BACEN Cybersecurity Readiness: CMN 4.893, BCB 85, and the 2025 Controls
BACEN cybersecurity readiness for banks, payment institutions, brokerages, and the technology providers that serve them. We assess your policy, governance, and the 14 controls the Central Bank of Brazil added in December 2025. You get evidence a supervisor can review and a risk-ranked roadmap. Most assessments take 6–12 weeks.
What BACEN Cybersecurity Rules Require
BACEN cybersecurity rules are the Central Bank of Brazil's requirements for how regulated institutions protect their systems and data. Banks and other financial institutions follow CMN Resolution 4.893/2021. Payment institutions follow BCB Resolution 85/2021. Both demand a board-approved cybersecurity policy, an incident response plan, an annual report, and control over cloud and data service providers.
The rules got much more specific in December 2025, after a series of attacks on providers connected to Brazil's payment infrastructure. The Central Bank no longer asks only for a sound policy. It now lists the technical controls it expects to see working.
Accredify Global assesses each requirement against your real environment. We check configurations, logs, test reports, and contracts, not just documents, and report what a supervisor would find.
BACEN Cybersecurity in 2026: 14 New Controls, Now Enforceable
CMN Resolution 5.274/2025 and BCB Resolution 538/2025 were published on 18 December 2025. They amended the two core rules and added 14 mandatory procedures and controls. Institutions had until 1 March 2026 to comply.
Smaller institutions now carry bank-level duties. Payment institutions, brokerages, and distributors must meet the same controls as banks. No filing was due on the deadline. Instead, supervisors test compliance by asking for evidence, such as the date of the last intrusion test and the status of its findings.
Payment infrastructure gets special protection. Environments connected to Pix and the Reserve Transfer System (STR) must be isolated from other systems. Administrative access to them needs multi-factor authentication.
Sources: BCB and CMN cyber requirements (Baker McKenzie) · CMN 5.274/2025 controls (Grant Thornton) · March 2026 deadline (Assbanc)
BACEN Cybersecurity Controls, and the Evidence We Test
The 2025 amendments list fourteen controls. We group them into six areas and test each against live evidence.
| Area | Controls in the rule | Evidence we review |
|---|---|---|
| Identity and access | Authentication and access controls | MFA coverage, privileged accounts, and access reviews |
| Data protection | Encryption and leakage prevention | Key management, transaction integrity, and DLP alerts |
| Detection and response | Intrusion prevention and detection, malware protection, and traceability | Alert handling, log retention, and incident tickets |
| Resilience | Backup management and network protection | Restore tests, segmentation, and Pix and STR isolation |
| Secure build | Vulnerability management, hardening, and API security | Scan results, configuration baselines, and API reviews |
| Trust and intelligence | Digital certificate management and cyber intelligence | Certificate inventory and dark web monitoring reports |
The annual intrusion test deserves its own check. The rules require a specialized independent company, a documented report, and evidence that findings were fixed. We review the scope and the tester's independence, then follow each critical finding to closure. A test that skipped the Pix environment, or findings left open for months, is what supervisors notice first.
Who Needs a BACEN Cybersecurity Assessment?
Regulated institutions are covered directly. Their providers feel the rules through contracts and due diligence.
Institutions under CMN 4.893 that must show the new controls working.
Issuers, acquirers, and wallets under BCB 85, now held to bank-level controls.
Securities firms newly brought up to the same standard as banks.
Institutions whose Pix and STR environments must be isolated and protected.
Foreign and local providers answering Brazilian clients' due diligence.
Firms preparing evidence before they apply to the Central Bank.
How Our BACEN Readiness Assessment Works
Six steps, ending with a report your board can approve and a supervisor can read.
Expecting a supervisory request, or a client's due diligence questionnaire? Share the date in your scoping review.
Book a free scoping reviewBACEN Rules vs ISO 27001, LGPD, PCI DSS, and DORA
Most Brazilian institutions answer to several frameworks at once. This is how they fit together.
| Framework | What it covers | Overlap with the BACEN rules |
|---|---|---|
| ISO 27001 | Certified information security management | Policy, risk, and most controls; not Pix isolation or BCB reporting |
| ISO 22301 | Certified business continuity | Backups, recovery, and incident continuity |
| LGPD | Personal data protection, enforced by the ANPD | Security safeguards and incident notice |
| PCI DSS | Card data security | Encryption, access, testing, and logging |
| DORA | EU financial sector resilience | Similar duties for groups also active in the EU |
An accredited ISO 27001 certificate is often the strongest base. It gives independent evidence of a working security system, and Accredify Global holds UAF accreditation for it. The BACEN assessment then covers what ISO 27001 does not: payment infrastructure isolation, the annual report, and the rule's specific provider duties.
What You Receive From the Assessment
Each of the 14 controls rated, with the evidence behind it.
Policy, response plan, and annual report checked against the rules.
