CVM Resolution 245: Enhanced Due Diligence for Non-Resident Investors and Structures Linked to FATF-Listed Jurisdictions

Executive summary

On July 1, 2026, the Brazilian Securities and Exchange Commission (CVM) issued CVM Resolution 245, amending CVM Resolution 50/2021, the core rule governing the prevention of money laundering, terrorist financing, and the financing of the proliferation of weapons of mass destruction (AML/CFT/CPF) in the Brazilian capital markets. The new rule, effective as of July 15, 2026, introduces Article 17-A, which imposes enhanced due diligence measures on transactions and situations involving non-resident investors (NRIs) domiciled, headquartered, or incorporated in jurisdictions included in the FATF lists and, more broadly, on any clients, resident or not, whose corporate structures, chains of control, ultimate beneficial owners, or representatives are directly or indirectly linked to such jurisdictions.

The most significant practical impact stems from the current composition of the FATF’s increased-monitoring list (the “grey list”), which includes the British Virgin Islands (BVI) and Monaco. Structures involving vehicles in those jurisdictions are no longer regulatorily neutral and will, as a matter of law, attract additional scrutiny from intermediaries, fund administrators, and asset managers.

The context: converging pressure on Brazil’s AML/CFT framework

Resolution 245 should not be read in isolation. Its issuance, under an expedited procedure, with waivers of both regulatory impact analysis and public consultation, reflects a moment of converging pressure on Brazil’s anti-money laundering framework, on three fronts.

First front. Follow-up to Brazil’s FATF mutual evaluation. Formally, the rule is part of the enhanced follow-up process to which Brazil was subjected after its most recent mutual evaluation, and seeks to align CVM regulation with FATF Recommendation 19 (enhanced due diligence for higher-risk countries), which until now lacked an express normative counterpart at the agency level. The country’s reassessment timeline was expressly invoked to justify the expedited procedure.

Second front. Recent scandals in the financial system. The domestic environment has been profoundly reshaped by two episodes. The Banco Master case exposed serious supervisory failures and the use of layered structures (funds, securities dealers, offshore vehicles) to conceal the origin and destination of assets. In turn, Operation Carbono Oculto (August 2025) and its subsequent phases revealed the infiltration of the PCC, which is Brazil’s largest criminal organization, into the fuel sector and the financial markets themselves, with approximately BRL 30 billion invested across dozens of investment funds, and fintechs operating as “parallel banks” through pooled accounts that obscured the identification of ultimate beneficial owners.

The final front: international pressure. In May 2026, the U.S. government designated Comando Vermelho and the PCC as Specially Designated Global Terrorists (SDGT) and, effective June 5, as Foreign Terrorist Organizations (FTO), in addition to imposing sanctions on associated Brazilian individuals and entities. Although this is a distinct legal regime with no formal interface with the FATF lists, the designation significantly raises reputational and correspondent-banking costs for the Brazilian financial system, creating an additional incentive for the demonstration of regulatory robustness.

This landscape, combined with the longstanding use of offshore structures for wealth planning purposes in Brazil, led the regulator to convert into an express normative obligation what had previously been addressed under each institution’s own risk-based approach.

What changes: the mechanics of Article 17-A of Resolution 245

The rule operates on two levels. First, it extends to transactions involving NRIs from listed jurisdictions the regime of Article 16 of CVM Resolution 50, originally designed for cases in which the ultimate beneficial owner cannot be identified, including a new wording of its paragraph 1, item I, which now requires continuous and enhanced monitoring regardless of the investor’s risk classification. In such cases, the institution’s internal risk matrix ceases to be the determining filter.

Second, paragraph 1 of Article 17-A establishes a minimum set of enhanced due diligence measures, which must include:

• additional restrictions or conditions for the establishment of business relationships (onboarding control);
• limitation, postponement, or refusal of transactions involving assets classified as higher-risk (operational control, with express normative grounds for holding pending transactions while due diligence is completed);
• requests for additional information or supporting evidence (a documentary standard, not a merely declaratory one); and
• termination of the business relationship upon identification of risks deemed unacceptable and incapable of mitigation (mandatory offboarding, conditioned on a demonstrated attempt at mitigation).

As this is a minimum set of measures, institutions’ internal policies may, and, in the current environment, will tend to, go further.

The expanded reach of Article 17-A, paragraph 2: wealth structures in the crosshairs

The provision with the broadest reach is paragraph 2 of Article 17-A, which extends the enhanced due diligence duties to clients, whether non-resident investors or not, connected to corporate structures, chains of control, ultimate beneficial owners, or representatives directly or indirectly linked to the listed jurisdictions, as well as to any other high-risk situation derived from the FATF lists.

Three consequences stand out. First: a Brazilian resident whose wealth structure includes a vehicle incorporated in a listed jurisdiction (a BVI holding company or trust, for instance) is captured by the rule even without NRI status. Second: an indirect link suffices, which captures multi-layered structures, including those designed precisely to interpose distance between the principal and the listed vehicle. Third: the final, open-ended clause imposes on institutions an ongoing duty to derive other high-risk scenarios from the FATF lists, broadening both the discretion and the responsibility of intermediaries.

Practical impacts

For investors and families with offshore structures. Structures involving vehicles in the BVI, Monaco, or other grey-list jurisdictions (currently 22, including, among others, Venezuela) are likely to face slower and costlier onboarding, heightened documentary requirements regarding the source of funds and ultimate beneficial ownership, the possibility of postponed settlement of transactions, and, ultimately, mandatory offboarding. A case-by-case assessment of restructuring, for instance, migration to jurisdictions outside the lists, is warranted, weighing reorganization costs, tax effects, and the tendentially transitory nature of grey-list status.

For regulated institutions. The short window before the rule takes effect (July 15) requires an immediate review of AML/CFT/CPF policies, risk matrices, and onboarding and monitoring procedures, in addition to screening the existing client base against the FATF lists with attention to the three annual list updates (February, June, and October) and to the need to document both the mitigation measures adopted and, in cases of termination, the impossibility of mitigation. The absence of an adequate audit trail creates exposure in both directions.

Final remarks

Resolution 245 is a targeted amendment and should not be confused with the comprehensive review of CVM Resolutions 13 and 50 contemplated in the CVM’s 2026 regulatory agenda, a signal that further adjustments are forthcoming. Our firm is available to assist with the review of wealth and investment structures potentially captured by the rule, the adaptation of internal AML/CFT/CPF policies, and the assessment of regulatory risks in pending transactions.