Resolution BCB No. 85 — Cybersecurity Policy and Requirements for Data Processing, Storage, and Cloud Computing Services — BCB — BR

RESOLUTION BCB NO. 85, OF APRIL 8, 2021

Provides for the cybersecurity policy and for the requirements for the contracting of data processing and storage services and cloud computing services to be observed by payment institutions, securities brokerage firms, securities distribution firms, and foreign exchange brokerage firms authorized to operate by the Central Bank of Brazil. (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

Provides for the cybersecurity policy and for the requirements for the contracting of data processing and storage services and cloud computing services to be observed by payment institutions, securities brokerage firms, securities distribution firms, foreign exchange brokerage firms, and virtual asset service providers authorized to operate by the Central Bank of Brazil. (Amended by Resolution BCB No. 552, of March 3, 2026.)

The Collegiate Board of the Central Bank of Brazil, in a session held on April 8, 2021, based on arts. 9, 10, and 15 of Law No. 12,865, of October 9, 2013, and in view of art. 14 of Resolution No. 4,282, of November 4, 2013,

R E S O L V E S:

CHAPTER I
OBJECT AND SCOPE OF APPLICATION

Art. 1. This Resolution provides for the cybersecurity policy and for the requirements for the contracting of data processing and storage services and cloud computing services to be observed by payment institutions, securities brokerage firms, securities distribution firms, and foreign exchange brokerage firms authorized to operate by the Central Bank of Brazil. (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

Art. 1. This Resolution provides for the cybersecurity policy and for the requirements for the contracting of data processing and storage services and cloud computing services to be observed by payment institutions, securities brokerage firms, securities distribution firms, foreign exchange brokerage firms, and virtual asset service providers authorized to operate by the Central Bank of Brazil. (Amended by Resolution BCB No. 552, of March 3, 2026.)

CHAPTER II
CYBERSECURITY POLICY

Section I
Implementation of the Cybersecurity Policy

Art. 2. Payment institutions must implement and maintain a cybersecurity policy formulated based on principles and guidelines that seek to ensure the confidentiality, integrity, and availability of data and information systems used.

Art. 2. The institutions mentioned in art. 1 must implement and maintain a cybersecurity policy formulated based on principles and guidelines that seek to ensure the confidentiality, integrity, and availability of data and information systems used. (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

§ 1. The policy mentioned in the caput must be compatible with:

I - the size, risk profile, and business model of the institution;

II - the nature of the institution's activities and the complexity of the products and services offered; and

III - the sensitivity of the data and information under the institution's responsibility.

§ 2. Payment institutions that are part of a prudential conglomerate may adopt a single cybersecurity policy for the prudential conglomerate, in accordance with current regulations, provided that it is compatible with the provisions of this Chapter.

§ 2. Institutions that are part of a prudential conglomerate may adopt a single cybersecurity policy for the prudential conglomerate, in accordance with current regulations, provided that it is compatible with the provisions of this Chapter. (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

§ 3. Payment institutions that do not establish their own cybersecurity policy due to the provision of § 2 must formalize the option for this facility in a meeting of the board of directors or, if none exists, of the institution's management.

§ 3. Institutions that do not establish their own cybersecurity policy due to the provision of § 2 must formalize the option for this facility in a meeting of the board of directors or, if none exists, of the institution's management. (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

Art. 3. The cybersecurity policy must specify, at a minimum:

~~I - the cybersecurity objectives of the payment institution;~~

I - the cybersecurity objectives of the institution; (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

~~II - the procedures and controls adopted to reduce the vulnerability of the payment institution to incidents and to meet other cybersecurity objectives;~~

II - the procedures and controls adopted to reduce the vulnerability of the institution to incidents and to meet other cybersecurity objectives; (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

III - specific controls, including those aimed at information traceability, that seek to ensure the security of sensitive information;

~~IV - the recording, analysis of cause and impact, and control of the effects of incidents relevant to the activities of the payment institution;~~

IV - the recording, analysis of cause and impact, and control of the effects of incidents relevant to the activities of the institution; (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

V - guidelines for:

~~a) the development of incident scenarios considered in the continuity tests of payment services provided;~~

a) the development of incident scenarios considered in business continuity tests; (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

b) the definition of procedures and controls aimed at the prevention and handling of incidents to be adopted by third-party service providers that handle data or sensitive information or that are relevant to the conduct of the payment institution's operational activities;

c) the classification of data and information regarding relevance; and

d) the definition of parameters to be used in the assessment of the relevance of incidents;

~~VI - mechanisms for disseminating the cybersecurity culture in the payment institution, including:~~

VI - mechanisms for disseminating the cybersecurity culture in the institution, including: (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

a) the implementation of training programs and periodic personnel assessments;

