BRAZIL · BANKING
Key Facts
- —What is happening Brazil’s Monetary Council and Central Bank approved Joint Resolution 21 on Thursday, 22 October, requiring a client’s specific consent for each partner company that receives Open Finance data.
- —Why it matters The rules tighten how banks and fintechs pass shared account data to outside firms, which affects lenders, accountants and retailers that build credit and payment services on that data.
- —The numbers The resolution has five main changes: consent per partner, closer monitoring, more transparency, suspension on security risk and limits on misuse. Open Finance linked 65 million accounts by August 2025.
- —Who is who The Monetary Council (CMN) sets national financial rules, and the Central Bank (BCB) regulates Open Finance. Participants are banks, fintechs and cooperatives that share client data with the client’s consent.
- —What to watch Whether the final text bans passing account-movement data to unregulated firms, and when the new duties start. Neither point has been clarified publicly.
- —Power Index Brazil ranks 1st of 14 in The Rio Times Latin America Power Index, with 75.0 points (October 2026 edition).
- —What it means for you For US readers, the change touches Brazilian financial firms and could reach foreign companies that use Brazilian bank data through a local partner. Clients, including expats, should expect a separate consent for each partner.
Brazilian regulators now require financial firms to get a client’s consent for each partner company that receives shared bank data. The rules were approved on 22 October.
Brazil’s National Monetary Council (CMN) and Central Bank (BCB) approved new Open Finance rules on Thursday, 22 October. Clients must now give specific consent for each partner company that receives their data.
Open Finance lets clients share data between institutions, and the Central Bank said in August 2025 it linked 65 million accounts. The rules matter to US readers because they govern how that data moves in Latin America’s biggest economy, Brazil.
What the Resolution Changes
Poder360 and Atlas Público, citing the Central Bank, date Joint Resolution 21 to 22 October 2026. It refines the definition of a partnership contract, the deal by which a participant passes client data to an unlicensed firm.
Each client must authorise sharing with every partner company separately. Participants must also monitor those partners more closely and give clients more information about where their data goes.
The rules provide for stopping data sharing when security is at risk. They also add limits meant to prevent misuse of the data, which the announcement does not spell out, Finsiders Brasil noted.
Directors and boards of participating institutions carry more responsibility for monitoring, compliance and corrective action. Agência Brasil said the changes also aim to reduce disputes over how the rules are read.
What Changes for Companies
The text also prepares a future option for consent to be given at different moments by the receiving and the sending institution. For a company, different users could then give approval, so one employee starts a request and another finishes it.
Poder360 said the aim is to fit Open Finance to how firms approve decisions internally. The reports seen give no start date for that option.
Agência Brasil gave an example: a company can let a second institution check its account data to assess a credit offer. Sharing still depends on authorisation and must follow security and privacy rules.
Why the Rules Took Months
Finsiders Brasil reported that the Central Bank presented a partnership review to the Open Finance governing council in March. It worried about outside firms such as retailers assessing credit and accountants reading client accounts.
The bank listed five concerns, including data passed to third parties, weak technical standards and little transparency for clients. It also cited a lack of reciprocity, meaning outside firms received data without sharing their own clients’ data.
Executives pushed back in May, Finsiders Brasil reported. Bruno Chan, chief executive of intermediary Klavi, warned that a ban could revive bank logins and passwords being requested from clients.
Executives and lawyers also warned of a possible clash with ANPD, the national data-protection authority. They argued that the data-protection law lets clients direct data they have authorised.
Payment initiators, which make payments for clients through Open Finance, hold 25% to 30% of active consents, executives told Finsiders Brasil. It earlier reported their minimum capital rising from BRL 1 million (about US$200,000) to BRL 17 million (about US$3.4 million).
Conversions use the exchange rate of 23 October 2026, about BRL 5.04 per US$1. The figures on initiators are Finsiders Brasil’s and were not checked against a regulator text.
What It Means for US Readers
The rules bind institutions operating in Brazil and do not change US law. Investors with Brazilian bank or fintech holdings should watch whether business models built on partner data need new contracts.
Foreign companies that use Brazilian account data through a local partner may need fresh consent from clients. No report seen says which firms are affected, and none quotes a company on the final text.
Expats and visitors who use Brazilian banking apps should expect clearer screens naming each company that receives their data. Related coverage is in the Rio Times Brazil fintech guide and on Pix rules for large banks.
What Is Not Known
It is not known whether the final text bans passing account-movement data to unregulated firms. Finsiders Brasil called this the most contested point of the March proposal and said the announcement does not settle it.
The full resolution text was not reviewed for this report. Details come from the announcement as reproduced by Atlas Público, Poder360, Agência Brasil and Finsiders Brasil.
Start dates, transition periods and penalties are not stated in the reports seen. Nor is it clear what the additional limits on misuse require, or how many firms must change contracts.
What Comes Next
Banks, fintechs and lawyers are expected to study the full text in the coming days, Finsiders Brasil said. Its report gives no compliance deadline.
Consent at different moments is described as a future implementation, with no date. The resolution deals with partner contracts only and does not settle other Open Finance disputes.
Frequently Asked Questions
What is Open Finance in Brazil?
It is a system that lets clients authorise banks and fintechs to share their financial data with other institutions. Its aim is to widen access to services and increase competition.
What did Brazil decide on 22 October?
The Monetary Council and Central Bank approved Joint Resolution 21 on partner contracts. Clients must give specific consent for each partner company that receives their data.
What is a partnership contract?
It is a deal by which an Open Finance participant passes client data to a company without its own licence. The new rules tighten consent, monitoring and transparency for those deals.
Does this affect foreign companies?
It can affect any firm that receives Brazilian clients’ data through a participating bank or fintech. Which firms must change their contracts is not known.
When do the new rules start?
The reports seen give no start date. The resolution is dated 22 October 2026.
Sources: Atlas Público, reproducing the Central Bank announcement, 22 October; Poder360, 22 October; Agência Brasil, 22 October; Finsiders Brasil, 22 October; Finsiders Brasil on the Central Bank’s 65 million accounts figure, 11 August 2025; exchange rate, 23 October (all accessed 23 October 2026).
This article was drafted with automated assistance and reviewed before publication. How we use AI · Report an error · Editorial responsibility: Matthias Camenzind, Editor-in-Chief
Brazil runoff, Sunday, October 25: Brazil runoff date. Latest: Brazil runoff polls, Flávio 51%, Lula 49%.