Part 2 of 6 in the series Generative AI in a Regulated Financial Institution.
A disclaimer before we begin:#
I am not a lawyer, and you do not need to be one to follow this part of the series, but you do need to be careful. The conclusions below are my interpretation as a technology professional, not a legal opinion. Where the regulatory text permits more than one path, I say so explicitly. I believe this may be the most tedious part for some readers and the most critical part of the entire series. And you may be wondering why an article written by someone in technology spends so much time on CMN resolutions, the LGPD, and CVM instructions. In the corporate world, interpreting regulations and producing regulatory opinions is not the engineer's job; it belongs to Compliance, Legal, and Information Security teams. But working as a developer or leader in a regulated area requires a critical, attentive view of these rules and genuine proximity to those teams. The person implementing the architecture is the first to notice when a technical decision collides with a legal obligation, and that awareness only exists if the engineer knows, at a minimum, where to look. This article provides that minimum. It does not replace a formal legal opinion. It replaces the comfortable ignorance of not knowing that the question exists.
Before choosing a model, vendor, or pilot team, a regulated financial institution needs to answer a question that comes before the technical one: what does the Brazilian regulator actually require for generative AI to operate legally, auditably, and defensibly?
If the previous article established demonstrability as the dominant criterion and Product ≠ Vendor as an operating principle, this one fulfills the promise of showing which concrete regulations materialize those principles and in what order they must be addressed.
The answer is not found in a single regulation. It comes from the intersection of four bodies of rules: BACEN (CMN 4,893/2021 + CMN 5,274/2025), Complementary Law 105/2001, the LGPD, and the CVM (Law 6,385/1976 + CVM Instruction 607/2019), together with ANBIMA's GAIG as a sector-specific due-diligence reference. Some obligations are explicit; others are implicit by analogy. The article walks through each regulation in the operational sequence in which it appears.
CMN 4,893/2021 + CMN 5,274/2025: the pair governing cloud AI procurementCMN Resolution 4,893/2021 is the central rule for any procurement of cloud data-processing and storage services by an institution authorized by the BCB. CMN Resolution 5,274/2025, published on December 18, 2025, updated the text and made the required technical controls verifiable. BCB Resolution 538/2025, dated the same day, mirrors the regime for payment institutions, brokers, and distributors. Together, they form the most direct regulatory framework for generative AI in the cloud.
Article 16, item I: two paths, one operational questionItem I of Article 16 establishes two regulatory paths depending on the country where the service is provided:
A country with a supervisory agreement between the BCB and the foreign regulator: subsequent notification to the BCB within 10 days of contracting, including the provider's name, details of the services, and the countries or regions where data will be processed.
A country without an agreement: prior BCB authorization with at least 60 days' notice. Contract amendments changing processing information follow the same timeframe.
The right operational question is not "do I need to notify?" but "is there a supervisory agreement between the BCB and the regulator of the country where data is processed during inference?"
Enlarge ↗MoUs: what they are and what they do not guaranteeThe BCB maintains a section on Memoranda of Understanding for supervisory purposes on its institutional portal. Two sets are relevant to the United States. The first is the Cooperation Agreement of June 3, 2003, between the BCB, Federal Reserve System, and OCC (Office of the Comptroller of the Currency), extended in 2006–2007 to include the FDIC (Federal Deposit Insurance Corporation) and OTS (Office of Thrift Supervision) as signatories. It addresses consolidated supervision of cross-border banking organizations, exchange of information for authorization and ongoing supervision, and on-site inspections. The second is the MoU between the BCB and the New York State Department of Financial Services, signed in January/February 2023, with an express cooperation clause concerning third-party technology service providers, including data-storage and cloud-computing services (item 15, subitem f). The existence of these MoUs changes part of the classification, but a prudent reading of Article 16, item I, still requires care. There are two reasons. First, item 33 of the DFS MoU expressly states that it is not an international agreement under Brazilian law and does not establish legally binding obligations, creates no enforceable third-party rights, and does not override domestic regulations. Second, the FED/OCC/FDIC MoUs address supervisory cooperation between authorities where cross-border banking establishments exist, not approval of contractual cloud outsourcing to a provider that is not itself supervised by those authorities. Whether an MoU of this nature satisfies Article 16, item I, for cloud AI procurement remains unsettled. Practical outcome: a financial institution's legal team may reasonably interpret the FED–OCC–FDIC and DFS MoUs as valid agreements for Article 16, item I, and adopt subsequent notification within 10 days for inference hosted in a jurisdiction covered by those MoUs. It may also, with equal justification, maintain prior authorization with 60 days' notice as the default position, considering the DFS MoU's express non-binding caveat and the supervisory scope of the FED/OCC/FDIC MoUs. The decision must be documented as the institution's legal interpretation, with a date, legal opinion, and periodic review—not as an assumption by the technical team.
