Resolution BCB No. 93 — Regulates internal audit activity in consortium administrators, payment institutions, securities broker-dealers, securities distributors, foreign exchange brokers, and virtual asset service providers authorized by the Central Bank of Brazil

RESOLUTION BCB NO. 93, OF MAY 6, 2021

Regulates internal audit activity in consortium administrators and payment institutions.

Regulates internal audit activity in consortium administrators, payment institutions, securities broker-dealers, securities distributors, and foreign exchange brokers authorized to operate by the Central Bank of Brazil. (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

Regulates internal audit activity in consortium administrators, payment institutions, securities broker-dealers, securities distributors, foreign exchange brokers, and virtual asset service providers authorized to operate by the Central Bank of Brazil. (Amended by Resolution BCB No. 552, of March 3, 2026.)

The Collegiate Board of the Central Bank of Brazil, in a session held on May 6, 2021, based on arts. 6 and 7, item III, of Law No. 11,795, of October 8, 2008, 9, items II and IX, letter "b", and 15 of Law No. 12,865, of October 9, 2013,

R E S O L V E:

CHAPTER I
OBJECT AND SCOPE OF APPLICATION

Art. 1. This Resolution regulates internal audit activity in consortium administrators and payment institutions authorized to operate by the Central Bank of Brazil.

Art. 1. This Resolution regulates internal audit activity in the following institutions authorized to operate by the Central Bank of Brazil: (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

I - consortium administrators; (Added, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

II - payment institutions; (Added, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

III - securities broker-dealers; (Added, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

IV - securities distributors; and (Added, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

IV - securities distributors; (Amended by Resolution BCB No. 552, of March 3, 2026.)

V - foreign exchange brokers. (Added, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

V - foreign exchange brokers; and (Amended by Resolution BCB No. 552, of March 3, 2026.)

VI - virtual asset service providers. (Added by Resolution BCB No. 552, of March 3, 2026.)

CHAPTER II
INTERNAL AUDIT ACTIVITY

Section I
Obligation

Art. 2. Consortium administrators and payment institutions must implement and maintain an internal audit activity compatible with the nature, size, complexity, structure, risk profile, and business model of the institution.

Art. 2. The institutions mentioned in art. 1 must implement and maintain an internal audit activity compatible with the nature, size, complexity, structure, risk profile, and business model of the institution. (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

Sole paragraph. The internal audit activity referred to in the caput must provide the necessary conditions for the independent, autonomous, and impartial assessment of the quality and effectiveness of the institution's internal control systems, risk management, and corporate governance processes.

Art. 3. Internal audit activity must be carried out by a specific unit of the consortium administrator or payment institution, or by another institution authorized to operate by the Central Bank of Brazil that is part of the same prudential conglomerate, directly subordinate to the board of directors.

Art. 3. Internal audit activity must be carried out by a specific unit of the institution mentioned in art. 1 or by another institution authorized to operate by the Central Bank of Brazil that is part of the same prudential conglomerate, directly subordinate to the board of directors. (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

§ 1. The internal audit activity referred to in the caput may be carried out:

I - by an independent auditor duly qualified, in accordance with current regulation, to provide independent audit services for institutions authorized to operate by the Central Bank of Brazil, provided that this auditor is not responsible for the audit of the financial statements of the consortium administrator or payment institution or for any other activity with a potential conflict of interest;

I - by an independent auditor duly qualified, in accordance with current regulation, to provide independent audit services for institutions authorized to operate by the Central Bank of Brazil, provided that this auditor is not responsible for the audit of the financial statements of the institution mentioned in art. 1 or for any other activity with a potential conflict of interest; (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

II - by the audit of the professional entity to which the consortium administrator or payment institution is affiliated; or

II - by the audit of the professional entity to which the institution mentioned in art. 1 is affiliated; or (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

III - by audit of a professional entity of other institutions authorized to operate by the Central Bank of Brazil, through an agreement, previously approved by this autarchy, entered into between the entity to which the consortium administrator or payment institution is affiliated and the entity providing the service.

III - by audit of a professional entity of other institutions authorized to operate by the Central Bank of Brazil, through an agreement, previously approved by this autarchy, entered into between the entity to which the institution mentioned in art. 1 is affiliated and the entity providing the service. (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

§ 2. The provisions of § 1 do not apply to consortium administrators and payment institutions that, in accordance with current regulation, are required to establish an audit committee.

