Resolution No. 4,865

CMN RESOLUTION

NO. 4,865, OF OCTOBER 26, 2020

Establishes the guidelines for the functioning of the Controlled Testing Environment for Financial and Payment Innovations (Regulatory Sandbox) and the conditions for the provision of products and services in the context of this environment within the scope of the National Financial System.

The Central Bank of Brazil, in accordance with Article 9 of Law No. 4,595, of December 31, 1964, makes it public that the National Monetary Council, in a session held on October 22, 2020, based on Articles 4, items V, VI, VIII, and XXXI, of the aforementioned Law, Article 9 of Law No. 4,728, of July 14, 1965, Article 1, § 1, and Article 12, item III, of Complementary Law No. 130, of April 17, 2009, and Articles 7 and 9, item X, of Law No. 12,865, of October 9, 2013,

RESOLVES:

CHAPTER I

OF THE OBJECT

Art. 1. This Resolution establishes the guidelines for the functioning of the Controlled Testing Environment for Financial and Payment Innovations (Regulatory Sandbox) and the conditions for the provision of products and services in the context of this environment within the scope of the National Financial System.

Sole Paragraph. The Regulatory Sandbox is a unique environment for the execution of projects under the competence of the National Monetary Council and the Central Bank of Brazil, comprising the rules set forth in this Resolution and in a BCB Resolution, according to the regulatory competence of each authority.

CHAPTER II

OF THE DEFINITIONS

Art. 2. For the purposes of this Resolution, the following are considered:

I - participant: a legal entity authorized by the Central Bank of Brazil to execute an innovative project in the Regulatory Sandbox;

II - innovative project: an experimental product or service within the scope of the National Financial System or the Brazilian Payments System that meets the following requirements:

a) employs technological innovation or promotes the alternative use of existing technology; and

b) promotes improvements, such as gains in efficiency, reach, or coverage, cost reduction, or increased security;

III - discontinuity plan for activities: a sequence of acts and procedures to be carried out by the participant in the process of closing its activities in the Regulatory Sandbox, with the aim of ensuring compliance with its legal, regulatory, and contractual obligations; and

IV - controller: a person or group of persons who holds, directly or indirectly, shareholder rights corresponding to the majority of the voting capital of a corporation or to 75% (seventy-five percent) of the capital stock of a limited liability company.

CHAPTER III

OF THE CONTROLLED TESTING ENVIRONMENT FOR FINANCIAL AND PAYMENT INNOVATIONS (SANDBOX REGULATÓRIO)

Section I
Of the Concept and Objectives

Art. 3. The Regulatory Sandbox is an environment in which entities are authorized by the Central Bank of Brazil to test, for a determined period, an innovative project in the financial or payment area, observing a specific set of regulatory provisions that support the controlled and delimited execution of their activities.

Art. 4. The Regulatory Sandbox will be operationalized through cycles, the duration of which will be determined by the Central Bank of Brazil, and must be limited to a period of one year, renewable once for an equal period.

Sole Paragraph. The Central Bank of Brazil, without prejudice to the extension provided for in the caput, may extend, for up to one year, the authorization granted to the participant for the Regulatory Sandbox, for the purpose of:

I - issuing specific regulation for the product or service provided by the participant; or

II - conducting the process of definitive authorization of the participant.

Art. 5. The regulation and conduct of the Regulatory Sandbox shall have as objectives:

I - stimulate innovation and diversity of business models in the National Financial System and in the Brazilian Payments System;

II - increase efficiency and reduce costs in the National Financial System and in the Brazilian Payments System;

III - promote competition and financial inclusion;

IV - meet the needs of end-users, especially freedom of choice, security, protection of their economic interests, transparency in service provision and fee charging, non-discriminatory treatment, privacy and protection of personal data and banking secrecy, access to clear and complete information, and adequate conditions for the provision of products and services;

V - increase the reliability, quality, and security of products and services;

VI - improve the regulation of matters under the competence of the National Monetary Council and the Central Bank of Brazil; and

VII - improve the supervision processes of the Central Bank of Brazil.

