Brazil Open Finance: Resolução Conjunta BCB/CMN No. 21, 1 Dec 2026 Partner-list Deadline and Banned Partnerships

Who this is for: in-house counsel, compliance officers, banks, payment institutions, fintechs and legal advisors in Brazil. What it explains: the changes introduced by Resolução Conjunta No. 21 (22 October 2026), the 1 December 2026 partner-list filing requirement, prohibited partnerships, the six-month unwind rule, and a practical compliance checklist.

Brazil open finance resolução conjunta BCB/CMN No. 21, approved jointly by the Banco Central do Brasil (BCB) and the Conselho Monetário Nacional (CMN) on 22 October 2026, is among the most consequential regulatory developments the ecosystem has seen since the framework launched. The resolution sets a firm 1 December 2026 deadline for institutions with existing partnership agreements covered by the new rules to file a list of their partner entities with the Central Bank, prohibits certain categories of partnership, and requires that non-conforming arrangements be brought into compliance or unwound. It also strengthens consent requirements, including a client’s specific consent for data sharing in partnership contexts.

This article translates those obligations into a practitioner-focused compliance playbook for institutions operating in Brazil. Because the operative rules turn on precise wording, institutions should always verify specific requirements against the official text published in the Diário Oficial da União.

Executive summary: what Resolução Conjunta No. 21 does (quick read)

The Brazil open finance resolução conjunta BCB/CMN No. 21 tightens the rules governing how participants in the Open Finance ecosystem structure their commercial relationships and how they handle customer consent. In plain language, the resolution introduces several interlocking obligations that participants with partner contracts should address without delay.

First, it imposes a transparency and supervision measure: institutions that already have partnership agreements covered by the new rules must submit a list of those partners to the BCB by 1 December 2026. Second, it prohibits specific partnership structures that distort the consent mechanism, in particular, arrangements that effectively transfer customers to a partner in exchange for remuneration, or that condition data sharing on commercial incentives. Third, where a partnership falls within a prohibited category, the parties must bring the arrangement into compliance or end it within the period set by the resolution. Fourth, the resolution reinforces that data sharing must rest on the client’s specific consent, and restricts conduct that would undermine the integrity of that consent.

Institutions should treat the 1 December filing as inseparable from a substantive review. Preparing the list forces a review of every partnership against the new prohibitions, and that review will frequently surface arrangements requiring amendment or unwinding well before the filing is submitted.

Because the Brazil open finance resolução conjunta BCB/CMN applies to a broad population of banks, payment institutions and fintechs, the practical burden is significant. Institutions cannot treat the filing as a standalone administrative task; the filing gives the regulator visibility over the partnership landscape it will supervise, while the substantive rules govern how those partnerships may be structured.

Key dates at a glance

• 22 October 2026, Resolução Conjunta No. 21 approved by the BCB and CMN.
• 1 December 2026, deadline for institutions with existing covered partnership agreements to file their partner list with the BCB.
• Transition/unwind period, non-conforming partnerships must be brought into compliance or ended within the period specified in the resolution; institutions should confirm the exact window from the official text.

Legal and regulatory context: where this amendment sits

Open Finance in Brazil was established through a joint regulatory framework issued by the BCB and the CMN, which created the structure for sharing customer data and payment initiation services across regulated institutions. Since then, the system has been built out in phases, coordinated jointly by the BCB and the CMN. The BCB operates as the day-to-day regulator and supervisor, while the CMN sets the broader monetary and financial policy under which the framework operates. Resolução Conjunta No. 21 sits within this established normative architecture as a corrective and supervisory layer, it does not replace the framework but refines how participants may commercialise their roles within it.

The Brazil open finance resolução conjunta BCB/CMN is best understood as a response to market behaviour. As the ecosystem matured, commercial incentives emerged around the movement of customers and data between institutions and their partners. The regulators have moved to ensure that consent remains the genuine foundation of data sharing, rather than a formality that commercial arrangements can engineer. Reading the resolution against the BCB’s published Open Finance materials and its normative catalogue is essential for accurate interpretation.

