resolution; and

VII - failure to meet, within the set deadline, determinations or precautionary measures imposed by the Central Bank of Brazil under this Resolution; and [Text given by Resolution BCB No. 547, of 30/1/2026.]

VIII - situations that evidence loss of integrity, reputation or technical qualification of PSTI controllers and administrators.

VIII - situations that evidence non‑compliance by the controllers and administrators with requirements or conditions set out in this Resolution. [Text given by Resolution BCB No. 547, of 30/1/2026.]

Sole paragraph. The Central Bank of Brazil, prior to the disaccreditation referred to in the caput, shall notify the PSTI and grant it a period to comment on the intention of its disaccreditation. [Included by Resolution BCB No. 547, of 30/1/2026.]

Art. 10. Disaccreditation, in any of the hypotheses provided for in art. 7º, shall be preceded by the implementation of the orderly exit plan provided for in art. 20.

Art. 10. [Revoked by Resolution BCB No. 547, of 30/1/2026.]

CHAPTER III

OF CORPORATE GOVERNANCE AND RISK MANAGEMENT

Section I

Of corporate governance

Art. 11. The PSTI must have a corporate‑governance structure compatible with its nature, size, complexity, structure and risk profile, ensuring transparent decision‑making processes, effective internal control mechanisms and appropriate risk management.

§ 1º The governance structure must ensure, at a minimum:

I - segregation of functions among executive management, risk management, compliance, information security and internal audit, to avoid conflicts of interest and concentration of power; II - existence of a collegiate administration body (board of directors or equivalent), with proportional participation of independent members, whenever the size or systemic relevance of the PSTI justifies it; III - preparation and disclosure of formal corporate‑governance policies, including risk management, cyber security, compliance, internal audit and business continuity; IV - mechanisms that ensure corporate transparency, including public disclosure of the corporate structure, identification of controllers and ultimate beneficiaries, and timely communication of relevant changes to the Central Bank of Brazil; V - prior and continuous assessment of the integrity, reputation and professional experience of controllers, administrators and senior executives, according to the criteria established in this Resolution; and VI - existence of an Operational Crisis Management Committee, supported by a formally defined structure, roles and responsibilities.

§ 2º Administrators and members of the PSTI’s corporate bodies must be professionals of recognized technical and strategic competence in the matter, capable of performing their multiple roles in pursuit of strategic objectives.

§ 2º [Revoked by Resolution BCB No. 547, of 30/1/2026.]

§ 3º The PSTI must establish, within senior management, directors responsible for critical functions, at minimum:

I - Director of Information and Cyber Security, responsible for implementing cyber‑security policies and managing operational incidents; II - Director of Risk and Compliance, responsible for supervising regulatory compliance and the effectiveness of internal controls; III - Director responsible for relations with the Central Bank of Brazil, responsible for providing information and regulatory liaison; and IV - Director responsible for operational‑crisis management and for coordinating the Operational Crisis Management Committee.

§ 4º The directors mentioned in § 3º may perform more than one critical function, or other functions in the entity, provided there is no conflict of interest. [Included by Resolution BCB No. 547, of 30/1/2026.]

Art. 12. The Operational Crisis Management Committee, established within the PSTI’s governance structure, must:

I - deliberate on the activation of the crisis‑management plan provided for in articles 21 and 22; II - declare the closure of operational crises; III - provide timely information to the Central Bank of Brazil about the operational crisis; and IV - record information and evidence that supported decision‑making during the management of the operational crisis.

Section II

Of risk management

Art. 13. The PSTI must segregate activities, computing environments and other resources necessary for providing data‑processing services for RSFN access from other services or activities that may be provided.

Art. 14. The PSTI must establish risk‑management policies compatible with its nature, size, complexity, structure and risk profile, supported by market‑best practices and principles.

Art. 15. The PSTI must establish risk‑management policies that address, at a minimum, the following areas:

I - information and cyber security;
II - business continuity;
III - operational‑crisis management;
IV - fraud management;
V - internal controls and compliance; and
VI - internal audit.

Sole paragraph. The policies referred to in the caput must be approved by the board of directors or an equivalent collegiate administration body, and reviewed at least annually, or whenever a relevant change occurs in the PSTI’s structure or risk profile. [Text given by Resolution BCB No. 547, of 30/1/2026.]

