This was the text used for publication at the UIA Congress of 2000 in Buenos Aires.

It was also presented by Eliana Maria Filippozzi to the Banking and Financial Services Commission on 1 November 2000.

Buenos Aires, October 29th November 2nd

Buenos Aires, 29 Octobre – 2 Novembre

Buenos Aires, 29 Octubre – 2 Noviembre

E-BANKING : REGULATORY AND CONTRACTUAL CHALLENGES IN BRAZIL

E-BANKING : DÉFI RÉGULATOIRE ET CONTRACTUEL AU BRÉSIL

E-BANKING : DESAFÍOS DE REGULAMENTACIÓN Y CONTRACTUALES EN BRASIL

Eliana Maria Filippozzi

Partner, Banking Department, member of the Brazilian and Portuguese Bars and solicitor of the Supreme Court of England and Wales

November 1st , 2000

1 Novembre 2000

1 Noviembre 2000

Ó UIA

UNION INTERNATIONALE DES AVOCATS

E-BANKING: REGULATORY AND CONTRACUAL CHALLENGES IN BRAZIL

I – The Regulatory Framework

1. Is there any law or a regulation in your jurisdiction relating to and/or organising the creation of a virtual bank?

No. Despite the fact that there are many virtual banks operating in Brazil and many traditional banking institutions rendering services through the Internet, up to now there is no law or regulation whatsoever in Brazil related to or organising the creation of a virtual bank, nor any regulation that provides rules for the rendering of banking services through the Internet. Thus, all the regulations presently applicable for such activities are those normally applied to traditional banks.

There is currently a project of law awaiting approval by the Federal Senate. This is project of Law 672 of 1999, which was based on the UNCITRAL model for electronic commerce with proceeding number 672/99. This project does not specifically provide for e-banking activities, but it regulates e-commerce activities in general.

According to information provided by the Regulation Department of the Central Bank of Brazil (DENOR), the banking authorities are only waiting for the final approval of the project, to issue regulations that deal specifically with the activities of virtual banks.

2. If yes:

2.1 What are the differences between such law or regulation and those applicable to traditional banks?

Although, as mentioned above, there are not yet any law regulating e-banking activities, it is possible to point out some differences that the project of law 672/99, will bring about in face of the present legislation if approved with the same text that it presently has.

The main innovation of such project is the fact that banks and clients will be able to conduct all their business through the Internet. According to Resolution 2025/93 of the Central Bank of Brazil, which regulates the opening, maintenance and operation of banking accounts in Brazil, for instance, the physical signature of the client on the documentation required for the opening of a bank account is strictly necessary, and the bank manager is also required to check the trustworthiness and authenticity of such signature, as well as every other document presented by the client. In this regard, article 7 of project of law 672/99 determines that any signature required from a person may be substituted by an electronic message, as long as there are technological means to identify the sender of such message and the message expressly contain the sender´s approval to the content of such message. Thus, the requirement of a physical signature of the client for the opening of a banking account, for example, will no longer be necessary after the approval of this project of law.

2.2 How many virtual banks exist if any in your jurisdiction?

According to the last research performed by the Brazilian Federation of Banking Association (FEBRABAN) in this regard, which occurred in 1999, approximately 50% of the 201 Brazilian Banks were already rendering services through the Internet. Just for a comparison, we understand that in the United States of America, where the number of banking institutions is approximately 43 times greater than Brazil, in the same period of 1999 the number of banks rendering services through the Internet was equivalent to 11,3%. There is no data related to the year 2000 yet, but projections are very high as there is a huge market trend for e-banking. There are, for instance, many banks in Brazil that offer free and unlimited Internet access to its clients.

However, despite the fact that most of the Brazilian banks offer services on the Internet, according to a research performed in 1999 by the Central Bank of Brazil, only 4% percent of the clients of banks at the time were using e-banking services. This number, however, have been increasing considerably. According to a similar research performed in 1998, only 1% of the banking clients at the time were using e-banking services. It is estimated by the FEBRABAN that by the end of year 2000, at least 25% of the clients will be using internet banking services in Brazil.

As an example of the great increase in the utilisation of such technology in Brazil, the federal state run Banco do Brasil, which has offered e-banking services since 1997, has jumped from approximately 400,000 e-banking transactions in December 1998 to over 4 million transactions by October 1999.

