Brazil Open Finance (Resolução Conjunta No. 1/2020): every control, and what you already have

30 controls 5 frameworks share controls with it Brazil verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

There is no implementation kit for this framework yet. The control list and the overlap above are free and complete.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
Australia Consumer Data Right	5	measure it →
LGPD	3	measure it →
ISO 31000:2018	1	measure it →
ISO/IEC 23894:2023	1	measure it →
ISO/IEC 17050-2:2004	1	measure it →

Every control

Code	Control	Also in
`BR-OF-A1`	Implementation and scope of Open Finance	2
`BR-OF-A10`	Data recipient and initiator obligations	0
`BR-OF-A12`	Data use limitation and accuracy	1
`BR-OF-A13`	Payment initiation consent	0
`BR-OF-A14`	Client information requirements	0
`BR-OF-A15`	Responsibilities in data sharing	0
`BR-OF-A16`	Security measures by transmitter/account holder	1
`BR-OF-A17`	Customer authentication procedures	1
`BR-OF-A20`	Confirmation of sharing	0
`BR-OF-A23`	Dedicated interfaces (APIs)	0
`BR-OF-A24`	Information to participants	0
`BR-OF-A25`	Availability and crisis management	1
`BR-OF-A28`	Prohibition on obstacles to sharing	0
`BR-OF-A3`	Objectives of Open Finance	0
`BR-OF-A30`	Customer service channel	0
`BR-OF-A31`	Reliability and responsibility	0
`BR-OF-A33`	Responsible director	0
`BR-OF-A34`	Personal data treatment (LGPD)	1
`BR-OF-A4`	Institutions' obligations	0
`BR-OF-A44`	Open Finance governance convention	0
`BR-OF-A46`	Banco Central oversight role	0
`BR-OF-A48`	Risk management policies	1
`BR-OF-A49`	Records available to the Banco Central	0
`BR-OF-A5`	Scope of data and services shared	1
`BR-OF-A52`	Banco Central power to veto or restrict participation	0
`BR-OF-A53`	Entry into force and transition	0
`BR-OF-A6`	Participants (transmitter, recipient, initiator)	0
`BR-OF-A7`	Registration of participation	0
`BR-OF-A8`	Consent for data and transaction sharing	2
`BR-OF-A9`	Information provision to client	0

Tell me when Brazil Open Finance (Resolução Conjunta No. 1/2020) files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

Mapping of statutory definitions to internal terminology
Classification of systems as AI / roles per Art 4
Classification of data as personal/sensitive per s2
Mapping of statutory definitions to internal roles (transmitter/recipient/initiator)
Classification of data as personal data per s2
Defined cybersecurity roles and responsibilities
Workforce/resourcing plan for cybersecurity
Accountability assignments
Appointment record for the data protection representative
Defined responsibilities and independence

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

Definitions not applied named by 4 frameworks
Responsibilities undefined named by 3 frameworks
Purpose creep named by 3 frameworks
No transition plan named by 3 frameworks
Weak authentication named by 3 frameworks

What this page is

A control-level reference for Brazil Open Finance (Resolução Conjunta No. 1/2020), drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition