Resolution CMN No. 4557 — Establishes the Risk Management Structure and Capital Management Structure

---

The Central Bank of Brazil, pursuant to Article 9 of Law No. 4,595 of December 31, 1964, makes public that the National Monetary Council, in a session held on February 23, 2017, based on Articles 4, item VIII, of the aforementioned Law, 2, item VI, and 9 of Law No. 4,728 of July 14, 1965, 20, § 1, of Law No. 4,864 of November 29, 1965, 7 and 23, item “a”, of Law No. 6,099 of September 12, 1974, 1, item II, of Law No. 10,194 of February 14, 2001, 6 of Decree-Law No. 759 of August 12, 1969, and 1, § 1, of Complementary Law No. 130 of April 17, 2009,

R E S O L V E D:

Art. 1 This Resolution provides for the risk management structure and the capital management structure.

CHAPTER I

SCOPE

Art. 2 Financial institutions and other institutions authorized to operate by the Central Bank of Brazil classified in Segment 1 (S1), Segment 2 (S2), Segment 3 (S3), or Segment 4 (S4), pursuant to Article 2 of Resolution No. 4,553 of January 30, 2017, must implement, pursuant to Articles 5 to 60 and 65 to 67 of this Resolution:

I - a continuous and integrated risk management structure; and

II - a continuous capital management structure.

§ 1 The management structures referred to in the main text must be:

I - compatible with the business model, the nature of operations, and the complexity of the institution’s products, services, activities, and processes;

II - proportional to the size and relevance of exposure to risks, according to criteria defined by the institution;

III - adequate to the institution’s risk profile and systemic importance; and

IV - capable of assessing risks arising from macroeconomic conditions and the markets in which the institution operates.

§ 2 Each management structure referred to in the main text must be unified for institutions that are part of the same prudential conglomerate, defined pursuant to Resolution No. 4,280 of October 31, 2013.

§ 3 The institutions referred to in the main text must adopt a prospective posture regarding risk management and capital management.

Art. 3 Institutions authorized to operate by the Central Bank of Brazil classified in Segment 5 (S5), pursuant to Article 2 of Resolution No. 4,553 of 2017, must implement, pursuant to Articles 61 to 67 of this Resolution, a simplified structure for continuous risk management.

§ 1 The simplified management structure referred to in the main text must be:

I - compatible with the business model, the nature of operations, and the complexity of the institution’s products, services, activities, and processes;

II - proportional to the size and relevance of exposure to risks, according to criteria defined by the institution; and

III - adequate to the institution’s risk profile.

§ 2 The management structure referred to in the main text must be unified for institutions that are part of the same prudential conglomerate, defined pursuant to Resolution No. 4,280 of 2013.

Art. 4 Credit cooperative systems are permitted, regardless of the classification of the institutions comprising them, to implement a centralized structure for risk management and a centralized structure for capital management.

§ 1 The centralized structures referred to in the main text must consider, for each institution of the credit cooperative system included therein:

I - the risks incurred significantly by the institution;

II - the impacts arising from the risks referred to in item I on the institution’s capital and liquidity;

III - risks associated with entities controlled by the institution or in which it participates.

§ 2 The exercise of the option referred to in the main text implies the disclosure, in internal policies and documents, of the functions performed by each institution included in the centralized structures.

§ 3 The management structures mentioned in the main text must be located in a supervised entity of the Central Bank of Brazil that is part of the credit cooperative system.

§ 4 The Central Bank of Brazil must be informed about the designation of the entity referred to in § 3.

§ 5 The exercise of the option referred to in the main text does not exempt the administration of each credit cooperative from responsibility for risk management and capital management pursuant to this Resolution, including the designation, before the Central Bank of Brazil, of the directors referred to in Articles 44 and 47, or 62.

CHAPTER II

RISK APPETITE STATEMENT (RAS)

Art. 5 Risk appetite levels must be documented in the Risk Appetite Statement (RAS).

§ 1 For the purpose of preparing the RAS, the following must be considered:

I - the types of risks and the respective levels that the institution is willing to assume;

II - the institution’s capacity to manage risks effectively and prudently;

III - the institution’s strategic objectives; and

IV - competitiveness conditions and the regulatory environment in which the institution operates.

§ 2 The exercise of the option referred to in Article 4 implies the documentation of risk appetite levels, considering each institution of the credit cooperative system that is classified in S2, S3, or S4.

CHAPTER III

RISK MANAGEMENT STRUCTURE

Section I

Requirements of the risk management structure

Art. 6 The risk management structure must identify, measure, assess, monitor, report, control, and mitigate:

I - credit risk, as defined in Article 21, to which the institution is significantly exposed;

II - market risk, as defined in Article 25, to which the institution is significantly exposed;

III - interest rate risk for instruments classified in the banking book (IRRBB), as defined in Article 28, to which the institution is significantly exposed;

IV - operational risk, as defined in Article 32;

V - liquidity risk, as defined in Article 37;

VI - socio-environmental risk, pursuant to Resolution No. 4,327 of April 25, 2014; and

VII - other relevant risks, according to criteria defined by the institution, including those not covered in the calculation of risk-weighted assets (RWA), as provided in Resolution No. 4,193 of March 1, 2013.

Sole paragraph. Risk management must be integrated, enabling the identification, measurement, assessment, monitoring, reporting, control, and mitigation of adverse effects resulting from interactions between the risks mentioned in the main text.