§ 2. The provisions of § 1 do not apply to the institutions mentioned in art. 1 that, in accordance with current regulation, are required to establish an audit committee. (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

Section II
Essential Characteristics

Art. 4. Internal audit activity must:

I - be independent of the audited activities;

II - be continuous and effective; and

III - have:

a) sufficient resources for the performance of audit work;

b) defined and effective communication channels, to report findings and assessments resulting from audit work; and

c) personnel in sufficient quantity, adequately trained, and with the necessary experience to exercise their functions.

Art. 5. The appointment, designation, removal, or dismissal of the head of the internal audit activity must be approved by the board of directors and communicated to the Central Bank of Brazil.

Section III
Members of the Audit Team

Art. 6. For the performance of internal audit activity, team members must:

I - act with independence, autonomy, impartiality, diligence, integrity, and professional ethics;

II - have professional competence, including the knowledge and experience of each internal auditor and of internal auditors collectively, so that the internal audit team has the capacity to collect, understand, examine, and evaluate information and to judge results; and

III - report to and be accountable to the board of directors and the audit committee, when constituted, on all matters related to the performance of their activities, in accordance with the internal audit regulation mentioned in art. 13.

Art. 7. Consortium administrators and payment institutions must guarantee to members of the audit team, in the performance of their activities:

Art. 7. The institutions mentioned in art. 1 must guarantee to members of the audit team, in the performance of their activities: (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

I - a permanent communication channel with senior management, allowing it to act corrective, appropriately, and timely, in response to recommendations resulting from internal audit work;

II - authority to evaluate the institution's own functions and outsourced functions; and

III - free access to any information of the institution.

Art. 8. It is prohibited for a member of the internal audit team:

I - to be involved in the development and implementation of specific measures related to internal controls; and

II - to act in the audit of activities for which they had responsibility, before at least twelve months have elapsed.

Art. 9. The compensation policy for members of the internal audit team must be adequate to attract qualified and experienced professionals and must be determined independently of the performance of business areas, so as not to generate a conflict of interest.

Art. 9. (Revoked, effective January 1, 2025, by Resolution BCB No. 432, of November 13, 2024.)

Section IV
Scope

Art. 10. The scope of internal audit activity must consider all functions of the consortium administrator and payment institution, including outsourced ones.

Art. 10. The scope of internal audit activity must consider all functions of the institution mentioned in art. 1, including outsourced ones. (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

Sole paragraph. In the case of a leading institution of a prudential conglomerate, the scope of internal audit activity must also consider the functions of the institutions comprising the conglomerate.

Art. 11. In the performance of internal audit activity, the following must be evaluated, at least:

I - the effectiveness and efficiency of internal control and corporate governance systems and processes;

II - the effectiveness of policies and strategies for managing relevant risks, considering current risks and potential future risks;

III - the reliability, effectiveness, and integrity of management information processes and systems;

IV - compliance with the legal framework, sub-legal regulation, recommendations of regulatory bodies, and applicable internal codes and norms for the institution's workforce;

V - the safeguarding of assets and activities related to the institution's financial function; and

VI - activities, systems, and processes recommended or determined by the Central Bank of Brazil, in the exercise of its supervisory duties.

Art. 12. The Central Bank of Brazil may determine:

I - the inclusion of work in the scope of internal audit and the execution of specific work; and

II - the adoption of measures aimed at improving internal audit processes.

CHAPTER III
INTERNAL AUDIT ACTIVITY REGULATIONS

Art. 13. Consortium administrators and payment institutions must prepare and maintain a specific regulation for internal audit activity, approved by the board of directors and the audit committee, when constituted.

Art. 13. The institutions mentioned in art. 1 must prepare and maintain a specific regulation for internal audit activity, approved by the board of directors and the audit committee, when constituted. (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

Art. 14. The internal audit activity regulation must provide, at a minimum:

I - the objective and scope of internal audit activity;

II - the position of the internal audit unit in the institution's structure, if any;

III - the essential characteristics of internal audit activity, observing the provisions of Section II of Chapter II of this Resolution;

IV - the attributes, prohibitions, and compensation policy applicable to audit team members, as defined in Section III of Chapter II of this Resolution;

IV - the attributes and prohibitions applicable to audit team members, as defined in Section III of Chapter II of this Resolution; (Amended, effective January 1, 2025, by Resolution BCB No. 432, of November 13, 2024.)