Art. 15-A. The PSTI must establish a risk‑management structure, internal controls and compliance compatible with its nature, size, complexity, structure and risk profile. [Included by Resolution BCB No. 547, of 30/1/2026.]

Art. 15-B. The PSTI must prepare an annual risk, internal‑control and compliance report, to be approved by the board of directors or equivalent collegiate administration body, and sent to the Central Bank of Brazil by the last business day of May of the following year. [Included by Resolution BCB No. 547, of 30/1/2026.]

§ 1º The report referred to in the caput must include, at a minimum:

I - the conclusions of the examinations performed; [Included by Resolution BCB No. 547, of 30/1/2026.]
II - recommendations regarding any deficiencies, with an established remediation schedule, when applicable; and [Included by Resolution BCB No. 547, of 30/1/2026.]
III - the statements of the responsible persons from the corresponding areas concerning the deficiencies found in previous verifications and the measures actually taken to remedy them. [Included by Resolution BCB No. 547, of 30/1/2026.]

§ 2º The Central Bank of Brazil may determine:

I - the inclusion of work in the scope of internal audit and the execution of specific tasks; and [Included by Resolution BCB No. 547, of 30/1/2026.]
II - the adoption of measures aimed at improving internal‑audit processes. [Included by Resolution BCB No. 547, of 30/1/2026.]

§ 3º The PSTI must keep the documents referred to in the caput available to the Central Bank of Brazil for a minimum period of five years. [Included by Resolution BCB No. 547, of 30/1/2026.]

Art. 16. The PSTI must implement and maintain an information and cyber‑security policy formulated on principles and guidelines that aim to guarantee the security of data, information, information systems and other computing resources used, in accordance with internationally recognized standards.

Art. 17. The information and cyber‑security policy referred to in art. 16 must, at a minimum, cover the following aspects:

I - encryption mechanisms, intrusion prevention and detection, data‑leak prevention and protection against malicious software; II - transaction traceability mechanisms; III - management of data and information backups; IV - assessment and correction of vulnerabilities in the computing environment and information systems used to provide services; V - access control; VI - regular application of security patches; VII - network protection mechanisms.

VIII - segregation of computing environments, limiting access to the production environment and critical computing resources;

IX - physical and logical isolation of the Pix environment from the institution's other systems, if it is also a software‑as‑a‑service provider for participants in this payments ecosystem, maintaining a dedicated and separate instance from other environments in public‑cloud use cases;

X - physical and logical isolation of the Reserve Transfer System – STR environment from the institution's other systems, if it is also a software‑as‑a‑service provider for participants in this payments ecosystem, maintaining a dedicated and separate instance from other environments in public‑cloud use cases;

XI - management of digital certificates;

XII - specific controls for integration with other parties through electronic interfaces;

XIII - technical certification of the information‑technology solutions used by financial institutions and other entities supervised by the Central Bank of Brazil to integrate, via electronic interfaces, with the services provided by the PSTI; and

XIV - cyber‑intelligence actions, including monitoring of information of interest (clients, keys, credentials, vulnerabilities, etc.) on the Internet, Deep and Dark Web, as well as private communication groups.

§ 1º The PSTI must not have access to the private keys used to sign messages within the arrangements and payment systems provided by the Central Bank of Brazil.

§ 2º The transaction traceability mechanisms referred to in item II of the caput must include, at a minimum:

I - end‑to‑end processing audit trails of data and information, including the definition and generation of logs that enable identification of processing failures or atypical behavior, as well as support analyses;

II - definition of information retention time according to the type of processing performed;

III - secure retention of audit trails; and

IV - access to audit trails by institutions that use the PSTI services, for reconciliation or risk‑management purposes.

§ 3º The assessment and correction of vulnerabilities referred to in item IV of the caput must include, at a minimum:

I - periodic tests and analyses to detect vulnerabilities in information systems;

II - periodic physical scans of the technological environment that can identify devices improperly connected to the corporate network that could establish connection with external technology assets;

II - periodic scans of the technological environment that can identify devices improperly connected to the corporate network that could establish connection with external technology assets; (Redação dada pela Resolução BCB nº 547, de 30/1/2026.)

