The Central Bank of Brazil and the National Monetary Council have outlined rules approved on Oct. 22, 2026, strengthening safeguards for Open Finance partnerships involving customer data. The changes tighten partner oversight and consent requirements while providing for future workflows that separate consent requests from approvals, particularly to accommodate corporate authorization processes.
The rules define an integrating institution as an Open Finance participant that receives customer data with consent and transmits it to a partner entity. Before entering a partnership, the institution must assess the partner’s capacity to comply with regulations, protect data and maintain adequate controls. That capacity must be certified by an independent auditor registered with the Securities and Exchange Commission of Brazil. Customer consent must be explicit, obtained within the integrating institution’s environment and granted separately for each partner. Contracts must provide for prompt interruption of sharing in the event of security incidents or constraints on regulatory compliance. Delegating the partnership and sharing the data with third parties are prohibited.
Future decoupled approval flows would allow customers to request consent within the receiving institution’s environment and approve it later within the transmitting institution’s environment, without automatic redirection. The stages could occur at different times and, where applicable, involve different users, accommodating companies whose service requests and approvals require different representatives. The framework provides for technical standards to be developed through Open Finance governance, with requirements for security, integrity and transparency.