Resolution BCB No. 65 — Regulates the compliance policy of consortium administrators, payment institutions, securities brokerage firms, securities distribution firms, foreign exchange brokerage firms, and virtual asset service providers

RESOLUTION
BCB NO. 65, OF JANUARY 26, 2021

Regulates the compliance policy of consortium administrators and payment institutions.

Regulates the compliance policy of consortium administrators, payment institutions, securities brokerage firms, securities distribution firms, and foreign exchange brokerage firms authorized to operate by the Central Bank of Brazil. (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

Regulates the compliance policy of consortium administrators, payment institutions, securities brokerage firms, securities distribution firms, foreign exchange brokerage firms, and virtual asset service providers authorized to operate by the Central Bank of Brazil. (Amended by Resolution BCB No. 552, of March 3, 2026.)

The Collegiate Board of the Central Bank of Brazil, in a session held on January 26, 2021, based on Arts. 6 and 7, item III, of Law No. 11,795, of October 8, 2008, 9, items II and IX, and 15 of Law No. 12,865, of October 9, 2013,

R E S O L V E:

Art. 1 This Resolution regulates the compliance policy applicable to consortium administrators and payment institutions.

Art. 1 This Resolution regulates the compliance policy applicable to the following institutions authorized to operate by the Central Bank of Brazil: (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

I - consortium administrators; (Added, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

II - payment institutions; (Added, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

III - securities brokerage firms; (Added, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

IV - securities distribution firms; and (Added, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

IV - securities distribution firms; (Amended by Resolution BCB No. 552, of March 3, 2026.)

V - foreign exchange brokerage firms. (Added, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

V - foreign exchange brokerage firms; and (Amended by Resolution BCB No. 552, of March 3, 2026.)

VI - virtual asset service providers. (Added by Resolution BCB No. 552, of March 3, 2026.)

Art. 2 Consortium administrators and payment institutions must implement and maintain a compliance policy compatible with their nature, size, complexity, structure, risk profile, and business model, in order to ensure effective management of their compliance risk.

Art. 2 The institutions mentioned in Art. 1 must implement and maintain a compliance policy compatible with their nature, size, complexity, structure, risk profile, and business model, in order to ensure effective management of their compliance risk. (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

Sole Paragraph. For the purposes of this Resolution, compliance risk is considered to be the possibility of the consortium administrator or payment institution suffering legal or administrative sanctions, financial losses, reputational damage, and other damages, resulting from non-compliance or failures in observing the legal framework, sub-legal regulations, recommendations of regulatory bodies, and applicable self-regulation codes.

Sole Paragraph. (Revoked, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

§ 1 For the purposes of this Resolution, compliance risk is considered to be the possibility of the institution suffering legal or administrative sanctions, financial losses, reputational damage, and other damages, resulting from non-compliance or failures in observing the legal framework, sub-legal regulations, recommendations of regulatory bodies, and applicable self-regulation codes. (Added, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

§ 2 Compliance risk must be managed by securities brokerage firms, securities distribution firms, and foreign exchange brokerage firms, in an integrated manner with the other risks incurred by the institution, in accordance with specific regulation. (Added, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

§ 2 Compliance risk must be managed by the institutions mentioned in Art. 1 in an integrated manner with the other risks incurred by the institution, as required by specific regulation. (Amended by Resolution BCB No. 552, of March 3, 2026.)

Art. 3 The adoption of a single compliance policy by a conglomerate is permitted.

Art. 4 The compliance policy must be approved by the board of directors.

Art. 5 The compliance policy must define, at a minimum:

I - the objective and scope of the compliance function;

II - the clear division of responsibilities of persons involved in the compliance function, in order to avoid potential conflicts of interest, especially with business areas;

III - the allocation of personnel in sufficient quantity, adequately trained, and with the necessary experience to perform activities related to the compliance function;

IV - the position, in the organizational structure, of the specific unit responsible for the compliance function, when constituted;

V - the measures necessary to guarantee independence and adequate authority to those responsible for activities related to the compliance function;

VI - the allocation of sufficient resources for the performance of activities related to the compliance function;

VII - the free access of those responsible for activities related to the compliance function to the information necessary for the exercise of their duties;

VIII - the communication channels with the executive board or administrators, with the board of directors, and with the audit committee, when constituted, necessary for reporting results arising from activities related to the compliance function, possible irregularities, or identified failures; and

IX - the procedures for coordinating activities related to the compliance function with risk management functions and with internal audit.