III - periodic analyses of the technological environment aimed at identifying vulnerabilities that could compromise the security of the PSTI’s technology assets; and

IV - periodic intrusion tests.

§ 4º The access control referred to in item V of the caput must include, at least:

I - mechanisms to limit corporate‑network access to authorized users and devices;

II - periodic and timely review of access permissions, especially for outsourced collaborators with access to the institution’s computing environment;

III - establishment of multi‑factor authentication for corporate‑network access from external environments; and

IV - for Pix and STR environments, administrative access must always be performed using multi‑factor authentication.

§ 5º The network protection mechanisms referred to in item VII of the caput must include, at a minimum:

I - establishment of firewall rules as well as connection monitoring, preventing connection attempts to critical systems from technology assets located outside the institution’s corporate network;

II - definition of criteria for establishing and monitoring connections with external environments, especially during night or non‑standard hours;

III - mechanisms to identify and prevent improper connections with external environments from the PSTI’s computing environment; and

IV - implementation and maintenance of processes and tools for identification, analysis and treatment of atypical events in the PSTI environment, such as opening virtual private networks – VPNs – and privileged‑access attempts, especially during night or non‑standard hours, as well as assessment of the implementation of more robust controls that mitigate the risk of improper accesses in those occasions.

§ 6º The digital‑certificate management referred to in item XI of the caput must provide, at a minimum:

I - monitoring of digital‑certificate usage and controls for safeguarding this information; and

II - validation of revoked certificates with the certification authorities.

§ 7º The specific controls for integration with other parties through electronic interfaces referred to in item XII of the caput must consider, at a minimum:

I - definition of specific security requirements for the provision of services through electronic interfaces, ensuring the security and integrity of operations;

II - definition of operational and security requirements to be implemented by financial institutions and other entities supervised by the Central Bank of Brazil that wish to use services provided by the PSTI through electronic interfaces;

III - establishment of operation‑monitoring mechanisms, enabling behavioral analysis and detection of atypical operations;

III - establishment of request‑monitoring mechanisms for the interface, enabling behavioral analysis and detection of atypical use; (Redação dada pela Resolução BCB nº 547, de 30/1/2026.)

IV - establishment of reconciliation mechanisms that allow validation of processed operations;

IV - (Revogado pela Resolução BCB nº 547, de 30/1/2026.)

V - establishment of non‑functional requirements related to the provision of services through electronic interfaces, as well as the execution of tests to validate the implementation of those requirements;

VI - establishment of metrics and indicators for monitoring the performance of services provided through electronic interfaces;

VII - monitoring of the performance of services provided through electronic interfaces;

VIII - establishment of mechanisms to detect and inhibit attempts of improper use, behavior manipulation and data‑extraction attempts from services provided through electronic interfaces; and

IX - definition, establishment and monitoring of operational limits for services provided through electronic interfaces.

IX - definition, establishment and monitoring of operational parameters for services provided through electronic interfaces. (Redação dada pela Resolução BCB nº 547, de 30/1/2026.)

§ 8º The technical certification referred to in item XIII of the caput must consider, at a minimum, the definition and periodic execution of tests aimed at certifying that the computing systems used by financial institutions and other entities supervised by the Central Bank of Brazil to integrate, via electronic interfaces, with the services provided by the PSTI comply with the operational and security requirements established.

Art. 18. The PSTI must implement and maintain a business‑continuity policy to ensure the continuity of the institution’s activities and limit the impacts resulting from interruption of critical business processes.

Art. 19. The business‑continuity policy referred to in art. 18 must include, at a minimum, the following:

I - procedures and estimated timelines for restarting and recovering activities in case of interruption of critical business processes, as well as the necessary communication actions;

II - tests and reviews of business‑continuity plans with a minimum annual frequency;

II - preparation of business‑continuity plans, which must be tested and reviewed with a minimum annual frequency; (Redação dada pela Resolução BCB nº 547, de 30/1/2026.)

III - installation and operation of a secondary processing centre, subject to a set of risks different from the primary processing centre, capable of processing volumes at least equal to the highest volume verified in the last two hundred and fifty‑two business days, plus a safety percentage, and with data replication from the primary processing centre; and

IV - emergency procedures in case of simultaneous impediment of the primary and secondary processing centres.

