Plenty of cybersecurity policies at Brazilian banks, credit cooperatives and finance companies still open with “in compliance with CMN Resolution No. 4,658/2018”. That rule was revoked on 1 July 2021. What applies today is CMN Resolution No. 4,893/2021, which in December 2025 gained a list of minimum controls through CMN Resolution No. 5,274. This guide shows what changed at each step, who follows which rule and what to review in the old document.
Why 4,658 still turns up everywhere
Resolution No. 4,658, of 26 April 2018 (Official Gazette of 30/04/2018), was the first text from Brazil’s National Monetary Council (CMN) dedicated to cybersecurity policy and to contracting data processing, data storage and cloud computing. Many institutions wrote their first policy and their first cloud contracts to comply with it, and the citation on the first page tends to survive the annual reviews.
It was amended once, by Resolution No. 4,752/2019, and revoked together with that amendment by article 27 of CMN Resolution No. 4,893, of 26 February 2021 (Official Gazette of 01/03/2021), in force since 1 July 2021.
The full timeline
| Rule | What it did | Status in October 2026 |
|---|---|---|
| Resolution No. 4,658/2018 | First cybersecurity policy and cloud rule for institutions authorised by the Central Bank of Brazil. | Revoked since 01/07/2021 |
| Circular No. 3,909/2018 | Equivalent rule for payment institutions. | Articles 1 to 26 revoked since 01/08/2021 |
| Resolution No. 4,752/2019 | Replaced prior notice of cloud contracts with notice up to ten days after signing. | Revoked since 01/07/2021 |
| CMN Resolution No. 4,893/2021 | Replaced 4,658 and 4,752. | In force, as amended |
| BCB Resolution No. 85/2021 | Replaced Circular 3,909 for payment institutions. | In force, as amended |
| CMN Resolution No. 5,117/2024 and BCB Resolution No. 368/2024 | From 01/03/2024, securities brokers and dealers and foreign exchange brokers moved from 4,893 to BCB 85. | In force |
| CMN Resolution No. 5,274/2025 and BCB Resolution No. 538/2025 | Minimum controls, requirements for the RSFN, Pix and STR, and penetration testing. | In force; compliance by 01/03/2026 |
| BCB Resolution No. 552/2026 | Brought virtual asset service providers under BCB 85. | In force since 05/03/2026 |
From 4,658 to 4,893: less of a break than it looks
Compared article by article, the two texts are almost the same rule. Resolution 4,893 kept the policy proportionate to size, risk profile and business model, the incident action and response plan, the accountable director, the annual report with a 31 December reference date presented to the board by 31 March, approval by the board of directors or, where there is none, by the executive board, review at least once a year and retention of documents for five years. The cloud contracting chapter (articles 11 to 17) also stayed practically the same.
The differences that matter when you review an old policy are four:
- Deadline to notify the Central Bank. The original text of 4,658 required notice of a material service contract at least sixty days in advance. Resolution 4,752/2019 changed this to up to ten days after, and 4,893 kept it. If the country has no information-sharing agreement with the Central Bank, authorisation must still be requested sixty days in advance, including for contract changes.
- Crisis criteria. Resolution 4,893 began to require institutions to set and document the criteria that define a crisis, the situation that triggers timely notice to the Central Bank (article 20, sole paragraph).
- Scope. Resolution 4,893 made it explicit that it does not apply to payment institutions, which follow their own Central Bank rule. Since 1 March 2024, under CMN Resolution No. 5,117, consortium administrators, securities brokers and dealers and foreign exchange brokers have also been excluded.
- Transition deadlines. Those in 4,658, such as approving the policy by 6 May 2019, were dropped from the text.
In practice, a policy written for 4,658 did not become wrong in 2021: its legal basis went out of date and it probably lacked crisis criteria. The real change came four years later.