Art. 6 The unit responsible for the compliance function, when constituted, must be fully segregated from the internal audit activity.

Art. 7 Those responsible for executing activities related to the compliance function, regardless of the existence of a specific unit, must:

I - test and evaluate the adherence of the consortium administrator or payment institution to the legal framework, sub-legal regulations, recommendations of supervisory bodies, and, when applicable, to codes of ethics, conduct, and other regulations they are obliged to observe;

I - test and evaluate the adherence of the institution mentioned in Art. 1 to the legal framework, sub-legal regulations, recommendations of supervisory bodies, and, when applicable, to codes of ethics, conduct, and other regulations they are obliged to observe; (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

II - provide support to the board of directors and the executive board or administrators regarding the observance and correct application of the items mentioned in item I of the main text, including keeping them informed about relevant updates regarding such items;

III - assist in informing and training all employees and relevant third-party service providers on matters related to compliance;

IV - review and monitor the resolution of points raised in the report of non-compliance with legal and regulatory provisions prepared by the independent auditor, in accordance with specific regulation;

V - prepare a report, with a minimum annual frequency, containing a summary of the results of activities related to the compliance function, its main conclusions, recommendations, and measures taken by the administration of the consortium administrator or payment institution; and

V - prepare a report, with a minimum annual frequency, containing a summary of the results of activities related to the compliance function, its main conclusions, recommendations, and measures taken by the administration of the institution mentioned in Art. 1; and (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

VI - systematically and timely report the results of activities related to the compliance function to the board of directors.

Sole Paragraph. Consortium administrators and payment institutions may hire specialists to execute activities related to the compliance policy, with the duties and responsibilities of the board of directors remaining fully intact.

Sole Paragraph. The institutions mentioned in Art. 1 may hire specialists to execute activities related to the compliance policy, with the duties and responsibilities of the board of directors remaining fully intact. (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

Art. 8 The remuneration policy for those responsible for activities related to the compliance function must be determined independently of the performance of business areas, in order to avoid conflicts of interest.

Art. 8 (Revoked, effective January 1, 2025, by Resolution BCB No. 432, of November 13, 2024.)

Art. 9 The board of directors must, in addition to what is provided in Art. 4 of this Resolution:

I - ensure:

a) the adequate management of the compliance policy;

b) the effectiveness and continuity of the application of the compliance policy;

c) the communication of the compliance policy to all employees and relevant third-party service providers; and

d) the dissemination of standards of integrity and ethical conduct as part of the culture of the consortium administrator or payment institution;

d) the dissemination of standards of integrity and ethical conduct as part of the institution's culture; (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

II - guarantee that corrective measures are taken when compliance failures are identified; and

III - provide the necessary means for activities related to the compliance function to be performed adequately, in accordance with this Resolution.

Art. 10. For consortium administrators and payment institutions that do not have a board of directors, the duties and responsibilities provided for in this Resolution must be attributed to their executive board or administrators.

Art. 10. For the institutions mentioned in Art. 1 that do not have a board of directors, the duties and responsibilities provided for in this Resolution must be attributed to their executive board or administrators. (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

Art. 11. Consortium administrators and payment institutions must keep available to the Central Bank of Brazil:

Art. 11. The institutions mentioned in Art. 1 must keep available to the Central Bank of Brazil: (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

I - the documentation related to the compliance policy approved by the board of directors or, in the case of Art. 10, by the executive board or administrators; and

II - the report referred to in item V of Art. 7, for a minimum period of five years.

Art. 12. Circular No. 3,865, of December 7, 2017, is hereby revoked.

Art. 13. This Resolution enters into force on March 1, 2021.

Otávio Ribeiro Damaso
Director of Regulation