Isolation and access findings for Pix and STR.
Contract terms and evidence gaps for key vendors.
Actions in priority order, with owners and dates.
A short report your directors can approve.
Many institutions also need evidence for clients and partners abroad. A SOC 2 report helps providers selling to US customers. ISO 27701 certifies privacy management alongside LGPD, and ISO 42001 covers AI used in credit and fraud decisions. All three can reuse the evidence gathered here. Our certification process guide explains how an assessment leads into an audit.
BACEN Readiness Cost and Timeline
No list price applies. The effort depends on your institution and how much evidence already exists, and a free scoping review gives you a tailored proposal.
What changes the effort
- Institution type — bank, payment institution, or provider
- Payment connections — Pix, STR, and other infrastructure
- Service providers — cloud, core banking, and data vendors
- Group structure — several licensed entities
- Existing evidence — ISO 27001 or PCI DSS already in place
Typical timeline
| Assessment and report | 6–12 weeks |
|---|---|
| Remediation | Set by your roadmap |
| Re-check | Before each annual report |
Questions to Ask a BACEN Cybersecurity Provider
What compliance and security leaders usually ask us first.
| Question | Accredify Global's answer |
|---|---|
| Can you certify us for BACEN? | No one can. The Central Bank supervises directly. |
| Do you test or only read policies? | We test against logs, configurations, and reports. |
| Do you run the intrusion test? | We review it; where needed, we coordinate a tester. |
| Can you cover our providers? | Yes, through contract and evidence reviews. |
| Do you give legal advice? | No. Interpretation stays with your counsel. |
| How is it priced? | A tailored proposal after a free scoping review. |
Frequently Asked Questions About BACEN Cybersecurity
Answers on the 2025 changes, intrusion tests, Pix, providers, cost, and timeline.
What is BACEN cybersecurity compliance?
It means meeting the Central Bank of Brazil's cybersecurity rules for regulated institutions. The core rules are CMN Resolution 4.893/2021 for banks and other financial institutions and BCB Resolution 85/2021 for payment institutions, both amended in December 2025.
What changed in December 2025?
CMN Resolution 5.274/2025 and BCB Resolution 538/2025, published on 18 December 2025, added 14 mandatory controls. They include multi-factor authentication, isolation of Pix and STR environments, annual intrusion tests by an independent company, and dark web monitoring.
When did the new controls have to be in place?
By 1 March 2026. There was no formal filing on that date, so supervisors check compliance when they ask for evidence, such as test reports and remediation records.
Who must comply?
Institutions authorized by the Central Bank of Brazil, including banks, payment institutions, brokerages and distributors. The 2025 changes gave payment institutions, brokerages and distributors the same controls as banks.
Does BACEN cybersecurity apply to foreign technology providers?
Not directly, but regulated institutions must control the risk from their service providers. Cloud, software and data providers serving Brazilian financial institutions are asked for evidence and contract terms.
Is there a BACEN cybersecurity certification?
No. The Central Bank supervises compliance directly; there is no certificate. Accredify Global provides an independent readiness assessment and report.
What is the annual intrusion test requirement?
The amended rules require an intrusion test at least once a year by a specialized independent company. The report must be documented and available to the Central Bank, with findings tracked to closure.
What does Pix and STR isolation mean?
The environments that connect to Pix and the Reserve Transfer System must be physically and logically isolated from other systems. Administrative access to them must use multiple authentication factors.
Does ISO 27001 satisfy the BACEN rules?
Not on its own, but it covers much of the ground. ISO 27001 gives you risk assessment, policies and controls. The BACEN rules add specific technical controls, reporting duties and provider requirements that must be checked separately.
How does BACEN cybersecurity relate to LGPD?
They overlap on security and incidents. LGPD protects personal data and is enforced by the ANPD, while the BACEN rules protect the financial system and are supervised by the Central Bank. A single control set can serve both.
What does the board need to approve?
The cybersecurity policy, the incident response plan and the annual report on how the plan was carried out. The amended rules expect the revised policy to be approved by senior management.
Do you perform the annual intrusion test?
Our readiness assessment reviews the test scope, the tester's independence and the remediation of findings. Where you need a tester, we coordinate one within the same plan.
How long does a BACEN readiness assessment take?
Most assessments take 6 to 12 weeks, depending on the number of systems, providers and entities in scope.
How much does a BACEN cybersecurity assessment cost?
There is no list price. The cost follows your institution type, systems, service providers and existing evidence. A free scoping review gives you a tailored proposal.
Do you give legal or regulatory advice?
No. We assess and report on controls and evidence. Interpretation of the rules stays with your compliance team and counsel.
Show the Central Bank Your Controls Work, Before It Asks
Tell us about your institution, systems, and providers. We'll map the BACEN cybersecurity requirements that apply and send a tailored proposal.
Book your free scoping review →Last reviewed by the Accredify Global compliance team.