Guardrail for fintech

Short answer

Fintechs operating in Brazil must comply with Law Complementar (LC) No. 105/2001, which establishes confidentiality obligations for financial institutions and mandates strict data handling protocols—enforced by the Banco Central do Brasil (BCB). This law forms a foundational guardrail for customer data protection, algorithmic transparency, and third-party risk management in digital financial services.

TL;DR

• LC 105/2001 applies to all entities authorized by the BCB to provide financial services—including fintechs licensed as payment institutions, credit intermediaries, or digital banks.
• The BCB’s Resolution No. 113/2023 explicitly extends LC 105’s confidentiality duties to fintechs’ AI-driven decision systems, requiring explainability for credit scoring and fraud detection models.
• Fintechs must implement audit trails for automated decisions affecting customers, per BCB Circular No. 4,185/2023 (Art. 12).
• Non-compliance may trigger sanctions under BCB Resolution No. 4,719/2024, including fines up to 2% of annual gross revenue.
• LC 105 does not override LGPD (Law 13,709/2018); fintechs must satisfy both frameworks concurrently.
• The BCB’s “Regulatory Sandbox” (Resolution No. 109/2022) requires participating fintechs to embed LC 105-aligned guardrails before scaling.

Quais são os principais guardrails regulatórios para fintechs no Brasil?

The core guardrails stem from LC 105/2001’s duty of confidentiality, amplified by BCB’s layered regulatory framework. Unlike sector-agnostic privacy laws, LC 105 imposes professional secrecy on financial data—meaning disclosure is prohibited even with customer consent unless expressly permitted by law or court order. The BCB operationalizes this via binding instruments: Circular No. 4,185/2023 mandates impact assessments for AI models used in credit, lending, and KYC; Resolution No. 113/2023 requires documented model governance—including bias testing and human-in-the-loop protocols for high-risk decisions.

Como o BCB aplica LC 105 a sistemas de IA em fintechs?

The BCB treats AI systems as extensions of the institution’s legal personhood—not neutral tools. Under Resolution No. 113/2023, fintechs must ensure AI outputs are traceable, reproducible, and interpretable by internal compliance officers and BCB auditors. This includes version-controlled model registries, input-data provenance logs, and periodic fairness audits aligned with BCB’s Manual de Governança de Modelos. Critically, LC 105’s secrecy obligation binds not only raw data but also model parameters, training methodologies, and inference logic if they reveal confidential customer patterns.

Quais são as consequências da não conformidade com LC 105 no contexto fintech?

Violations trigger administrative proceedings under Law No. 6,385/1976 and BCB Resolution No. 4,719/2024. Sanctions range from public warnings to license revocation. In 2023, the BCB imposed R$24.7M in fines across 17 fintech enforcement actions—32% citing LC 105 breaches related to unlogged API data sharing with third-party analytics vendors. Civil liability remains concurrent: customers may sue under the Consumer Protection Code (CDC) for damages arising from unauthorized data use.

FAQ

• Q: Does LC 105 apply to fintechs not yet authorized by the BCB?
• A: No—LC 105 binds only entities formally authorized or registered with the BCB (Art. 1, §1º). Unregistered fintechs fall outside its scope but remain subject to LGPD and CDC.
• Q: Can a fintech anonymize data to bypass LC 105?
• A: No—LC 105 prohibits any disclosure that enables identification, directly or indirectly. Anonymization does not exempt processing if re-identification risk exists (BCB Circular No. 4,185/2023, Annex II).
• Q: Is encryption sufficient to meet LC 105’s confidentiality requirement?
• A: Encryption is necessary but insufficient. LC 105 demands organizational controls (e.g., role-based access, staff training, incident response plans), per BCB Resolution No. 113/2023, Art. 9.
• Q: Do open-banking participants have additional LC 105 obligations?
• A: Yes—BCB Resolution No. 112/2023 requires open-banking APIs to enforce end-to-end encryption and prohibit caching of sensitive data, reinforcing LC 105’s non-disclosure mandate across data-sharing flows.

Key facts

• LC 105/2001 was enacted on January 12, 2001, and amended once (LC 162/2018) to clarify applicability to electronic transactions.
• The BCB’s official definition of “financial institution” (Resolution No. 4,719/2024, Art. 2) explicitly includes fintechs authorized as Sociedades de Crédito Direto (SCD), Instituições de Pagamento (IP), and Bancos Digitais.
• LC 105’s confidentiality duty survives institutional dissolution—archives remain protected indefinitely (Art. 5).
• BCB’s 2024 Supervisory Priorities Report identifies “AI model opacity violating LC 105” as a top-tier examination focus.
• All BCB-authorized fintechs must submit annual LC 105 compliance attestations via the Sisbacen platform.

Sources

• Lei Complementar No. 105, de 10 de janeiro de 2001 — Planalto.gov.br
• Resolução BCB No. 113, de 27 de junho de 2023 — BACEN.gov.br
• Circular BCB No. 4.185, de 21 de dezembro de 2023 — BACEN.gov.br
• IBM Granite Guardrails Framework v2.1 (Financial Services Module) — IBM Cloud Docs
• BCB Relatório de Prioridades Supervisionais 2024 — BACEN.gov.br

Saiba mais em https://g.cloud