What 5,274/2025 added to 4,893
CMN Resolution No. 5,274, of 18 December 2025 (Official Gazette of 22/12/2025), did not replace 4,893. It amended the text, so the correct reference today is “CMN Resolution No. 4,893/2021, as amended by CMN Resolution No. 5,274/2025”. The main changes:
- 14 minimum controls (article 3, paragraph 2): authentication, encryption, intrusion prevention and detection, data leakage prevention, malware protection, traceability, backups, vulnerability assessment and remediation, access controls, secure configuration, network protection, digital certificates, security of integration through electronic interfaces and cyber intelligence, including monitoring of the deep web, the dark web and private messaging groups.
- Minimum content for several controls (paragraphs 7 to 12), such as end-to-end audit trails with defined retention, multi-factor authentication for external access to the corporate network, periodic review of contractors’ permissions and monitoring of external connections at night and on non-business days.
- Additional requirements for the RSFN (article 3-A), the National Financial System Network: multi-factor authentication for administrative access to the Pix and STR (reserve transfer system) environments, physical and logical isolation of those environments (with a dedicated instance in the cloud), monitoring of credentials and certificates, integrity validation before messages are signed and a ban on third-party access to private keys.
- Penetration testing (article 22-A): at least annual, carried out independently by a specialist individual or firm hired for the purpose, without preventing tests by the internal team, with results and remediation plans documented. These results now go into the annual report.
- RSFN connectivity as a material service (article 22-B), subject to the contracting rules.
The rule took effect on publication and gave institutions already in operation until 1 March 2026 to adapt (article 2). The post on CMN Resolution 5,274 covers the controls and how they relate to ISO 27001.
Payment institutions and similar firms: BCB 85 and BCB 538
Payment institutions never followed 4,658. Their rule was Circular No. 3,909/2018, replaced by BCB Resolution No. 85, of 8 April 2021 (Official Gazette of 12/04/2021), in force since 1 August 2021. Today BCB 85 applies to payment institutions, securities brokers and dealers and foreign exchange brokers (since 1 March 2024) and, under BCB Resolution No. 552/2026, also to virtual asset service providers.
BCB Resolution No. 538, of 18 December 2025 (Official Gazette of 22/12/2025), made the same changes to BCB 85 that 5,274 made to 4,893: the 14 minimum controls, article 3-A, the penetration test in article 22-A and article 22-B, with the same deadline of 1 March 2026.
| Type of institution | Cybersecurity and cloud rule |
|---|---|
| Banks, credit cooperatives, finance companies and other authorised institutions not excluded | CMN Resolution No. 4,893/2021, as amended by 5,274/2025 |
| Payment institutions, securities brokers and dealers, foreign exchange brokers and virtual asset service providers | BCB Resolution No. 85/2021, as amended by 538/2025 |
| Consortium administrators | Outside 4,893 since 01/03/2024 and not listed in BCB 85; 4,893 itself refers them to Central Bank regulation, which should be confirmed with legal counsel |
Deadlines and routines that apply today
| Obligation | Deadline or frequency |
|---|---|
| Compliance with 5,274 or BCB 538 | By 01/03/2026 (passed) |
| Review of the policy and the incident action and response plan | At least annually |
| Annual report on the plan | Reference date 31/12, presented to the board or executive board by 31/03 |
| Independent penetration test | At least annually |
| Notice of a material service contract | Up to 10 days after signing or after a contract change |
| Service abroad without an agreement | Authorisation request at least 60 days in advance |
| Retention of policy, plan, reports, contracts and test results | Five years |
The rules on assessing providers, contract clauses and services abroad are covered in the post on third-party risk under CMN 4,893.
Checklist if your policy is still based on 4,658
- Confirm the applicable rule, 4,893 or BCB 85, using the table above.
- Replace the legal basis in the policy, the incident action and response plan, the public summary and internal standards.
- Map the 14 minimum controls to internal controls, with an owner and evidence, including the content of paragraphs 7 to 12 of article 3.
