RC 21: what changes in Open Finance data partnerships

Joint Resolution No. 21 set specific rules for sharing Open Finance data with partner companies, and it is already in force. Here is the flow and what changes.

Marcelo MartinsMarcelo Martins6 min read
PTEN

What RC 21 is

Since 22 October 2026, sharing Open Finance data with partner companies has had rules of its own. Joint Resolution No. 21, issued by the Central Bank of Brazil and the National Monetary Council, amended the 2020 rule that created Open Finance and took effect on the day it was published. It sets clearer rules for these partnerships, reinforces customer consent, and raises security and performance standards.

In Open Finance, the customer authorizes the sharing of their banking data with another institution in order to use a product or a service. RC 21 deals with an arrangement that is common in this market. An institution authorized by the Central Bank receives the customer's data through Open Finance and passes it on to a company that uses it in its own product: a personal finance app, a lending platform, a management system.

RC 21 gives each party in that relationship a name. The authorized institution that receives the data and passes it on is the integrating institution. The company that receives the data from it, under contract, is the partner entity. The agreement between the two is the partnership agreement.

The rule covers any data that still identifies the customerInside the partnership regimeRegistration and transaction dataobtained through Open FinanceDerived data that still identifies thecustomer, such as credit scoresSharing with a non-authorized companyin the same economic groupOutside itProcessors acting on the integrator'sbehalf, with no purpose of their ownDerived data that does notidentify the customerPayment initiation services(the regime covers data only)
Scope of the rule: what is covered and what is not

What sets the scope is whether the data still identifies the customer, not the name the data is given.

How the flow works

There are four steps. The customer authorizes once at the bank and then confirms, on the integrator's screen, who will receive the data.

The customer authorizes at the bank, then confirms each partner entity1 authorizes at the bank2 sends the data4 shares under contract3 confirms sharing with that specific partner, on the integrator's screenCustomerowns the data; canrevoke at any timeCustomer's banksends the datathrough Open FinanceIntegratinginstitutionauthorized by the BCB;answers for the dataPartner entityuses it only for theagreed purposesharing prohibitedThird partiesWho supervisesCentral Bank: can access contracts and reports, and veto or suspendCVM-registered auditor: attests the assessment, renewed every year
The data partnership flow in four steps

The customer authorizes at the bank and, on the integrator's screen, confirms which company will receive the data. The partner entity uses the data only for that purpose and cannot pass it on.

The points that matter most

  1. One consent for each partner entity. The customer expressly authorizes sharing with that specific company, in the integrating institution's environment, which has to identify the customer before passing on any data. The partner entity is named clearly, and the same Open Finance rules on consent and revocation apply here.
  2. Broad scope. It covers registration and transaction data, and also derived data that still identifies the customer, such as credit scores and ratings. It leaves out anyone who merely processes data on the integrator's behalf, with no purpose of their own. Payment initiation services are out of scope as well.
  3. Prior assessment of the partner entity. Before contracting, the integrator checks whether the partner has adequate security, confidentiality and access controls. That check is attested by an independent auditor registered with the CVM, Brazil's securities regulator, on terms the Central Bank is yet to define, and repeated at least once a year.
  4. A contract with mandatory content. The agreement has to set out, among other points, where the data may go, the Central Bank's access to it, incident reporting, and what happens to existing consents if the partnership ends.
  5. No onward sharing. The partner entity uses the data only for the purpose the customer accepted and deletes it once that purpose is over. It cannot pass the data on, nor the data derived from it, nor try to reconstruct transaction data by reverse engineering.
  6. Four prohibited partnerships. There can be no data partnership between two authorized institutions, nor with a company from a group that has an authorized institution outside Open Finance. Nor can the partner act on the integrator's behalf, or carry a name typical of a financial or payment institution — in any language.
  7. The integrator is the one accountable. It answers to the Central Bank for the security, the availability and the confidentiality of the data it shares. The rule also starts to require performance, meaning the quality of the API services, measured by indicators the Central Bank defines.

In practice, this is how the customer confirms sharing with the partner entity:

The customer sees who receives the data, why and for how longIntegrator · via Open FinanceShare your dataCompany that will receive the dataTax ID 00.000.000/0001-00Purpose: e.g. credit assessmentData: accounts and cardsUntil: the date shownUsed only for this purpose; deleted afterAuthorizeDon't authorizeYou can revoke this at any timeWho receives itthe partner entity, named, with tax IDPurpose, data, time limitstated purpose, scope and termExpress consentNo pre-ticked boxes
Sharing confirmation screen — illustrative example

The screen lives in the integrator's environment. The wording is illustrative; what has to be shown at this step is still to be detailed by the Central Bank.

The rule also opens the way for the decoupled approval flow: the consent request starts in one environment and approval happens later, at the bank, with no redirect and possibly by a different person. That is what could enable, for instance, payments and authorizations at companies that require more than one approver. This flow still depends on specific regulation and on the Open Finance technical specifications.

What does not change, and what is still to come

The customer still authorizes at the bank and now explicitly confirms who will receive the data, and can revoke at any time. For institutions that take part in Open Finance under their own license, the relationship with their technology providers does not change either. Some of the prohibitions, such as the one on partnerships between authorized institutions, already existed and were kept.

The rules are already in force, but how to comply with some of them depends on further regulation from the Central Bank:

The rules are in force; how to comply with some of them is still to comeOct 22, 2026Published and inforce: the rulesalready applyBy Dec 1, 2026Existing partnershipsmust be reportedto the BCBDate to be setBCB rulemaking: audit,report, indicators,consent screenSchedule to be setContracts and consentsto be adapted; thenannual verificationA partnership that falls into a prohibition — the partner becoming BCB-authorized, say — has six months to end.
The RC 21 timeline in four phases

What this means for companies that use Open Finance data

For those receiving data through an integrating institution, the message is direct: consent that names them, a fuller contract, annual verification, and use restricted to the purpose. Companies already operating this way should have little to change.

Iniciador's Regulatory Innovation team took an active part in shaping the rule with the Central Bank, through seat 2.3 of Open Finance governance and the ABFintechs and INIT associations. We remain in that dialogue now, as the complementary regulation is drafted.

At Iniciador, consent for each partner entity is already collected in our own environment, right after the authorization at the bank, on a screen that identifies who will receive the data. For institutions authorized by the Central Bank, the path is still to take part in Open Finance under their own license, and Iniciador provides the infrastructure for that.

It is a rule that matches the way Iniciador has always seen Open Finance: clear accountability, the customer at the center, reliable infrastructure. We have followed this work closely from the start and remain in close dialogue with the regulator and with the ecosystem's governance.

Source: Joint Resolution No. 21, of 22 October 2026 — Banco Central do Brasil