BrazilCMN Resolution 4,893 of 2021, Communication of Relevant Incidents
Resolução CMN nº 4.893, de 26 de fevereiro de 2021, arts. 20 e 22
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds an institution authorized to operate by the Banco Central do Brasil, other than a consortium administrator, a payment institution, a securities broker or dealer, or a foreign-exchange broker, which follow the Banco Central do Brasil's own regulation (reached by declaring that you provide financial services). It has applied since .
- In your risk management procedures for business continuity, provide for timely communication to the Banco Central do Brasil of the occurrence of relevant incidents, and of interruptions of relevant data processing, storage and cloud computing services, that constitute a crisis situation for you, together with the measures to restart your activities (article 20, item III). The Resolution sets no number of hours; it says "tempestiva" (timely).
- Document the criteria that constitute a crisis situation (article 20, sole paragraph).
- Develop initiatives to share information on the relevant incidents the policy covers, including incidents reported by your service providers, and keep that information available to the Banco Central do Brasil (article 22).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Banco Central do Brasil, which applies the administrative penalties of Lei nº 13.506/2017 (public admonition, fine, bans on services or activities, disqualification of managers, and withdrawal of authorization) to a breach of its rules.
Settledness
- As of
- Open questions
- Does the Banco Central do Brasil's other regulation set a number of hours for the communication of a relevant incident that "tempestiva" leaves open in article 20?
What this law does
Article 20, item III, of Resolução CMN nº 4.893 requires the risk management procedures of the institutions to contemplate timely communication to the Banco Central do Brasil of the occurrence of relevant incidents and of interruptions of relevant services that constitute a crisis situation for the institution, together with the measures to restart its activities.
Article 20 applies that requirement to the risk management procedures the institutions adopt under the regulation in force, in respect of business continuity. Article 22 requires the institutions to develop initiatives for sharing information on the relevant incidents referred to in article 3, item IV. Article 28 provides that the Resolution enters into force on .
Article 1 of Resolução CMN nº 4.893 applies the Resolution to the institutions authorized to operate by the Banco Central do Brasil, and its sole paragraph, as redrafted from , excludes consortium administrators, payment institutions, securities brokers and dealers, and foreign-exchange brokers.
Article 3, item I, of Lei nº 13.506/2017 makes it an infraction to carry out operations in the National Financial System or the Brazilian Payment System in disagreement with the principles of the legal and regulatory norms that govern the activity the Banco Central do Brasil has authorized. Article 5 of Lei nº 13.506/2017 applies the penalties of public admonition, fine, bans on services and activities, disqualification of managers and withdrawal of authorization, alone or cumulatively.
When LexLint raises it
When your app profile says your app provides financial services.