3. If no

Can/do foreign virtual banks freely provide services in your jurisdiction? Under what condition and control?

Yes, foreign virtual banks can freely provide services in Brazil. As long as they are authorised by the Central Bank and other competent authorities to operate in Brazil, foreign banks situated in Brazil can freely render services through the Internet. Foreign Banks operating in Brazil undergo exactly the same regulations and conditions as Brazilian banks. Thus, there are no difference regarding the rendering of e-banking services.

If the foreign bank is situated abroad, there is no law or regulation in Brazil applicable to such matters. Thus, since Brazilian citizens are authorised to maintain banking accounts abroad, there is no restriction on Brazilian clients to operate such accounts or to have e-banking services rendered by the banks abroad. However, in this case, the legislation related to capital remittances to and from Brazil shall be observed, and all the values maintained by the client residing in Brazil shall be informed to the Federal Revenue Service.

4. Has your national regulatory/supervisory authority addressed or reflected on the regulatory issues resulting from the creation and operation of a virtual bank?

Yes, the Regulation Department of the Central Bank of Brazil, is presently discussing and creating regulations regarding the rendering of Internet services by the banks operating in Brazil. The issuing of such regulations is only pending the approval by the Federal Senate and presidential sanction of the above-mentioned project of law 672/99 which shall regulate e-commerce in Brazil. There is not yet a definite estimate on to when this regulation shall be approved, but according to the Central Bank, as soon as the new legislation enters into force, regulation regarding e-banking will be issued.

II – Contract and e-banking

1. Is there a specific law, regulation, standard or recommendation (e.g. from regulatory/supervisory authority) (each and together a “Provision”) in your jurisdiction specifically relating to e-banking?

No, up to now there is only a project of law from the Federal Senate of proceeding number 672/99, which generally rules on e-commerce, and is pending approval by the Senate and subsequent presidential sanction. According to the Central Bank, there are presently no specific recommendations to financial institutions regarding the rendering of services through the Internet. Thus, the same regulations and controls applicable to traditional banks are currently applicable to the banking services rendered through the Internet, because Brazilian legislation has generic provisions that can be extended to e-banking activities.

1.1. If no:

– Is there a general (versus specifically e-banking related) Provision in your Jurisdiction relating to:

– privacy
– electronic identification (e-wallet, network protection, encryption, firewalls; information access controls, PINS)
– electronic payment (national/cross border); secure payment transactions,
– electronic evidence rules
– electronic contract making (e.g. battle of forms, effectiveness of general conditions);

Regarding privacy, Brazilian legislation protects and guarantees privacy and secrecy in all banking operations. Law n. 7492/86, which defines the crimes against the National Financial System, in article 18, determines that the violation of secrecy of information of operations or services rendered by a financial institution or any other component of the national system of securities distribution, to which it had access due to its professional activities, subjects the infringer to a penalty of imprisonment from 1 to 4 years, plus fine.

In view of the above, the banking services rendered through the Internet by financial institutions, as well as any other activity performed by traditional banks, are also comprised by the provisions of Law 7492/86. Thus any violation to protected information transmitted through the Internet shall be punished by law.

Furthermore, Law n. 4595/64, which brings the general regulations for financial institutions in Brazil, provides in article 38 that “the financial institutions shall maintain secrecy in all of its operations and services”. Despite the fact that the Brazilian legislation does not stipulate any specific provision regarding privacy of electronic information or Internet data transmission, it can be considered to protect the same due to article 5, clause XII of the Federal Constitution of Brazil, which determines that all forms of correspondences, communications and data transmission shall be protected.

Regarding the electronic identification, payment, contracts, proof among others, there is no provision whatsoever in Brazilian legislation concerning such issues. Thus the law neither grants nor hinders the validity of such instruments. In view of this, any legal conflict arising from matters regarding electronic communications are presently solved by Brazilian courts and tribunals. Nowadays, most of the courts admit the existence, validity and efficiencies of business, transactions and operations carried out by electronic means, as well as the recognition of commitments, as long as such communications can be proved in court by the parties or by experts.

Even though there is no legal regulation, electronic contracts, transactions and operations are widely performed in Brazil, and the parties normally apply the general legislation regarding traditional contracts and businesses to regulate them.