Section II
Of Duties and Prerogatives

Subsection I
Common Provisions

Art. 6. With regard to activities carried out in the innovative project subject to the rules of the Regulatory Sandbox, the participant must comply, within the regulatory competence of the National Monetary Council, exclusively with:

I - the provisions of this Resolution and related regulation;

II - anti-money laundering and counter-terrorism financing norms, according to current regulation; and

III - norms of the Central Bank of Brazil regarding the handling of complaints made by its clients and users.

Art. 7. The charging of fees to clients and users by the participant is admitted, provided there is:

I - provision for fee charging related to the provision of products or services in the contract signed between the participant and the client;

II - effective provision of the respective product or service; and

III - disclosure of a table, on the participant's website, in its application, and on other network communication platforms, specifying the products or services whose provision implies fee charging, as well as their respective value and method of charging.

Art. 8. In the provision of products and services, the participant must:

I - adopt procedures and controls that allow proving the identity of its clients and users, as well as the authenticity of the information provided;

II - present to its clients and users the concept of the Regulatory Sandbox, as per Article 3;

III - provide information to its clients and users about the nature and complexity of the products and services provided;

IV - ensure that such products and services are suitable for the needs, interests, and objectives of its clients and users;

V - conduct its transactions with integrity, reliability, security, and confidentiality;

VI - inform the Effective Total Cost (CET), according to current regulation, if it operates in the credit market;

VII - limit the maturity dates of contracts signed with its clients and users to the duration period of its authorization to participate in the Regulatory Sandbox, unless it proves the existence of instruments that guarantee the transfer of the ownership of the obligations formalized in these contracts to other institutions authorized to assume them; and

VIII - timely provide its clients and users with contracts, receipts, statements, proofs, and other documents related to these products and services.

Sole Paragraph. The information mentioned in items II and III of the caput must:

I - be disclosed and kept updated in a visible location and in a legible format on the participant's website, in its application, and on other network communication platforms used to communicate with its clients and users;

II - be expressed in clear and objective language, in a way that allows broad understanding of the risks incurred and of the temporary and experimental nature of the innovative project;

III - appear in contracts, advertising and promotional materials, and other documents intended for clients and users;

IV - contain a specific warning, highlighted, about the risks associated with the product or services of the innovative project;

V - contain a warning, highlighted, that the activities are carried out by the participant within the scope of the Regulatory Sandbox, including references to the fact that it does not have definitive authorization from the Central Bank of Brazil and to the end date of the authorization to participate in the experiment; and

VI - contain clarification that the participant may promote modifications in the scope of the innovative project, provided it obtains prior consent from the Central Bank of Brazil.

Art. 9. It is permitted for the participant, during the execution of its innovative project, with prior consent from the Central Bank of Brazil, to make modifications to the scope of the project, provided that it remains within the concept of innovative project mentioned in Article 2, item II, and that the parameters established in the call for proposals referred to in Article 25 are observed.

Sole Paragraph. In the event that the alteration is approved, the participant must:

I - carry out broad communication to clients and users affected by the modification, in accordance with the principles set forth in the sole paragraph of Article 8; and

II - adapt the discontinuity plan for activities referred to in Article 2, item III, if necessary.

Art. 10. The participant assumes full responsibility for the service provided to its clients and users during participation in the Regulatory Sandbox.

Accounting Procedures

Art. 11. It is optional for the participant to apply the general criteria and accounting and audit procedures established by the National Monetary Council and the Central Bank of Brazil, embodied in the Accounting Plan of the Institutions of the National Financial System (Cosif).

Sole Paragraph. The participant that does not apply the criteria referred to in the caput must observe the Basic Conceptual Pronouncement (R2) approved by the Accounting Pronouncements Committee (CPC) on November 1, 2019, in the preparation of its financial statements.

Risk Management

Art. 12. The participant must implement a risk management structure.

§ 1. The structure mentioned in the caput must be implemented in a way that allows identification, measurement, assessment, monitoring, reporting, control, and mitigation:

I - of operational risk, as defined in § 2;

II - of credit risk, as defined in § 3, when the execution of the innovative project implies the collection of public funds; and

III - of other risks to which the participant is exposed in a relevant manner.