~~b) the provision of information to end-users about precautions in the use of offered products and services; and~~

b) the provision of information to clients and end-users about precautions in the use of offered products and services; and (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

c) the commitment of senior management to the continuous improvement of procedures related to cybersecurity; and

~~VII - initiatives for sharing information about relevant incidents, mentioned in item IV, with payment institutions and with other institutions authorized to operate by the Central Bank of Brazil.~~

VII - initiatives for sharing information about relevant incidents, mentioned in item IV, with the institutions mentioned in art. 1 and with other institutions authorized to operate by the Central Bank of Brazil. (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

§ 1. In defining the cybersecurity objectives referred to in item I of the caput, the payment institution's capacity to prevent, detect, and reduce vulnerability to incidents related to the cyber environment must be included.

§ 1. In defining the cybersecurity objectives referred to in item I of the caput, the institution's capacity to prevent, detect, and reduce vulnerability to incidents related to the cyber environment must be included. (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

§ 2. The procedures and controls referred to in item II of the caput must cover authentication, encryption, intrusion prevention and detection, information leak prevention, periodic testing and scanning for vulnerability detection, protection against malicious software, the establishment of traceability mechanisms, access controls and computer network segmentation, and the maintenance of data and information backups.

§ 2. The procedures and controls referred to in item II of the caput must cover, at a minimum: (Amended by Resolution BCB No. 538, of December 18, 2025.)

I - authentication; (Added by Resolution BCB No. 538, of December 18, 2025.)

II - encryption mechanisms; (Added by Resolution BCB No. 538, of December 18, 2025.)

III - intrusion prevention and detection mechanisms; (Added by Resolution BCB No. 538, of December 18, 2025.)

IV - information leak prevention mechanisms; (Added by Resolution BCB No. 538, of December 18, 2025.)

V - protection mechanisms against malicious software; (Added by Resolution BCB No. 538, of December 18, 2025.)

VI - traceability mechanisms; (Added by Resolution BCB No. 538, of December 18, 2025.)

VII - data and information backup management; (Added by Resolution BCB No. 538, of December 18, 2025.)

VIII - the assessment and correction of vulnerabilities in computing resources and information systems; (Added by Resolution BCB No. 538, of December 18, 2025.)

IX - access controls; (Added by Resolution BCB No. 538, of December 18, 2025.)

X - the definition and implementation of secure configuration profiles for technology assets; (Added by Resolution BCB No. 538, of December 18, 2025.)

XI - network protection mechanisms; (Added by Resolution BCB No. 538, of December 18, 2025.)

XII - digital certificate management; (Added by Resolution BCB No. 538, of December 18, 2025.)

XIII - security requirements for the integration of information systems through electronic interfaces; and (Added by Resolution BCB No. 538, of December 18, 2025.)

XIV - intelligence actions in the cyber environment, including the monitoring of information of interest to the institution on the internet, the Deep Web, and the Dark Web, as well as private communication groups. (Added by Resolution BCB No. 538, of December 18, 2025.)

§ 3. The procedures and controls cited in item II of the caput must be applied, including in the development of secure information systems and in the adoption of new technologies used in the payment institution's activities.

§ 3. The procedures and controls cited in item II of the caput must be applied, including: (Amended by Resolution BCB No. 538, of December 18, 2025.)

I - in the development of secure information systems; and (Added by Resolution BCB No. 538, of December 18, 2025.)

II - in the adoption of new technologies used in the institution's activities. (Added by Resolution BCB No. 538, of December 18, 2025.)

§ 4. The recording, analysis of cause and impact, and control of the effects of incidents, cited in item IV of the caput, must include information received from third-party service providers.

§ 5. The guidelines referred to in item "b" of item V of the caput must include procedures and controls at levels of complexity, scope, and precision compatible with those used by the payment institution itself.

§ 6. The institution must verify the provision of item I of § 3, insofar as applicable, in cases of information systems acquired by it or developed by third-party service providers, executed using the institution's own computing resources. (Added by Resolution BCB No. 538, of December 18, 2025.)

§ 7. The traceability mechanisms referred to in item VI of § 2 must cover the traceability of transactions and operations, including, at a minimum: (Added by Resolution BCB No. 538, of December 18, 2025.)

I - audit trails of end-to-end data and information processing, including the definition and generation of logs that enable the identification of processing failures or atypical behaviors, as well as to support analyses; (Added by Resolution BCB No. 538, of December 18, 2025.)

II - definition of information retention time according to the type of processing performed; and (Added by Resolution BCB No. 538, of December 18, 2025.)

III - secure retention of audit trails. (Added by Resolution BCB No. 538, of December 18, 2025.)

