CMN Resolution No. 5,274, dated 18 December 2025 (published in the Official Gazette on 22 December), updates CMN Resolution No. 4,893/2021 and redesigns cybersecurity requirements for institutions authorised to operate by the Central Bank of Brazil. The deadline for full compliance was 1 March 2026 — it is already in force.
For payment institutions, brokerages and securities distributors, the corresponding instrument is BCB Resolution No. 538/2025.
The regulatory timeline
It helps to place the change, because a lot of material available online still describes the previous regime:
- CMN Resolution 4,658/2018 — the first cybersecurity policy and cloud contracting framework.
- CMN Resolution 4,893/2021 — consolidated and replaced 4,658.
- CMN Resolution 5,274/2025 — updates 4,893, with a March 2026 deadline.
Resolution 4,893 is still in force: 5,274 amended its text rather than replacing it. Your compliance matrix should cite 4,893 as amended by 5,274. A matrix is out of date if it still cites 4,658, revoked in 2021 (see what changed from 4,658 to today), or uses the text of 4,893 from before December 2025.
The mandatory minimum controls
The main change in character is the level of specification. The previous regime was more principles-based; 5,274 details a set of 14 mandatory minimum controls, among them:
- Authentication
- Encryption mechanisms
- Intrusion prevention and detection
- Information leakage prevention
- Protection against malicious software
- Traceability
- Backup management
- Vulnerability assessment
- Access controls
- Hardening
- Network protection
- Certificate management
- API security
- Cyber intelligence
Note what appears on that list and did not feature so prominently before: API security, certificate management and cyber intelligence. All three reflect the design of the Brazilian financial system after Pix and Open Finance, where inter-institutional integration is the exposure point.
Enhanced requirements for Pix, RSFN and STR
For communication over the National Financial System Network, which covers the Pix and Reserves Transfer System environments, the new article 3-A of 4,893 imposes additional requirements:
- Multi-factor authentication for administrative access
- Physical and logical isolation of those environments
- Monitoring of credentials and digital certificates
- End-to-end integrity validation before messages are digitally signed
- No service-provider access to the private signing keys
Penetration testing: annual, independent and institution-wide
Penetration testing is not a requirement for the Pix, RSFN and STR environments only. The new article 22-A applies to the whole institution: the test must run at least once a year, with independence and impartiality, by a specialised individual or firm under contract, and its results must be documented, including the vulnerabilities found and the action plans to fix them. The rule says this applies “without prejudice” to tests by the internal team. Internal testing is still allowed and useful, but it does not replace the independent test.
Where ISO 27001 helps
The resolution does not require ISO 27001 certification, and it is important not to sell one as the other. But the overlap is substantial: the 14 minimum controls map almost directly onto ISO 27001:2022 Annex A controls — including several of the eleven controls new to the revision, such as threat intelligence, data leakage prevention and configuration management.
In practice, an institution with an implemented ISMS and a current Statement of Applicability already produces much of the evidence the regulator asks for. What is usually missing is the specific layer: the explicit mapping between each regulatory requirement and the corresponding internal control, with the evidence pointed to. Without that mapping, the organisation has the controls but cannot demonstrate them in the format the question is asked.
What to do now
With the deadline already past, the question is no longer "how do we prepare" but "what can we demonstrate today". Three quick checks show where you stand:
- Is there a document mapping each of the 14 minimum controls to an internal control, with an owner and evidence? If the answer is an outdated spreadsheet, that is the first item.
- Was the last penetration test performed by an independent contracted party, is there a report dated within the last twelve months, and do the vulnerabilities found have an action plan?
- Has the cybersecurity policy been reviewed and approved by senior management after December 2025?
Source consulted: Grant Thornton Brazil — Cybersecurity: what changes with CMN Resolution No. 5,274/2025. This article is informational and does not constitute legal advice; consult the official text on the Central Bank of Brazil website.