Covers Institutions authorised to operate by Banco Central do Brasil.

The main requirements are to maintain a risk-based AML/CFT policy; identify customers and beneficial owners; monitor and analyse operations; govern internal controls and staff responsibilities.

The preventive framework connects an institution's understanding of its customers to its understanding of their activity. Identification establishes who the customer is; beneficial-ownership analysis identifies the people behind a legal entity; risk assessment informs the level of attention; and ongoing monitoring looks for activity inconsistent with the known relationship. These functions reinforce each other rather than operating as independent checks.

An unusual transaction is a signal for assessment, not an automatic conclusion that a crime has occurred. Investigation brings together transaction history, the customer's explanation, counterparties and other relevant information. Record keeping makes those decisions reconstructable and supports the authority's ability to follow the movement of funds. Suspicious-activity reporting and routine threshold reports serve different purposes and can have different triggers.

In a payment operation, the framework affects onboarding, changes to customer information, transaction review, escalation and retention. Sanctions screening remains a related but distinct control: a sanctions prohibition can require a different response from an AML suspicion. The specific reporting authority, legal triggers and treatment of customer communications come from the applicable instrument and its implementing rules.

The instrument also addresses reporting and evidence: report suspicious operations to COAF and retain customer, risk-assessment and transaction records.