BrazilBCB Resolution 85 of 2021, Cybersecurity Policy of Payment Institutions and Other Authorized Institutions
Resolução BCB nº 85, de 8 de abril de 2021, arts. 1º, 2º, 6º, 7º e 8º
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds a payment institution, a securities broker or dealer, a foreign-exchange broker or a virtual asset service provider authorized to operate by the Banco Central do Brasil (reached by declaring that you are a payment provider, a securities firm or a crypto-asset provider). It has applied to payment institutions since , to brokers, dealers and foreign-exchange brokers since , and to virtual asset service providers from Resolução BCB nº 552 of .
- Implement and maintain a cybersecurity policy built on principles and guidelines that seek to ensure the confidentiality, integrity and availability of your data and information systems, compatible with your size, risk profile, business model, the nature of your activities and the sensitivity of the data you hold (article 2).
- Establish a plan of action and incident response that implements the policy, and designate a director responsible for the policy and for executing the plan (articles 6 and 7).
- Prepare an annual report on the implementation of the plan, with a base date of 31 December (article 8).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Banco Central do Brasil, which applies the administrative penalties of Lei nº 13.506/2017 (public admonition, fine, bans on services or activities, disqualification of managers, and withdrawal of authorization) to a breach of its rules.
Settledness
- As of
- Open questions
- Does the Resolution apply to virtual asset service providers from the date of Resolução BCB nº 552, or from a later date that the amending Resolution sets?
What this law does
Article 1 of Resolução BCB nº 85, as redrafted by Resolução BCB nº 552 of , applies the Resolution to payment institutions, securities brokers and dealers, foreign-exchange brokers and virtual asset service providers authorized to operate by the Banco Central do Brasil.
Article 2 of the Resolution requires the institutions to implement and maintain a cybersecurity policy built on principles and guidelines that seek to ensure the confidentiality, integrity and availability of the data and information systems used. Article 6 of the Resolution requires the institutions to establish a plan of action and incident response aimed at implementing the cybersecurity policy.
Article 7 of the Resolution requires the institutions to designate a director responsible for the cybersecurity policy and for executing the plan of action and incident response. Article 8 of the Resolution requires the institutions to prepare an annual report on the implementation of the plan of action and incident response, with a base date of 31 December. Article 27 provides that the Resolution enters into force on .
Article 3, item I, of Lei nº 13.506/2017 makes it an infraction to carry out operations in the National Financial System or the Brazilian Payment System in disagreement with the principles of the legal and regulatory norms that govern the activity the Banco Central do Brasil has authorized. Article 5 of Lei nº 13.506/2017 applies the penalties of public admonition, fine, bans on services and activities, disqualification of managers and withdrawal of authorization, alone or cumulatively.
When LexLint raises it
When your app profile says your app is a payment provider, is a securities firm or is a crypto-asset provider.