bacen-compliance-sentinel-rafael-mastronardi

What it does

Provides guidance on regulatory conformity for Brazilian financial institutions, covering PSC, PARI, GRSIC, Open Finance/Banking data sharing, Open Finance consent, API requirements, outsourcing, and BACEN sanctions. Includes a routing table to map user needs to normative actions and a step-by-step flow for elaborating the Política de Segurança Cibernética (PSC), including asset risk mapping, mandatory PSC sections, governance, training, and annual reporting. Also outlines Open Finance compliance, incident reporting timelines to BACEN, and sanctions framework, plus a PARI incident response script with identification, containment, and regulatory communication phases.

How it works

• Identifies user need and directs action using the routing table, mapping needs like PSC, PARI, GRSIC, Open Finance, consent, API, Pix security, incidents, sanctions, and annual reports to specific regulatory actions.
• For PSC, guides through diagnosis/segmentation, asset/risk mapping, and a structured PSC outline with sections: objectives, controls (IAM, encryption, monitoring, vulnerability management), data classification, third-party due diligence, PARI, tests/exercises, governance, training, and RAS.
• For GRSIC, notes due diligence, contract clauses, data location, and cloud requirements; emphasizes responsibility remains with the institution.
• For Open Finance, enumerates data phases, consent requirements, data providers/receivers roles, API standards, and SLA expectations, plus consent specifics and data use restrictions.
• For Pix/DICT and incident reporting, states reporting timelines to BACEN and required data in the communications form.
• Provides a PARI incident response script with phases: identification/classification, containment, and regulatory communication, including timelines (e.g., 3 days úteis to BACEN).

When to use it

Use when designing or reviewing a financial institution’s cyber and information governance programs to ensure compliance with CMN 4.893/2021, BCB 85/2021, Open Finance regulations, DICT, and related BACEN sanctions.

What it can touch

No explicit tool invocations are listed in the provided content beyond the referenced regulatory concepts. The skill references "Triggers" and a routing table but does not specify executable tool interactions in the FACTS section.

Caveats

• Includes a prominent aviso that guidance is not legal or regulatory advice and to consult specialized counsel.
• Contains regulatory interpretations and thresholds (e.g., incident timelines, data classifications, and reporting periods) as described in the bullet points, without asserting new outcomes.
• License declared as agpl-3.0; ensure compliance with license terms when integrating.