New SUSEP and CNSP rules: implications for internal controls and anti-money laundering compliance

Recently issued CNSP Resolution No. 497/2026 and SUSEP Resolution No. 99/2026 strengthen the requirements applicable to the Brazilian insurance market in relation to internal controls, risk management, and the prevention of money laundering and terrorist financing.

Published on 24 September, CNSP Resolution No. 497/2026 makes targeted amendments to CNSP Resolution No. 416/2021, which governs internal control systems, risk management structures, and internal audit arrangements for supervised entities and large insurance brokers.

In practical terms, the key changes are: 

• an expansion of the minimum scope of the risk management structure, which shall include, among the guidelines applicable to the most material or priority risks, risk transfer and cybersecurity policies and, where relevant, policies addressing specific risks identified in sector-specific regulations; and
• mandatory statement, upon the appointment or replacement of the independent auditor responsible for performing the Internal Audit function, confirming compliance with the applicable restrictions and authorisations provided for in the resolution. 

As part of the same effort to strengthen governance and control mechanisms, SUSEP Resolution No. 99/2026, published on 1^st October, will fully revoke and replace SUSEP Circular No. 612/2020 with effect from 1^st January 2027. The new rule updates the framework for anti-money laundering (AML) and counter-terrorist financing (CTF) and expressly includes counter-proliferation financing (CPF) within the risks that must be monitored by the insurance sector.

The main points requiring attention from businesses are: 

• the inclusion of CPF within the scope of the regulation; 
• the inclusion of additional obliged entities: special purpose insurance companies (SSPEs), administrators of mutual asset protection arrangements, and customer order processing companies (SPOCs); 
• a strengthened role for the officer responsible for compliance with Law No. 9,613/1998, who must direct and oversee, across all areas of the entity, the implementation and operation of AML, CTF and CPF policies, procedures and controls, without prejudice to the responsibilities of the other officers within their respective areas; 
• a more developed risk-based approach, comprising three levels of due diligence: enhanced due diligence for higher-risk situations, standard due diligence, and simplified due diligence for lower-risk situations. Further subcategories are permitted, provided they are proportionate to the risk identified; 
• permission to rely on know-your-customer (KYC) procedures carried out by companies within the same group, subject to the conditions set out in the applicable regulations; 
• permission to simplify, but not waive, customer identification and verification under KYC procedures, taking into account the risk profile and nature of the business, in cases subject to standard or simplified due diligence;
• more stringent beneficial ownership identification requirements, including analysis of ownership and control structures, consultation of independent sources, and the adoption of risk-proportionate procedures;
• specific measures for business relationships involving jurisdictions classified by the Financial Action Task Force (FATF) as higher risk, including restrictions, additional conditions, refusal or limitation of transactions, requests for supplementary documentation, and termination of the relationship where the risk is considered unacceptable;
• a requirement for the annual effectiveness report to include quantitative and qualitative indicators concerning the controls in place, together with metrics relating to the monitoring, detection, selection and reporting of suspicious transactions; and
• authority for SUSEP to publish structured lists of higher and lower-risk transactions and to determine mandatory controls for specific situations. 

Although the new resolution retains the core structure of SUSEP Circular No. 612/2020, it raises the compliance standard expected of businesses, expands the framework to include CPF, and consolidates a genuinely risk-based approach to controls.

As a next step, entities should assess the impact of the new rules and review their policies, procedures, systems and controls. Priority should be given to risk classification, the integration of CPF requirements, KYC processes, transaction monitoring, and the quality of regulatory reporting, with a view to achieving timely compliance and mitigating operational, regulatory and reputational risks.