Art. 20. The PSTI must prepare an orderly exit plan, containing measures to be implemented for the termination of its activities.

Parágrafo único. The plan referred to in the caput must prioritize mitigation of impact on financial institutions and other entities supervised by the Central Bank of Brazil that use PSTI services, as well as on the regular functioning of the Financial System Network (SFN) and the Brazilian Payment System (SPB). (Redação dada pela Resolução BCB nº 547, de 30/1/2026.)

Art. 21. The PSTI must implement and maintain an operational‑crisis‑management policy to guide the handling of atypical situations that could compromise its operation, with potential impacts on the regular functioning of the SFN and the SPB. (Redação dada pela Resolução BCB nº 547, de 30/1/2026.)

Art. 22. The operational‑crisis‑management policy referred to in art. 21 must include, at a minimum, the following measures:

I - definition of roles and responsibilities necessary for operational‑crisis management, including the provision of governance bodies and decision‑making thresholds;

II - definition of objective criteria for characterizing crisis situations and directing scenario analysis;

III - guidelines for the preparation, review and testing of crisis‑management plans; and

IV - guidelines for the preparation, review and testing of communication plans.

Art. 23. The PSTI must structure processes and procedures for managing operational, technological and security incidents, specifying the integration of these processes with the operational‑crisis‑management process in situations where incidents aggravate, in line with industry‑observed practices.

Parágrafo único. The PSTI must implement an incident‑response plan compatible with the institution’s risk profile, tested and updated at least annually, with a clear definition of functions and responsibilities and of the response and recovery procedures to be adopted to mitigate the effects of operational incidents on the institution’s operation.

Art. 24. The PSTI must implement and maintain a fraud‑management policy to mitigate atypical situations that could compromise the regular functioning of the SFN and the SPB. (Redação dada pela Resolução BCB nº 547, de 30/1/2026.)

Art. 25. The fraud‑management policy referred to in art. 24 must include, at a minimum, the following measures:

I - establishment of a channel for reporting fraud indications;

II - establishment of fraud‑prevention mechanisms, including provision of data for information reconciliation, access to audit trails and definition of operational limits;

III - continuous, 24‑hour‑a‑day, seven‑days‑a‑week monitoring to identify in real time, based on historical and behavioral patterns, atypical or fraudulent transactions, evaluating deviations relative to expected parameters concerning, among others:

a) transaction values;

b) transaction volume; and

c) number of transactions per unit of time;

IV - assessment of atypicalities in a stage prior to forwarding a transaction to the Central Bank of Brazil;

V - definition of mechanisms to validate transaction integrity during processing stages;

VI - existence of a mechanism to halt the entire transaction flow in case of serious suspicion of compromise; and

VII - establishment of a channel that enables timely communication of fraud indications to financial institutions and other entities supervised by the Central Bank of Brazil that may be impacted by such events.

Art. 26. The PSTI must implement and maintain a comprehensive internal‑controls and compliance policy, considering all business risks, including those arising from outsourcing of relevant services, and ensuring the implementation of effective internal controls in all areas.

Art. 27. The internal‑controls and compliance policy referred to in art. 26 must include, at a minimum, the following controls:

I - periodic testing and review of internal controls and contingency measures; and

II - mechanism to ensure compliance with the provisions of this Resolution and with all technical requirements of the RSFN set forth in the SFN Service Catalogue, the SFN Network Manual and the SFN Security Manual published by the Central Bank of Brazil.

Art. 28. The PSTI must implement and maintain an internal‑audit policy that sets out responsibilities, composition and mode of operation of internal audit, observing, among other things, best practices associated with the subject.

Art. 29. The internal‑audit policy referred to in art. 28 must provide, at a minimum, the following aspects:

I - reporting line of internal audit to the board of directors or equivalent collegiate administration body; (Redação dada pela Resolução BCB nº 547, de 30/1/2026.)

