The cybersecurity resolutions issued by BACEN and the CMN — among them Resolução CMN nº 4.893/2021 for financial institutions and Resolução BCB nº 85/2021 for payment institutions — require a formal policy, an incident response plan and periodic verification that controls are effective. A pentest produces the technical evidence that proves this verification to the regulator.
What do BACEN's cybersecurity resolutions require?
The BACEN and CMN cybersecurity rules define a set of obligations every regulated institution must implement, document and maintain. They do not prescribe a specific technology; they describe outcomes the institution must be able to demonstrate. In practice, the recurring pillars are:
- A formal cybersecurity policy — approved by senior management, reviewed periodically and communicated to employees and service providers.
- Governance and accountability structure — a designated responsible director and clearly defined roles for preventing and handling incidents.
- Incident response plan — procedures for detection, logging, classification, containment and communication, including the duty to report relevant incidents to the regulator.
- Verification and testing of controls — periodic assessment of how effective the institution's protection, detection and response mechanisms actually are.
- Third-party and cloud management — requirements for contracting data processing, storage and cloud computing, with equivalent controls demanded from suppliers.
- Continuity and resilience — the ability to keep critical operations running and recover services after an incident.
The fourth pillar — verifying that controls are effective — is where the pentest sits at the centre. The resolutions ask the institution to prove, regularly, that its defences work against real threats. An internal statement that controls exist is not enough; the regulator expects evidence that they were tested.
Regulatory note: Resolução CMN nº 4.893/2021 remains in force and was amended by Resolução CMN nº 5.274/2025. For payment institutions, Resolução BCB nº 85/2021 replaced Circular BCB nº 3.909/2018, and Resolução BCB nº 538/2025 also updates the framework. Always consult the Banco Central's normativos database for the text currently in force.
Where does the pentest fit into BACEN compliance?
A penetration test is the most direct way to produce the evidence the resolutions call verification of control effectiveness. While an automated scanner lists known vulnerabilities, a pentest demonstrates what an adversary could actually do: chain flaws, bypass authentication, reach sensitive data and prove impact with a reproducible proof of concept.
For compliance purposes, that result translates into three deliverables the regulator and internal audit value:
- Evidence that controls were tested — a dated report with a defined scope and declared methodology, proving the required periodic verification took place.
- Findings prioritised by risk — vulnerabilities classified by severity with business context, feeding the institution's action plan.
- Validation of fixes — the retest confirms the reported flaws were effectively treated, closing the continuous-improvement loop the rules assume.
The pentest also strengthens the incident response pillar. A Red Team exercise, for example, tests not only technical defences but the detection and reaction capability of the teams — exactly what the incident response plan needs to prove in practice.
There is also an under-used governance benefit. When the test result reaches senior management in business-risk language, the institution meets another expectation of the resolutions: that cybersecurity is followed by the board rather than treated as a purely technical matter. The pentest report, with its executive summary, becomes direct input for the accountability required of the responsible director.
Which types of test demonstrate the required controls?
Adequate coverage depends on each institution's attack surface. A digital bank, a payments fintech and a credit cooperative have different risk profiles. The most common engagement types in BACEN-regulated environments include:
- Web application and API pentest — the core of any digital institution, where authorisation, business-logic and data-exposure flaws concentrate.
- Network pentest and cloud pentest — assess internal infrastructure, perimeters and cloud configurations, a topic explicitly covered by the cloud contracting requirements.
- Mobile pentest — essential for institutions whose main channel is the app, with attention to insecure storage, communication and client-side protections.
- Red Team — objective-driven adversary simulation that exercises detection, response and resilience end to end.
- Payment and Open Finance security — payment security testing and Open Finance security address the regulated transaction and data-sharing flows.
Institutions handling payment accounts or card credentials usually combine these tests with specific compliance tracks such as PCI DSS and PCI MPoC, and with governance programmes such as ISO/IEC 27001 and LGPD compliance.
How does a pentest produce the evidence the regulator expects?