Art. 7 The risk management structure must provide for:

I - clearly documented policies and strategies for risk management, establishing limits and procedures intended to maintain exposure to risks in compliance with the levels set in the RAS;

II - effective processes for tracking and timely reporting of exceptions to risk management policies, limits, and risk appetite levels set in the RAS;

III - systems, routines, and procedures for risk management;

IV - periodic assessment of the adequacy of the systems, routines, and procedures referred to in item III;

V - adequate policies, processes, and controls to ensure the prior identification of risks inherent to:

a) new products and services;

b) relevant modifications to existing products or services;

c) significant changes in processes, systems, operations, and the institution’s business model;

d) hedging strategies and risk-taking initiatives;

e) significant corporate reorganizations; and

f) changes in macroeconomic outlooks;

VI - roles and responsibilities for risk management, clearly documented, establishing assignments for the institution’s personnel at various levels, including outsourced service providers;

VII - a stress testing program, as defined in Article 11;

VIII - continuous assessment of the effectiveness of risk mitigation strategies used, considering, among other aspects, the results of stress tests;

IX - clearly documented policies and strategies for business continuity management;

X - timely managerial reports to the institution’s board of directors, the risk committee, and the board of directors, if existing, covering:

a) aggregated values of exposure to the risks referred to in Article 6 and their main determinants;

b) adherence of risk management to the terms of the RAS and the policies and limits mentioned in the main text, item I;

c) assessment of the systems, routines, and procedures referred to in the main text, item IV, including any deficiencies of the risk management structure and actions to correct them;

d) actions to mitigate risks and assessment of their effectiveness;

e) degree of dissemination of the risk management culture within the institution; and

f) premises and results of stress tests.

§ 1 The policies for risk management referred to in the main text, item I, must provide for:

I - necessary authorizations and appropriate and timely actions by the institution’s board of directors and, where applicable, the board of directors, in case of exceptions to policies, procedures, limits, and RAS terms;

II - instruments, financial services, and hedging strategies with intended use by the institution, in compliance with RAS terms.

§ 2 The systems referred to in the main text, item III, include information systems adequate to assess, measure, and report, under normal or stress conditions, the size, composition, and quality of exposures, considering the risks incurred by the institution.

§ 3 The reporting produced by the information systems referred to in § 2 must:

I - reflect the institution’s risk profile and liquidity needs;

II - be available, periodically and in a manner appropriate for use, to the board of directors and the board of directors, if existing;

III - explicitly state deficiencies or limitations of risk estimates and premises adopted in quantitative models and scenarios.

Art. 8 The following must be disseminated to the institution’s personnel at various levels, including relevant outsourced service providers, in language and degree of information compatible with their area of operation:

I - the risk appetite documented in the RAS and its connection with routine risk-taking activities and decisions;

II - procedures for reporting occurrences related to non-compliance with risk appetite levels set in the RAS;

III - policies, strategies, processes, and limits provided for in the risk management structure.

Sole paragraph. The dissemination of information referred to in the main text must be carried out through a structured communication process.

Art. 9 Models for risk management, when used and relevant, must be submitted to periodic assessment regarding:

I - the adequacy and robustness of premises and methodologies used;

II - their performance, including comparison, when applicable, between estimated and observed losses (backtesting).

Sole paragraph. The assessment of the models referred to in the main text cannot be carried out by the unit responsible for their development nor by the unit that assumes risks.

Art. 10 The institution must maintain a sufficient quantity of technically qualified professionals in areas subject to risk-taking.

Section II

Stress testing program

Art. 11 For the purposes of the stress testing program, the following are considered:

I - stress testing program: a coordinated set of processes and routines, equipped with its own methodologies, documentation, and governance, with the main objective of identifying the institution’s potential vulnerabilities;

II - stress test: an exercise, with defined purpose, for prospective assessment of potential impacts of adverse events and circumstances on the institution or on a specific portfolio;

III - sensitivity analysis: a stress testing methodology that allows assessing the impact resulting from variations in a specific relevant parameter on the institution’s capital, liquidity, or the value of a portfolio;

IV - scenario analysis: a stress testing methodology that allows assessing, over a determined period, the impact resulting from simultaneous and coherent variations in a set of relevant parameters on the institution’s capital, liquidity, or the value of a portfolio;

V - reverse stress test: a stress testing methodology that allows identification of adverse events and circumstances associated with predefined levels of result, capital, or liquidity, including those that constitute the institution’s unsustainability; and

VI - second-order effects: adverse consequences resulting from responses by the institution and the market to the originally defined scenario.

Art. 12 The requirements of the stress testing program are:

I - to cover the relevant risks mentioned in Article 6;

II - to assess the impact of significant risk concentrations;

III - to use, appropriately to the needs of risk management, the following stress testing methodologies:

a) sensitivity analysis;

b) scenario analysis;

c) reverse stress test;

IV - to provide for the use of premises and parameters that are adequately severe; and

V - to be clearly documented, with detailing of the following aspects:

a) governance and processes of the program;

b) purpose, frequency, and methodology of each stress test;

c) actions listed to correct weaknesses pointed out by the program, including assessment of their feasibility in stress situations;

d) methodologies for defining relevant scenarios, when scenario analysis methodology is used;

e) role played by the institution’s specialists in definitions related to stress tests; and

f) methodological limitations of stress tests, including those related to model selection, their premises, and databases used.

Sole paragraph. In carrying out the stress testing program, the contribution of specialists from relevant areas of the institution must be considered, including risk-taking, risk management, economic, finance, and capital management.

Art. 13 The institution must ensure, regarding the stress testing program:

I - the use of its results in identifying, measuring, assessing, monitoring, controlling, and mitigating the institution’s risks;

II - its use to assist in assessing the adequacy and robustness of premises and methodologies used in the models referred to in Article 9, when used.

Art. 14 Stress tests must:

I - be carried out in an integrated manner for the various risks and business units of the institution, considering:

a) different levels of aggregation of exposures, according to the purpose of the tests; and

b) the prudential conglomerate as a whole;

II - consider adverse effects resulting from interactions between risks and provide for the use of a common scenario, when scenario analysis methodology is used.

Art. 15 In the process of developing scenarios, when scenario analysis methodology is used, the following must be considered, when relevant:

I - historical and hypothetical elements;

II - short- and long-term risks, idiosyncratic and systemic, of national and external origin;

III - interaction between risks;

IV - risks associated with the prudential conglomerate as a whole and with each institution comprising it;

V - risk of the institution providing financial support to an entity that is not part of its conglomerate;

VI - asymmetries, non-linearities, second-order effects, and breakage of correlations and other premises.

§ 1 Each scenario developed and its severity must be consistent with the purposes of the respective stress test.

§ 2 The low probability of a scenario occurring does not necessarily imply its exclusion from the stress testing program.

Art. 16 The systems mentioned in Article 7, item III, used within the stress testing program, must be flexible to allow:

I - inclusion and alteration of scenarios, when scenario analysis methodology is used;

II - incorporation of changes in the business model; and

III - aggregation of operations by risk factors, counterparties, and business lines.

