Software sold to banks in Brazil
Brazilian banks must vet the data services they buy. Cryptography is on the list.
Central Bank of Brazil rules require every institution it authorizes to include encryption and digital certificate management among its cybersecurity controls, and to check, before contracting relevant data processing, storage or cloud services, that the provider can keep the data confidential and intact. If you sell such a service to a Brazilian bank, that check is about you.
Resolução CMN nº 4.893 of 26 February 2021, as amended by Resolução CMN nº 5.274 of 18 December 2025. Institutions already operating had until 1 March 2026 to adapt (5.274, Art. 2º). The resolution at the Central Bank
What the rules say
What the resolution says.
“Os procedimentos e os controles de que trata o inciso II do caput devem abranger, no mínimo: [...] II - os mecanismos de criptografia; [...] XII - a gestão de certificados digitais;”
Our translation · The procedures and controls referred to in item II must cover, at least: [...] II - encryption mechanisms; [...] XII - digital certificate management;
Encryption and certificate management are named minimum controls. Certificate management was added in December 2025.
Read the source“a verificação da capacidade do potencial prestador de serviço de assegurar: [...] c) a confidencialidade, a integridade, a disponibilidade e a recuperação dos dados e das informações processados ou armazenados pelo prestador de serviço;”
Our translation · verifying the prospective provider’s ability to ensure: [...] c) the confidentiality, integrity, availability and recovery of the data and information it processes or stores;
Before signing, the bank has to check that you can keep its data confidential and intact.
Read the source“o acesso da instituição contratante aos relatórios elaborados por empresa de auditoria especializada independente contratada pelo prestador de serviço, relativos aos procedimentos e aos controles utilizados na prestação dos serviços”
Our translation · the contracting institution’s access to reports prepared by an independent specialized audit firm engaged by the provider, on the procedures and controls used to provide the services
The bank must be able to see independent audit reports on your controls.
Read the sourceThe resolution applies to institutions authorized by the Central Bank of Brazil. Its Article 1 excludes payment institutions, which follow the Central Bank’s own regulation.
It does not mention quantum computers or post-quantum cryptography. The connection is ours: encryption and certificates that a quantum computer can break are the controls a bank has to check, on data it may hold for years.
What an assessment gives you
Each part, against what it serves.
The inventory: the cryptography and certificates your product uses, as found in the code and dependency manifests you give us, each finding with the file and line where it was seen.
The exposure ranking and the migration plan: which of those uses a quantum computer breaks, in what order you will replace them, and with what.
The evidence file: the inventory, the ranking and the plan as linked, signed records your customer can check offline. It is not the independent audit report the article refers to; it can be one of the things that auditor examines.
What this is not
- This is not legal advice or a certification. Whether a service counts as relevant is the bank’s assessment, by its criticality and the sensitivity of the data (Art. 12, § 1º).
- We are not an audit firm, and the evidence file is not an audit report.
- The assessment covers the systems you put in scope. Cryptography we are not shown is not in the inventory.
Next
See what the deliverable looks like.
The sample is a made-up bank run through the real method: what your customer’s own assessment of its cryptography looks like.
Quotations read from the Central Bank of Brazil’s published text on 21 September 2026. Translations are ours.