V - the definition of the obligation, form, and organizational components to which internal auditors must communicate the results of the performance of their functions;

VI - the duties and responsibilities of the head of internal audit activity;

VII - the requirement to observe recognized internal audit standards; and

VIII - procedures for coordinating internal audit activity with independent audit.

CHAPTER IV
PLANNING AND EXECUTION OF INTERNAL AUDIT ACTIVITY

Art. 15. The planning of internal audit activity must be carried out in accordance with guidelines established by the board of directors, considering all relevant factors and risks related to the areas, activities, products, and processes subject to audit.

Art. 16. The execution of internal audit activity must encompass the collection and analysis of information, as well as the performance of tests, which adequately support conclusions and recommendations to the board of directors.

Art. 17. Those responsible for internal audit activity in consortium administrators and payment institutions must prepare the following documents:

Art. 17. Those responsible for internal audit activity in the institutions mentioned in art. 1 must prepare the following documents: (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

I - annual internal audit plan, based on audit risk assessment, containing, at least, the processes that will be part of the scope of internal audit activity, the classification of these processes by risk level, the proposed schedule, and allocation of available resources;

II - for each specific work of internal audit activity:

a) specific work plan, with definition of scope, schedule, and relevant factors in the execution of the work, such as the nature, timing, and extent of internal audit procedures to be applied, allocation of human resources, and availability of appropriate budget for execution;

b) working papers, with record of facts, information, and evidence obtained during the audit, in order to evidence examinations performed and justify conclusions and recommendations; and

c) report of conclusions and recommendations resulting from internal audit work;

III - follow-up report on measures taken to comply with recommendations; and

IV - annual internal audit report, containing a summary of audit work results, main conclusions, recommendations, and measures taken by the entity's administration.

Sole paragraph. The annual internal audit plan and the annual internal audit report must be approved by the board of directors and the audit committee, when constituted.

CHAPTER V
ADMINISTRATION DUTIES

Art. 18. The board of directors must:

I - ensure the independence and effectiveness of internal audit activity, even when performed by third parties, in accordance with § 1 of art. 3;

II - provide the necessary means for internal audit activity to be performed adequately, in accordance with this Resolution; and

III - promptly inform those responsible for internal audit activity of any material change occurring in the institution's strategy, policies, and risk management processes.

Art. 19. The board of directors is the body responsible for compliance, by the consortium administrator or payment institution, of the norms and procedures applicable to internal audit activity.

Art. 19. The board of directors is the body responsible for compliance, by the institution mentioned in art. 1, of the norms and procedures applicable to internal audit activity. (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

CHAPTER VI
GENERAL PROVISIONS

Art. 20. In the performance of internal audit activity, the audit norms and procedures established by the Central Bank of Brazil and, insofar as not conflicting with these, by the Federal Council of Accounting and the Institute of Internal Auditors of Brazil must be observed.

Art. 21. For consortium administrators and payment institutions that do not have a board of directors, the duties, competencies, and requirements provided for in this Resolution must be attributed to their management or administrators.

Art. 21. For the institutions mentioned in art. 1 that do not have a board of directors, the duties, competencies, and requirements provided for in this Resolution must be attributed to their management or administrators. (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

Art. 22. Delegation to another authority of the responsibilities, duties, and competencies of the board of directors, audit committee, and management or administrators of the institution defined in this Resolution is prohibited.

Art. 23. Consortium administrators and payment institutions must keep available to the Central Bank of Brazil:

Art. 23. The institutions mentioned in art. 1 must keep available to the Central Bank of Brazil: (Amended, effective March 1, 2024, by Resolution BCB No. 368, of January 25, 2024.)

I - the current regulation of internal audit activity, referred to in art. 13; and

II - the documents referred to in art. 17, for a minimum period of five years.

CHAPTER VII
FINAL PROVISIONS

Art. 24. Arts. 1 to 24 of Circular No. 3,856, of November 10, 2017, are revoked.

Art. 25. This Resolution enters into force on June 1, 2021.

Otávio Ribeiro Damaso
Regulation Director