In November 2022, the Brazil’s Central Bank (Banco Central do Brazil/Bacen) published BCB Resolution 260/2022, which provides for the internal control systems of payment institutions that it has authorized to operate. It is worth remembering that CMN Resolution 2,554/1998, which was revoked, provided guidelines on the implementation of an internal control system for financial and other institutions that have been authorized to operate.
The new resolution that comes into force on January 1, 2023 (but appointment of the director responsible for compliance with it only comes into force on January 1, 2024) determines that payment institutions must implement internal control systems that are compatible with their nature, size, complexity, structure, risk profile and business model – and must be periodically reviewed and updated.
Internal control systems should provide for:
Aspects related to the control culture;
Aspects related to risk identification and risk assessment;
Aspects related to control activities and segregation of duties;
Aspects related to information and communication;
Aspects related to monitoring.
The systematic monitoring of activities related to internal control systems must be the subject of an annual report, which will be submitted to the board of directors or, if it does not exist, to the IP's executive board, as well as to internal and external audits. In addition to the duty to remain at the disposal of the Bacen for a period of five years.
The Central Bank may also determine the adoption of additional controls in cases where it finds inadequacy in the ones that have been implemented, and establish more restrictive operational limits to payment institutions that fail to comply with the determination within the established period.