BC’s public consultation: Improved regulation on risk management involving payment networks

On September 02, 2024, the Central Bank of Brazil (“BC”) submitted to public consultation a draft resolution seeking to amend Annex I of BCB Resolution No. 150, in order to establish new rules destined to improve the centralized risk management structures involving payment networks that integrate the Brazilian Payment System (“SPB”).

The new draft resolution aims to strengthen the regulatory framework on the authorization, monitoring, and supervision of payment arrangements, as well as to standardize the risk management practices involving these networks.

The key points of the draft resolution submitted to public consultation are highlighted as follows:

1. New concepts introduced
   1. BR Code: a quick response code standard determined by the BC for payment initiation purposes.
   2. Risk management mechanisms: a set of measures provided for in the regulation governing payment networks, as well as the rules for their employment, managed centrally by the payment arrangement provider, to be carried out in the event of default or failure involving the payment arrangement by the participant. These mechanisms are aimed at ensuring the receipt of funds allocated to the settlement of payment transactions by the receiving end-users or by those who have subrogated the right to receive these funds in compliance with the payment arrangement, which can encompass the following:
      1. Prior provision of individual guarantees to the payment network provider by the participants involved in the financial flow of the transaction;
      2. Creation of a mutual fund based on individual contributions from the participants in the arrangement involved in the financial flow of the transaction as well as contributions from the arrangement provider; and
      3. Other measures consistent with the risk management purposes between participants in the network provided for in this resolution or in the rules governing the payment network.
   3. Provider‘s guarantee fund: A fund composed of resources from the payment network provider intended for covering the financial flow of transactions to be settled in an extreme situation.
   4. Extreme situation: an event in which the risk management mechanisms established by the network provider are not sufficient or timely to cover the financial flow of the transactions to be settled, in the event of default or failure by the payment network participant, including failures in the implementation of procedures.
   5. Qualified net funds:
      1. funds in local currency with immediate liquidity, deposited in financial or payment institutions authorized to operate by the BC, which are not subject to a special regime;
      2. Investments that are readily convertible into a known amount of cash, which are subject to insignificant risk of changes in terms of value and that are free of any impediment or restriction in regard to trading;
      3. Guarantees that are readily convertible into a known amount of cash, which are subject to insignificant risk of changes in terms of value, and that are free of any impediment or restriction in regard to trading;
      4. Funds to be obtained through liquidity credit lines that cannot be canceled unilaterally, previously contracted with financial institutions that are not subject to a special regime; or
      5. Share of the mutual fund referred to in item XII, “b”, which can be immediately used or readily converted into a known amount of cash, which is subject to insignificant risk of changes in terms of value and that is free from any impediment or restriction in regard to trading.
   6. Stress test: an exercise with a defined purpose of prospectively assessing the potential impacts of adverse events and circumstances on the payment network, in order to identify potential gaps in the ongoing and integrated risk management framework.
   7. Backtesting: a comparison between amounts recorded and those expected by the credit and liquidity risk calculation models, in order to verify accuracy.
   8. Chargeback: reversal or cancellation of a payment transaction at the request of the paying user due to fraud, scam, processing failure or commercial disagreement with the receiving user, in compliance with the rules provided for in the payment network regulation.
   9. Authorized payment transaction: a payment transaction that has successfully undergone the payment transaction authorization process – whose obligation to settle the full amount of the transaction has been recognized – in compliance with the rules provided for in the payment network regulation, including any outstanding installments.

2. Providers’ obligations

• • Monitoring, preventing, and combating fraud and scams at each participating institution.
  • Establishing mechanisms for contesting and disputing payment transactions of all kinds.
  • Internal risk assessment of the payment network, aimed at identifying and measuring the risks of using its products and services in money laundering and terrorist financing practices, as well as the dissemination of weapons of mass destruction, considering, at least, the risk profiles of the participants, the provider, operations and transactions, products and services – covering all distribution channels, including the use of new technologies and the activities carried out by employees, partners, and outsourced service providers.
  • Effectiveness assessment of the network policies, procedures, and controls relating to the operational aspects and drafting an annual report on such assessment.

3. Additional items to be included in the regulation governing payment networks

• • Identification of the risks incurred by the participants and the provider as a result of the regulations and procedures governing the provision of the payment services covered by the arrangement, in particular, the details of the risk management structure and mechanisms, their order of implementation, and the associated responsibilities.
  • The regulations and mechanisms for interoperability between the network participants.
  • The regulations and mechanisms for interoperability with other networks, including the provision for transferring resources between them.
  • The assignment of responsibilities between the network provider and its participants in relation to the management of the service provided to the paying user.

4. Tariff categories

• • Mandatory tariffs: tariffs or other forms of recurring remuneration levied on the regular course of transactions.
  • Potential tariffs: tariffs or other non-recurring forms of remuneration relating to specific facts provided for in the arrangement regulation.

5. Shelving authorization applications without a determination on the merits

The BC can shelve authorization applications without a determination on the merits in the event that:

1. 1. The payment network is not in compliance with the parameters so as to be considered an integrating part of the SPB;
   2. The application form does not comply with the required format under the current regulation; and
   3. The arrangement provider fails to respond, within the deadline established by the BC, to the requests to supplement or clarify any information, or to be summoned to specific meetings regarding the authorization application.

6. Authorization dismissal to payment arrangement institutions

The BC can dismiss applications in the event of:

1. 1. Misrepresentation or omission in the declarations and documents submitted in the fact-finding stage of the proceedings or if any discrepancy is verified between them and the facts or data ascertained in the analysis; or
   2. Failure to comply with any requirement or condition established in the resolution, or failure by interested parties to prove that these requirements or conditions have been met.

7. Orderly withdrawal plan

In the event of termination of the network operations, the payment network provider must submit an orderly withdrawal plan, to be approved by the BC, providing for, at least, the following aspects:

1. 1. the deadline for terminating operations; and
   2. the mechanisms to be adopted to mitigate any risks to the regular functioning of retail payment transactions, if applicable.

8. Ongoing and integrated risk management framework

This structure must provide for:

1. 1. Risk management policies and strategies, including the provision of exposure limits and the order of implementation of risk management mechanisms – clearly documented, formalized, and duly approved by the governing bodies of the arrangement provider;
   2. Adequate systems, processes, controls, routines, and procedures to ensure prior identification of the risks involved in each payment network;
   3. Effective processes for tracking and reporting exceptions – arising from risk management policies – to the fund’s governing bodies in a timely manner;
   4. Systems dedicated to the implementation of risk management routines and procedures throughout the entire payment flow under the network;
   5. Regular suitability assessment of the systems, processes, controls, routines and procedures relating to the risk management structure;
   6. A routine for sharing information with network participants on the risks incurred and the results of the risk mitigation measures implemented; and
   7. Notification to the BC about events considered critical regarding any of the risks managed by the arrangement provider.

The public consultation, published on September 02, 2024, will remain open to the public for the period of 60 days and is available for contributions on the following website: https://www3.bcb.gov.br/audpub/HomePage?1.

Demarest’s Banking and Finance team is available to provide any further clarifications that may be necessary.