Brazil Tightens Open Finance Rules to Give Users Firm Control Over Data Sharing

Overview

• Resolução Conjunta nº 21, which the CMN and Banco Central approved Thursday, Oct. 22, 2026, formally updates Brazil’s Open Finance rules and was published by the central bank.
• The new rules require each client to give a specific authorization for every partner that will receive their financial data, so banks and fintechs must obtain partner-by-partner consent.
• Institutions must step up monitoring of partner companies and are required to suspend data sharing when regulators or firms detect security risks to prevent misuse of information.
• Boards of directors and senior management now carry clearer, expanded duties to oversee Open Finance operations and to adopt preventive and corrective measures for compliance.
• The package readies the system for staged authorizations for legal entities, which should let companies split consent across representatives, and regulators say the changes aim to boost user trust and competition while adding operational requirements for firms.