According to the new rule, financial institutions and other institutions authorized to operate by the BACEN framed in Segment 1 (“S1”), Segment 2 (“S2”), Segment 3 (“S3”), or Segment 4 (“S4”) shall implement structures for continued and integrated risk management and continued capital management (shared by institutions of the same prudential conglomerate), which must be (i) compatible with the business model, the nature of the transactions and the complexity of the products, services, activities and procedures of the institution; (ii) proportional to the size and relevance of the risk exposure, according to the criteria defined by the institution; (iii) suitable to the risk profile and the systemic relevance of the institution; and (iv) capable of evaluating the risks arising of the macroeconomic conditions and of the markets in which the institution performs its activities.

In relation to the risk management structure, it is intended to allow the institution to identify, measure, evaluate, monitor, report, control and mitigate (i) the credit risk; (ii) the market risk; (iii) the variation of the interest rate risk in the banking book (IRRBB); (iv) the operational risk; (v) the liquidity risk; (vi) the socioenvironmental risk; and (vii) other relavant risks, according to the criteria defined by the institution, including those not covered in the calculation of the risk-weighted assets (RWA), pursuant to the terms of Resolution CMN 4,193/13.

In relation to the capital management structure, the rule sets forth the obligation of maintainance of a continued process of (i) monitoring and controlling of capital maintained by the institution; (ii) evaluation of the capital needs to face risks to which the institution is exposed; and (iii) planning of goals and capital needs, considering the strategic goals of the institution.

The risk and capital management activities must be performed by specific units of the institutions framed in S1, S2, S3 and S4, which shall indicate specific officers to each of these units.

Additionally, the rule sets forth that the institution shall constitute a risk committee, with the following responsibilities, among others, (i) evaluation of the levels of risk appetite and the strategies for its management, considering the risks individually and collectively; (ii) supervision of the activities and the performance of the risk management unit officer; and (iii) evaluation of the level of adherence of the risk management structure procedures to the established policies.

The descriptions of the risk and capital management structures must be evidenced in a publicly-available report at least annually, and the composition and responsibilities of the risk committee must be published in the institution’s website.

The institutions authorized to operate by the BACEN framed in S5 shall implement a simplified structure for continued risk management (shared by the institutions of the same prudential conglomerate), which must be (i) compatible with the business model, the nature of the transactions and the complexity of the products, services, activities and procedures of the institution; (ii) proportional to the size and relevance of the risk exposure, according to the criteria defined by the institution; and (iii) suitable to the risk profile of the institution.

Such simplified risk management structure of institutions framed in S5 must be suitable to (i) identify, measure, evaluate, monitor, report, control and mitigate the relevant risks to which the institution is exposed; and (ii) provide for policies, strategies, routines and procedures for the risk management, assessed periodically by the institution’s administration. Those institutions shall appoint responsible officers before the BACEN for such simplified structure of risk management.

Resolution CMN 4,557/17 also sets forth that the level of risk appetite of the financial institutions and other institutions authorized to operate by the BACEN must be documented in the Risk Appetite Statement (“RAS”), which must be prepared considering (i) the types and levels of the risks that the institution is willing to take; (ii) the capacity of the institution to manage risks in an effective and prudent manner; (iii) the strategic goals of the institution; and (iv) the competitive conditions and the regulatory environment in which the institution operates.

The RAS, the documentation related to the risk and capital management structures, and the reports indicated in Resolution CMN 4,557/17 must be available to the BACEN for the period of 5 years.

The risk and capital management structures provided for in Resolution CMN 4,557/17 must be implemented, as of March 1st, 2017 (i) within 180 days, for the institutions framed in S1; and (ii) within 360 days, for the institutions framed in S2, S3, S4 or S5, provided that the institutions framed in S2 and S3 must prepare, within 180 days, the plan for implementation of such structures.