Which institutions are Open Finance participants?

Open Finance participation extends to institutions authorised by the BCB that hold customer data or offer services within the sharing ecosystem. In broad terms, this includes commercial banks, multiple banks, payment institutions, credit unions and other regulated institutions that either transmit customer data on the basis of consent (transmitting institutions) or receive it to deliver services (receiving institutions). Institutions should confirm their precise classification by reference to the BCB’s Open Finance scope definitions, because the filing and prohibition obligations attach to participants with partner contracts.

Relationship with the LGPD and ANPD guidance

Data sharing under Open Finance does not operate in isolation from Brazil’s general data protection regime. The Lei Geral de Proteção de Dados (LGPD) governs the processing of personal data across sectors, and the Autoridade Nacional de Proteção de Dados (ANPD) issues guidance on lawful bases, consent and data subject rights. Where the Brazil open finance resolução conjunta BCB/CMN tightens consent rules, it reinforces, rather than displaces, the LGPD’s requirement that consent be free, informed and specific. Institutions should treat the two regimes as complementary: a consent flow that satisfies the resolution should also satisfy the LGPD, and ANPD guidance remains the reference point for the data-protection dimension of any partnership.

What the Brazil open finance resolução conjunta BCB/CMN requires in detail

The resolution operates on several fronts, and compliance teams should map each obligation to an owner inside the institution. The following breakdown summarises the core requirements. Where legal language is quoted or paraphrased, institutions should verify it against the official text published in the Diário Oficial da União before relying on it.

The filing obligation requires institutions that already have partnership agreements covered by the new rules to submit a list of those partners to the BCB by 1 December 2026. The list is intended to give the regulator visibility over the network of commercial relationships that sit around the data-sharing infrastructure. In preparing it, institutions must assess each partnership, which means the filing exercise and the prohibition analysis are inseparable.

The prohibition on certain partnerships targets structures that compromise the integrity of consent. The clearest examples are arrangements in which a participant transfers customers to a partner in exchange for payment, or in which consent to data sharing is induced or conditioned by a commercial arrangement between the institution and the partner. These structures are restricted because they convert what should be a customer-driven decision into a commercially-driven one.

The transition/unwind requirement provides that where a partnership is identified as non-conforming, the parties must bring it into compliance or bring it to an end within the period specified in the resolution. Institutions should confirm the exact window from the official text and plan the exit on a timeline that leaves room for customer communication and data handling.

The consent-integrity rules require that data sharing rest on the client’s specific consent and restrict conduct that would undermine that consent. The rationale is to ensure that a customer’s decision to share data remains a genuine choice and to protect the data portability the framework is designed to enable.

Exact wording and key clauses

Because enforcement will turn on the precise wording, institutions should quote the operative clauses verbatim from the official publication rather than relying on summaries. The 1 December 2026 filing deadline, the enumerated prohibited structures, the transition/unwind window, and the specific-consent requirements are the clauses that compliance teams should extract and circulate internally with a direct citation to the Diário Oficial text.

Interpretation notes and foreseeable regulator expectations

The BCB is expected to use the partner-list filing as a supervisory baseline against which it assesses market conduct. The likely practical effect is that institutions filing lists containing borderline arrangements should expect follow-up supervisory engagement. The prudent posture is a conservative interpretation of the prohibition on consent-distorting partnerships, treating any arrangement that pays for customer transfer or conditions consent as at risk, while the Brazil open finance resolução conjunta BCB/CMN beds in.

Which partnerships are prohibited and practical examples

The prohibitions bite hardest on arrangements where money and consent intersect. In assessing existing partnerships, the controlling question is whether the commercial structure influences the customer’s decision to share data, or whether it moves customers to a partner in return for consideration. Two common market models illustrate how the analysis works in practice.

