Resolution 2554

Provides for the establishment and implementation of the internal control system.

The Brazilian Central Bank, under Art. 9 of law no. 4595 dated Dec. 31, 1964, announces that the National Monetary Council, considering the contents of Art. 4., Section VIII, of said Law; Art. 9 and 10 of Law no. 6099 dated Sept. 12, 1974; and the amendments introduced by Law no. 7132 dated Oct. 26, 1983, in the session held on Sep. 24, 1998,

Rules that:

Article 1. Financial institutions and other institutions authorized to work by the Brazilian Central Bank shall establish and implement internal controls for the activities they develop, for their financial, operational and managing information systems, and for assuring the compliance with the applicable legal rules and regulations.

Paragraph 1. The internal controls, regardless of the size of the institution, shall be effective and consistent with the nature, complexity and risk of the operations performed by the institution.

Paragraph 2. The institution’s top management is responsible for:

I – effectively establishing and implementing a structure of internal controls by defining control activities applicable to all business in the institution;

II – establishing the objectives and procedures related to the abovementioned controls;

III – systematically checking if the procedures defined in Section II are used and complied with.

Article 2. The internal controls, whose provisions must be accessible to all employees in the institution to assure that their duties in relation to the process and that the responsibilities assigned to the several levels in the organization are known, shall provide for:

I – defining the responsibilities within the institution;

II – separating the activities assigned to the institution’s personnel to avoid conflict of interests, as well as to minimize and to properly monitor the areas identified and deemed as of potential conflict;

III – establishing means to identify and evaluate internal and external factors that may adversely affect the institution to achieve its objectives;

IV – establishing communication channels assuring that employees have access, according to their position level, to reliable, timely and understandable information that are deemed important to their work and responsibilities;

V – continuously evaluating the various risks associated with the institution’s activities;

VI – systematically monitoring the activities performed so that it is possible to evaluate if the institution’s objectives are being met, if the set limits and applicable laws and rules are complied with; and to assure that any deviation is immediately corrected;

VII – periodically testing the information systems for safety, particularly the electronic ones.

Paragraph 1. The internal controls shall be periodically reviewed and updated so that new features covering new risks or issues not previously addressed to are incorporated.

Paragraph 2. The internal audit activity shall be built in the internal control system.

Paragraph 3. When the activity mentioned in Paragraph 2 is not performed by a specific unit of the institution itself or by an institution in the same financial conglomerate, it can be exercised by:

I – an independent auditor, properly registered with the "Comissão de Valores Mobiliários" – CVM – (Securities Commission), provided that such auditor is not the one responsible for the financial-statement audit;

II – auditors from the trade association or from the central agency to which the institution is affiliated;

III – auditors from the trade association of other institutions, which Central Bank authorizes to operate by means of an agreement, previously approved by the Bank, between the entity that the institution is affiliated to and the service provider entity.

Paragraph 4. In case the internal audit activity is carried out by an in-house unit, such unit shall report directly to the Board of Directors or, in case it does not exist, directly to the institution’s top management.

Paragraph 5. In case the internal audit activity is carried out as provided in Paragraph 3, the official responsible for its execution shall report directly to the Board of Directors or, in case it does not exist, directly to the institution’s top management.

Paragraph 6. The activities described in Paragraph 3., Sections II and III, shall only be exercised by credit cooperatives and by stock and securities brokers, foreign exchange brokers and securities dealers that do not take part in financial conglomerates.

Article 3. At least every semester, a report of the systematic monitoring of the activities related to the internal control system shall be issued, containing:

I – the conclusions of the examinations conducted;

II – the recommendations about possible shortcomings and a schedule for remedying them, if applicable;

III – a report issued by the responsible officer for the corresponding area about the shortcomings found in previous examinations and the measures taken to remedy them;

Sole Paragraph. The conclusions, recommendations and report referred to in Sections I, II and III in this article shall:

I – be submitted to the Board of Directors or, in case it does not exist, directly to the institution’s top management, as well as to the institution’s external auditors;

II – remain available to the Brazilian Central Bank for a period of five (5) years.

Article 4. In addition to the responsibilities listed in Art. 1., Paragraph 2, the institution’s top management shall foster high ethical and integrity standards and an organizational culture that shows and emphasizes to all employees the importance of internal controls and the duties of each one in the process.

Article 5. The internal control system shall be implemented by Dec. 31, 1999, according to the following schedule:

I – definition of internal structures that will allow establishing and monitoring such internal controls – by Jan. 31, 1999;

II – definition and availability of the corresponding procedures – by Jun. 30, 1999.

Sole Paragraph. The institution’s external auditors shall specifically mention the compliance with the schedule set forth in this article in their audit report.

Article 6. The Brazilian Central Bank is authorized to:

I – mandate the adoption of additional controls when it determines that the controls implemented by the institution are inadequate;

II – impose more restrictive operational limits to the institution that fails to comply with the determination stated in Section I within the timeframe set forth;

III – establish rules and adopt measures that are deemed necessary to perform the provisions set forth herein, including the amendments to the schedule referred to in Art. 5.

Article 7. This Resolution shall be effective as of the date of its publication.

Brasília, September 24, 1998

Gustavo H. B. Franco