- Check whether article 3-A applies. Institutions that communicate over the RSFN need to document MFA, isolation, keys and integrity validation.
- Document the crisis criteria that trigger notice to the Central Bank, if they do not exist yet.
- Schedule the annual penetration test with an independent tester and keep the report and the remediation plan.
- Update the annual report template to include the results of penetration tests and scans and the remediation plans.
- Review the inventory of material services, including the RSFN connectivity provider, and check the notices sent to the Central Bank.
- Review the cloud contract clauses required by article 17, especially data location, subcontracting, exit and Central Bank access.
- Take the new version for approval by the board of directors or, where there is none, the executive board, and record the date in the minutes.
The guides on GRC platforms in Brazil and AI compliance software for banks cover how to organise requirements, controls and evidence.
Eagle and this checklist
Futture’s Eagle GRC module was designed to centralise frameworks, requirements, policies, controls, evidence and action plans in a reusable model, and it accepts custom requirements, which is how you would load 4,893 or BCB 85 as currently worded. The third-party risk module tracks suppliers through assessments, criticality, contracts and periodic reviews. Penetration testing, notices to the Central Bank and legal interpretation remain with the institution and its advisers.
Sources consulted on 30/10/2026: texts and amendment histories of Resolutions No. 4,658/2018 and No. 4,752/2019, CMN Resolutions No. 4,893/2021, No. 5,117/2024 and No. 5,274/2025, Circular No. 3,909/2018 and BCB Resolutions No. 85/2021, No. 368/2024, No. 538/2025 and No. 552/2026, in the Central Bank of Brazil’s regulatory database. This article is for information only and does not constitute legal advice.
Frequently asked questions
Is CMN Resolution 4,658/2018 still in force?
No. CMN Resolution No. 4,893/2021 revoked Resolution 4,658, together with Resolution No. 4,752/2019, which had amended it, with effect from 1 July 2021. Since then, citing 4,658 as the basis of a cybersecurity policy means citing a revoked rule.
Which rule replaced CMN Resolution 4,658?
CMN Resolution No. 4,893/2021, later amended by CMN Resolution No. 5,117/2024, which changed its scope, and by CMN Resolution No. 5,274/2025, which set out the minimum controls. Payment institutions, securities brokers and dealers, foreign exchange brokers and virtual asset service providers follow BCB Resolution No. 85/2021, amended by BCB Resolution No. 538/2025.
Our cybersecurity policy still cites 4,658. What should we do?
Review the policy and the incident action and response plan against 4,893 as currently worded (or BCB Resolution 85), add the 14 minimum controls and any additional requirements that apply, and take the documents to the board of directors for approval or, where there is no board, to the executive board.
What is the deadline to notify the Central Bank of a material cloud service contract?
Up to ten days after signing the contract, and also up to ten days after any contract change that alters the information notified. If the service is provided in a country without an information-sharing agreement with the Central Bank, authorisation must be requested at least sixty days in advance.
What was the deadline to comply with CMN Resolution 5,274/2025?
Resolution 5,274 and BCB Resolution No. 538/2025 took effect on publication, on 22 December 2025, and gave institutions already in operation until 1 March 2026 to adapt. That deadline has passed.
Official references
- Resolution No. 4,658/2018 (revoked) — Central Bank of Brazil
- Resolution No. 4,752/2019 (revoked) — Central Bank of Brazil
- CMN Resolution No. 4,893/2021 — Central Bank of Brazil
- CMN Resolution No. 5,117/2024 — Central Bank of Brazil
- CMN Resolution No. 5,274/2025 — Central Bank of Brazil
- Circular No. 3,909/2018 — Central Bank of Brazil
- BCB Resolution No. 85/2021 — Central Bank of Brazil
- BCB Resolution No. 368/2024 — Central Bank of Brazil
- BCB Resolution No. 538/2025 — Central Bank of Brazil
- BCB Resolution No. 552/2026 — Central Bank of Brazil