Cybersecurity in the financial sector: what the BCU requires.

Security governance

• The Board approves an information security strategy and governance framework that includes cybersecurity (EMG 6.9–6.13).
• The information security function must be functionally and budgetarily independent from IT (EMG 57.5). The rule does not say “CISO”, but an independent function.
• IT and cybersecurity processes must be audited regularly by independent people.

Technical requirements (EMG 83)

• MFA for all remote access, identity and privileged account management, and annual access reviews.
• Automated vulnerability scans at least monthly, with remediation deadlines by criticality.
• Penetration testing of critical applications based on risk and exposure.
• Tamper-proof logs, SIEM with continuous monitoring and threat intelligence.
• Incident drills at least once a year.

In addition, the incident response plan is tested at least once a year and the continuity plan must cover cyberattack scenarios and outsourced services (EMG 61 and 62). Cloud use requires controls equivalent to or stronger than internal ones (EMG 82.13).

Incident reporting

• Entities supervised by the SSF: emerging events are reported to the Superintendency “as soon as possible”, including those at outsourced providers (Communication 2021/105).
• Payment system players (acquirers, processors, e-money issuers, among others): initial report within 4 hours at most, follow-up every 48 hours and closure within 15 days (Communication 2024/018).

Decree 66/025 lists banking and finance among the critical sectors, so the 24-hour reporting obligation to CERTuy should also be reviewed.

Strong customer authentication

Circular 2497 requires, from 1 October 2026, at least two authentication factors from different categories to access digital channels, make transfers or payments, request remote loans and change sensitive data, together with transaction monitoring and user notifications. It also covers credit administrators, exchange houses, financial services companies, money transfer companies and peer-to-peer lending platforms.