SUSEP launches public consultation on retention of documentation supporting independent audits; comments due by November 16, 2026

The Brazilian Superintendence of Private Insurance (“SUSEP”) has launched Public Consultation No. 11/2026 to gather market feedback on a draft resolution amending SUSEP Circular No. 605/2020, which establishes deadlines and methods for storing documents related to supervised operations. The consultation seeks to regulate the recording, retention, and access by SUSEP to documentation supporting the independent accounting and actuarial audit work of supervised entities.

The proposal seeks to address a regulatory gap. Although the retention of audit working papers and SUSEP’s access to such documents are already provided for under the applicable regulations, no equivalent obligation currently applies to supervised entities regarding documentation used during the audit process. According to SUSEP, the measure will enable verification, including through retrospective reviews, that the evidence relied upon by the auditor corresponds to the report submitted with the financial statements.

According to the explanatory memorandum, the proposal does not create new documents or expand the scope of audit work; rather, it regulates the retention of existing documentation. The analytical register containing a cryptographic hash was introduced to mitigate the risk of discrepancies between the files maintained by the supervised entity and those maintained by the auditor, allowing verification of whether any document has been deleted, replaced, or altered. SUSEP waived the Regulatory Impact Assessment (“AIR”), on the grounds that the regulation is intended to preserve the liquidity, solvency, or soundness of the supervised markets.

Compared to the current wording of SUSEP Circular No. 605/2020, the main proposed changes are as follows:

• Inclusion of audit documentation among the documents subject to retention requirements (Article 2, Paragraph 3, IV): Data, information, and documents provided by the supervised entity to the independent auditor and independent actuary, as well as documents issued by them and delivered to the supervised entity during the course of the engagement, will now be expressly covered.
• Starting point of the retention period (Article 3, Paragraph 4): For such documentation, the minimum five-year retention period established under Article 3 of SUSEP Circular No. 605/2020 will be counted from the date of the independent auditor’s or independent actuary’s report, as applicable, thereby standardizing the calculation for documents created on different dates.
• Preparation of an analytical register of documentation (new Article 11-A): For each independent accounting and actuarial audit engagement and for each fiscal year covered, the supervised entity must prepare an analytical register of documentation containing, at least:
  • Identification of the engagement, the independent auditor or independent actuary, and the fiscal year to which it relates.
  • The name, format, and size (in bytes) of each file.
  • The cryptographic hash of each file, generated through the SHA-256 algorithm or another more robust algorithm accepted within the scope of the Brazilian Public Key Infrastructure (ICP-Brasil).
  • The date on which the document was provided to, or received from, the auditor or independent actuary.
• Digitization of physical documents (Article 11-A, Paragraph 1): Documents provided or received in physical format must be digitized in accordance with the applicable legislation and included in the analytical register.
• Digital signature and sharing with the auditor (Article 11-A, Paragraphs 2 and 3): The register must be signed within 30 days from the date of the independent auditor’s or independent actuary’s report using an ICP-Brasil digital certificate and accompanied by a timestamp issued by an accredited Time Stamping Authority, the officer responsible for accounting matters (for accounting audits), or by the technical officer in charge (for actuarial audits). Within the same period, a copy must be delivered to the independent auditor or actuary for inclusion in their audit documentation.
• Availability to SUSEP (Article 11-A, Paragraph 4): The register must be retained for the same retention period and made available to SUSEP whenever formally requested.

In practice, if the resolution enters into force on the proposed date, the new obligations may already apply to audit engagements relating to fiscal year 2026, the corresponding audit reports for which are typically issued in early 2027. This will require insurers, capitalization companies, open private pension entities, and local reinsurers to adapt, within a short timeframe, their internal processes for organizing, digitizing, ensuring the integrity control of, and signing the documentation shared with independent auditors, as well as to review their document governance procedures and alignment practices with such auditors. It is also noteworthy that personal responsibility for signing the list of documents will be assigned to both the officer responsible for accounting matters and the technical officer in charge.

If approved, the resolution will enter into force on January 2, 2027.

The public consultation will remain open for 30 days, and interested parties may submit comments and suggestions until November 16, 2026, through SUSEP’s Public Consultation System. The consultation documents are available in full on SUSEP’s website and may be accessed through the links below:

• Draft resolution
• Explanatory memorandum
• Comparative table

Demarest’s Insurance, Reinsurance, Health and Private Pension team is monitoring this matter and remains available to provide any necessary clarification.