Financial Market: main news from 18 to 22/05
1. BCB Records Significant Increase in Cybersecurity Incidents
On Monday (18), during the “Banks & Banking 2026 Forum” organized by the National Association of Credit, Financing and Investment Institutions (Acrefi) in partnership with Cantarino Brasileiro, Aristides Cavalcante Neto, Head of the Strategic Management and Specialized Supervision Department at the Central Bank of Brazil (BCB), stated that 25 out of the 33 security incidents recorded by the BCB in the first five months of this year were related to fraud. This represents a more than fourfold increase from 2024 to 2025. Technological advancements, particularly involving Artificial Intelligence, have increasingly been exploited by criminals to conduct more sophisticated attacks. In this context, a survey presented by Leandro Vilain, CEO of the Brazilian Banking Association (ABBC), revealed significant weaknesses in financial institutions’ technology risk management: approximately 20% of the institutions surveyed do not have technology risk management structures, while 27% stated that such management exists but operates separately from the broader corporate risk framework. In addition, 44% of institutions still rely on technologies undergoing obsolescence, and 13% maintain such systems in critical operations. Another key concern highlighted was the growing exposure of APIs (Application Programming Interfaces), identified as the primary attack vector against the financial system. Although widely used by institutions, the Central Bank identified low levels of control and governance over these interfaces.
Central Bank registers 25 fraud cases in less than five months
2. BCB Standardizes Rules Applicable to Virtual Asset Transactions within the Foreign Exchange Market
On Tuesday (19), the Central Bank of Brazil published BCB Normative Instruction No. 736, which amends BCB Normative Instruction No. 693, responsible for establishing the procedures for reporting to the Central Bank information related to the provision of virtual asset services in the foreign exchange market, pursuant to BCB Resolution No. 521. The new regulation aims to standardize the reporting requirements applicable to international payments or transfers involving virtual assets, as well as to the loading and unloading of virtual assets through cards or other internationally used electronic payment instruments.
3. BCB Studies Changes to FGC Rules Following Banco Master Case
The Central Bank of Brazil is studying a new round of changes to the rules governing the Credit Guarantee Fund (FGC) in response to the Banco Master case. After tightening requirements applicable to banks issuing debt securities, the regulator is now considering measures targeting investors and investment platforms, with discussions expected to take place in the second half of 2026. Banco Master, currently under extrajudicial liquidation, expanded its funding activities through the issuance of bank deposit certificates (CDBs) offering yields significantly above market averages, using the FGC protection of up to BRL 250,000 per taxpayer ID as a key selling point. These securities were widely distributed through investment platforms, and the estimated impact on the FGC resulting from the group’s collapse is approximately BRL 50 billion. Representatives from the financial sector, including Febraban, ABBC, and associations representing fintechs and payment institutions, have initiated discussions on possible regulatory adjustments, which may include broader risk-sharing mechanisms among issuers, distributors, and investors.
4. BCB Publishes Rule on Data Sharing Measures Related to Fraud Indicators
On Tuesday (19), the Central Bank published BCB Resolution No. 569, amending BCB Resolution No. 343, which regulates measures necessary for the sharing of data and information concerning fraud indicators under Joint Resolution No. 6. The new rule broadens the scope of information that must be reported, now including indications of activities conducted by individuals or legal entities acting as unauthorized betting operators, as provided under Law No. 14,790/2023, which regulates fixed-odds betting. In addition, the scope of information sharing now also encompasses data related to credit operations, virtual asset services, and the provision of financial and payment services to unauthorized betting operators. The resolution establishes different implementation deadlines for the new requirements. For activities involving virtual asset services, institutions must comply by October 30, 2026. Reporting obligations related to financial and payment services provided to unauthorized fixed-odds betting operators must be implemented by December 1, 2026.
5. CVM Issues Guidance on Registration of Small Companies Under the FÁCIL Regime
On Monday (18), the Brazilian Securities and Exchange Commission (CVM) published Circular Letter CVM/SEP 2/2026, providing guidance to organized market administrators regarding the procedures for obtaining initial registration as securities issuers by small companies (CMP), pursuant to CVM Resolution No. 232 and the FÁCIL Regime. The document establishes guidelines for the review of listing requests, which, at this initial stage, must occur outside the Empresas.Net System, in accordance with the technical cooperation agreements executed with B3 and BEE4. Market administrators must also notify the CVM upon approval of the registration and verify the payment of the supervisory fee required under Law No. 7,940/89.