§ 8. The assessment and correction of vulnerabilities referred to in item VIII of § 2 must include, at a minimum: (Added by Resolution BCB No. 538, of December 18, 2025.)

I - periodic tests and analyses for the detection of vulnerabilities in information systems; (Added by Resolution BCB No. 538, of December 18, 2025.)

II - periodic scans of technological resources with the objective of identifying improperly connected devices to the corporate network that may establish connections with technology assets external to the institution; (Added by Resolution BCB No. 538, of December 18, 2025.)

III - periodic analyses of technological resources with the objective of identifying vulnerabilities that may compromise the security of the institution's technology assets; (Added by Resolution BCB No. 538, of December 18, 2025.)

IV - intrusion tests; and (Added by Resolution BCB No. 538, of December 18, 2025.)

V - timely correction of identified vulnerabilities. (Added by Resolution BCB No. 538, of December 18, 2025.)

§ 9. The access controls referred to in item IX of § 2 must include, at a minimum: (Added by Resolution BCB No. 538, of December 18, 2025.)

I - mechanisms to limit access to the corporate network to accredited users and authorized devices; (Added by Resolution BCB No. 538, of December 18, 2025.)

II - periodic and timely review of access permissions, especially for outsourced collaborators with access to the institution's computing resources; and (Added by Resolution BCB No. 538, of December 18, 2025.)

III - implementation of multi-factor authentication for access to the corporate network from environments external to the institution. (Added by Resolution BCB No. 538, of December 18, 2025.)

§ 10. The definition and implementation of secure configuration profiles referred to in item X of § 2 must provide, at a minimum: (Added by Resolution BCB No. 538, of December 18, 2025.)

I - the management of the lifecycle of the institution's computing resources; (Added by Resolution BCB No. 538, of December 18, 2025.)

II - the regular application of security patches; (Added by Resolution BCB No. 538, of December 18, 2025.)

III - the proper configuration of services to be supported by computing resources; and (Added by Resolution BCB No. 538, of December 18, 2025.)

IV - the change of passwords and other standards that may be used for unauthorized access to computing resources. (Added by Resolution BCB No. 538, of December 18, 2025.)

§ 11. The network protection mechanisms referred to in item XI of § 2 must include, at a minimum: (Added by Resolution BCB No. 538, of 12/18/2025.)

I - computer network segmentation, safeguarding, in particular, the production environment and the computational resources that support critical business processes; (Added by Resolution BCB No. 538, of 12/18/2025.)

II - the establishment of firewall rules, as well as connection monitoring, avoiding connection attempts to information systems originating from technology assets located outside the institution's corporate network; (Added by Resolution BCB No. 538, of 12/18/2025.)

III - the definition of criteria for establishing and monitoring connections with external environments, especially during nighttime hours and on non-business days; (Added by Resolution BCB No. 538, of 12/18/2025.)

IV - measures to identify and prevent unauthorized connections with environments external to the institution originating from the institution's technological resources; (Added by Resolution BCB No. 538, of 12/18/2025.)

V - the implementation and maintenance of processes and tools for identifying, analyzing, treating, and controlling atypical events in the institution's production environment, including, as examples, the establishment of virtual private networks – VPN and attempts at privileged access to computational resources, especially during nighttime hours and on non-business days; and (Added by Resolution BCB No. 538, of 12/18/2025.)

VI - the establishment of measures to restrict access to corporate networks only to duly authorized devices or technology assets. (Added by Resolution BCB No. 538, of 12/18/2025.)

§ 12. The management of digital certificates referred to in item XII of § 2 must include, at a minimum: (Added by Resolution BCB No. 538, of 12/18/2025.)

I - monitoring the use of certificates and digital signatures, including the implementation of the traceability mechanisms referred to in § 7; (Added by Resolution BCB No. 538, of 12/18/2025.)

II - procedures for the storage of information, including physical and logical access controls to private keys under the institution's responsibility; (Added by Resolution BCB No. 538, of 12/18/2025.)

III - procedures and tools to prevent the improper sharing of private keys associated with the institution's digital certificates; and (Added by Resolution BCB No. 538, of 12/18/2025.)

IV - the timely validation of revoked certificates with certification authorities. (Added by Resolution BCB No. 538, of 12/18/2025.)

Art. 3º-A The institutions referred to in Art. 1 must establish the following additional security requirements, as an integral part of the procedures and controls provided for in their cybersecurity policy referred to in Art. 3: (Added by Resolution BCB No. 538, of 12/18/2025.)