Art. 17 The results of the stress testing program must be incorporated:

I - into the institution’s strategic decisions;

II - into the revision of risk appetite levels;

III - into the revision of policies, strategies, and limits established for risk management and capital management purposes;

IV - into the structured communication process referred to in Article 8;

V - into the assessment of the institution’s capital and liquidity levels and the preparation of respective contingency plans;

VI - into the capital adequacy assessment referred to in Article 40, item VI; and

VII - into the recovery plan referred to in Resolution No. 4,502 of June 30, 2016.

Art. 18 The board of directors and the board of directors, if existing, must actively participate in the stress testing program, indicating the guidelines to be followed and approving scenarios, when scenario analysis methodology is used.

Art. 19 The Central Bank of Brazil may determine:

I - adjustments in the institution’s stress testing program, including the use of scenarios different from those originally established and the carrying out of additional stress tests, if deficiencies are identified in this program; and

II - carrying out of stress tests based on scenarios provided by it.

Section III

Business continuity management

Art. 20 The policies for business continuity management referred to in Article 7, item IX, must establish:

I - a process for business impact analysis that includes:

a) identification, classification, and documentation of critical business processes;

b) assessment of potential effects of interruption of the processes mentioned in item “a”;

II - strategies to ensure the continuity of the institution’s activities and limit losses resulting from interruption of critical business processes;

III - business continuity plans that establish procedures and estimated deadlines for resumption and recovery of activities in case of interruption of critical business processes, as well as necessary communication actions;

IV - tests and reviews of business continuity plans with adequate periodicity.

§ 1 The policy and business continuity plans must consider services provided by third parties, when relevant.

§ 2 The managerial reports mentioned in Article 7, item X, must include the results of tests and reviews referred to in the main text, item IV.

Section IV

Credit risk management

Art. 21 For the purposes of this Resolution, credit risk is defined as the possibility of occurrence of losses associated with:

I - non-compliance by the counterparty with its obligations as agreed;

II - devaluation, reduction of remunerations, and expected gains in a financial instrument resulting from deterioration of the credit quality of the counterparty, the guarantor, or the mitigating instrument;

III - restructuring of financial instruments; or

IV - recovery costs of exposures characterized as problematic assets, pursuant to Article 24.

§ 1 For the purposes of credit risk management, the following are considered:

I - counterparty: the borrower, the guarantor, and the issuer of a title or security acquired;

II - restructuring of financial instruments: renegotiation that implies granting advantages to the counterparty due to deterioration of its credit quality or the credit quality of the guarantor or mitigating instrument.

§ 2 The advantages mentioned in § 1, item II, include those formalized in the original financial instruments or in new instruments used for settlement or refinancing of those.

§ 3 The definition of credit risk includes:

I - counterparty credit risk, understood as the possibility of losses resulting from non-compliance with obligations related to settlement of operations involving bilateral flows, including trading of financial assets or derivatives;

II - country risk, understood as the possibility of losses related to non-compliance with obligations associated with a counterparty or mitigating instrument located outside the Country, including sovereign risk, where the exposure is assumed against a central government of a foreign jurisdiction;

III - transfer risk, understood as the possibility of occurrence of obstacles in the foreign exchange conversion of values received outside the Country associated with an operation subject to credit risk;

IV - the possibility of occurrence of disbursements to honor financial guarantees provided pursuant to Resolution No. 4,512 of July 28, 2016;

V - the possibility of losses associated with non-compliance with obligations as agreed by a guarantor, provider of the mitigating instrument, or collection agent;

VI - concentration risk, understood as the possibility of losses associated with significant exposures:

a) to the same counterparty;

b) to counterparties operating in the same economic sector, geographic region, or segment of products or services;

c) to counterparties whose revenues depend on the same type of commodity or activity;

d) to financial instruments whose risk factors, including currencies and indexers, are significantly related;

e) associated with the same type of financial product or service; and

f) whose risk is mitigated by the same type of instrument.

Art. 22 Connected counterparties must constitute a single counterparty for the purposes of credit risk management.

§ 1 Counterparties are considered connected if they share credit risk with the institution, including through a control relationship.

§ 2 For the purposes of this Resolution, a control relationship must be verified in the occurrence of at least one of the following criteria:

I - one of the counterparties holds, directly or indirectly, more than 50% (fifty percent) of the voting capital of the other counterparty;

II - a voting agreement between a counterparty and other participants in the other counterparty ensures preponderance in the social deliberations of the participating counterparty;

III - a counterparty holds the power to elect or remove the majority of the administrators of the other counterparty; or

IV - a counterparty holds preponderance in the operational management decisions of the other counterparty.

§ 3 The criteria used for the identification of each group of connected counterparties must be documented.

§ 4º Exceptionally, the institution may choose not to treat connected counterparties linked by a control relationship as a single counterparty, provided that the absence of credit risk sharing is demonstrated and documented.

§ 5º For the purposes of credit risk management, the Central Bank of Brazil may, at its discretion, consider two or more counterparties as connected if it verifies the existence of credit risk sharing between them.

Art. 23. The management structure referred to in Art. 7 must additionally provide, for credit risk:

I - the management of exposures with similar characteristics, both at the individual and aggregate levels, covering aspects such as significant sources of credit risk, identification of the counterparty or intervening party, method of aggregating exposures, and use of mitigating instruments;

II - policies that establish criteria for identifying significant risk factors for the purposes of concentration risk management;

III - mechanisms for managing credit risk of:

a) instruments classified in the trading portfolio mentioned in Art. 26;

b) instruments classified in the banking portfolio mentioned in Art. 26, § 2º;

IV - management of credit risk of exposures not recorded in the institution's balance sheet;

V - use of relevant and consistent information for the assessment and measurement of credit risk;

VI - estimation, according to consistent and verifiable criteria, of expected losses associated with credit risk, as well as comparison of estimated values with actually observed losses;

VII - criteria for reassessing the credit quality of counterparties, intervening parties, and mitigating instruments;

VIII - observed the accounting regulations in force, mechanisms to ensure that provisioning levels are sufficient in relation to the expected losses referred to in item VI;

IX - adequate assessment regarding risk retention in operations involving the sale or transfer of financial assets;