II - segregation of business units and risk‑management, internal‑control and compliance bodies;

III - definition of an internal‑audit structure compatible with the nature, size, complexity, structure and risk profile of the PSTI;

IV - preparation of an annual internal‑audit plan, approved by the board of directors or equivalent collegiate administration body, based on audit‑risk assessment and containing, at a minimum, the processes that will be within the scope of internal audit, their risk classification and the proposed allocation of available resources; and (Redação dada pela Resolução BCB nº 547, de 30/1/2026.)

V - possibility of hiring independent audit registered with the Securities and Exchange Commission, to validate or complement internal audit, with sharing of reports with the Central Bank of Brazil and contracting institutions. (Redação dada pela Resolução BCB nº 547, de 30/1/2026.)

CHAPTER IV

ON THE PROVISION OF INFORMATION TO THE CENTRAL BANK OF BRAZIL

Art. 30. The PSTI must provide the Central Bank of Brazil with the following information:

I - annual financial statements audited by an independent audit registered with the Securities and Exchange Commission; (Redação dada pela Resolução BCB nº 547, de 30/1/2026.)

II - technical certification required in art. 3, caput, item XI whenever renewed or updated;

III - (Revogado pela Resolução BCB nº 547, de 30/1/2026.)

IV - operational or information‑security incidents that could compromise the integrity, availability or confidentiality of the services provided, immediately after becoming aware of the occurrence, accompanied by a report within ten days;

V - significant changes to the service architecture or the PSTI’s computing environment;

VI - commencement or termination of relationships with financial institutions and other entities supervised by the Central Bank of Brazil;

VII - commencement of provision of other data‑processing services;

VIII - information necessary for monitoring the regular operation of the PSTI;

IX - (Revogado pela Resolução BCB nº 547, de 30/1/2026.)

X - (Revogado pela Resolução BCB nº 547, de 30/1/2026.)

Art. 30‑A. The PSTI accredited under this Resolution must notify the Central Bank of Brazil, in the manner defined by it, the appointment and dismissal of directors. (Incluído pela Resolução BCB nº 547, de 30/1/2026.)

Parágrafo único. If directors do not meet the conditions established in arts. 5 and 5‑B, the Central Bank of Brazil will grant a period for the PSTI to regularize the situation, under penalty of de‑accreditation. (Incluído pela Resolução BCB nº 547, de 30/1/2026.)

Art. 30‑B. The PSTI accredited by the Central Bank of Brazil must report cases in which directors, during the exercise of their functions, cease to meet the conditions set out in art. 5. (Incluído pela Resolução BCB nº 547, de 30/1/2026.)

§ 1º The communication referred to in the caput must be made within fifteen days from the knowledge or access to the information concerning the occurrence that characterizes the non‑compliance with the condition. (Incluído pela Resolução BCB nº 547, de 30/1/2026.)

§ 2º The Central Bank of Brazil will evaluate the occurrences subject to the communication mentioned in the caput and, considering the circumstances of each concrete case and the context of the facts, may carry out the de‑accreditation of the PSTI. (Incluído pela Resolução BCB nº 547, de 30/1/2026.)

Art. 30‑C. The transfer or change of corporate control of a PSTI organized as a corporation or limited liability company must be communicated to the Central Bank of Brazil in the manner defined by it. (Incluído pela Resolução BCB nº 547, de 30/1/2026.)

§ 1º If the new controllers do not meet the conditions set out in art. 5, the Central Bank of Brazil will grant a period for the PSTI to regularize the situation, under penalty of de‑accreditation. (Incluído pela Resolução BCB nº 547, de 30/1/2026.)

§ 2º The provision in the caput does not apply to transfers of corporate control to legal entities that do not result in a change of the institution’s ultimate controllers. (Incluído pela Resolução BCB nº 547, de 30/1/2026.)

CHAPTER V

CAUTELARY MEASURES

Art. 31. The Central Bank of Brazil is authorized to adopt a cautary measure in relation to the PSTI in the following situations:

Resolution BCB No. 498 — Regulates, within the National Financial System and the Brazilian Payment System, the requirements, procedures and conditions for the accreditation of Information Technology Service Providers – PSTI and provides other provisions

I

• occurrence of operational, technological or security incidents, including those caused by cyber attack or fraud event, that may impact the regular functioning of the SPB, or those related to situations where no root cause is identified or definitive resolution of the problem is proven;

II - deficiências relevantes de controles que possam trazer implicações para a segurança, a integridade ou a disponibilidade de dados, informações ou sistemas de informação geridos pelo PSTI; II

• relevant deficiencies in governance, procedures and controls that may bring implications for the security, integrity or availability of data, information or information systems managed by the PSTI; (Text as given by Resolution BCB No. 547, dated 30/1/2026.)