I - in the case of electronic data communication on the National Financial System Network – RSFN: (Added by Resolution BCB No. 538, of 12/18/2025.)

a) use of multi-factor authentication for administrative access to the Pix environment and the Reserve Transfer System – STR; (Added by Resolution BCB No. 538, of 12/18/2025.)

b) physical and logical isolation of the Pix environment from the institution's other systems, maintaining a dedicated and separate instance from other environments in cases of using contracted cloud computing services; (Added by Resolution BCB No. 538, of 12/18/2025.)

c) physical and logical isolation of the STR environment from the institution's other systems, maintaining a dedicated and separate instance from other environments in cases of using contracted cloud computing services; (Added by Resolution BCB No. 538, of 12/18/2025.)

d) monitoring of the use of credentials and digital certificates, as well as the establishment of controls for the storage of this information, especially those used within the scope of the Instant Payment System – SPI; (Added by Resolution BCB No. 538, of 12/18/2025.)

e) implementation of end-to-end integrity validation mechanisms for transactions by the institution before the digital signature of associated messages, ensuring that data has not been corrupted or manipulated during the generation process of these messages; and (Added by Resolution BCB No. 538, of 12/18/2025.)

f) prohibition of access by third-party service providers to private keys associated with digital certificates used by the institution for signing messages; and (Added by Resolution BCB No. 538, of 12/18/2025.)

II - in the case of connection as a participant in Financial Market Systems – SMF authorized to operate, the implementation of security controls for fraud prevention, detection, and response to be observed by the institution. (Added by Resolution BCB No. 538, of 12/18/2025.)

Sole Paragraph. The institutions must observe this article in a manner compatible with the provisions of: (Added by Resolution BCB No. 538, of 12/18/2025.)

I - this Resolution; (Added by Resolution BCB No. 538, of 12/18/2025.)

II - the current regulation; and (Added by Resolution BCB No. 538, of 12/18/2025.)

III - all technical requirements of the RSFN provided for in the SFN Services Catalog, the SFN Network Manual, and the SFN Security Manual, published by the Central Bank of Brazil. (Added by Resolution BCB No. 538, of 12/18/2025.)

Section II
Disclosure of the Cybersecurity Policy

Art. 4 The cybersecurity policy must be disclosed to employees of the payment institution and to third-party service providers, using clear, accessible language and at a level of detail compatible with the functions performed and the sensitivity of the information.

Art. 4 The cybersecurity policy must be disclosed to employees of the institution mentioned in Art. 1 and to third-party service providers, using clear, accessible language and at a level of detail compatible with the functions performed and the sensitivity of the information. (Revised, effective 3/1/2024, by Resolution BCB No. 368, of 1/25/2024.)

~~Art. 5 Payment institutions must disclose to the public a summary containing the general guidelines of the cybersecurity policy.~~

Art. 5 The institutions mentioned in Art. 1 must disclose to the public a summary containing the general guidelines of the cybersecurity policy. (Revised, effective 3/1/2024, by Resolution BCB No. 368, of 1/25/2024.)

Section III
Action and Incident Response Plan

~~Art. 6 Payment institutions must establish an action and incident response plan aimed at implementing the cybersecurity policy.~~

Art. 6 The institutions mentioned in Art. 1 must establish an action and incident response plan aimed at implementing the cybersecurity policy. (Revised, effective 3/1/2024, by Resolution BCB No. 368, of 1/25/2024.)

Sole Paragraph. The plan mentioned in the caput must cover, at a minimum:

I - the actions to be developed by the institution to adapt its organizational and operational structures to the principles and guidelines of the cybersecurity policy;

II - the routines, procedures, controls, and technologies to be used in the prevention and response to incidents, in compliance with the guidelines of the cybersecurity policy; and

III - the area responsible for recording and controlling the effects of relevant incidents.

~~Art. 7 Payment institutions must designate a director responsible for the cybersecurity policy and for the execution of the action and incident response plan.~~

Art. 7 The institutions mentioned in Art. 1 must designate a director responsible for the cybersecurity policy and for the execution of the action and incident response plan. (Revised, effective 3/1/2024, by Resolution BCB No. 368, of 1/25/2024.)

Sole Paragraph. The director mentioned in the caput may perform other functions in the institution, provided there is no conflict of interest.

~~Art. 8 Payment institutions must prepare an annual report on the implementation of the action and incident response plan, mentioned in Art. 6, with a base date of December 31.~~

Art. 8 The institutions mentioned in Art. 1 must prepare an annual report on the implementation of the action and incident response plan, mentioned in Art. 6, with a base date of December 31. (Revised, effective 3/1/2024, by Resolution BCB No. 368, of 1/25/2024.)