What CMN 5,274 addsCMN Resolution 5,274/2025 makes 14 minimum procedures and controls verifiable and mandatory components of the cybersecurity policy. The most relevant for AI infrastructure are:
MFA for external access to the corporate network and privileged access. This also applies to the workflow of developers operating through corporate coding agents such as Claude Code, Codex, and others.
End-to-end traceability of relevant transactions, operations, and access, with secure log retention—integrity, confidentiality, and availability throughout the retention period.
An annual penetration test by an independent third party, with reports and action plans retained for five years.
Threat intelligence—monitoring the internet, deep web, and dark web—becomes a minimum control, not a differentiator.
Control of systems acquired from third parties, also applicable when they run on the institution's own resources. This is the point that directly affects a self-hosted AI gateway: running it internally does not exempt it from third-party governance requirements.
Translation to AI: a gateway processing corporate prompts is subject to these controls. Logs, audit trails, network segmentation, MFA, and penetration testing of AI infrastructure become verifiable requirements, not best practices. Designing this gateway is the subject of Part 4 of the series; here, it is enough to recognize that the obligation exists and has a deadline.
Complementary Law 105/2001: banking secrecy as an architectural principleArticle 1 of Complementary Law 105/2001 establishes that financial institutions must maintain secrecy over their lending and deposit operations and services provided. It is a duty of safekeeping, not merely non-disclosure; that distinction changes the control design. Exceptions are exhaustive: court order, criminal investigation, BCB supervision, and tax inspection. Client consent is not enough; the obligation remains with the institution. A violation falls under Article 10, with civil, administrative, and criminal liability. The operational implication is direct. Any client data—CPF, account number, balance, PIX key, or credit score—in a prompt sent to an external model is leaving the controlled perimeter. No "consent to send it to the LLM" reduces that duty. The data-classification policy for prompts operationalizes safekeeping in AI: restricted or confidential data does not enter prompts for external models without prior pseudonymization and explicit Compliance authorization.
Banking secrecy is a duty of safekeeping, not merely non-disclosure. A data-classification policy for prompts is not optional.
LGPD: three articles that define the architectureLaw 13,709/2018 contains three articles that, in practice, dictate architectural decisions for generative AI in a financial institution.
Article 20 — review of automated decisions (with the nuance that matters): Article 20 guarantees data subjects the right to request review of decisions made solely on the basis of automated processing that affect their interests, such as personal, professional, consumer, or credit profiles. An important distinction is often stated incorrectly here. The original text approved by Congress in 2018 required review by a natural person. Paragraph 3, which contained that requirement, was vetoed by the President in 2019, and the veto was upheld. Law 13,853/2019 preserved the right to review, but without expressly requiring that it be performed by a human. What keeps human review as the prudent path is the prevailing market interpretation and a defensive posture toward ANPD oversight, not the current wording. In generative AI, keeping humans in the review chain for decisions that affect clients—credit, scoring, risk classification, product suggestions—is a governance decision justified by risk management and a prudent reading of the provision. The difference between "required by law" and "a prudent interpretation by the DPO (Data Protection Officer)" may seem subtle in a presentation, but it is the kind of thing an auditor can identify in three questions.
Article 33 — international transfers and ANPD Resolution 19/2024: Article 33 prohibits transferring personal data to countries without an adequate level of protection, except under the article's own exceptions. These include standard contractual clauses (SCCs) approved by the ANPD. The current SCCs come from CD/ANPD Resolution No. 19/2024, published on August 23, 2024. The regulation granted a 12-month period to incorporate SCCs into existing contracts. That period ended on August 23, 2025. Since then, a "vendor-standard" DPA without the full text of the ANPD SCCs does not satisfy the contractual basis for international transfer.
Article 46 — security measures and the RIPD before the first prompt: Article 46 requires technical and administrative measures proportionate to risk. For generative AI, this materializes on three fronts: a gateway detecting PII before the prompt leaves, an audit trail for use involving personal data, and a specific incident-response policy. A Data Protection Impact Report (RIPD) is mandatory for any use case processing personal data. It must be validated by the DPO before operation, not as a retrospective artifact.
Articles 20, 33, and 46 together are not a generic requirement for "good protection". They are three explicit architectural decisions: review built into the design, the full ANPD SCCs in the contract, and an RIPD signed before the first prompt containing real data.
CVM: a silence that speaks loudlyAs of this date, the CVM has not issued a regulation specific to generative AI. That does not create an exemption; the existing regime applies directly. Article 27-D of Law 6,385/1976, as amended by Law 13,506/2017, criminalizes using material information not yet disclosed to the market to obtain an undue advantage in securities trading. The penalty is imprisonment for 1 to 5 years and a fine of up to three times the unlawful advantage. It is increased by one-third when there is a duty of confidentiality over the information, with the same penalty for those who pass it on. CVM Instruction 607/2019 governs sanction proceedings, including settlement agreements and investigation of misuse. The application to generative AI is direct. A model with access to nonpublic information—through RAG over internal research, prompt context about an M&A pipeline, or MCP over a portfolio table—can generate output that, read by an analyst before publication, constitutes the offense under Article 27-D. It does not matter that the suggestion was generated by a model: the trading decision is human, and so is the responsibility. In an earlier article on regulatory guardrails in investment assistants, I described how the control must intervene before the response reaches the client, precisely because recording it afterward does not prevent the violation. Here, the point is the regulatory counterpart of that architecture: the existing CVM regime already criminalizes the behavior, with or without an AI-specific rule. Use cases involving portfolios, M&A, or issuer analysis require restricted scope, prior Compliance approval, and segregation of data entering the model's context.
