Provides financial services, in Brazil

Lei nº 12.414, de 9 de junho de 2011 (Lei do Cadastro Positivo), arts. 3º, 4º, 7º, 7º-A, 10, 12, 14 and 15 · Read the law's page

• Store in a credit-history database only objective, clear, true and easily understood information needed to assess the registered person's economic situation, and never excessive information or sensitive information (social and ethnic origin, health, genetic information, sexual orientation, political, religious or philosophical convictions).
• Notify the registered person, at no cost, within 30 days after opening the registry and state the channels for cancelling it, unless the person already has a registry in another database.
• Give enquirers the credit history only with the registered person's specific prior authorization, and keep procedures that prove that the authorization is authentic and valid.
• Use the information held only to analyze the registered person's credit risk or to support credit, a sale on credit or another transaction that carries financial risk to the enquirer, and let only enquirers that keep or intend to keep a commercial or credit relationship with the person access it.
• Do not keep payment-performance information in a database for more than 15 years.
• Do not require exclusivity from the sources of information.
• Publish on your website, in clear and accessible form, your policy for collecting and using personal data to prepare credit-risk analyses.
• Do not use in a credit score information unrelated to credit risk, information on origin, health, genetic information, sex or political, religious or philosophical convictions, information on persons who are not first-degree relatives or economic dependents of the registered person, or information on the registered person's exercise of the right of access.

Lei nº 12.414, de 9 de junho de 2011 (Lei do Cadastro Positivo), arts. 5º and 6º · Read the law's page

• Cancel or reopen a registry when the registered person asks, free of charge, within 2 business days, and pass the request to the other managers.
• Let the registered person access free of charge, without giving a reason, the information held, including the credit history and credit score, and provide it within 10 days.
• Correct or cancel, within 10 days and in every database that shared it, an entry that the registered person challenges as wrong.
• On request, give the registered person all the information held, its sources, the managers it was shared with, every enquirer that accessed it in the previous 6 months, a summary of the person's rights and confirmation of any cancellation.

Decreto nº 9.936, de 24 de julho de 2019 (regulamenta a Lei do Cadastro Positivo), arts. 2º, 7º, 8º, 9º, 10, 12, 13 and 18 · Read the law's page

• Hold net equity of at least R$ 100,000,000, shown by financial statements audited by an independent auditor registered with the Securities Commission, and hold independent technical certifications of your platform security and information-security policy, renewed at least every three years and reviewed every year.
• Give a registered person's credit history to an enquirer only with the person's prior and specific authorization, and let the person revoke an authorization at any time.
• Let a registered person cancel or reopen the registry at any time, and suspend an enquirer's access to the person's credit score within two business days of the request, passing the request to the other managers.
• Report a leak of registered persons' information or another security incident that may cause relevant risk or harm to the Autoridade Nacional de Proteção de Dados, the Central Bank of Brazil or the National Consumer Secretariat, according to the data involved, within two business days of learning of it, and promptly notify the persons affected.
• Let only enquirers that keep or intend to keep a commercial or credit relationship with the registered person access the person's information, and keep policies and controls that ensure it.
• Give the registered person free access, on your website and by telephone, to the information you hold, the sources that supplied it, the managers it was shared with and the enquirers that saw the credit history and score in the previous six months.
• Keep the authorizations and the cancellation, reopening, deletion, revocation and correction requests on file for at least 15 years after the registry is cancelled.

Resolução CMN nº 4.893, de 26 de fevereiro de 2021, arts. 20 e 22 · Read the law's page

• This binds an institution authorized to operate by the Banco Central do Brasil, other than a consortium administrator, a payment institution, a securities broker or dealer, or a foreign-exchange broker, which follow the Banco Central do Brasil's own regulation (reached by declaring that you provide financial services). It has applied since 1 July 2021.
• In your risk management procedures for business continuity, provide for timely communication to the Banco Central do Brasil of the occurrence of relevant incidents, and of interruptions of relevant data processing, storage and cloud computing services, that constitute a crisis situation for you, together with the measures to restart your activities (article 20, item III). The Resolution sets no number of hours; it says "tempestiva" (timely).
• Document the criteria that constitute a crisis situation (article 20, sole paragraph).
• Develop initiatives to share information on the relevant incidents the policy covers, including incidents reported by your service providers, and keep that information available to the Banco Central do Brasil (article 22).

Resolução CMN nº 4.893, de 26 de fevereiro de 2021, arts. 2º, 3º, 3º-A, 6º, 7º, 8º e 22-A, as amended by Resolução CMN nº 5.274, de 18 de dezembro de 2025 · Read the law's page

• Implement and maintain a cybersecurity policy built on principles and guidelines that seek to ensure the confidentiality, integrity and availability of your data and information systems, compatible with your size, risk profile, business model, the nature and complexity of your operations and the sensitivity of the data you hold (articles 2 and 3).for a financial business
• In the policy, set your cybersecurity objectives, the procedures and controls that reduce your vulnerability to incidents, controls that secure sensitive information, and the recording, root-cause and impact analysis and control of relevant incidents (article 3).when it serves a financial business
• Establish a plan of action and incident response that implements the policy, and designate a director responsible for the policy and for executing the plan (articles 6 and 7).for a financial business
• Prepare an annual report on the implementation of the plan, with a base date of 31 December (article 8).for a financial business
• Include in the procedures and controls the mechanisms the Resolution now lists, among them multiple-factor authentication for access to the corporate network from outside the institution, annual independent intrusion tests, and, on the National Financial System Network, multiple-factor authentication for administrative access to the Pix and Reserve Transfer System environments (articles 3, 3-A and 22-A).when it serves a financial business
• This binds an institution authorized to operate by the Banco Central do Brasil, other than a consortium administrator, a payment institution, a securities broker or dealer, or a foreign-exchange broker, which follow the Banco Central do Brasil's own regulation (reached by declaring that you provide financial services). It has applied since 1 July 2021.