III - descumprimento grave ou reiterado das obrigações de reporte e de transparência previstas nesta Resolução; ou III

• serious or repeated non‑compliance with the obligations set out in this Resolution; (Text as given by Resolution BCB No. 547, dated 30/1/2026.)

IV - falhas operacionais que comprometam a integridade, a disponibilidade ou a confiabilidade da RSFN ou dos serviços por ela suportados. IV

• operational failures that compromise the integrity, availability or reliability of the RSFN or the services supported by it; or (Text as given by Resolution BCB No. 547, dated 30/1/2026.)

V - absence, for a period exceeding forty‑five days counted from the date of the event, of the designation of a substitute to exercise the administrator functions, in case of removal from the function. (Included by Resolution BCB No. 547, dated 30/1/2026.)

Art.
32. Upon occurrence of the cases provided for in art. 31, the Central Bank of Brazil may require, singly or cumulatively, the adoption of the following precautionary measures:

I

• observance of more restrictive operational limits, including regarding the volume of processed transactions, the maximum transaction values, or the number of institutions served;

II

• suspension of the connection to the RSFN, total or partial, until definitive resolution of the problem is proven;

III

• suspension of a specific service provided by the PSTI within the RSFN, total or partial, until definitive resolution of the problem is proven;

IV

• determination of immediate reinforcement in technical security requirements, governance or business continuity, with defined deadlines for proof;

V

• requirement of extraordinary independent audit, at the expense of the PSTI, to verify the effectiveness of the corrective measures adopted;

VI

• imposition of a corrective action plan, with specific deadlines and compliance targets, to be monitored by the Central Bank of Brazil;

VII

• restriction on hiring new clients or expanding services until the remediation of identified deficiencies is proven;

VIII

• total or partial execution of the orderly exit plan; and

IX

• adoption of other proportional and necessary measures to safeguard the integrity, stability and reliability of the RSFN and the payment services supported by it.

Sole paragraph. The precautionary measures addressed in this article are preventive in nature, not replacing the procedure aimed at the de‑accreditation of the PSTI, as provided for in this Resolution. (Text as given by Resolution BCB No. 547, dated 30/1/2026.)

CHAPTER VI

FINAL PROVISIONS

Art. 33. O PSTI deve adotar como premissa, para o fornecimento de serviços para instituições financeiras e demais instituições supervisionadas pelo Banco Central do Brasil, a manutenção da segurança e do regular funcionamento do SPB. Art.
33. The PSTI must adopt as a premise, for the provision of services to financial institutions and other institutions supervised by the Central Bank of Brazil, the maintenance of security and the regular functioning of the SFN and the SPB. (Text as given by Resolution BCB No. 547, dated 30/1/2026.)

Sole paragraph. Observance of the premise established in the caput must be supported by:

I

• use of information systems designed with mechanisms to ensure operational resilience, security and information integrity, as well as to prevent fraud;

II

• use of computing environments, including contingency ones, with adequate capacity to support the information systems and the proper provision of services to financial institutions and other institutions supervised by the Central Bank of Brazil; and

III

• establishment of monitoring and event handling processes that may impact the proper provision of services.

Art.
34. The Central Bank of Brazil will promote the monitoring of services provided by the PSTI, being able to request from them information, clarifications or additional documents deemed necessary for the exercise of the Authority's duties.

Sole paragraph. A normative instruction of the Central Bank of Brazil will regulate the monitoring process of the services provided by the PSTI. (Included by Resolution BCB No. 547, dated 30/1/2026.)

Art.
35. To access the RSFN through a PSTI, financial institutions and other institutions supervised by the Central Bank of Brazil must contract services of a PSTI duly accredited under the terms of this Resolution.