Example 1, Bank and marketplace partnership

Consider a bank that enters an arrangement with an online marketplace under which the bank directs customers to the marketplace’s financial products and receives a per-customer payment, with data sharing enabled as part of the hand-off. Under the Brazil open finance resolução conjunta BCB/CMN, this structure is problematic because the payment is tied to the transfer of customers, and the consent to share data forms part of a commercially incentivised transfer rather than an independent customer choice. Where remuneration is contingent on customer transfer and data flow, the arrangement sits within the prohibited category and must be restructured or unwound.

By contrast, a referral relationship in which the bank presents a partner’s offer, the customer independently decides to proceed, and consent is obtained separately and specifically for the data sharing, with no payment conditioned on the transfer itself, stands a better chance of surviving scrutiny, provided the consent remains free, informed and specific.

Example 2, Payment institution and data aggregator

A payment institution that partners with a data aggregator to pool customer data for onward commercial use must examine how consent is captured and whether the aggregation is driven by the customer’s genuine request. If the aggregator’s access is bundled into a broader commercial deal and the institution is remunerated for channelling customers and their data, the arrangement risks falling within the prohibited structures. The safer design keeps the aggregation service customer-initiated, keeps consent specific to the defined purpose, and avoids any fee structure that rewards the institution for the volume of customers or data it transfers to the aggregator.

Across both examples, the recurring compliance test is simple to state and demanding to apply: does the money follow the customer or the data in a way that compromises the independence of consent? Where it does, the partnership is at risk under the Brazil open finance resolução conjunta BCB/CMN.

Filing requirement: preparing the 1 December 2026 submission

The partner-list filing is the visible deliverable, but assembling it is a cross-functional exercise. Institutions should begin by building a complete inventory of partnerships that touch the Open Finance ecosystem, then layer in the data the regulator will expect to see for each relationship. Institutions should confirm the exact content and format the BCB requires from the official instructions accompanying the resolution.

• Partner legal name and registration. Full legal name and CNPJ (the Brazilian corporate taxpayer registration number) of each partner entity.
• Nature of the partnership. A clear description of what the partner does, how data flows, and whether any payment is made in connection with customers or data.
• Contract dates and status. Commencement date, term, renewal mechanics and whether the contract is live.
• Customer consent status. How consent is obtained for the data sharing associated with the partnership, and whether it meets the free, informed and specific standard.
• Technical integration status. The state of API or other integration supporting the partnership.
• Mitigation and remediation measures. Any steps already taken or planned to bring a borderline arrangement into compliance.

Internal roles and workflow

Preparing the filing requires legal, compliance, commercial and IT to work in concert. Legal and compliance run the prohibition analysis and sign off on the characterisation of each partnership. The commercial team provides the contractual and remuneration detail. IT confirms the integration status and the technical consent controls. A single accountable owner should coordinate the workstream and own the submission to the BCB ahead of the 1 December 2026 deadline.

Suggested data format and retention

Maintain the partner list in a structured, auditable format that can be updated as partnerships change. Retain supporting evidence, contracts, consent records and integration logs, so the institution can respond quickly to any supervisory query following the filing. Treating the list as a living register, rather than a one-off submission, positions the institution well for ongoing supervision under the Brazil open finance resolução conjunta BCB/CMN.

Contracts, consents and operational steps

Where the prohibition analysis flags a partnership for remediation, contractual and consent changes are the primary levers. The goal is to sever any link between remuneration and the transfer of customers or data, and to ensure consent stands on its own as a genuine customer decision.

Contract redlines and sample language

Amendment triggers include any clause that conditions payment on customer transfer, any provision that bundles consent into a commercial deal, and any term that allows a partner to drive the customer’s consent decision. At a high level, remediation language should decouple fees from customer volume and data flow, confirm that consent is obtained independently and specifically for the defined purpose, and include representations that the arrangement complies with the Brazil open finance resolução conjunta BCB/CMN. Where an arrangement cannot be cured through amendment, the contract should provide a clean exit path consistent with the resolution’s transition requirements.

