BCB Resolution 538 and CMN Resolution 5,274, dated December 18, 2025, require institutions subject to each regulation to undergo at least annual penetration testing, independently and impartially, by a contracted individual or specialized company, with documented results and action plans. The deadline for updating the cybersecurity policy was March 1, 2026.
With the deadline passed, the question is whether the test performed will stand as evidence when someone asks to see it. The official text is available on the pages of the BCB Resolution 538 and of the CMN Resolution 5,274 on Brazil's Central Bank website.
What the regulations changed
The two resolutions update the 2021 framework: BCB 538 amends BCB Resolution 85, and CMN 5,274 amends CMN Resolution 4,893. What was previously a principle has become a requirement, with minimum controls that must be demonstrable.
Additional requirements include multifactor authentication for sensitive access, cyber intelligence with threat monitoring beyond the perimeter, operational traceability, vulnerability and patch management, isolation of critical environments such as Pix, STR, and RSFN, stricter rules for procuring cloud services, and an annual independent penetration test.
What the regulation requires in a penetration test
Four elements appear consistently. Annual testing is the minimum, and significant changes to the environment justify additional tests. Article 22-A requires a specialized provider contracted with independence and impartiality, without precluding additional testing by the institution's own teams.
Results must be documented, accessible, and traceable. An action plan must also exist, with evidence of execution: finding a flaw without addressing it leaves the requirement unmet.
Where required controls meet field data
The 2026 Cyber Risk Landscape, a Vultus study of 132 organizations across 11 sectors, shows that several controls now considered minimum requirements correspond to the very gaps exploited during tests. Cloud environments lacked multifactor authentication in 38.1% of organizations, and credentials stolen by infostealers accelerated intrusion in 21.4% of tests.
The study spans multiple sectors and is not limited to financial services. Even so, it indicates that the regulation focused requirements on the areas where testing most often finds weaknesses.
The financial sector is also on international organizations' radar. A survey by BIS (Bank for International Settlements) with central banks shows that few consider the sector adequately prepared for cyberattacks and that more than half rated the sector's security investment in the previous year as insufficient. In Brazil, banks are expected to allocate R$50.4 billion to technology in 2026, according to the FEBRABAN Banking Technology Survey, which places cybersecurity at the center of the sector's agenda.
Fictional example: the report that does not hold up
A fictional payment institution completed testing in February 2026, ahead of the deadline. The internal team conducted the work with help from a scanning tool, and the Pix environment was excluded from scope to avoid the risk of downtime. The report was filed away without a tracked action plan.
When an auditor, regulator, or board asks who performed the test, what was in scope, and where the fixes are, all three answers will be weak. Critical environments can be tested with execution windows and an escalation channel agreed before work begins.
Checklist for the next cycle
For the first annual cycle under the new rules:
- Applicability: confirm with legal which resolution applies to the institution.
- Scope: include critical environments in the next test.
- Independence: formalize the tester's independence, including when it provides other services.
- Action plan: require an owner, deadline, and retest demonstrating remediation.
- Retention: retain the report, plan, and evidence for the period required by the regulation.
- Reporting: present results to senior management with a risk indicator.
This content explains the resolutions' technical requirements and is not a legal opinion. Application to each institution should be reviewed by legal and compliance teams.
Independent testing with evidence and retesting
Vultus conducts penetration tests with an independent team, a scope that includes critical environments, and a report covering the attack chain, action plan, and documented retesting. Leaked credential monitoring supports the cyber intelligence requirement. Explore Vultus advanced pentesting and the threat intelligence.