X - establishment of limits for exposure to concentration risk as referred to in Art. 21, § 3º, item VI;

XI - policies and procedures, clearly documented, to monitor the total indebtedness of the counterparty, considering all risk factors, including that associated with exposures in foreign currency not protected by hedge;

XII - criteria and procedures, clearly defined and documented, accessible to those involved in the processes of granting and monitoring operations subject to credit risk, including:

a) prior analysis, execution, and renegotiation of operations subject to credit risk;

b) collection and documentation of information necessary for a complete understanding of the credit risk involved in the operations;

c) periodic assessment of the sufficiency degree of mitigating instruments;

d) detection of signs and prevention of deterioration in the credit quality of the counterparty;

e) treatment of exceptions to limits and to the credit risk appetite levels set in the RAS;

f) collection and receipt of credits;

g) recovery of exposures characterized as problem assets, in accordance with Art. 24;

XIII - criteria, clearly defined and documented, for the board of directors to deliberate on the assumption of exposure to credit risk:

a) that exceeds the concentration limit, in absolute value or proportional to Reference Equity (PR), established in risk management policies;

b) incompatible with the institution's risk profile or with the products and services offered by it;

XIV - system for classifying exposures according to the nature of the operation and credit risk, using consistent and verifiable criteria, considering aspects such as:

a) economic-financial situation, as well as other updated registration information of the counterparty and the intervening party, if any;

b) use of instruments that provide effective mitigation of the credit risk associated with the operation;

c) period of delay in fulfilling financial obligations as agreed;

XV - criteria and procedures for identifying, monitoring, and controlling exposure characterized as a problem asset, in accordance with Art. 24;

XVI - documentation and storage of information regarding losses associated with credit risk, including those related to restructuring, in accordance with Art. 21, § 1º, item II, and credit recovery;

XVII - information systems capable of identifying and aggregating, continuously, exposures subject to the concentration risk defined in Art. 21, § 3º, item VI.

§ 1º The estimate of expected loss, referred to in the caput, item VI, must consider:

I - the classification of the exposure as provided in the caput, item XIV;

II - the current macroeconomic environment and changes expected in the short term;

III - the probability that the exposure will be characterized as a problem asset;

IV - the expectation of credit recovery, including granting of advantages, execution costs, and timeframes.

§ 2º The estimate of expected loss must be reviewed semi-annually or:

I - monthly, if the exposure presents delay in payment of charges or amortizations;

II - immediately, upon characterization of the exposure as a problem asset.

§ 3º The management reports referred to in Art. 7, item X, must address the following additional aspects regarding credit risk:

I - the segregated reporting by jurisdiction of exposures subject to country risk and transfer risk, as defined in Art. 21, § 3º, items II and III;

II - the assessment and expectation of performance of exposures to credit risk, addressing their classification and respective provisions;

III - exposures subject to the concentration risk defined in Art. 21, § 3º, item VI.

IV - information regarding significant exposures characterized as problem assets, including characteristics, history, and recovery prospects;

V - information on the execution of mitigators and exposures in restructuring.

Art. 24. For the purposes of credit risk management, an exposure must be characterized as a problem asset when at least one of the following events is verified:

I - the respective obligation has been overdue for more than ninety days;

II - there are indications that the respective obligation will not be fully honored without recourse to guarantees or collateral.

§ 1º The indications that an obligation will not be fully honored include:

I - the institution considers that the counterparty no longer has the financial capacity to honor the obligation under the agreed conditions;

II - the institution, regardless of regulatory requirement, recognizes significant deterioration in the credit quality of the borrower or counterparty;

III - the operation related to the exposure is restructured, in accordance with Art. 21, § 1º, item II;

IV - the institution files for bankruptcy or takes similar action against the counterparty; and

V - the counterparty requests or undergoes any type of judicial measure that limits, delays, or prevents the fulfillment of its obligations under the agreed conditions.

§ 2º Exposures characterized as problem assets may only have this status changed in the face of evidence of the counterparty's resumption of the capacity to honor its obligations under the agreed conditions.

§ 3º The criteria for the evidence referred to in § 2º must be previously established by the institution and clearly documented.

Section V

On the management of market risk and IRRBB

Art. 25. For the purposes of this Resolution, market risk is defined as the possibility of occurrence of losses resulting from fluctuations in the market values of instruments held by the institution.

Sole Paragraph. The definition referred to in the caput includes:

I - the risk of variation in interest rates and stock prices, for instruments classified in the trading portfolio; and

II - the risk of variation in exchange rates and commodity prices (commodities), for instruments classified in the trading portfolio or in the banking portfolio.

Art. 26. The trading portfolio must be formed by instruments, including derivatives, held with the intention of trading or destined for hedge of other elements of the trading portfolio, and which are not subject to limitations on their tradability.

§ 1º Instruments held with the intention of trading are those destined for:

I - resale;

II - obtaining benefit arising from price movements, actual or expected; or

III - carrying out arbitrage.

§ 2º Instruments not classified in the trading portfolio must constitute the banking portfolio.

Art. 27. The institution must establish clearly defined policies to determine which instruments will be included in the trading portfolio, as well as procedures to ensure that the classification criteria in this portfolio are observed consistently.

§ 1º In the event that the institution does not maintain a trading portfolio, the policy and procedures referred to in the caput must ensure the non-existence of instruments held with the intention of trading.

§ 2º In the definition of the policy and procedures referred to in the caput, the criteria established by the Central Bank of Brazil must be observed.

Art. 28. IRRBB is defined as the risk, current or prospective, of the impact of adverse movements in interest rates on the capital and results of the financial institution, for instruments classified in the banking portfolio.

Art. 29. The management structure referred to in Art. 7 must additionally provide, for market risk and for IRRBB:

I - systems that consider all significant sources of risk and use reliable market and liquidity data, both internal and external;

II - adequate documentation of reclassifications of instruments between the trading portfolio and the banking portfolio and of internal risk transfers, observing the criteria established by the Central Bank of Brazil.

Sole Paragraph. For the purposes of this Resolution, internal transfer of risk corresponds to the internal recording of risk transfer within the banking portfolio, between the banking portfolio and the trading portfolio, or within the trading portfolio, of the same institution.

