New Guidelines for Open Finance
The National Monetary Council (CMN, Brazil’s top macroeconomic regulatory body) and the Central Bank of Brazil (BC) have approved significant changes to data-sharing rules under Open Finance. The system, also known as the open financial system, allows clients to authorize the sharing of their financial information across different participating institutions. The primary goal of this framework is to facilitate access to services better tailored to user profiles and stimulate competition among banks, fintechs, and other financial sector players.
The recent amendments approved in a joint resolution by both regulatory authorities focus on reinforcing security, expanding transparency, and establishing new operational requirements. The measures seek to clarify the responsibilities of all institutions involved in the ecosystem, reduce divergences in regulatory interpretation, and, fundamentally, grant clients tighter control over the use of their own information.
Key Changes in Data Sharing
The new rules established by the CMN and the BC encompass five main pillars that directly affect the dynamics of authorization and information control:
- Specific consent: Clients will need to authorize data sharing individually with each partner entity involved in the transaction. This increases clarity regarding who actually gains access to the information.
- Expanded oversight: Participating financial institutions must reinforce monitoring of their partner companies. The objective is to verify continuously whether partners comply with established rules and adequately protect received information.
- Greater transparency: System users will gain access to more detailed and comprehensive information regarding partnerships established between institutions and the flow of their shared data.
- Suspension for security: The new regulation provides specific mechanisms to immediately suspend data sharing if situations posing risks to information security are identified.
- Prevention of misuse: Strict additional restrictions will be applied to prevent shared data from being used improperly or for purposes not authorized by the client.
Governance and Senior Management Responsibility
One of the most notable aspects of the new rules is elevating data security to an institutional strategic level. The changes reinforce the role of senior management in the supervision of Open Finance.
From now on, executive boards and boards of directors will bear clearer responsibilities regarding partnership monitoring, full regulatory compliance, and the adoption of measures to prevent or rectify potential irregularities. In practice, this means system security is no longer an assignment restricted exclusively to technical information technology teams.
Financial institutions’ governance structures must closely monitor risks related to data sharing. If issues are identified, institutions have a duty to adopt immediate preventive or corrective measures, in compliance with applicable regulatory requirements.
Flexibility for Legal Entities
The updates pay special attention to the operational needs of corporate entities (legal entities). One of the main innovations is preparing the system for more flexible consent journeys adapted to corporate realities.
Under the current model, data sharing involves institutions that transmit information and institutions that receive it. The new rules pave the way for required authorizations to be granted at different times at each end. For companies, this is a significant advance, as consents can be provided by distinct users, respecting the internal representation, signing authority, and approval workflows of each business.
The workflow can operate as follows: a corporate representative requests a financial service at an institution that needs to consult data held at another bank. The consents required for this transaction can be granted in separate steps and at different times. If internal company rules require it, another authorized user may complete a subsequent approval stage. Only after all validations are completed will the data be shared according to security rules.
This model significantly facilitates the adoption of Open Finance by companies that have more complex governance structures and require approval from multiple stakeholders for financial transactions or decisions.
Practical Considerations
For the corporate environment, the new guidelines represent a maturation of Open Finance in Brazil. The set of measures makes it clearer who can access data, under what conditions, and what each participant’s responsibilities are. The expected outcome is a more predictable and secure ecosystem, allowing financial innovation to continue developing without undermining protection for users, whether individuals or corporations.
This content is for informational purposes only and does not constitute legal advice. For guidance on specific matters, consult a qualified lawyer.
