SUSEP updates anti-money laundering rules and strengthens governance, documentation, and decision traceability requirements

Brazil’s Superintendence of Private Insurance (“SUSEP”) has issued SUSEP Resolution No. 99, updating the rules on policies, procedures, and internal controls aimed at preventing money laundering, terrorism financing, and the financing of the proliferation of weapons of mass destruction (“AML/CFT”) applicable to the markets supervised by the authority. The regulation revokes SUSEP Circular No. 612/2020 and will enter into force on January 1, 2027.

Among the main changes, the following stand out:

• the expansion of the scope of entities subject to the regulation, which now expressly includes insurance cooperatives, mutual asset protection operators, and client order processing companies (“SPOCs”);
• the strengthening of the risk-based approach;
• the update of the rules applicable to politically exposed persons (“PEPs”); and
• the detailing of procedures related to customer identification, qualification, and classification, transaction monitoring, internal governance, training, recordkeeping, knowledge of employees, partners, and outsourced service providers, effectiveness assessment, and reporting of suspicious situations to the Financial Activities Control Council (“COAF”).

The new resolution also requires supervised entities to conduct an internal risk assessment, duly documented, approved by the responsible director and reviewed every two years or whenever there are significant changes in risk profiles. In addition, it is recommended that they adopt due diligence measures proportionate to the level of risk identified, which may be simplified, standardized, or enhanced depending on the characteristics of customers, beneficiaries, transactions, products, distribution channels, and the activities of employees and partners.

Another relevant aspect is the greater level of detail in the rules relating to the analysis and reporting of suspicious transactions. Reports to COAF must be submitted within 24 hours from the conclusion of the analysis and must contain the rationale for the suspicious situation identified. In addition, exemptions from analysis and the adoption of simplified procedures must be justified and documented, and the annual effectiveness assessment report must list the events identified through enhanced due diligence, together with a summary of the conclusions that supported the decision on whether to report the matter to COAF.

Main obligations and deadlines

• Governance: the AML/CFT policy must be documented, approved by the board of directors or, if none exists, by management, and kept up to date. The designation of the responsible director is mandatory for each supervised entity, including where a centralized policy, risk assessment, or effectiveness report is adopted at the conglomerate level.
• Ultimate beneficial owner and PEPs: ownership of more than 25% of the capital is presumed to constitute significant influence. Verification of PEP status, as well as that of family members and close associates, must be carried out regardless of a negative self-declaration, through consultation of public or private information or databases, with annual review of registration records in cases of simplified due diligence.
• Reports to COAF: in addition to suspicious transaction reports, these are automatically required, regardless of analysis, for cash payments of insurance premiums, contributions, contributions of funds, or purchases of capitalization bonds equal to or greater than BRL 10,000, and for payments of redemptions, indemnities, or prize winnings to accounts abroad equal to or greater than BRL 100,000. In the absence of any reports during the previous calendar year, a negative report must be submitted by the last business day of March.
• Effectiveness assessment: annual report, with a reference date of December 31, to be submitted to management, the board of directors, if any, and the audit committee, where applicable, by March 31 of the following year, containing the methodology, tests, indicators, deficiencies, remediation schedule, and statement by the responsible director.
• United Nations Security Council (UNSC) sanctions: asset-freezing determinations must be implemented immediately and without prior notice, with notification to SUSEP, the Ministry of Justice and Public Security, and COAF, considering that such obligations are not subject to the risk-based approach.
• Proportional regime: insurance brokers with annual gross revenue below BRL 12 million, admitted reinsurers, and SPOCs may adopt controls compatible with their risks, subject to minimum obligations, and must document the risk assessment supporting such classification.
• Ongoing action plans: action plans related to findings from SUSEP inspections must be adapted to the new resolution.

Practical impacts and key points of attention

Although the regulation maintains several concepts already familiar to the market, the new resolution demonstrates a clear shift in regulatory focus.

From a compliance and risk management perspective, the regulation deserves attention not only because of the expansion of obligations related to the prevention of money laundering and terrorism financing, but mainly because of the reinforcement of the risk-based approach and the requirement to document the analyses performed.

In practice, it will not be sufficient merely to demonstrate the formal existence of policies, manuals, and internal controls. The resolution requires effective controls, subject to an annual assessment of effectiveness. In addition, it requires the maintenance of studies, analyses, and reports evidencing compliance, making it necessary to demonstrate how risks were effectively identified, which criteria guided the classification of customers and transactions, which elements were considered in the analyses performed, and why a given situation was, or was not, reported to COAF.

In this context, supervised entities are advised to review their analysis, documentation, escalation, and reporting flows, ensuring that decisions taken throughout monitoring and investigation processes can subsequently be reconstructed, justified, and demonstrated before regulatory authorities.

The new regulation also highlights the growing importance of traceability of compliance decisions. In the event of an inspection, administrative proceeding, or investigation, the ability to demonstrate the grounds supporting the analyses performed may be just as relevant as the existence of the internal controls themselves.

From a criminal law perspective, the proper documentation of risk assessment, monitoring, and decision-making processes is particularly relevant. Violations of the resolution are subject to the administrative sanctions provided for in Article 12 of Law No. 9,613/1998, and a consistent decision trail helps demonstrate the diligence of the institution and its managers. In this context, proper documentation of the analyses performed and decisions adopted may constitute an important element in rebutting allegations of individual criminal liability, particularly with respect to the responsible director and other managers, in investigations related to the crimes provided for in Article 1 of Law No. 9,613/1998, reinforcing the importance of governance structures capable of demonstrating the reasonableness, consistency, and effectiveness of the measures implemented by the institution.

From a technical perspective, it is worth noting that the resolution assigns the definition of relevant parameters to the entities themselves, including the maximum timeframes for transaction selection and analysis completion, the criteria for simplifying procedures, and the situations in which individual analyses may be waived. As the 24-hour reporting period to COAF is measured from the conclusion of the analysis, the calibration of these internal parameters, including their supporting rationale, is likely to become a central focus of supervisory activities. Additionally, the regulation does not provide for a specific transition rule regarding the adaptation of the existing customer base. Accordingly, it is recommended that the review process be initiated immediately, taking into account the deadline of January 1, 2027.

For more information, access: SUSEP Resolution No. 99/2026

Demarest’s Insurance, Reinsurance, Health and Private Pension and Compliance and Investigations teams are monitoring the matter and remain available to assist in assessing and mitigating the impacts of the new regulation.