Art. 30. The management of IRRBB must provide:

I - assessment and control of its main determinants, including the mismatch between assets and liabilities, regarding maturities, rates, indexers, and currencies; and

II - identification, measurement, and control of this risk based on methodologies that are consistent with the characteristics of the banking portfolio and that consider the maturity, liquidity, and risk sensitivity of instruments classified in this portfolio.

§ 1º For institutions classified in S1, S2, or S3, the identification, measurement, and control of IRRBB referred to in the caput, item II, must be based on economic value and financial intermediation result approaches.

§ 2º Without prejudice to the provisions of § 1º, for institutions classified in S1, S2, S3, or S4, the Central Bank of Brazil may define specific methodologies and minimum requirements to be observed in the identification, measurement, and control of IRRBB, including those based on economic value and financial intermediation result approaches.

§ 3º For the purposes of this Resolution, the following are considered:

I - economic value approaches: assessments of the impact of changes in interest rates on the present value of cash flows of instruments classified in the institution's banking portfolio; and

II - financial intermediation result approaches: assessments of the impact of changes in interest rates on the financial intermediation result of the institution's banking portfolio.

§ 4º The IRRBB appetite levels must be documented in the RAS for each approach referred to in § 3º.

Art. 31. The management reports referred to in Art. 7, item X, must address the following additional aspects regarding IRRBB:

I - results of IRRBB measurement based on economic value and financial intermediation result approaches;

II - assumptions used in modeling:

a) embedded options;

b) changes in the temporal structure of cash flows of deposits with no defined contractual maturity; and

c) currency aggregation.

Section VI

On the management of operational risk

Art. 32. For the purposes of this Resolution, operational risk is defined as the possibility of occurrence of losses resulting from external events or failure, deficiency, or inadequacy of internal processes, people, or systems.

§ 1º The definition referred to in the caput includes the legal risk associated with inadequacy or deficiency in contracts entered into by the institution, sanctions due to non-compliance with legal provisions, and indemnities for damages to third parties arising from activities developed by the institution.

§ 2º Among operational risk events, the following are included:

I - internal fraud;

II - external fraud;

III - labor demands and deficient workplace security;

IV - inappropriate practices regarding clients, products, and services;

V - damage to physical assets owned or used by the institution;

VI - situations that cause interruption of the institution's activities;

VII - failures in systems, processes, or information technology (IT) infrastructure;

VIII - failures in execution, compliance with deadlines, or management of the institution's activities.

Art. 33. The management structure referred to in Art. 7 must additionally provide, for operational risk:

I - policies that establish decision criteria regarding the outsourcing of services and selection of their providers, including the minimum contractual conditions necessary to mitigate operational risk;

II - allocation of adequate resources to assess, manage, and monitor operational risk arising from outsourced services relevant to the regular functioning of the institution;

III - implementation of an IT governance structure consistent with the risk appetite levels established in the RAS;

IV - IT systems, processes, and infrastructure that:

a) ensure integrity, security, and availability of data and information systems used;

b) are robust and adequate to the needs and changes of the business model, both in normal circumstances and during periods of stress;

c) include mechanisms for information protection and security aimed at preventing, detecting, and reducing vulnerability to digital attacks;

V - a consistent and comprehensive process for:

a) timely collection of relevant information for the operational risk database;

b) classification and aggregation of identified relevant operational losses; and

c) timely analysis of the root cause of each relevant operational loss;

VI - periodic performance of scenario analyses with the objective of estimating the institution's exposure to rare and high-severity operational risk events.

§ 1º The contracts regarding the provision of outsourced IT services must include permission for the Central Bank of Brazil to access:

I - terms signed;

II - documentation and information regarding the services provided; and

III - contractor's premises.

§ 2º The results of the scenario analyses referred to in the caput, item VI, must be considered in the revision of the risk management structure and in capital allocation.

Art. 34. The institution must constitute an operational risk database containing values associated with operational losses, including provisions and expenses related to each loss event, and other operational risk data.

§ 1º For the purposes of this Resolution, operational loss is defined as the quantifiable value associated with the operational risk events mentioned in Art. 32.

§ 2º Operational losses associated with market risk and credit risk must be included in the operational risk database.

§ 3º The database referred to in the caput must be considered in the management of operational risk.

Art. 35. The management reports referred to in Art. 7, item X, must include information regarding relevant operational losses.

Art. 36. The institution must ensure adequate operational risk training for all employees and relevant outsourced service providers.

Section VII

On the management of liquidity risk

Art. 37. For the purposes of this Resolution, liquidity risk is defined as:

I - the possibility that the institution will not be able to efficiently honor its expected and unexpected, current and future obligations, including those arising from collateral linking, without affecting its daily operations and without incurring significant losses; and

II - the possibility that the institution will not be able to trade a position at market price, due to its large size relative to the normally traded volume or due to some discontinuity in the market.

Art. 38. The management structure referred to in Art. 7 must additionally provide, for liquidity risk:

I - policies, strategies, and processes that ensure:

a) identification, measurement, assessment, monitoring, reporting, control, and mitigation of liquidity risk at different time horizons, including intraday, in normal or stress situations, including daily assessment of operations with settlement periods of less than ninety days;

b) maintenance of an adequate stock of liquid assets that can be promptly converted into cash in stress situations;

c) maintenance of an adequate funding profile relative to the liquidity risk of assets and exposures not recorded in the institution's balance sheet; and

d) adequate diversification of funding sources; and

II - a liquidity contingency plan.

§ 1º The management of liquidity risk must consider all operations practiced in the financial and capital markets, as well as possible contingent or unexpected exposures, including those associated with settlement services, provision of guarantees and collateral, and contracted and unused credit and liquidity lines.

§ 2º The institution must consider liquidity risk individually in the jurisdictions where it operates and in the currencies to which it is exposed, observing any restrictions on the transfer of liquidity and convertibility between currencies, such as those caused by operational problems or by impositions made by a country.

§ 3º The liquidity contingency plan referred to in the caput, item II, must be regularly updated and establish responsibilities, strategies, and procedures, clearly defined and documented, to deal with stress situations.

