Brazil tightens Open Finance rules

Update October 28, 2026: Along with tougher Open Finance rules for partnership contracts and consent, Brazil’s central bank said it had recorded 99 cyber incidents through September 2026, up from 76 in all of 2025. Of those cases, 68 were classified as fraud, although the regulator said the increase also reflects better monitoring and detection capabilities.

Brazil’s National Monetary Council and the central bank approved Joint Resolution No. 21, which updates Open Finance rules for partnership contracts between financial institutions and related companies. The rule adds requirements for evaluation, contractual security, specific customer consent and reporting of active contracts to the regulator.

What does the new resolution require?

The new regulation requires institutions acting as integrators to assess whether their partner companies can comply with the rules and protect shared information. That assessment must be certified at least once a year by an independent auditor registered with the Comissão de Valores Mobiliários.

Partnership contracts must also define security measures, limits on data transfers to third parties and procedures for stopping information sharing if an incident occurs. Finsiders Brasil said the reform aims to clarify the scope of these contracts and reduce interpretation gaps among system participants.

How does customer consent change?

The resolution also requires customer consent to be explicit and specific for each partner company within the integrator institution’s environment. Based on the reporting available, this strengthens control over which data is shared, and with whom, inside Open Finance schemes.

Independent coverage says the measure applies to partnerships in which banks, fintechs and credit unions transfer data obtained through Open Finance to companies outside the financial system. In that context, the new rules strengthen responsibilities around security, privacy and governance of shared data.

What happens to existing contracts?

Institutions that already have contracts covered by the new rules must notify the central bank, by December 1, 2026, of the list of partner companies with active contracts. They must also report on the adjustment of existing contracts and consent forms according to the timeline set by the central bank.

A secondary source also said the central bank could ban or restrict data sharing, and order contracts suspended or terminated when there is an impact on the security or operation of the National Financial System or the Brazilian Payments System. Agência Brasil added that the new rules allow data sharing to be suspended when situations pose risks to information security.

What do the new cyber incident figures show?

The central bank said 99 cyber incidents were recorded through September 2026, compared with 76 in all of 2025, and that 68 of those cases were classified as fraud. O Globo said that volume is the highest since at least 2018, and also cited 59 incidents in 2024.

Folha de S.Paulo said the 68 fraud-classified incidents accounted for 69% of the total recorded through September 2026. According to Valor, the regulator said the increase should be viewed alongside improvements in monitoring and detection capabilities, an explanation that points to a system with greater capacity to identify and report events.

When does it take effect?

Joint Resolution No. 21 took effect on the day it was published, according to a secondary source reproducing the rule’s text. Institutions covered by the rule must now adjust their contracts and control mechanisms under the new requirements already in force.