§ 1º It is the responsibility of the contracting institution referred to in the caput:

I

• ensure that contracts concluded with the PSTI include the obligations established in this Resolution and other applicable rules;

II

• continuously monitor the adequacy of the contracted PSTI to the corporate governance, risk management, cyber security, fraud management and business continuity requirements set forth in this Resolution;

III

• implement security controls established by the PSTI for the use of the services to be provided;

IV

• retain possession of its private keys used for signing messages and validate the integrity of transactions prior to signing, ensuring that data have not been corrupted or manipulated during the message generation process;

V

• not use the same certificate across environments, such as testing and production, nor function, such as message signing and Pix channel establishment;

VI

• keep available to the Central Bank of Brazil the documentation related to the contracting, monitoring and supervision of the PSTI, including audit reports and continuity test reports; and

VII

• promptly inform the Central Bank of Brazil of any relevant failures or non‑compliance identified in the operation of the contracted PSTI.

§ 2º Failure to observe the provisions of this article subjects the contracting institution referred to in the caput to the sanctions provided for in the legislation in force.

Art.
36. The Central Bank of Brazil may issue complementary instructions that are necessary for the compliance with the provisions of this Resolution, including with respect to the procedures for instruction and evaluation of the accreditation and de‑accreditation processes, addressed in arts. 3 and 7, caput, item I, respectively, and to the provision of information addressed in Chapter IV, among other aspects. (Text as given by Resolution BCB No. 547, dated 30/1/2026.)

Art.
36-A. The Central Bank of Brazil, in the course of analyzing the matters addressed in this Resolution, may request information, clarifications or additional documents considered necessary for examination and decision. (Included by Resolution BCB No. 547, dated 30/1/2026.)

Art.
36-B. The Central Bank of Brazil, in the continuous monitoring process of the PSTI, may require an amount of paid‑in share capital and net equity higher than that required at the time of accreditation, pursuant to art. 3, caput, item VIII, aiming to ensure proportionality relative to the volume of operations, the number of clients and the risk profile of the PSTI. (Included by Resolution BCB No. 547, dated 30/1/2026.)

Art.
37. The PSTI operating on the effective date of this Resolution must carry out the necessary adaptations to comply with the provisions of arts. 17 and 25 of this Resolution, according to a timetable to be published by the Central Bank of Brazil.

§
1º The fulfillment of each of the phases set out in the timetable referred to in the caput must be confirmed by a reasonable assurance report, issued by an independent audit registered with the Securities and Exchange Commission, attesting the PSTI's full compliance with the procedures and requirements set out for the corresponding phase. (Text as given by Resolution BCB No. 547, dated 30/1/2026.)

§
2º Delay in meeting the deadlines set in the timetable referred to in the caput may result in the establishment, by the Central Bank of Brazil, of more restrictive operational limits, pursuant to art. 32, caput, item I, or the de‑accreditation of the PSTI, as provided in art. 7, caput, item II.

§
3º The accreditation request must be made within up to eight months after the entry into force of this Resolution. (Text as given by Resolution BCB No. 547, dated 30/1/2026.)

§
4º Failure to submit an accreditation request within the period referred to in § 3 shall result in the de‑accreditation ex officio of the PSTI, which must develop and implement an orderly exit plan.

§
5º The PSTI that has a pending authorization request for analysis or approval on the date of entry into force of this Resolution must submit to the Central Bank of Brazil an accreditation request, based on the criteria established in this Resolution, within the deadline provided in § 3.

§
6º Until the adaptation period referred to in this article is concluded, the PSTI may be subject to specific operational limits, as provided for in the legislation in force, without prejudice to the provisions of § 2.

Art.
38. The following provisions of Circular No. 3,970, dated 28 November 2019, published in the Official Gazette of the Union on 2 December 2019, are revoked:

I

• item III of the caput of art. 2;

II

• art. 6; and

III

• item III of the caput of art. 7.

Art.
39. This Resolution enters into force on the date of its publication.

---

GILNEU
FRANCISCO ASTOLFI VIVAN RODRIGO
ALVES TEIXEIRA

Director of Regulation Director of Administration

AILTON
DE AQUINO SANTOS DIOGO ABRY GUILLEN

Director of Supervision Director of Organization of System

Financial and of Resolution substitute