§ 1 The report referred to in the caput must address, at a minimum:

I - the effectiveness of the implementation of the actions described in Art. 6, sole paragraph, item I;

II - the summary of results obtained in the implementation of the routines, procedures, controls, and technologies to be used in the prevention and response to incidents described in Art. 6, sole paragraph, item II;

~~III - relevant incidents related to the cyber environment that occurred during the period; and~~

III - relevant incidents related to the cyber environment that occurred during the period; (Revised by Resolution BCB No. 538, of 12/18/2025.)

~~IV - the results of payment service continuity tests, considering scenarios of unavailability caused by incidents.~~

~~IV - the results of business continuity tests, considering scenarios of unavailability caused by incidents.~~ ~~(Revised, effective 3/1/2024, by Resolution BCB No. 368, of 1/25/2024.)~~

IV - the results of business continuity tests, considering scenarios of unavailability caused by incidents; and (Revised by Resolution BCB No. 538, of 12/18/2025.)

V - the results of intrusion tests and the tests, scans, and periodic analyses for vulnerability detection referred to in Art. 3, § 8, and the action plans established for their corrections, observing the provisions of Art. 22-A, caput, item III. (Added by Resolution BCB No. 538, of 12/18/2025.)

~~§ 2 The report mentioned in the caput must be submitted to the board of directors or, if none exists, to the institution's management by March 31 of the year following the base date.~~

§ 2 The report mentioned in the caput must be: (Revised, effective 3/1/2024, by Resolution BCB No. 368, of 1/25/2024.)

I - submitted to the risk committee, when it exists; and (Added, effective 3/1/2024, by Resolution BCB No. 368, of 1/25/2024.)

II - presented to the board of directors or, if none exists, to the institution's management by March 31 of the year following the base date. (Added, effective 3/1/2024, by Resolution BCB No. 368, of 1/25/2024.)

Art. 9 The cybersecurity policy referred to in Art. 2 and the action and incident response plan mentioned in Art. 6 must be approved by the board of directors or, if none exists, by the management of the payment institution.

Art. 10. The cybersecurity policy and the action and incident response plan must be documented and reviewed, at a minimum, annually.

CHAPTER III
CONTRACTING OF DATA PROCESSING AND STORAGE SERVICES AND CLOUD COMPUTING

Art. 11 Payment institutions must ensure that their policies, strategies, and structures for risk management provided for in the current regulation, specifically regarding decision criteria for service outsourcing, contemplate the contracting of relevant data processing and storage and cloud computing services, in the country or abroad.

Art. 11 The institutions mentioned in Art. 1 must ensure that their policies, strategies, and structures for risk management provided for in the current regulation, specifically regarding decision criteria for service outsourcing, contemplate the contracting of relevant data processing and storage and cloud computing services, in the country or abroad. (Revised, effective 3/1/2024, by Resolution BCB No. 368, of 1/25/2024.)

~~Art. 12 Payment institutions, prior to contracting relevant data processing and storage and cloud computing services, must adopt procedures that include:~~

Art. 12 The institutions mentioned in Art. 1, prior to contracting relevant data processing and storage and cloud computing services, must adopt procedures that include: (Revised, effective 3/1/2024, by Resolution BCB No. 368, of 1/25/2024.)

I - the adoption of corporate governance and management practices proportional to the relevance of the service to be contracted and the risks to which they are exposed; and

II - the verification of the potential service provider's capacity to ensure:

a) compliance with legislation and current regulation;

b) the institution's access to the data and information to be processed or stored by the service provider;

c) the confidentiality, integrity, availability, and recovery of the data and information processed or stored by the service provider;

d) its adherence to certifications required by the institution for the provision of the service to be contracted;

e) the contracting institution's access to reports prepared by an independent specialized audit company hired by the service provider, regarding the procedures and controls used in the provision of the services to be contracted;

f) the provision of information and management resources adequate for monitoring the services to be provided;

~~g) the identification and segregation of end-user data of the institution through physical or logical controls; and~~

g) the identification and segregation of data of the institution's clients and end-users through physical or logical controls; and (Revised, effective 3/1/2024, by Resolution BCB No. 368, of 1/25/2024.)

~~h) the quality of access controls aimed at protecting the data and information of the institution's end-users.~~

h) the quality of access controls aimed at protecting the data and information of the institution's clients and end-users. (Revised, effective 3/1/2024, by Resolution BCB No. 368, of 1/25/2024.)

§ 1 In evaluating the relevance of the service to be contracted, mentioned in item I of the caput, the contracting institution must consider the criticality of the service and the sensitivity of the data and information to be processed, stored, and managed by the contractor, taking into account, among other things, the classification carried out in accordance with Art. 3, item V, letter "c".

§ 2 The procedures referred to in the caput, including the information related to the verification mentioned in item II, must be documented.