CHAPTER IV

ON THE CAPITAL MANAGEMENT STRUCTURE

Art. 39. For the purposes of this Resolution, capital management is defined as the continuous process of:

I - monitoring and control of the capital maintained by the institution;

II - assessment of the need for capital to face the risks to which the institution is exposed; and

III - planning of targets and capital needs, considering the institution's strategic objectives.

Art. 40. The capital management structure must provide:

I - policies and strategies for capital management, clearly documented, that establish procedures intended to maintain Reference Equity (PR), Level I, and Core Capital, as referred to in Resolution No. 4,192, of March 1, 2013, at levels compatible with the risks incurred;

II - systems, routines, and procedures for capital management;

III - assessment of the impacts on capital of the results of the stress testing program referred to in Art. 7, item VII;

IV - a capital plan;

V - a capital contingency plan;

VI - assessment of capital adequacy;

VII - timely management reports for the institution's board of directors, the risk committee, and the board of directors, if they exist, covering:

a) any deficiencies in the capital management structure and actions to correct them; and

b) adequacy of PR, Level I, and Core Capital levels to the risks incurred.

§ 1º The capital contingency plan referred to in the caput, item V, must be regularly updated and establish responsibilities, strategies, and procedures, clearly defined and documented, to deal with stress situations.

§ 2º The assessment of capital adequacy must be carried out according to the following methodologies, established by the Central Bank of Brazil:

a) Internal Capital Adequacy Assessment Process (ICAAP), for institutions classified in S1;

b) Simplified Internal Capital Adequacy Assessment Process (ICAAPSimp), for institutions classified in S2.

§ 3º Until the criteria for the assessment of capital adequacy according to the ICAAPSimp methodology are established, institutions classified in S2 that, on the base date of December 31, 2016, carried out the assessment of capital adequacy according to this methodology, remain subject to the assessment of capital adequacy according to the ICAAP methodology.

Art. 41. The capital plan, mentioned in Art. 40, item IV, must be consistent with the institution's strategic planning, cover a minimum horizon of three years, and provide:

I - capital targets and projections;

II - main sources of the institution's capital.

Sole Paragraph. In the preparation of the capital plan, the following must be considered:

I - threats and opportunities related to the economic and business environment;

II - projections of asset and liability values, exposures not recorded in the balance sheet, as well as revenues and expenses;

III - growth or market share targets;

IV - profit distribution policy; and

V - terms of the RAS.

Art. 42. If the assessment of the need for capital by the financial institution points to a value above the minimum requirements for PR, Level I, and Core Capital, as referred to in Resolution No. 4,193, of 2013, the institution must maintain capital compatible with the results of its internal assessments.

CHAPTER V

ON THE GOVERNANCE OF RISK MANAGEMENT AND CAPITAL MANAGEMENT

Section I

On risk management

Art. 43. The risk management activity must be executed by a specific unit in the institutions referred to in Art. 2.

§ 1º The unit referred to in the caput must be segregated from the business units and the unit executing the internal audit activity, as referred to in Art. 2 of Resolution No. 2,554, of September 24, 1998.

§ 2º The unit referred to in the caput must have a sufficient quantity of experienced and qualified risk management professionals who meet the following requirements:

I - possess knowledge of the market and the institution's products and services;

II - have regular access to training and education;

III - be capable of questioning the risks assumed in operations carried out by business units; and

IV - understand the limitations and uncertainties related to the methodologies used in the risk management structure.

Art. 44. The institution must appoint a Chief Risk Officer (CRO) responsible for the specific unit referred to in Art. 43.

§ 1st The CRO's responsibilities include:

I - supervision of the development, implementation, and performance of the risk management structure, including its improvement;

II - responsibility for the adequacy, to the RAS and the institution's strategic objectives, of the policies, processes, reports, systems, and models used in risk management;

III - responsibility for the adequate training of the members of the specific unit referred to in Art. 43, regarding the policies, processes, reports, systems, and models of the risk management structure, even if developed by third parties;

IV - support and participation in the strategic decision-making process related to risk management and, where applicable, to capital management, assisting the Board of Directors.

§ 2nd Provided that the absence of conflict of interest is ensured, it is admitted that the CRO performs other functions in the institution, including the assessment of capital adequacy referred to in Art. 40, item VI.

§ 3rd The institution's bylaws, or equivalent, must expressly provide for the CRO's responsibilities.

§ 4th The institution must establish adequate conditions for the CRO to exercise its responsibilities independently and to report, directly and without the presence of board members, to the Risk Committee, the institution's chief executive, and the Board of Directors.

§ 5th The CRO must be ensured access to the information necessary to fulfill its responsibilities.

§ 6th The appointment and dismissal of the CRO must be approved by the Board of Directors.

§ 7th The institution must designate the name of the CRO to the Central Bank of Brazil.

§ 8th The dismissal of the CRO must be promptly disclosed on the institution's website, and the reasons for this fact must be communicated to the Central Bank of Brazil, which may request additional information.

Art. 45. The institution must constitute a Risk Committee.

§ 1st The Risk Committee's responsibilities include:

I - proposing, at a minimum annual frequency, recommendations to the Board of Directors regarding the matters referred to in Art. 48, item II;

II - assessing the risk appetite levels established in the RAS and the strategies for their management, considering risks individually and in an integrated manner;

III - supervising the performance and performance of the CRO;

IV - supervising the compliance, by the institution's Board of Directors, of the terms of the RAS;

V - assessing the degree of adherence of the risk management structure processes to the established policies; and

VI - maintaining records of its deliberations and decisions.

§ 2nd The Risk Committee must be composed of at least three members.

§ 3rd The institution's bylaws, or equivalent, must expressly provide for the following aspects, regarding the Risk Committee:

I - the maximum number of members;

II - the operating rules, including responsibilities and minimum frequency of meetings;

III - the form of accountability to the Board of Directors;

IV - the term of office of the members, when fixed.

§ 4th It is a condition for exercising the function of a member of the Risk Committee not to be and not have been, in the last six months, the CRO of the institution or a member of the Audit Committee referred to in Resolution No. 3.198, of May 27, 2004.

