On 18 December 2025, Brazil’s Conselho Monetário Nacional and the Banco Central published two resolutions that changed the security routine of every institution authorized to operate by the BCB. Until then, penetration testing was good practice cited in guidance. It became a provision: a minimum annual frequency, independent execution and a documented result. The adaptation deadline fell on 1 March 2026. For an MSP serving a credit union, a finance company, a securities broker or a payment institution, the subject stopped being a sales argument and became an obligation the client carries — with a supplier to contract. This piece gathers what the three resolutions say, article by article, and what that demands of whoever runs the test: an impartiality problem an MSP has to solve before selling, and the record an operation built on Wardizon produces alongside the service.
What changed in December 2025
Resolução CMN nº 5.274, of 18 December 2025, amends Resolução CMN nº 4.893, of 26 February 2021, which sets the cybersecurity policy of the institutions authorized to operate by the Banco Central. On the same day, Resolução BCB nº 538 made the equivalent amendment to Resolução BCB nº 85, of 8 April 2021.[1][2]
The change enters through vulnerability management. Art. 3º, § 2º, item VIII covers the assessment and correction of vulnerabilities in computing resources and information systems, and the new § 8º now states what that item must cover, at a minimum: periodic tests and analyses to detect vulnerabilities, scans to identify devices improperly connected to the corporate network, periodic analyses of technology resources, penetration tests, and timely correction of the vulnerabilities identified.[1]
Both resolutions took effect on their publication date and gave institutions already in operation the same deadline: the necessary adaptations were to be in place by 1 March 2026. That date has passed. An institution that has not contracted the test is not late on a recommendation; it is outside a provision in force.[1][2]
Art. 22-A: three conditions, not a recommendation
The new article is 22-A, worded identically in both resolutions. It requires institutions to ensure that the penetration tests mentioned in art. 3º, § 8º, item IV have a minimum annual frequency; are carried out with independence and impartiality by a natural person or a specialized company contracted by the institution for that purpose, without prejudice to tests run by the institution’s own teams; and have the results of their execution documented, in particular any vulnerabilities identified and the action plans established to correct them.[1][2]
Item II is worth reading slowly. “Without prejudice” does not offer an alternative: the internal team’s test remains permitted and remains useful, but it does not take the place of the contracted one. An institution that only tests with its own people does not meet the item, however good that team is.
And “contracted for that purpose” carries its own weight. An umbrella IT contract that lists the test as one line item is not what the rule describes; the rule describes a contract whose object is the test. For an MSP, that is precisely the difference between folding a scan into the monthly package and selling an assessment with its own scope, window, deliverable and price.
- A minimum annual frequency — annual is the floor, not the target.
- Independence and impartiality, by a natural person or a specialized company contracted for that purpose.
- Documented results, carrying the vulnerabilities identified and the action plans to correct them.
Who is in scope
Resolução 4.893 applies to the institutions authorized to operate by the Banco Central, and the sole paragraph of its art. 1º expressly excludes payment institutions, which follow the BCB’s own regulation. That regulation is Resolução BCB nº 85, of 2021 — the one Resolução 538 amended on the same day.[3][2]
Together the two cover both sides of the system. On one side, banks, credit unions, finance companies and the others authorized by the CMN. On the other, payment institutions, securities brokers and dealers, and foreign-exchange brokers. Art. 22-A is the same in both texts, so the obligation does not change with the side the client sits on.[2]
This matters to an MSP because the list is not made of large banks with security teams of their own. Single credit unions, small payment institutions, regional brokers and credit fintechs are on it — and they are exactly the client profile that already outsources infrastructure to a managed service provider.
The independence problem an MSP has to solve before selling
Item II asks for two things, not one: independence and impartiality. An MSP that administers the client’s firewall, identity directory and servers is not, by default, an impartial assessor of its own configuration. Whoever designed the control has an interest in the result of the test that evaluates that control, and that does not disappear because the report is well written.
The point does not stop an MSP from providing the service; it stops them from providing it without addressing the question. The paths are known and none of them is new: separate who operates from who assesses, record that separation in writing, and make the finding come from a recorded execution against an authorized scope rather than from the judgment of the engineer who maintains the environment.
The independence assessment belongs to the institution, which answers for it before the supervisor. The MSP’s job is to hand over material that supports it: who authorized, what scope was authorized, what was executed, when, and what evidence supports each finding. NIST SP 800-115 already treated scope, rules and recording as part of the test rather than administrative appendix. Without those records, the conversation about impartiality has nothing to rest on.[4]
The rule does not ask for a test; it asks for a record that lasts five years
Art. 8º, § 1º, item V now requires the annual report to carry the results of the penetration tests and of the periodic tests, scans and analyses for vulnerability detection, together with the action plans established for their correction.[1]
Art. 23 closes the loop. Its caput requires the documentation to remain at the Banco Central’s disposal for five years, and the new item X adds to that list the documentation with the results of penetration test executions and the action plans for the corrections, with the term counted from the date the tests were executed.[3][1]
Five years counted from execution changes what counts as a deliverable. A PDF with no execution date, no declared scope and no record of who authorized it settles this week’s meeting and does not settle the supervisor’s question in 2031. The report has to say what was tested, in which window, under which authorization, what was found and what was agreed for correction.
- The execution date of each test — the five-year term runs from it.
- The authorized scope, and who on the client’s side authorized it.
- The vulnerabilities identified, with the evidence supporting each one.
- The action plans for correction, with an owner and a deadline.
- The retest result, where there is one.
How this fits an MSP’s operation with Wardizon
Wardizon organizes the operation around the document the rule presupposes but never describes: the Rules of Engagement signed by the client. The RoE states the targets, the window, the depth and who authorized it, and it is what bounds how far an execution may reach. For an institution that has to show under which authorization the test happened, that is the first record in the trail.[5]
Every execution happens inside an RoE and is recorded with its scope and its moment. The report carries the MSP’s branding and the “Powered by Wardizon” signature, with the findings, the evidence and the remediation guidance that feed the action plan art. 22-A requires to be documented. Once the fix is applied, a retest inside the same RoE produces the record that the vulnerability is no longer observed — which is what closes the plan, not the assurance that it was fixed.[6]
None of this declares compliance on its own. The independence assessment, the acceptance of residual risk and the decision on the action plan belong to the institution. What the operation delivers is the material those decisions require and the rule requires to be kept: recorded authorization, dated execution, findings with evidence, and retests. The MSP enters as the specialized company contracted for that purpose, with a process that produces the record alongside the service.[7]
What to do in the coming weeks
For an MSP, the most productive conversation does not open with the rule. It opens by asking when the client’s last penetration test was and who ran it. The answer is usually “never” or “we did”, and both open the same door — except that the second already carries an impartiality problem inside it.
- List the clients authorized to operate by the Banco Central, payment institutions included.
- Ask for the date of the last penetration test and who executed it.
- Check whether the annual report already cites the results and the action plans.
- Separate, in writing, who operates the environment from who assesses it.
- Settle scope and authorization before any execution.
What this article is not
This article describes what the resolutions say; it does not replace reading the official texts or the institution’s own legal advice. The three rules cited are published in the Diário Oficial da União, they are short, and they are worth reading in full before any contracting decision.[1][2][3]
Art. 22-A asks for a documented execution, and the record starts before the first packet: the Rules of Engagement template carries the twelve clauses, the pre-flight checklist and the authorization email to send the institution.