§ 2. For the purposes of this Resolution, operational risk is defined as the possibility of occurrence of losses resulting from external events or failure, deficiency, or inadequacy of internal processes, people, or systems associated with the execution of the innovative project, including:

I - internal frauds;

II - external frauds;

III - labor demands and deficient workplace security;

IV - inadequate practices regarding clients and users, products and services, including those provided by third parties;

V - damage to physical assets owned or used by the institution;

VI - situations that cause interruption of activities;

VII - failures in systems, processes, or Information Technology (IT) infrastructure; and

VIII - failures in execution, compliance with deadlines, or management of activities.

§ 3. The definition referred to in § 2 includes the legal risk associated with inadequacy or deficiency in contracts signed by the institution, sanctions due to non-compliance with legal provisions, and indemnities for damages to third parties resulting from the activities developed by the institution.

§ 4. For the purposes of this Resolution, credit risk is defined as the possibility of occurrence of losses associated with:

I - non-compliance by the counterparty with its obligations as agreed; and

II - devaluation or reduction of remunerations and expected gains in a financial instrument resulting from the deterioration of the credit quality of the counterparty or the mitigating instrument.

§ 5. For the purposes of item I of § 4, the counterparty is considered the borrower, the guarantor, and the issuer of a title or security acquired.

Art. 13. The structure referred to in Article 12 must include policies, strategies, routines, and procedures for:

I - identification, measurement, assessment, monitoring, reporting, control, and mitigation of the risks mentioned in Article 12;

II - monitoring the participant's liquidity level;

III - assessment, management, and monitoring of operational risk arising from relevant outsourced services for the regular functioning of the participant; and

IV - maintenance of IT infrastructure that ensures the integrity, security, and availability of data related to risk management.

§ 1. For the purposes of this Resolution, liquidity is defined as the availability of financial resources to efficiently honor expected and unexpected obligations, current and future, including those resulting from the tying of guarantees, without affecting daily operations and without incurring significant losses.

§ 2. The policies, strategies, routines, and procedures mentioned in the caput must be documented.

Monitoring

Art. 14. For the purpose of monitoring activities related to the innovative project, the participant, before the Central Bank of Brazil, must:

I - indicate representatives with managerial responsibilities for periodic and timely interaction, either in person or remotely;

II - guarantee full access to relevant information about the business, including those related to its development and the achievement of operation goals;

III - present information, documents, or other materials related to the business, whenever requested; and

IV - communicate the materialization of extraordinary risks during the development of activities.

Subsection II
Of Participants Operating in the Foreign Exchange Market

Art. 15. The participant that operates in the foreign exchange market, considering the nature of its innovative project, must:

I - identify the client or user and store, in electronic media, proof of their identification; and

II - inform the client or user, prior to the realization of the foreign exchange operation, the Effective Total Value (VET), according to current regulation.

Art. 16. It is optional for the participant referred to in Article 15 to hold an account in foreign currency in the country for the exclusive purpose of settling the foreign exchange operation of its client or user carried out within the scope of its innovative project, and the regulatory provisions of accounts held by institutions authorized to operate in the foreign exchange market must be observed.

Sole Paragraph. In the event of cancellation of the authorization to participate in the Regulatory Sandbox, the participant must sell the existing balance in the foreign currency account to the institution with definitive authorization to operate in the foreign exchange market, within the period established by the Central Bank of Brazil.

Art. 17. The exchange rate must be freely agreed upon between the participant referred to in Article 15 and its clients and users, reflecting exclusively the price of the currency negotiated for the date of the foreign exchange operation contract.

Art. 18. Foreign exchange operations between the participant and an institution with definitive authorization to operate in the foreign exchange market must fully observe the provisions provided by current regulation.

Art. 19. It is prohibited for the participant:

I - to carry out a purchase or sale operation of foreign currency with an institution abroad;

II - to maintain deposit accounts in national currency of residents, domiciled persons, or with headquarters abroad, or accounts in foreign currency for clients and users within the scope of the Regulatory Sandbox; and

III - to use cash resources for the delivery or receipt of reais or foreign currency.

Subsection III
Of the Prerogatives of the Central Bank of Brazil

Art. 20. The Central Bank of Brazil, considering the characteristics of the project authorized to participate in the Regulatory Sandbox, will define the period for the participant to put its innovative project into operation.