ANBIMA — from self-regulation to GAIG: on March 10, 2026, ANBIMA, in partnership with Zetta, launched GAIG—the Generative AI Assessment Guide. Its nature: advisory, not binding. It is a vendor due-diligence tool, not a mandatory internal-governance framework. Its structure covers four stages: assessing the inherent risk of procurement, a third-party assessment questionnaire, calculating residual risk, and defining internal-governance requirements. The assessment pillars cover regulatory compliance (DPA, SCCs, BCB clauses), cybersecurity (SOC 2, ISO 27001, penetration testing), the AI lifecycle (data cutoff, versioning), data protection (ZDR, inference location, log retention), and the value chain (subprocessors). There is no formal sanction for not adopting GAIG. But an institution that does not demonstrate an equivalent process has no defense in a third-party audit; the absence of an equivalent process is interpreted as a due-diligence failure. The guide also functions as an assessment framework and, in that role, connects directly to NIST AI RMF, ISO/IEC 42001, and OWASP. How these frameworks become concrete controls and verifiable artifacts is the subject of Part 3.
Direct procurement, through a hyperscaler, or through SaaS: the structural decisionOnce the requirements of each regulation are understood, the next operational question is: which procurement arrangement minimizes the regulatory surface without compromising technical capability?
Direct procurement (Anthropic, OpenAI, others): greater ability to negotiate contractual clauses related to the BCB, LGPD, and ANPD standard contractual clauses. Inference typically takes place in the US. Without a specific applicable MoU, the practical rule is prior BCB authorization with 60 days' notice. Attaching the SCCs from Resolution 19/2024 to the contract became non-negotiable after August 2025.
Through a hyperscaler/cloud provider with a Brazilian region: when inference occurs within national territory, the data does not cross a border during inference; the Article 16 classification is simplified, and the LGPD transfer basis may no longer be necessary for that segment. Three operational checks are needed before assuming this simplified classification: (i) the desired model is available in-region (in AWS Bedrock sa-east-1, availability varies by model; check regional availability before contracting); (ii) the inference profile is configured as in-region, not cross-region; (iii) subprocessors have been mapped.
SaaS with an embedded LLM: the responsibility under CMN 4,893 does not diminish with intermediaries. The entire chain must be mapped: subprocessors, the underlying model, the SaaS vendor's DPA together with the model vendor's DPA. The apparent simplicity of procurement disappears when due diligence begins.
Comparison of procurement arrangements (regulatory regime):
Enlarge ↗The principle Product ≠ Vendor, established in Part 1, runs through the comparison. The procurement arrangement is independent of the vendor. The same provider may be contracted directly—with regime A—or through a hyperscaler—with contractual regime B—and the regulatory assessment changes even though it is the "same model." For CMN Resolution 4,893, what matters is the processing location, not the vendor's legal headquarters. For the LGPD, what matters is whether personal data leaves national territory. An architecture that addresses both questions at once is a self-hosted gateway in a Brazilian VPC: it inspects the prompt before it leaves, masks PII, records an auditable log locally, and turns "a prompt containing PII leaving Brazil" into "a sanitized prompt leaving Brazil". Designing this component is the subject of Part 4 of the series.
The sequence before the first promptDemonstrability—the criterion established in Part 1—stops being a concept and becomes a sequence. Before the first prompt containing real data, the institution must have produced eight defensible artifacts, in order:
Enlarge ↗What sustains the program during an auditThe four bodies of regulation together with GAIG do not form a checklist but a framework for defense. The difference between an institution that sustains its program during an inspection and one that stumbles does not lie in the sophistication of the chosen model; it lies in the stack of artifacts that exists before the first prompt. Approved policy, documented classification, signed RIPD, DPA with the complete SCCs, BCB notification or authorization, a gateway in production, and completed training. Seven artifacts before prompt number one.
If regulations say what needs to be done, frameworks say how to measure whether it was done well. NIST AI RMF 1.0, ISO/IEC 42001:2023, OWASP LLM Top 10 2025, OWASP Agentic Top 10 2026, and GAIG in its assessment-framework role, translated into concrete controls and verifiable artifacts, are the subject of the next part of the series.
Next: Part 3 — Frameworks in practice.
#IAGenerativa #Compliance #BACEN #InstituiçãoFinanceira #LGPD #GovernançaDeIA #RegTech