Brazil's central bank and its monetary council approved new Open Finance partnership rules that allow banks, fintechs, and cooperatives to share customer data with companies outside the regulated financial system. Announced by the central bank on Thursday, October 22, the decision requires clients to give separate consent for each partner that receives their information. The measures seek to clarify contract scope, reduce divergent interpretations, and strengthen data security, privacy, and governance.
What Changes for Customers and Institutions
The central bank revised the definition of a partnership contract, which covers agreements through which an Open Finance participant transfers client data to a company without regulatory authorization to operate in the system. Customer consent now applies individually to each partner, making the flow of information more specific and controlled. Participating institutions must also strengthen monitoring of partner companies, and clients will receive more information about how their data travels.
Safeguards, Governance, and Restrictions
The rules introduce mechanisms to interrupt data sharing whenever information security is at risk, along with additional restrictions to prevent misuse of customer data. The central bank's statement did not spell out all of those restrictions in detail. The framework also increases the accountability of directors and boards at participating institutions for monitoring, compliance, and corrective measures.
Flexibility for Corporate Clients
The changes bring relevant news for legal entities, allowing consent to occur at different moments in the institution that sends data and the institution that receives it. In corporate cases, authorization may come from different users when that reflects internal representation and approval rules. The goal is to make Open Finance more convenient for companies, since the person requesting data is not always the person empowered to authorize it.
Origins of the Discussion
The revisions follow months of debate that began in March, when the central bank presented a proposal to review partnerships within the Open Finance governance council. Regulators expressed concern about data use by nonfinancial companies, including retailers assessing consumer credit and accounting firms accessing client accounts. The presentation highlighted five points: third-party transfers of transaction data, weak technical standards, limited transparency, lack of reciprocity, and the need for a model with one institution, one partner, and one consent.
Industry Warning and Regulatory Overlap
During a May debate organized by Pinheiro Neto Advogados, executives and lawyers warned about a possible conflict between the central bank and Brazil's National Data Protection Authority, known as ANPD. Bruno Chan, CEO of Klavi, said that blocking authorized data transfers could bring back risky practices such as requesting banking login and password from customers. Participants also noted that competition authority Cade and the Ministry of Finance were left out of the conversations.
Pressure on Startups and Fintechs
Startups and fintechs feared that stricter rules would close an important entry point to the market. The minimum capital required for a Payment Transaction Initiator rose from R$1 million to R$17 million, reaching R$30 million when combined with required net equity, while partnerships remained the main alternative for smaller niche companies and initiators account for between 25% and 30% of active consents. Gustavo Lino, president of Init, summarized the concern by saying, "The dose of the remedy turned into poison."
Next Steps for the Market
With the rules approved, the monetary council and the central bank said they aim to support a secure evolution of Open Finance, encourage innovation, increase user confidence, and improve efficiency and competitiveness in the national financial system. Market participants are expected to examine the full resolution in the coming days. The central bank's announcement did not clarify whether the most controversial point from March, a prohibition on sharing transaction data with nonregulated companies, was included in the final text.
The new framework refines how Open Finance data can reach third parties, but it leaves important questions open about the limits for nonregulated data recipients and coordination among regulators. Customers gain clearer visibility and more granular control, while banks, fintechs, and cooperatives assume stronger monitoring duties. The full resolution will determine whether the changes strike the right balance between innovation, customer protection, and competitive access to data.