Art. 21. The Central Bank of Brazil, during the duration of the Regulatory Sandbox, may establish the limits referred to in Article 34, § 2, or make adjustments to them, when it detects that the participant's activity may expose to excessive risks:

I - the National Financial System;

II - the Brazilian Payments System;

III - its related parties, as per the specific accounting regulation applicable to institutions authorized to function by the Central Bank of Brazil, embodied in the Accounting Plan of the Institutions of the National Financial System (Cosif); or

IV - its clients and users.

Art. 22. If it identifies inadequacy or insufficiency in the management of risks associated with the execution of the innovative project, the Central Bank of Brazil may determine its improvement.

Art. 23. The Central Bank of Brazil will adopt simplified monitoring procedures according to the complexity and risks associated with each participant's innovative project.

CHAPTER IV

OF PARTICIPATION IN THE SANDBOX REGULATÓRIO

Section I
Of Participants

Art. 24. Only the following may participate in the Regulatory Sandbox:

I - private legal entities provided for in Article 44, items I, II, and VI, of Law No. 10,406, of January 10, 2002;

II - notarial and registration service providers, as provided for in Law No. 8,935, of November 18, 1994;

III - public companies; and

IV - mixed-capital societies.

Section II
Of the Call for Proposals

Art. 25. The participation process in the Regulatory Sandbox will begin through a normative act of the Central Bank of Brazil, containing specific rules, covering the following aspects:

I - duration period, respecting the period referred to in Article 4;

II - maximum number of participants, if there is a need for limitation due to the operational capacity of the Central Bank of Brazil or other relevant circumstance;

III - thematic concentration area of projects, if there is interest in stimulating innovative projects related to certain strategic priorities of the Central Bank of Brazil;

IV - necessary documentation for registration; and

V - schedule of registration and authorization phases.

Section III
Of Registration

Art. 26. The interested entity must register, according to the call act to be issued by the Central Bank of Brazil in accordance with Article 25.

Art. 27. For the purposes of registration, the interested entity must:

I - present a proposal for the provision of a product or service:

a) framed within the concept of innovative project; and

b) inserted within the scope of regulatory competence of the National Monetary Council;

II - demonstrate the origin of the resources used or to be used in the development of the innovative project;

III - prove the unblemished reputation of its controllers and administrators;

IV - present a discontinuity plan for activities, subject to approval by the Central Bank of Brazil; and

V - designate, before the Central Bank of Brazil, a statutory director, in the case of corporations, a director mentioned in the social contract, in the case of limited liability companies, or a legal representative, in the case of other participants, responsible for participation in the Regulatory Sandbox and for compliance with the provisions of this Resolution.

Sole Paragraph. For the purposes of proving as referred to in item III of the caput, the following situations and occurrences will be considered:

I - impediment by special law, conviction for bankruptcy crime, tax evasion, prevarication, active or passive corruption, extortion, embezzlement, against the popular economy, public faith, property, the National Financial System, or the Brazilian Payments System, or conviction to a criminal penalty that prohibits, even temporarily, access to public office;

II - disqualification or suspension for the exercise of positions of fiscal councilor, administration councilor, director, or managing partner in institutions authorized to function by the Central Bank of Brazil, or in complementary pension entities, insurance companies, capitalization societies, open companies, or entities subject to supervision by the Securities and Exchange Commission (CVM);

III - criminal process or police inquiry to which the controller or administrator is responding, or any society of which it was or has been, at the time of the facts, controller or administrator;

IV - judicial or administrative process that has a relationship with the National Financial System and the Brazilian Payments System; and

V - other situations, occurrences, or analogous circumstances judged relevant by the Central Bank of Brazil.

Art. 28. The Central Bank of Brazil must activate the existing coordination mechanisms with the Securities and Exchange Commission (CVM) and the Private Insurance Superintendence (SUSEP), in order to enable the assessment regarding the framing, within the regulatory competence of the National Monetary Council or the Central Bank of Brazil, of an innovative project that has been presented in any of those agencies.

§ 1. The assessment referred to in the caput will only take place in the case where the innovative project is proposed during the registration phase of the Central Bank of Brazil's Regulatory Sandbox.

§ 2. The Central Bank of Brazil may request complementary documentation from the interested entity, for the purpose of complying with the provisions of Article 27.

