The deadline for the adjustments required by CMN Resolution No. 5,274 of 12/18/2025 on Cybersecurity Policy is already in effect

Published in December by the National Monetary Council (CMN), Resolution CMN No. 5,274/2025—which establishes new cybersecurity requirements for all institutions authorized to operate by the Central Bank of Brazil (Bacen)—set the beginning of March 2026 as the deadline for institutions to make the necessary adjustments, as provided in its Article 2.

Resolution CMN No. 5,274/2025 amends and supplements Resolution CMN No. 4,893/2021. For each of the controls outlined in the regulation, the CMN establishes requirements analyzed separately and in detail, taking into account the company’s business model, risk profile, and operational complexity.

Considering that the new Resolution was issued to amend certain provisions regarding the cybersecurity of institutions, failure to comply with these provisions may result in vetoes or restrictions imposed by the Bacen on contracting data processing and storage services, as well as cloud computing services.

Thus, the Resolution imposes the duty to structure, implement, and demonstrate the effectiveness of minimum cybersecurity controls, including when such controls involve systems or services provided by third parties.

Regulatory responsibility remains with the supervised institution, which underscores the need to review contractual instruments, due diligence mechanisms, and the third-party management forms currently adopted.

It is important for institutions to pay attention to the requirements and necessary adaptations for their sector.

Peck Advogados has a team of specialists with extensive experience in financial regulation and cybersecurity incident management, ready to support your institution in strategic and regulatory alignment, as well as in implementing the necessary measures, always aligned with your business reality.

For more information or to schedule a conversation with our specialists, please contact us at contato@peckadv.com.br.

Prepared by: Dra. Graziella Rosa, Digital Advisory Manager, and Dra. Bianca Melo da Cruz, Digital Advisory Lawyer.

AUTHOR

• Bianca Melo
• Graziella Rosa