§ 5th The Risk Committee must be composed, in the majority, of members who:

I - are not and have not been employees of the institution in the last six months;

II - are not spouses, or relatives in the direct line, collateral line, or by affinity, up to the second degree, of the persons referred to in item I;

III - do not receive from the institution any other type of remuneration that does not result from the exercise of the function of member of the Risk Committee or the Board of Directors;

IV - have proven experience in risk management;

V - do not control the institution and do not participate in decisions at the executive level.

§ 6th The Risk Committee must be chaired by a member who meets the requirements listed in § 5th and who is not and has not been, in the last six months, chairman of the Board of Directors or any other committee of the institution.

§ 7th The Risk Committee must coordinate its activities with the Audit Committee, in order to facilitate the exchange of information, the necessary adjustments to the risk governance structure, and the effective treatment of the risks to which the institution is exposed.

§ 8th The Board of Directors of an institution not subject to the constitution of a Risk Committee under the main text must assume the responsibilities mentioned in § 1st, items I, II, III, V, and VI.

Section II

On Capital Management

Art. 46. The capital management activity must be executed by a specific unit in the institutions referred to in Art. 2.

§ 1st The unit referred to in the main text must be segregated from the unit executing the internal audit activity, referred to in Art. 2 of Resolution No. 2.554, of 1998.

§ 2nd The unit referred to in the main text must have a sufficient number of experienced and qualified professionals who have regular access to training and training for the purposes of capital management.

Art. 47. The institution must appoint a director responsible for the capital management structure.

§ 1st It is admitted that the director referred to in the main text performs other functions, except those that constitute a conflict of interest.

§ 2nd The institution must designate to the Central Bank of Brazil the name of the director referred to in the main text.

Section III

On the Responsibilities of the Board of Directors and the Board of Directors

Art. 48. It is the responsibility of the Board of Directors, for the purposes of risk management and capital management:

I - establish the institution's risk appetite levels in the RAS and review them, with the assistance of the Risk Committee, the Board of Directors, and the CRO;

II - approve and review, at a minimum annual frequency:

a) the policies, strategies, and risk management limits referred to in Art. 7, item I;

b) the capital management policies and strategies referred to in Art. 40, item I;

c) the stress testing program referred to in Art. 7, item VII;

d) the business continuity management policies referred to in Art. 7, item IX;

e) the liquidity contingency plan, referred to in Art. 38, item II;

f) the capital plan referred to in Art. 40, item IV;

g) the capital contingency plan referred to in Art. 40, item V;

III - ensure the institution's adherence to the policies, strategies, and risk management limits;

IV - ensure the timely correction of deficiencies in the risk management structure and the capital management structure;

V - approve significant changes, due to the risks referred to in Art. 7, item V, in the institution's policies and strategies, as well as in its systems, routines, and procedures;

VI - authorize, when necessary, exceptions to the policies, procedures, limits, and risk appetite levels established in the RAS;

VII - promote the dissemination of the risk management culture in the institution;

VIII - ensure adequate and sufficient resources for the exercise of risk management and capital management activities, independently, objectively, and effectively;

IX - establish the organization and responsibilities of the Risk Committee, observing the provisions of this Resolution;

X - ensure that the remuneration structure adopted by the institution does not incentivize behaviors incompatible with the risk appetite levels established in the RAS;

XI - ensure that the institution maintains adequate and sufficient levels of capital and liquidity.

Art. 49. In the absence of a Board of Directors, the responsibilities attributed to it by this Resolution apply to the institution's Board of Directors.

Art. 50. It is the responsibility of the institution's Board of Directors to conduct, in accordance with the policies and strategies referred to in Art. 7, item I, the activities that imply the assumption of risks.

Section IV

On Joint Responsibilities

Art. 51. The Board of Directors, the Risk Committee, the CRO, and the institution's Board of Directors must:

I - understand, in a comprehensive and integrated manner, the risks that can impact the institution's capital and liquidity;

II - understand the limitations of the information contained in the reports referred to in Art. 7, item X, and Art. 40, item VII, and the reports related to risk management and capital management;

III - ensure that the content of the RAS is observed by the institution;

IV - understand the limitations and uncertainties related to the assessment of risks, models, even when developed by third parties, and the methodologies used in the risk management structure;

V - ensure the understanding and continuous monitoring of risks by the various levels of the institution.

Art. 52. The processes related to risk management and capital management must be periodically evaluated by the institution's internal audit.

CHAPTER VI

ON RISK MANAGEMENT AND CAPITAL MANAGEMENT OF A PRUDENTIAL CONGLOMERATE

Art. 53. The unified structure for risk management of the prudential conglomerate, referred to in Art. 2, § 2nd, must consider the risks associated with the conglomerate and each institution individually, as well as identify and monitor the risks associated with other entities controlled by its members or from which they participate.

Art. 54. The unified structure for capital management of the prudential conglomerate, referred to in Art. 2, § 2nd, must assess the possible impacts on the capital and liquidity of the prudential conglomerate arising from the risks referred to in Art. 6.

Art. 55. The Central Bank of Brazil must be informed about the designation of the institution member of the prudential conglomerate responsible for the provisions of this Resolution, which is responsible for:

I - designating the CRO responsible for the risk management of the conglomerate, in accordance with Art. 44;

II - designating the director responsible for the capital management of the conglomerate, in accordance with Art. 47;

III - constituting, for the conglomerate, a Risk Committee, in accordance with Art. 45.

Sole paragraph. The responsibilities of the Board of Directors and the Board of Directors established by this Resolution apply, respectively, to the Board of Directors and the Board of Directors of the institution designated in the form of the main text.

CHAPTER VII

ON TRANSPARENCY

Art. 56. The description of the risk management structure and the capital management structure must be evidenced in a public access report, with a minimum annual frequency.

§ 1st The Board of Directors must include in the report mentioned in the main text its responsibility for the disclosed information.

§ 2nd The report referred to in the main text must be available in a single and easily identifiable location on the institution's website, in a specific section of information related to the institution's risk management.

§ 3rd A summary of the description of the risk management and capital management structures must be published, together with the financial statements, indicating the location, on the institution's website, of the report cited in the main text.

Art. 57. The composition and responsibilities of the Risk Committee must be evidenced on the institution's website.

CHAPTER VIII

ON SPECIFIC EXEMPTIONS BY SEGMENT

Art. 58. Institutions classified in S2 are exempt from using, in the stress testing program, the reverse stress testing methodology mentioned in Art. 12, item III, letter “c”.