In view of the increasing utilisation of electronic means in Brazil, the above-mentioned project of law n. 672/99 shall be enacted to regulate and grant a legal certainty to such operations. Such project provides the recognition of all legal effects, validity and efficiency of the information and transactions exchanged and performed by electronic means, as well as to the declarations and commitments assumed through electronic messages.

– If no general Provision exists how does your law address the effectiveness and validity of electronic signature, electronic payment, electronic evidences issues and electronic contract making ?

As mentioned above, although there is a project of law which awaits approval, presently there is no regulation on these issues in the Brazilian Legal System. However, according to art. 332 of the Brazilian Civil Procedure Code, all legal and morally legitime means may be used to prove a fact, even if not provided in the relevant legislation. Thus, in order to demonstrate that a electronic signature is authentic, or that a electronic contract was concluded or any other obligations by electronic means were assume, one can rely on a variety of evidence that can be produced, such as oral testimony, documentary, admissions, expert examination, among others. The evidence that may be produced in order to demonstrate a virtual relationship is the same that can be produced to prove a non-virtual relationship. The evidence related to Internet transactions are normally produced by judicial experts specialised in computing.

1.2 If yes

– Can you please generally describe the specific Provision(s)?

As mentioned above, there is no specific provision on this regard.

– Is there a distinction to be drawn between e-private consumers and e-business consumers?

There is no legal distinction between “e-private consumers” and “e-business consumers”. According to Article 2, of the Brazilian Consumer Code, “a consumer is any individual or legal entity who acquires or uses products or services as a final consumer”. Consumers are protected by the rules of the Consumer Code based in the following principles: a) strict liability of the supplier; b) burden of the proof on the supplier; c) joint liability of suppliers, and; d) right to safety and information.

– Does the existence of such Provision(s) rule out the application of underlying existing legal or regulatory Provision(s) (e.g. U.C.C., Civil Code, law on trade practises, consumer protection etc)?

Since such provisions do not yet exist, this question is not applicable at present. However, in the hypothesis that new laws and regulations enter into force, according to the Brazilian general principles of law, the new regulations shall only rule out or revoke the existing regulations of same or inferior hierarchy if their previsions are directly conflicting with the existing regulation or if they provide that the existing regulation shall be revoked. However, since the laws which are being designed to regulate electronic businesses will include relations that already exist in accordance with the general principles of law and the existing regulations, it is more likely that such new regulations will only serve as a complement to the existing laws, and do not rule out the application of the same. In this regard, the mentioned project of law 672/99 recognises as legally valid electronic transactions conforming to the existing laws and regulations, without overriding any present law.

2. Is it possible in your jurisdiction to electronically:

– enter into:

– consumer credit agreements

– mortgage credit agreements

– secured credit agreements

– collect reimbursable funds and deposits

– issue ban guarantees

Yes, to a certain extent. There are many banks in Brazil that offer these types of contracts and services through the Internet, applicable to all the uses and conditions normally applied to traditional contracts and services. However, according to the present legislation, such operations cannot be completely performed through the Internet. Normally, the contacts between the client and the bank, the negotiation, the settlement of conditions and the commitment can be performed electronically. However, to actually sign the agreement and legally close the deal, the client must go to the bank, personally or through an attorney in fact, to deliver the required documentation and sign any required guarantees. Resolution n. 2025/93 from the Central Bank, determines that the documentation must be physically delivered and the bank manager must personally check the authenticity of the documentation and signatures.

3. Do your answers sub II.1. to 2. Vary according as the bank is a virtual bank or not?

No, in Brazil the regulations applicable to the traditional banks are exactly the same as to those applicable for virtual banks.

Likewise, does the technology used have any impact (e.g. phone banking, telephone network, Internet, on line PC banking, Internet banking using a software directly available on Internet.)?

Yes, since the majority of Brazilian banks offer services through the Internet and since the utilisation of such services increases daily, the technology utilised to render e-banking services in Brazil had a great evolution in the last few years, each time allowing more efficiency and security in the performance of e-banking activities. As a matter of fact, Brazil is one of the leading countries in the development of banking technology, as the banks located in Brazil have invested, according to the FEBRABAN, approximately US$ 1 billion in e-banking activities solely in the year of 1999. Brazil has many software companies specialised in the development of software used in the secured transmission of banking information through the Internet and software increasing the possibilities of e-banking used in Brazil. Many new concepts for e-banking technology were developed in Brazil, and Brazilian e-banking software companies are now extending their market by exporting their technologies to many regions of the world, such as Latin America, Europe and North America.