Resolução BCB nº 85, de 8 de abril de 2021, arts. 1º, 2º, 3º, 3º-A, 6º, 7º, 8º e 22-A, as amended by Resolução BCB nº 538, de 18 de dezembro de 2025 · Read the law's page

• Implement and maintain a cybersecurity policy built on principles and guidelines that seek to ensure the confidentiality, integrity and availability of your data and information systems, compatible with your size, risk profile, business model, the nature of your activities and the sensitivity of the data you hold (article 2).for a financial business
• Establish a plan of action and incident response that implements the policy, and designate a director responsible for the policy and for executing the plan (articles 6 and 7).for a financial business
• Prepare an annual report on the implementation of the plan, with a base date of 31 December (article 8).for a financial business
• Include in the procedures and controls the mechanisms the Resolution now lists, among them multiple-factor authentication for access to the corporate network from outside the institution, annual independent intrusion tests, and, on the National Financial System Network, multiple-factor authentication for administrative access to the Pix and Reserve Transfer System environments (articles 3, 3-A and 22-A).when it serves a financial business
• This binds a payment institution, a securities broker or dealer, a foreign-exchange broker or a virtual asset service provider authorized to operate by the Banco Central do Brasil (reached by declaring that you are a payment provider, a securities firm or a crypto-asset provider). It has applied to payment institutions since 1 August 2021, to brokers, dealers and foreign-exchange brokers since 1 March 2024, and to virtual asset service providers from Resolução BCB nº 552 of 3 March 2026.

Resolução BCB nº 85, de 8 de abril de 2021, arts. 20 e 22 · Read the law's page

• This binds a payment institution, a securities broker or dealer, a foreign-exchange broker or a virtual asset service provider authorized to operate by the Banco Central do Brasil (reached by declaring that you are a payment provider, a securities firm or a crypto-asset provider). It has applied to payment institutions since 1 August 2021, to brokers, dealers and foreign-exchange brokers since 1 March 2024, and to virtual asset service providers from Resolução BCB nº 552 of 3 March 2026.
• In your risk management procedures for business continuity, provide for timely communication to the Banco Central do Brasil of the occurrence of relevant incidents, and of interruptions of relevant data processing, storage and cloud computing services, that constitute a crisis situation for you, together with the measures to restart your activities (article 20, item III). The Resolution sets no number of hours; it says "tempestiva" (timely).
• Develop initiatives to share information on the relevant incidents the policy covers, including incidents reported by your service providers, and keep that information available to the Banco Central do Brasil (article 22).

Circular SUSEP nº 638, de 27 de julho de 2021, arts. 2º, 6º e 8º · Read the law's page

• This binds an insurance company, an open private pension entity, a capitalization company or a local reinsurer supervised by the Superintendência de Seguros Privados (reached by declaring that you are an insurer). It applies from 1 September 2021, with adaptation periods that ended on 30 June 2022 for segments S1 and S2 and on 1 September 2022 for segments S3 and S4 (article 17).
• Notify the Susep of the occurrence of a relevant incident within a maximum of 5 business days from the day you become aware of the event, detailing the extent of the damage and, where applicable, the actions under way to fully regularize the situation, those responsible and the deadlines (article 8). A relevant incident is an adverse event, whether or not from malicious activity, that substantially compromises, under parameters you set, the confidentiality, integrity or availability of relevant data or of relevant data processing or storage services (article 2, item VI).
• In your incident-handling procedures, communicate with the parties affected by the incident, above all customers (article 6, item VII).
• In your incident-handling procedures, share information on relevant incidents with the other supervised entities in a mutually agreed format, protecting confidential information and trade secrets (article 6, item VI).

Circular SUSEP nº 638, de 27 de julho de 2021, arts. 3º, 4º, 5º e 9º · Read the law's page

• This binds an insurance company, an open private pension entity, a capitalization company or a local reinsurer supervised by the Superintendência de Seguros Privados (reached by declaring that you are an insurer). It applies from 1 September 2021, with adaptation periods that ended on 30 June 2022 for segments S1 and S2 and on 1 September 2022 for segments S3 and S4 (article 17).
• Have a cybersecurity policy that contemplates at least your cybersecurity objectives, the commitment of your management bodies, and the parameters for classifying data, incidents and services and for outsourcing data processing and storage, compatible with your size, the nature and complexity of your operations and your exposure to cyber risk (article 4).
• Treat cyber risk as operational risk in your risk management framework, and observe national and international good practices on physical security, access control, encryption, protection against malware, data backups, activity logs, network protection and systems development and acquisition (article 3).
• Maintain effective, up-to-date processes, procedures and controls to identify and reduce vulnerabilities proactively and to detect, respond to and recover from incidents (article 5).
• Prepare an annual report on the prevention and handling of incidents, and send it to your management bodies, your audit and risk committees if any, and your internal controls director (article 9).

Arts. 1, 3, 10 e 23 do Decreto nº 13.135, de 9 de outubro de 2026 · Read the law's page

• The Decree names no technical standard: the competent regulatory agency or body is to set the accessibility of SAC channels (Art. 10, sole paragraph).
• If you supply products or services regulated by the federal executive and meet your regulator's criteria, or offer financial, payment or credit services to consumers through a platform or other digital means under Central Bank regulation or supervision, make your customer service channels, including the chat on your website or app and instant messaging, broadly accessible to persons with disabilities, with full access for the handling of their demands (Decreto nº 13.135/2026, Arts. 1, 3 and 10).