Art. 59. Institutions classified in S3 are exempt from:

I - informing, in the management report, the degree of dissemination of the risk management culture as provided in Art. 7, item X, letter “e”;

II - observing the restriction referred to in Art. 9, sole paragraph, in the periodic assessment of risk management models;

III - using, in the stress testing program, the scenario analysis and reverse stress testing methodologies mentioned in Art. 12, item III, letters “b” and “c”;

IV - documenting, regarding the stress testing program, the provisions of Art. 12, item V, letters “c” and “d”;

V - elaborating scenarios within the stress testing program as provided in Art. 15;

VI - having flexible systems, within the stress testing program, according to the criteria established in Art. 16;

VII - incorporating the results of stress tests into the structured communication process, as provided in Art. 17, item IV;

VIII - performing operational risk scenario analyses as provided in Art. 33, item VI and § 2nd;

IX - complying with the provisions of Art. 45, §§ 4th to 6th, in the constitution of the Risk Committee.

Art. 60. Institutions classified in S4 are exempt from:

I - informing, in the management report, the degree of dissemination of the risk management culture as provided in Art. 7, item X, letter “e”;

II - disseminating information through a structured communication process, as provided in Art. 8, sole paragraph;

III - observing the restriction referred to in Art. 9, sole paragraph, in the periodic assessment of risk management models;

IV - using, in the stress testing program, the scenario analysis and reverse stress testing methodologies mentioned in Art. 12, item III, letters “b” and “c”;

V - documenting, regarding the stress testing program, the provisions of Art. 12, item V, letters “c”, “d”, “e”, and “f”;

VI - considering the contribution of experts in carrying out the stress testing program, as provided in Art. 12, sole paragraph;

VII - using the stress testing program to assess the adequacy and robustness of the premises and methodologies used in risk management models, as provided in Art. 13, item II;

VIII - observing the criteria for carrying out stress tests established in Art. 14;

IX - elaborating scenarios within the stress testing program as provided in Art. 15;

X - having flexible systems, within the stress testing program, according to the criteria established in Art. 16;

XI - incorporating the results of stress tests into the structured communication process, as provided in Art. 17, item IV;

XII - documenting the reclassifications of instruments between the trading portfolio and the banking portfolio and internal risk transfers as provided in Art. 29, item II;

XIII - documenting in the RAS the IRRBB appetite levels for each approach as provided in Art. 30, § 4th;

XIV - including additional aspects related to IRRBB in management reports, as provided in Art. 31;

XV - implementing the information collection, classification, aggregation, and operational loss analysis processes referred to in Art. 33, item V;

XVI - performing operational risk scenario analyses as provided in Art. 33, item VI and § 2nd;

XVII - constituting an operational risk database as provided in Art. 34;

XVIII - elaborating the capital contingency plan mentioned in Art. 40, item V;

XIX - constituting a Risk Committee in accordance with Art. 45.

CHAPTER IX

ON THE RISK MANAGEMENT STRUCTURE OF INSTITUTIONS CLASSIFIED IN SEGMENT 5 (S5)

Art. 61. The simplified structure for continuous risk management referred to in Art. 3 must:

I - identify, measure, assess, monitor, report, control, and mitigate the risks to which the institution is exposed in a relevant manner;

II - predict policies, strategies, routines, and procedures for risk management, periodically evaluated by the institution's administration.

Sole paragraph. The processes related to risk management referred to in the main text must be periodically evaluated by the institution's internal audit.

Art. 62. The institutions mentioned in Art. 3 must designate to the Central Bank of Brazil a director responsible for the simplified structure for continuous risk management.

Sole paragraph. For the purposes of the responsibility referred to in the main text, it is admitted that the designated director performs other functions in the institution, except those that constitute a conflict of interest.

Art. 63. The unified structure for risk management of the prudential conglomerate, referred to in Art. 3, § 2nd, must consider the risks associated with the conglomerate and each institution individually, as well as identify and monitor the risks associated with other entities controlled by its members or from which they participate.

Art. 64. The Central Bank of Brazil must be informed about the designation of the institution member of the prudential conglomerate responsible for the provisions of this Resolution, which is responsible for designating the director responsible for the risk management of the conglomerate, in accordance with Art. 62.

CHAPTER X

ON FINAL PROVISIONS

Art. 65. The following must be kept available to the Central Bank of Brazil for five years:

I - the RAS;

II - the documentation related to the risk management structure;

III - the documentation related to the capital management structure;

IV - the reports referred to in this Resolution.

Art. 66. If the Central Bank of Brazil identifies inadequacy or insufficiency in risk management or capital management, it may determine its improvement, without prejudice to the determination of the adoption of preventive prudential measures referred to in Resolution No. 4.019, of September 29, 2011.

Art. 67. The risk management and capital management structures must be implemented, from the date of publication of this Resolution:

I - within 180 days, for institutions classified in S1;

II - within 360 days, for institutions classified in S2, S3, S4, or S5.

§ 1st Institutions classified in S2 or S3 must establish, within 180 days of the date of publication of this Resolution, a plan for the implementation of the risk management and capital management structures.

§ 2nd The plan mentioned in § 1st must be approved by the institution's Board of Directors.

§ 3rd From 180 days after the date of publication of this Resolution, the institutions mentioned in the main text, item I, must cease to observe Resolutions Nos. 3.380, of June 29, 2006, 3.464, of June 26, 2007, 3.721, of April 30, 2009, 3.988, of June 30, 2011, and 4.090, of May 24, 2012.

Art. 68. This Resolution enters into force:

I - 360 (three hundred and sixty) days after its publication, regarding Art. 69;

II - on the date of its publication, regarding the other articles.

Art. 69. Resolutions Nos. 3.380, of June 29, 2006, 3.464, of June 26, 2007, 3.721, of April 30, 2009, 3.988, of June 30, 2011, and 4.090, of May 24, 2012, are revoked.

Sole paragraph. Any reference to a normative act mentioned in the main text in regulations issued by the National Monetary Council and the Central Bank of Brazil shall now refer to this Resolution.

Ilan Goldfajn
President of the Central Bank of Brazil