4. Is there any Provision in your jurisdiction regulating non-cash electronic payment instruments?

No. Although this variety of payment is very common among financial institutions in Brazil, there is no specific regulation on this matter.

5. Does the money laundering legislation/ regulation in your jurisdiction specifically address e-banking?

No, there is no specific mention of Brazilian money laundering regulation in respect of e-banking. Law 9613/98, which regulates the crimes of money laundering determines that it is considered money laundering to “hide or obscure the nature, origin, location, disposition, movement or property of goods, rights or values arising, directly or indirectly” from a series of crimes, such as drug traffic, contraband, crimes against the national financial system, among others. Thus, any activity that shall be considered money laundering and is performed, in part or in full, by “e-banking” transactions, shall be subject to all the legal penalties and sanctions applicable to activities in general.

6. What are your conflict of law rules in the absence of any agreement on the law governing the following transactions?

– e-loan

– e-credit

– e-consumer credit

– e-mortgage credit

– e-issue of a banking guarantee

– e-deposit with the bank?

The Brazilian conflict of law rules are contained in the Introductory Law to the Civil Code (LICC).

Article 9, of the LICC, establishes that any dispute arising from any international contractual obligation must be ruled by the law of the country where they were contracted. In that way, the obligations shall be presumed to have been contracted:

i. At the place of residence of the offeror (Art. 9, §2nd, of the LICC), and/or;

ii. At the place where the contract is proposed (Art. 1.087, of the Brazilian Civil Code).

In accordance with Article 16 of the LICC, if the applicable foreign law establishes applicability of the law of a third country this provision will not be recognised in Brazil.

If the obligation is to be performed in Brazil and if it depends on an essential form, this shall be observed with due consideration to the foreign law requirements for its implementation, pursuant to the Article 9, §1, of the LICC.

Furthermore, foreign legal provisions cannot override provisions of public order or go against the national sovereignty and good morals. Provisions of the Consumer Code are considered to be part of the public order.

Brazilian assets are governed by Brazilian law and so is any guarantee covered by assets in Brazil.

7. Is there any specific/derogatory liability regime applicable in e-banking transactions?

No, there is no specific regime regarding this matter. The liability regime for e-banking transactions is exactly the same as the liabilities regarding traditional banking activities.

What is the impact on the liability of the bank resulting from disputed cash withdrawals, breach of the banking security system, vulnerability of the on line PC and/or Internet Banking systems?

According to the Brazilian legislation, the bank is deemed to be fully responsible for any damages or losses that the client may suffer from the normal utilisation of its e-banking services. This liability prevails even if the bank was not negligent nor imprudent and was not responsible for the specific event that caused the damage to the client. Thus, the banking institutions in Brazil are bound to the so-called “strict liability”, regardless of the occurrence of any fault by the service provider. This happens, according to the Brazilian Consumer Code, as banking activities are equivalent to the normal rendering of services to consumers, who are protected against any loss occurred during the service rendering.

In view of the above, if the client suffers damage due to a bug on the bank´s electronic system, the bank has to indemnify the client for all the losses suffered by the client, even though the failure was originated in a fault of the Software company that installed the bank´s computer system. In this case, after paying for the client´s losses, the bank has the right to claim the software company all the money it lost due to the computer failure, but it cannot exempt itself from indemnifying the client.


Can a bank exonerate itself from any liability resulting from a damage caused by a breakdown of the PC banking technology?

No, as explained above, the bank cannot exonerate itself from any liability resulting from damage caused by a breakdown in its technology, as the banking activity is considered to have “strict liability” in the activity of rendering banking and e-banking services. In view of this, the bank is always responsible towards the client, who is considered to be a consumer by the Brazilian Consumer Code. However, the bank may eventually claim the losses it has suffered due to a breakdown in its technology from the companies that developed and installed its technology, or from its hardware supplier, or even from the employees responsible for the functioning of the bank´s system, as the case may be.