On Nov. 22, BRZ CB issued rules on internal control systems.
BRZ CB issued Resolution 260 on internal control systems of consortium administrators and payment institutions (CAs), authorized to operate by the central bank of Brazil.
Internal Controls Overview
CAs must implement and maintain internal control systems compatible with their nature, size, complexity, structure, risk profile and its business model.
The internal control systems must aim to achieve the objectives of performance related to efficiency and effectiveness in the use of resources in their activities.
Provide information related to voluntary or mandatory disclosure of financial, operational and managerial data useful for the decision-making process.
Control system to ensure compliance with legal provisions, regulations, internal codes.
Resolution 260 sets forth the essential, required features of internal control systems.
Periodic Reports
The systematic monitoring of activities related to internal control systems must be the subject of an annual report, containing the information set forth in Resolution 260.
Including an assessment of the adequacy and effectiveness of internal control systems
Recommendations to address potential deficiencies and remediation schedule.
Identification of the individuals responsible for the areas corresponding to the deficiencies that were found, and the measures adopted to remedy them.
The report must be submitted to the board of directors as well as to internal and external auditors of the consortium administrator or payment institution.
The report must be kept accessible to the BRZ CB for a period of five years.
Management Responsibility
Board of directors must be actively involved in definition of internal control systems.
Must promote high ethical standards and integrity; establish organizational culture.
The organizational culture should have emphasis on the relevance of internal control systems and the engagement of each employee in the internal control process.
Board must maintain adequate organizational structure and resources to guarantee the quality and effectiveness of internal control systems and processes.
It is responsible for ensuring that it takes the necessary measures to identify, measure, monitor and control risks in accordance with the defined risk levels.
Also that it identifies failures, they are timely corrected, and that internal control systems are implemented and maintained in accordance with this Resolution.
Effectiveness
Resolution 260 becomes effective on Jan. 1, 2023 for certain provisions, and on Jan. 1, 2024 for others; repeals Cir. 3078/2002, Cir 3.856/2017; and other.
Nov. 13, 2024 BRZ CB Update
On Nov. 13, 2024, BRZ CB issued Resolution 431 to amend Resolution 260 of 2022.
Res 260 set internal control systems of consortium administrators, payment entities, securities brokerage firms, securities distribution companies, foreign exchange firms.
Amendments include changes to aspects related to information and communication.
Data quality verification process must include the performance of specific quality tests.
Resolution 431 shall come into force on Jan. 1, 2025.
Regulators
BRZ CB
Entity Types
Auditor; B/D; Bank; BHC; Corp; CU; SLHC; Thrift
Reference
Res 431, 11/13/2024; Res 260, Rpl, 11/22/2022
Functions
Audit; Compliance; C-Suite; Financial; Legal; Operations; Record Retention; Reporting; Risk