§ 3 In the case of application execution via the internet, referred to in Art. 13, item III, the institution must ensure that the potential service providers adopt controls that mitigate the effects of potential vulnerabilities in the release of new versions of the application.

§ 4 The institution must possess the necessary resources and competencies for the adequate management of the services to be contracted, including for the analysis of information and use of resources provided in accordance with letter "f" of item II of the caput.

Art. 13 For the purposes of this Resolution, cloud computing services include the availability to the contracting payment institution, on demand and in a virtual manner, of at least one of the following services:

Art. 13 For the purposes of this Resolution, cloud computing services include the availability to the contracting institution, on demand and in a virtual manner, of at least one of the following services: (Revised, effective 3/1/2024, by Resolution BCB No. 368, of 1/25/2024.)

I - data processing, data storage, network infrastructure, and other computational resources that allow the contracting institution to deploy or execute software, which may include operating systems and applications developed by the institution or acquired by it;

II - deployment or execution of applications developed by the contracting institution, or acquired by it, using computational resources of the service provider; or

III - execution, via the internet, of applications deployed or developed by the service provider, using the service provider's own computational resources.

Art. 14 The contracting payment institution is responsible for the reliability, integrity, availability, security, and confidentiality of the contracted services, as well as for compliance with legislation and current regulation.

Art. 14 The contracting institution of the services mentioned in Art. 12 is responsible for the reliability, integrity, availability, security, and confidentiality of the contracted services, as well as for compliance with legislation and current regulation. (Revised, effective 3/1/2024, by Resolution BCB No. 368, of 1/25/2024.)

~~Art. 15 The contracting of relevant data processing, data storage, and cloud computing services must be communicated by payment institutions to the Central Bank of Brazil.~~

Art. 15 The contracting of relevant data processing, data storage, and cloud computing services must be communicated by the institutions mentioned in Art. 1 to the Central Bank of Brazil. (Revised, effective 3/1/2024, by Resolution BCB No. 368, of 1/25/2024.)

§ 1 The communication mentioned in the caput must contain the following information:

I - the name of the contracted company;

II - the relevant services contracted; and

III - the indication of the countries and regions in each country where the services may be provided and the data may be stored, processed, and managed, defined in accordance with item III of Art. 16, in the case of contracting abroad.

§ 2º The communication referred to in the caput must be made within ten days after the hiring of the services.

§ 3º Contractual changes that imply modification of the information referred to in § 1º must be communicated to the Central Bank of Brazil within ten days after the contractual change.

Art. 16. The hiring of relevant processing, data storage, and cloud computing services provided abroad must observe the following requirements:

I - the existence of an agreement for the exchange of information between the Central Bank of Brazil and the supervisory authorities of the countries where the services may be provided;

II - the contracting institution must ensure that the provision of the services referred to in the caput does not cause harm to its regular functioning nor hinder the action of the Central Bank of Brazil; (Amended, effective from 1º/3/2024, by Resolution BCB No. 368, of 25/1/2024.)

III - the contracting institution must define, prior to hiring, the countries and the regions in each country where the services may be provided and the data may be stored, processed, and managed; and (Amended, effective from 1º/3/2024, by Resolution BCB No. 368, of 25/1/2024.)

IV - the contracting institution must provide alternatives for the continuity of business, in the event of impossibility of maintaining or terminating the service provision contract. (Amended, effective from 1º/3/2024, by Resolution BCB No. 368, of 25/1/2024.)

§ 1º In the event of the non-existence of an agreement as per item I of the caput, the contracting institution must request authorization from the Central Bank of Brazil for: (Amended, effective from 1º/3/2024, by Resolution BCB No. 368, of 25/1/2024.)

I - the hiring of the service, at least sixty days prior to the hiring, observing the provisions of art. 15, § 1º; and

II - the contractual changes that imply modification of the information referred to in art. 15, § 1º, observing the minimum period of sixty days prior to the contractual change.

§ 2º To comply with items II and III of the caput, institutions must ensure that the legislation and regulation in the countries and in the regions in each country where the services may be provided do not restrict or impede the access of the contracting institutions and the Central Bank of Brazil to the data and information. (Amended, effective from 1º/3/2024, by Resolution BCB No. 368, of 25/1/2024.)

§ 3º The proof of compliance with the requirements referred to in items I to IV of the caput and the fulfillment of the requirement referred to in § 2º must be documented.

Art. 17. Contracts for the provision of relevant processing, data storage, and cloud computing services must contain clauses providing for:

I - the indication of the countries and the region in each country where the services may be provided and the data may be stored, processed, and managed;

II - the adoption of security measures for the transmission and storage of the data cited in item I;

III - the maintenance, while the contract is in effect, of data segregation and access controls to protect the information of clients and end-users; (Amended, effective from 1º/3/2024, by Resolution BCB No. 368, of 25/1/2024.)