§ 3. The interested entity must comply with the provisions of § 2 within a maximum period of five business days.

Section IV
Of Classification and Authorization

Art. 29. In the selection and authorization process, the Central Bank of Brazil will initially evaluate the criteria referred to in Articles 24 and 27, item I.

Sole Paragraph. Entities that meet the criteria mentioned in the caput will be considered eligible to proceed in the Regulatory Sandbox selection process.

Art. 30. In the event that the number of entities eligible to proceed in the Regulatory Sandbox selection process is greater than the maximum number of participants referred to in Article 25, item II, the Central Bank of Brazil will classify them, observing the following criteria:

I - strategic priorities of the Central Bank of Brazil, to be specified in the call referred to in Article 25;

II - degree of maturity of the innovative project;

III - nature and magnitude of the risks inherent to the innovative project; and

IV - technical-operational capacity and governance structure of the interested entity.

Art. 31. The Central Bank of Brazil will only analyze the criteria established in Article 27, items III to V, regarding entities classified according to Article 30 up to the maximum number of participants referred to in Article 25, item II.

Art. 32. The Central Bank of Brazil will grant authorization to participate in the Regulatory Sandbox:

I - to eligible entities that meet the criteria established in Article 27, items III to V, in the event that the number of eligible entities is less than or equal to the maximum number of participants defined in the call; or

---

II - to the entities mentioned in Article 31 that meet the criteria established in Article 27, items III to V, in the event that the number of eligible entities exceeds the maximum number of participants defined in the call for applications.

Sole paragraph. The Central Bank of Brazil may, at any time, analyze the criterion referred to in Article 27, item II, observing that, in the event that the analysis occurs:

I - during the authorization process, failure to meet the criterion referred to in the main text will imply the denial of the request for authorization to participate in the Regulatory Sandbox; and

II - during the duration of the Regulatory Sandbox, failure to meet the criterion referred to in the main text will imply the ex officio cancellation of the authorization granted to the participant.

Article 33. The authorization to participate in the Regulatory Sandbox is limited:

I - to a period determined by the Central Bank of Brazil, in accordance with Article 4; and

II - to the single and exclusive execution of the innovative project subject to the authorization.

Sole paragraph. The authorization to participate in the Regulatory Sandbox does not imply, for any purposes, a guarantee that the participant will receive, at the end of the period stipulated in the main text, definitive authorization from the Central Bank of Brazil to operate.

Article 34. The Central Bank of Brazil may condition the authorization to participate in the Regulatory Sandbox on the compliance with operational limits and additional criteria, aiming to mitigate risks to the National Financial System and the Brazilian Payments System associated with the innovative project under analysis, without prejudice to the adoption of the measures provided for in Article 22.

§ 1º The operational limits and additional criteria mentioned in the main text may be established in a personalized manner for each innovative project, according to the following criteria:

I - public interest;

II - protection of public savings;

III - risks of the innovative project;

IV - money laundering and terrorist financing risks; and

V - proportionality.

§ 2º The operational limits mentioned in the main text may include specific restrictions regarding:

I - the participant's financial situation;

II - the maximum number of clients served by the innovative project;

III - the client profile;

IV - the maximum value of operations;

V - the maximum quantity of operations;

VI - the settlement period of operations;

VII - the specification of nature, type, and other characteristics of operations;

VIII - the geographic scope of the innovative project;

IX - the business model of the innovative project; or

X - the technology used in the innovative project.

§ 3º The additional criteria mentioned in the main text refer to requirements that must be added to the innovative project to allow its adequate monitoring by the Central Bank of Brazil, as well as to ensure that its execution occurs in a safe and transparent manner for clients and users.

Article 35. The Central Bank of Brazil may, in the classification and authorization granting process:

I - request additional documents and information deemed necessary for its decision; and

II - summon controllers and administrators to provide explanations and additional information.

Sole paragraph. In the case where the interested entity is constituted as an association, the summons referred to in item II of the main text applies only to administrators.

Article 36. In the case where the interested entity is an institution authorized to operate by the Central Bank of Brazil, this agency may condition its participation in the Regulatory Sandbox on the formation of a business entity specifically dedicated to the execution of the innovative project.

