BrazilBCB Resolution 85 of 2021, Communication of Relevant Incidents
Resolução BCB nº 85, de 8 de abril de 2021, arts. 20 e 22
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds a payment institution, a securities broker or dealer, a foreign-exchange broker or a virtual asset service provider authorized to operate by the Banco Central do Brasil (reached by declaring that you are a payment provider, a securities firm or a crypto-asset provider). It has applied to payment institutions since , to brokers, dealers and foreign-exchange brokers since , and to virtual asset service providers from Resolução BCB nº 552 of .
- In your risk management procedures for business continuity, provide for timely communication to the Banco Central do Brasil of the occurrence of relevant incidents, and of interruptions of relevant data processing, storage and cloud computing services, that constitute a crisis situation for you, together with the measures to restart your activities (article 20, item III). The Resolution sets no number of hours; it says "tempestiva" (timely).
- Develop initiatives to share information on the relevant incidents the policy covers, including incidents reported by your service providers, and keep that information available to the Banco Central do Brasil (article 22).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Banco Central do Brasil, which applies the administrative penalties of Lei nº 13.506/2017 (public admonition, fine, bans on services or activities, disqualification of managers, and withdrawal of authorization) to a breach of its rules.
Settledness
- As of
- Open questions
- Does the Banco Central do Brasil's other regulation set a number of hours for the communication of a relevant incident that "tempestiva" leaves open in article 20?
What this law does
Article 20, item III, of Resolução BCB nº 85 requires the risk management procedures of the institutions to specify timely communication to the Banco Central do Brasil of the occurrence of relevant incidents and of interruptions of relevant services that constitute a crisis situation for the institution, together with the measures to restart its activities.
Article 20 applies that requirement to the risk management procedures the institutions adopt under the regulation in force, in respect of business continuity. Article 22 requires the institutions to develop initiatives for sharing information on the relevant incidents referred to in article 3, item IV. Article 27 provides that the Resolution enters into force on .
Article 1 of Resolução BCB nº 85, as redrafted by Resolução BCB nº 552 of , applies the Resolution to payment institutions, securities brokers and dealers, foreign-exchange brokers and virtual asset service providers authorized to operate by the Banco Central do Brasil.
Article 3, item I, of Lei nº 13.506/2017 makes it an infraction to carry out operations in the National Financial System or the Brazilian Payment System in disagreement with the principles of the legal and regulatory norms that govern the activity the Banco Central do Brasil has authorized. Article 5 of Lei nº 13.506/2017 applies the penalties of public admonition, fine, bans on services and activities, disqualification of managers and withdrawal of authorization, alone or cumulatively.
When LexLint raises it
When your app profile says your app is a payment provider, is a securities firm or is a crypto-asset provider.