brazil-swift-ops/docs/COMPLIANCE.md

Compliance Documentation

Regulatory Framework

The Brazil SWIFT Operations Platform complies with Brazilian banking and foreign exchange regulations, including:

• Lei nº 14.286 (New Foreign Exchange Law, effective Dec 2022)
• Banco Central do Brasil (BCB) regulations
• Conselho Monetário Nacional (CMN) policies
• FATF AML standards

Key Compliance Requirements

1. USD 10,000 Reporting Threshold

Requirement: All international transfers ≥ USD 10,000 (or equivalent) must be reported to Banco Central do Brasil.

Implementation:

• Automatic detection of transactions meeting threshold
• BCB report generation
• Immutable audit logging
• 7-year retention period

Per-Transaction Basis:

• Threshold applies to each individual transaction
• Multiple smaller transactions are monitored for structuring patterns

2. Tax ID Validation (CPF/CNPJ)

Requirement: All parties must have valid Brazilian tax identification.

CPF (Individuals):

• 11 digits
• Valid checksum validation
• Required for individuals

CNPJ (Companies):

• 14 digits
• Valid checksum validation
• Required for legal entities

Implementation:

• Automatic validation on transaction submission
• Rejection of invalid Tax IDs
• Audit logging of validation results

3. Purpose of Payment

Requirement: All transactions must include a clear purpose of payment.

Implementation:

• Mandatory field validation
• Minimum length requirements
• Maximum length enforcement (140 characters for SWIFT)
• Audit trail

4. IOF Tax Calculation

Requirement: IOF (Imposto sobre Operações Financeiras) must be calculated and collected.

Rates:

• Inbound: 0.38% (0.0038)
• Outbound: 3.5% (0.035)

Implementation:

• Automatic calculation based on transaction direction
• Display in transaction details
• Inclusion in BCB reports

5. FX Contract Linkage

Requirement: Foreign exchange transactions must be linked to registered FX contracts.

Implementation:

• FX contract validation
• Contract amount reconciliation
• Contract lifecycle tracking
• Audit trail

6. AML Structuring Detection

Requirement: Detect and report potential structuring (breaking large transactions into smaller ones to avoid reporting).

Implementation:

• 30-day rolling window analysis
• Pattern detection across same parties
• Automatic flagging for review
• Escalation workflow

BCB Reporting

Report Types

1. Periodic Reports: Regular reporting for transactions meeting threshold
2. Ad-hoc Reports: On-demand reporting for specific periods
3. Compliance Reports: Regulatory compliance summaries

Report Contents

• Transaction details
• Party information (with Tax IDs)
• Amounts and currencies
• Purpose of payment
• FX contract references
• IOF calculations
• Compliance flags

Report Retention

• Retention Period: 7 years (2555 days)
• Format: JSON and CSV export
• Audit Trail: Immutable logging of all reports

Audit Trail

Audit Logging

All transactions generate immutable audit logs containing:

• Transaction ID
• Timestamp
• Rule set version
• Input data
• Evaluation results
• Decision and rationale
• User ID (if authenticated)
• IP address (if available)

Audit Retention

• Default: 7 years
• Configurable: Via environment variable AUDIT_RETENTION_DAYS
• Auto-deletion: Configurable via AUDIT_AUTO_DELETE

Audit Access

• Read-only access to audit logs
• Search by transaction ID
• Date range filtering
• Export capabilities

Rule Version Governance

Version Management

• Rule set versions tracked in audit logs
• Version changes require approval
• Migration scripts for version upgrades
• Compatibility checking

Version Format

• Semantic versioning (MAJOR.MINOR.PATCH)
• Example: 1.0.0
• Stored in package.json as source of truth

Data Retention

Transaction Data

• Retention: 7 years (configurable)
• Archival: After retention period
• Deletion: Per retention policy

Audit Logs

• Retention: 7 years (configurable)
• Immutable: Cannot be modified
• Deletion: Only per retention policy

Reports

• Retention: 7 years
• Export: Available for download
• Archival: Automatic after retention

Compliance Checklist

Before processing transactions, ensure:

• USD 10,000 threshold monitoring enabled
• CPF/CNPJ validation active
• Purpose of payment required
• IOF rates configured correctly
• FX contract validation enabled
• AML structuring detection active
• Audit logging enabled
• BCB reporting configured
• Retention policies set

Regulatory Contacts

• Banco Central do Brasil: https://www.bcb.gov.br
• CMN: https://www.bcb.gov.br/estabilidadefinanceira/cmn

Compliance Updates

This documentation is updated as regulations change. Always refer to the latest version and consult with compliance officers for specific questions.

Last Updated: 2026-01-23