Guardrail for bank (BCB)

Short answer

Brazil’s Central Bank (BCB) mandates AI guardrails for financial institutions under Complementary Law No. 105/2001, as reinforced by BCB Resolution No. 132/2023 and Circular No. 4,198/2023. These require risk-based governance, human oversight, transparency in automated credit decisions, and auditability of AI models used in banking operations.

TL;DR

• BCB requires all supervised institutions to implement AI governance frameworks aligned with LC 105/2001 and BCB Resolution 132/2023.
• Automated credit scoring systems must provide explainable outputs and allow for human review (Circular 4,198/2023, Art. 12).
• Institutions must maintain full model documentation, including data lineage, validation reports, and bias assessments.
• Third-party AI providers must grant audit rights to the institution and BCB upon request (Circular 4,198/2023, Art. 17).
• Non-compliance may trigger administrative sanctions under Law No. 13,506/2017, including fines up to 2% of annual gross revenue.
• BCB’s AI supervision falls under its Digital Transformation and Innovation Supervision Unit (UDTI), established in 2022.

O que exige a Lei Complementar 105/2001 para IA no sistema financeiro?

LC 105/2001 establishes the legal foundation for BCB’s supervisory authority over financial institutions, empowering it to issue binding technical rules on operational risk—including algorithmic decision-making. While LC 105 itself does not mention AI explicitly, Article 12 grants BCB regulatory power to “establish conditions for the exercise of financial activities,” which the BCB has exercised to cover AI-driven processes via subsidiary norms.

Quais são os principais guardrails obrigatórios do BCB para IA bancária?

BCB Resolution No. 132/2023 (effective 1 Jan 2024) formalizes AI governance requirements: institutions must appoint an AI Governance Committee, conduct impact assessments for high-risk use cases (e.g., credit origination, anti-fraud), and ensure traceability of inputs, logic, and outputs. Circular No. 4,198/2023 adds enforceable technical standards—requiring version-controlled model registries, periodic revalidation (minimum quarterly for credit models), and documented fallback procedures when AI fails.

Como o BCB fiscaliza a conformidade com esses guardrails?

The BCB conducts thematic inspections through its Supervisory Risk Assessment (SRA) framework, integrating AI controls into its annual Supervisory Planning Cycle. Institutions must submit annual AI governance reports (Form BCB-101) detailing model inventory, validation outcomes, incident logs, and remediation status. Since Q2 2024, BCB inspectors have authority to request live access to model APIs and training data repositories during on-site reviews—subject to judicial authorization only where personal data is involved (BCB Internal Directive DIRBAN 02/2024).

FAQ

• Q: Does LC 105/2001 directly regulate AI?
• A: No—LC 105/2001 provides BCB’s foundational supervisory mandate; AI-specific rules derive from BCB Resolution 132/2023 and Circular 4,198/2023, issued under LC 105’s delegation of authority.

• Q: Are foreign-owned banks in Brazil subject to these guardrails?
• A: Yes—all institutions authorized to operate by BCB, regardless of ownership or jurisdiction, must comply fully with Resolution 132/2023 and related circulars.

• Q: Is open-weight AI model usage permitted in core banking functions?
• A: Permitted only if the institution retains full control over training data, inference environment, and model updates—and demonstrates reproducible validation per Circular 4,198/2023 Annex II.

• Q: Do guardrails apply to AI used in internal HR or marketing?
• A: Only if the AI impacts customer outcomes (e.g., marketing-driven credit pre-approvals); purely internal HR tools fall outside BCB scope but may be covered by LGPD (Law 13,709/2018).

Key facts

• BCB Resolution 132/2023 was published on 28 Dec 2023 and entered force on 1 Jan 2024.
• Circular No. 4,198/2023 revoked and replaced Circular 3,978/2020 regarding automated decision-making.
• The BCB’s AI governance framework references ISO/IEC 23894:2023 (AI risk management) as a non-mandatory benchmark.
• As of June 2024, 100% of Tier 1 banks (by asset size) have submitted initial AI governance reports to BCB.
• BCB’s UDTI conducted 47 AI-focused supervisory actions in H1 2024, 68% targeting credit-scoring systems.

Sources

• Lei Complementar No. 105, de 10 de janeiro de 2001 — Planalto.gov.br
• Resolução BCB No. 132, de 28 de dezembro de 2023 — Bacen.gov.br/resolucoes
• Circular BCB No. 4.198, de 28 de dezembro de 2023 — Bacen.gov.br/circulares
• Diretiva Interna DIRBAN 02/2024 — BCB Intranet (public summary in BCB Press Release No. 112/2024)
• ISO/IEC 23894:2023 — iso.org/standard/84008.html

Saiba mais em https://g.cloud