Consent re-obtaining process and logs

Where existing consents were captured under a structure that no longer complies, institutions may need to re-obtain consent on a compliant basis. Any re-consent flow must meet the free, informed and specific standard shared by the resolution and the LGPD, and it must not be presented in a way that nudges the customer toward a commercially convenient outcome. Maintain detailed consent logs recording what was presented, when, and the customer’s decision, so the institution can demonstrate compliance on request.

If a prohibited partnership exists: the unwind process

When an arrangement is identified as prohibited and cannot be brought into compliance, the parties must end the partnership within the period set by the resolution. A disciplined exit plan protects customers, preserves the institution’s standing with the regulator, and limits reputational exposure. The milestones below are an illustrative project-management structure; institutions should align them to the actual deadline in the official text.

Illustrative milestone checklist

• Early stage. Confirm the prohibited characterisation, assign the exit owner, notify the partner of the required termination, and map affected customers and data flows.
• Mid stage. Execute contractual termination steps, finalise the customer transition plan, and determine the data deletion or transfer obligations arising from the end of the relationship.
• Completion. Complete the unwind, confirm data has been handled in accordance with the LGPD and any transition arrangements, and document the closure for the regulatory record.

Contingency planning and consumer notice considerations

Customer communications during an unwind must be neutral and factual. They should explain what is changing without undermining the integrity of the customer’s consent decision. Prepare contingency plans for service continuity so that ending a partnership does not leave customers without access to a function they relied on, and keep records of every notice issued.

Enforcement risk, penalties and regulator interactions

The BCB supervises Open Finance participants and can pursue administrative follow-up where institutions fail to meet their obligations. Non-compliance with the Brazil open finance resolução conjunta BCB/CMN, whether by missing the filing deadline, maintaining a prohibited partnership beyond the permitted transition window, or breaching the consent-integrity rules, exposes an institution to supervisory engagement and potential sanction under the applicable BCB and CMN enforcement regime. The prudent approach is proactive: identify and remediate issues early, document the remediation, and engage the regulator constructively where a partnership requires an unwind. Voluntary, well-documented remediation is generally viewed more favourably than issues surfaced through supervision.

Practical checklist and timeline for compliance teams

The following action plan condenses the obligations into an ordered sequence that in-house teams can adapt directly.

1. Inventory every partnership that touches the Open Finance ecosystem and assign an accountable owner.
2. Run the prohibition test against each partnership, applying a conservative interpretation of consent-distorting structures.
3. Assemble the partner-list data elements and prepare the filing for submission by 1 December 2026.
4. Amend contracts to decouple remuneration from customer and data transfer, and to strengthen consent language.
5. Re-obtain consent on a compliant basis where required, and log every consent decision.
6. For any prohibited partnership, launch the transition/unwind plan against the deadline specified in the resolution.
7. Ensure all customer communications respect the resolution’s consent-integrity requirements.
8. Retain evidence and maintain the partner list as a living register for ongoing supervision.

Allowed versus prohibited partnership features under Resolução Conjunta No. 21

Next steps for Brazilian institutions

The Brazil open finance resolução conjunta BCB/CMN gives compliance teams a narrow window to inventory partnerships, test them against the new prohibitions, file the partner list by 1 December 2026, and plan any required transitions or unwinds. Because the substantive consent and partnership rules take effect under the timetable set in the resolution, action should not wait for the filing deadline alone. Institutions that treat this as an integrated legal, compliance, commercial and technical exercise, rather than a form-filling task, will be best placed to meet the regulator’s expectations and avoid enforcement exposure. For tailored support, institutions can seek a compliance audit, contract review and filing-preparation assistance through Global Law Experts’ Banking & Finance practice for Brazil.

Sources

1. Banco Central do Brasil, Open Finance (official overview)
2. Banco Central do Brasil, homepage and normative acts portal
3. Imprensa Nacional / Diário Oficial da União
4. Presidency / Planalto legislation repository
5. Autoridade Nacional de Proteção de Dados (ANPD)