IV - the obligation, in the event of contract termination, of:

a) transfer of the data cited in item I to the new service provider or to the contracting institution; and (Amended, effective from 1º/3/2024, by Resolution BCB No. 368, of 25/1/2024.)

b) exclusion of the data cited in item I by the replaced contracted company, after the data transfer provided for in item "a" and the confirmation of the integrity and availability of the received data;

V - the access of the contracting institution to: (Amended, effective from 1º/3/2024, by Resolution BCB No. 368, of 25/1/2024.)

a) information provided by the contracted company, aiming to verify compliance with the provisions of items I to III;

b) information related to certifications and specialized audit reports, cited in art. 12, item II, items "d" and "e"; and

c) information and management resources adequate to monitor the services to be provided, cited in art. 12, item II, item "f";

VI - the obligation of the contracted company to notify the contracting institution about the subcontracting of relevant services for the institution; (Amended, effective from 1º/3/2024, by Resolution BCB No. 368, of 25/1/2024.)

VII - the permission of access by the Central Bank of Brazil to the contracts and agreements entered into for the provision of services, to the documentation and information related to the services provided, to the stored data and information about their processing, to the backups of data and information, as well as to the access codes to data and information;

VIII - the adoption of measures by the contracting institution, as a result of determination by the Central Bank of Brazil; and (Amended, effective from 1º/3/2024, by Resolution BCB No. 368, of 25/1/2024.)

IX - the obligation of the contracted company to keep the contracting institution permanently informed about any limitations that may affect the provision of services or compliance with the legislation and regulation in force. (Amended, effective from 1º/3/2024, by Resolution BCB No. 368, of 25/1/2024.)

Sole paragraph. The contracts mentioned in the caput must provide, in the event of the declaration of a resolution regime for the contracting institution by the Central Bank of Brazil: (Amended, effective from 1º/3/2024, by Resolution BCB No. 368, of 25/1/2024.)

I - the obligation of the contracted company to grant full and unrestricted access to the person responsible for the resolution regime to the contracts, agreements, documentation, and information related to the services provided, to the stored data and information about their processing, to the backups of data and information, as well as to the access codes, cited in item VII of the caput, that are in the possession of the contracted company; and

II - the obligation of prior notification to the person responsible for the resolution regime about the intention of the contracted company to interrupt the provision of services, with at least thirty days' notice prior to the date scheduled for the interruption, observing that:

a) the contracted company agrees to accept any request for an additional thirty-day period for the interruption of the service, made by the person responsible for the resolution regime; and

b) the prior notification must also occur in the situation where the interruption is motivated by the default of the contracting institution. (Amended, effective from 1º/3/2024, by Resolution BCB No. 368, of 25/1/2024.)

Art. 18. The provisions of arts. 11 to 17 do not apply to the hiring of systems operated by clearinghouses, by providers of clearing and settlement services, or by entities that carry out activities of registration or centralized deposit.

CHAPTER IV
GENERAL PROVISIONS

Art. 19. The institutions mentioned in art. 1º must ensure that their policies provided for in the risk management structure, under the terms of the regulation in force, provide, regarding business continuity, on: (Amended, effective from 1º/3/2024, by Resolution BCB No. 368, of 25/1/2024.)

I - the treatment of relevant incidents related to the cyber environment referred to in art. 3º, item IV;

II - the procedures to be followed in the event of interruption of relevant processing and data storage and cloud computing services hired, covering scenarios that consider the replacement of the contracted company and the restoration of the institution's normal operation; and

III - the incident scenarios considered in the business continuity tests referred to in art. 3º, item V, item "a". (Amended, effective from 1º/3/2024, by Resolution BCB No. 368, of 25/1/2024.)

Art. 20. The procedures adopted by the institutions mentioned in art. 1º for risk management provided for in the regulation in force must specify, regarding business continuity: (Amended, effective from 1º/3/2024, by Resolution BCB No. 368, of 25/1/2024.)

I - the provision for mitigating the effects of the relevant incidents referred to in art. 3º, item IV, and of the interruption of the relevant processing, data storage, and cloud computing services hired;

II - the period established for the restart or normalization of their activities or of the relevant services interrupted, cited in item I; and

III - the timely communication to the Central Bank of Brazil of the occurrences of relevant incidents and of the interruptions of the relevant services, cited in item I, that constitute a crisis situation for the institution mentioned in art. 1º, as well as of the measures for the restart of their activities. (Amended, effective from 1º/3/2024, by Resolution BCB No. 368, of 25/1/2024.)