Article 37. The Central Bank of Brazil may, during the examination, deny the request for authorization to participate in the Regulatory Sandbox if it verifies:

I - circumstances that may affect the reputation of the controllers or administrators of the interested entity;

II - omissions or the provision of incorrect documents, data, or information inconsistent with legal or regulatory standards, considering the circumstances of each concrete case and the context of the facts; or

III - failure to meet requests for the presentation of additional documents, provision of information, appearance for interviews, or other requests related to the process, within the specified deadline.

Sole paragraph. In the cases covered by this article, the Central Bank of Brazil will grant a period for prior manifestation by the interested entities.

Article 38. The participant must obtain prior authorization from the Central Bank of Brazil to replace its controller or administrator.

Sole paragraph. The replacement of the controller or administrator will be admitted provided that the unblemished reputation of the indicated substitutes is proven, as set forth in Article 27, sole paragraph.

Article 39. The Central Bank of Brazil may archive the request for authorization to participate in the Regulatory Sandbox when the innovative project of the interested entity is classified, according to the criteria described in Article 30, in a classification higher than the maximum number of participants referred to in Article 25, item II, when applicable.

Section V: Closure of Participants' Activities

Article 40. The closure of the participant's activities in the Regulatory Sandbox will occur in the following scenarios:

I - expiration of the period stipulated to participate in the Regulatory Sandbox;

II - obtaining definitive authorization from the Central Bank of Brazil by the participant, during the validity of the Regulatory Sandbox, considering any extensions; or

III - cancellation of the authorization to participate in the Regulatory Sandbox:

a) at the request of the participant; or

b) ex officio, by the Central Bank of Brazil.

Sole paragraph. The Central Bank of Brazil will establish procedures regarding:

I - the cancellation of authorization; and

II - the execution of the discontinuity plan for activities upon the closure of activities referred to in this article.

Article 41. The Central Bank of Brazil may, at any time, cancel ex officio the authorization to participate in the Regulatory Sandbox, due to:

I - non-compliance with the terms of the authorization to participate in the Regulatory Sandbox;

II - an increase in the risks referred to in Article 21, such that they are no longer compatible with the participation regime in the Regulatory Sandbox;

III - failure to prove the origin of the resources used in the development of the innovative project, in accordance with Article 32, sole paragraph;

IV - non-compliance with the deadline to put the innovative project into operation, provided for in Article 20;

V - replacement of the participant's controller or administrator without prior authorization from the Central Bank of Brazil;

VI - failure to prove the unblemished reputation of the substitute controller or administrator; or

VII - the receipt of an excessive quantity of complaints from users of the products and services made available by the participant.

Sole paragraph. The Central Bank of Brazil, prior to the cancellation referred to in the main text, must initiate an administrative process, notifying the participant to manifest their opinion regarding the intention to cancel.

CHAPTER V
FINAL PROVISIONS

Article 42. It is prohibited for institutions authorized to operate by the Central Bank of Brazil to limit or prevent, in any way, the access of Regulatory Sandbox participants to products and services necessary for the execution of the innovative project, as well as to customer information, provided that authorized by them.

§ 1º The provisions of the main text apply to products and services regularly provided by the institution.

§ 2º The failure to provide an electronic means regularly offered by the institution, alternative to in-person service, for formalizing the request, authorization, confirmation, and cancellation of the products and services referred to in the main text, constitutes a limitation or impediment to access to products and services.

§ 3º The failure to provide the products and services referred to in the main text to participants who do not hold an account with the providing institution does not constitute a limitation or impediment.

Article 43. In the event of refusal or discontinuation of the provision of products and services referred to in Article 42, the institution must keep available to the Central Bank of Brazil the documentation and respective justifications, based on legal and regulatory standards, for a period of five years.

Article 44. Confidential information provided by interested entities to the Central Bank of Brazil or collected by it in the exercise of its competencies will have their confidentiality preserved, in accordance with current legislation.

Article 45. The Central Bank of Brazil is authorized to issue norms and adopt measures necessary for the execution of the provisions of this Resolution.

Article 46. This Resolution enters into force on December 1, 2020.

Roberto de Oliveira Campos Neto
President of the Central Bank of Brazil