The Central Bank of Brazil has issued Resolution No. 85 of April 8, 2021, which provides for cybersecurity policy and requirements for contracting data processing and storage, as well as cloud computing services to be observed by payment institutions authorised to operate by the central bank. The resolution will enter into force on August 31, 2021, repealing Articles 1 to 26 of Circular No. 3,909 of August 16, 2018 and Circular No. 3,969 of November 13, 2019.
This analysis will highlight the main amendments made by the resolution to the legal framework in relation to the obligations provided for payment institutions in cybersecurity policy. It will also provide an overview of open banking implementation, as the technologies involved may cause greater cyber risk in the sector, and for the whole cybersecurity landscape in the country.