Each obligation in the resolutions has a concrete counterpart in the output of a well-run test. The table below maps what the rule requires to what the engagement delivers:
| BACEN/CMN resolution requirement | How the pentest meets it |
|---|---|
| Periodic verification of control effectiveness | Dated report with scope, methodology and findings proving the test was executed |
| Identification and treatment of vulnerabilities | Findings prioritised by severity and business risk, with actionable recommendations |
| Proof that remediation was effective | Retest that validates the fix and documents closure of the flaws |
| Incident detection and response capability | Red Team exercise that drills the defensive teams' reaction |
| Controls over cloud services and third parties | Cloud pentest and configuration review of the contracted environment |
| Governance and accountability to management | Executive summary with risk translated into business language |
What ties these deliverables together is traceability. An audit — internal, by BACEN itself or by an independent assessor — wants to see that the test happened, covered the right scope, found what there was to find and that fixes were validated. A professional report delivers that evidence chain in a verifiable form.
A common mistake is to confuse automated scanning with the required verification. A monthly scanner produces long lists of alerts, many of them false positives or irrelevant in context, and does not demonstrate real impact. The resolutions speak of control effectiveness, and effectiveness is only proven when someone tries to bypass the controls in a targeted way. That is the difference between ticking a compliance box and actually knowing whether the institution would withstand an attack.
Which institutions are subject to these resolutions?
BACEN's cybersecurity framework reaches a broad set of institutions authorised to operate by the Banco Central. This includes banks, credit cooperatives, finance companies, brokers and dealers, plus payment institutions, which follow Resolução BCB nº 85/2021. Authorised fintechs and Open Finance participants are also covered, to the extent of their activity.
The adaptation deadline for the most recent updates to the framework, for institutions already operating, closed on 01/03/2026. Institutions that have not yet structured their periodic verification of controls are therefore behind on a regulatory obligation and should prioritise bringing the pentest into their compliance programme — not as a one-off event, but as part of a recurring cycle of testing, remediation and revalidation, documenting the plan and the effective dates.
BACEN compliance rarely lives in isolation. The same institution usually has obligations under the LGPD — often handled by an outsourced DPO — and, when operating in Europe through subsidiaries, under rules such as NIS2. Institutions already using artificial intelligence in credit decisions or customer service add AI governance under ISO/IEC 42001 and AI agent security to their testing surface.
How Berghem does it
Berghem structures pentests for financial institutions from the real regulatory scope, not from a generic checklist. We start by mapping the attack surface and the applicable requirements so the test produces exactly the evidence that control verification demands. How we connect each test type to the regulator's obligations is detailed on our page on cybersecurity compliance for BACEN-regulated institutions.
Every engagement combines manual exploitation, vulnerability chaining and proof of impact with a report that serves both the technical team and the audit: prioritised findings, reproducible proof of concept, executive summary and retest included. As an information security company in São Paulo, we serve banks, cooperatives, finance companies and payment institutions, adjusting scope, depth and frequency to each operation's risk profile and regulatory calendar.
Frequently asked questions
Is a pentest mandatory under BACEN's resolutions?
Yes. The 2025 updates — Resolução CMN nº 5.274/2025, which amends Resolução CMN nº 4.893/2021, and Resolução BCB nº 538/2025 — require an annual penetration test ("teste de intrusão") performed by independent professionals, with documented results. The pentest report is the evidence auditors and the regulator itself expect to find.
How often do I need a pentest to comply with BACEN?
At least once a year. The framework in force requires an annual independent penetration test with documented results and a remediation action plan. Institutions with fast change cycles usually add targeted tests after every relevant release — new features, infrastructure migration or integrations — so the evidence keeps pace with the real risk of the environment.
What is the difference between Resolução CMN 4.893 and Resolução BCB 85?
Resolução CMN nº 4.893/2021 governs the cybersecurity policy of financial institutions authorised by BACEN. Resolução BCB nº 85/2021 sets equivalent requirements for payment institutions, replacing the former Circular BCB nº 3.909/2018. Both remain in force and continue to be updated by the regulator.