Sole paragraph. The institutions mentioned in art. 1º must establish and document the criteria that configure the crisis situation referred to in item III of the caput. (Amended, effective from 1º/3/2024, by Resolution BCB No. 368, of 25/1/2024.)

Art. 21. The institutions mentioned in art. 1º must institute monitoring and control mechanisms with a view to ensuring the implementation and effectiveness of the cybersecurity policy, the action and incident response plan, and the requirements for hiring processing, data storage, and cloud computing services, including: (Amended, effective from 1º/3/2024, by Resolution BCB No. 368, of 25/1/2024.)

I - the definition of processes, tests, and audit trails;

II - the definition of adequate metrics and indicators; and

III - the identification and correction of any deficiencies.

§ 1º The notifications received about the subcontracting of relevant services described in art. 17, item VI, must be considered in the definition of the mechanisms referred to in the caput.

§ 2º The mechanisms referred to in the caput must be submitted to periodic tests by internal audit compatible with the institution's internal controls.

Art. 22. Without prejudice to the duty of confidentiality and free competition, the institutions mentioned in art. 1º must develop initiatives for the sharing of information about the relevant incidents referred to in art. 3º, item IV. (Amended, effective from 1º/3/2024, by Resolution BCB No. 368, of 25/1/2024.)

§ 1º The sharing referred to in the caput must cover information about relevant incidents received from third-party service providers.

§ 2º The shared information must be available to the Central Bank of Brazil.

Art. 22-A. Institutions must ensure that the intrusion tests mentioned in art. 3º, § 8º, item IV, must: (Included by Resolution BCB No. 538, of 18/12/2025.)

I - have a minimum annual periodicity; (Included by Resolution BCB No. 538, of 18/12/2025.)

II - be carried out with independence and impartiality by a natural person or specialized company hired by the institution for this purpose, without prejudice to the carrying out of tests by the institution's own teams; and (Included by Resolution BCB No. 538, of 18/12/2025.)

III - have the results of their execution documented, especially any vulnerabilities that are identified and the action plans established for their corrections. (Included by Resolution BCB No. 538, of 18/12/2025.)

Art. 22-B. The service provided for the electronic communication of data in the RSFN, referred to in art. 3º-A, caput, item I, is considered relevant for the purposes of applying the provisions of this Resolution regarding the hiring of processing, data storage, and cloud computing services. (Included by Resolution BCB No. 538, of 18/12/2025.)

§ 1º The provisions of the caput apply regardless of the form of connection with the RSFN. (Included by Resolution BCB No. 538, of 18/12/2025.)

§ 2º The service referred to in the caput includes cases where the service provider provides message processing services within the SFN and the Brazilian Payments System – SPB. (Included by Resolution BCB No. 538, of 18/12/2025.)

CHAPTER V
FINAL PROVISIONS

Art. 23. The following must be made available to the Central Bank of Brazil for a period of five years:

I - the document related to the cybersecurity policy, referred to in art. 2º;

II - the minutes of the board of directors meeting or, if none exists, of the institution's executive board, in the event that the option referred to in art. 2º, § 2º is formalized;

III - the document related to the action and incident response plan, referred to in art. 6º;

IV - the annual report, referred to in art. 8º;

V - the documentation on the procedures referred to in art. 12, § 2º;

VI - the documentation referred to in art. 16, § 3º, in the case of services provided abroad;

VII - the contracts referred to in art. 17, counting the period referred to in the caput from the termination of the contract;

VIII - the data, records, and information related to the monitoring and control mechanisms referred to in art. 21, counting the period from the implementation of the said mechanisms; (Amended by Resolution BCB No. 538, of 18/12/2025.)

IX - the documentation with the criteria that configure a crisis situation referred to in art. 20, sole paragraph; and (Amended by Resolution BCB No. 538, of 18/12/2025.)

X - the documentation with the results of the execution of intrusion tests and the action plans established for the corrections of identified vulnerabilities referred to in art. 22-A, caput, item III, counting the period from the date of execution of the tests. (Included by Resolution BCB No. 538, of 18/12/2025.)

Art. 24. (Revoked, effective from 1º/3/2024, by Resolution BCB No. 368, of 25/1/2024.)

Art. 25. The Central Bank of Brazil may veto or impose restrictions for the hiring of processing and data storage and cloud computing services when it verifies, at any time, non-compliance with the provisions of this Resolution, as well as the limitation to the action of the Central Bank of Brazil, establishing a period for the adaptation of the said services and the corresponding contracts.

Art. 26. The following are revoked:

I - arts. 1º to 26 of Circular No. 3.909, of August 16, 2018; and

II - Circular No. 3.969, of November 13, 2019.

Art. 27. This Resolution enters into force on August 1, 2021.

Otávio Ribeiro Damaso
Director of Regulation