New Era of Financial Cybersecurity: Regulatory and Technological Evolution

The financial cybersecurity landscape is undergoing significant transformation driven by regulatory changes and global scenarios. For years, the assessment of internal policies was complemented by technical scrutiny of control systems. One major flaw in this traditional model was highlighted in 2016 when the Bangladesh Bank suffered a $81 million theft via SWIFT infrastructure, illustrating the limitations of document-based controls. In Brazil, the C&M Software incident in 2025 further reinforced these lessons, affecting institutions such as the BMP Bank. The regulator responded swiftly and consistently with Resolutions CMN nº 4.893 and BCB nº 85, which consolidated cybersecurity requirements, service technology management, and third-party services. The most recent step in this direction is the BCB Resolution nº 538, which establishes specific technical controls for critical environments, including multi-factor authentication and certificate protection. The expansion of Open Finance, PIX, and Drex introduces new challenges to financial cybersecurity, with technologies like blockchain adding a layer of complexity. These innovations do not eliminate risks but transform them into interconnected ecosystems of fintechs, custodians, and tokenization platforms, expanding the attack surface. This scenario implies greater complexity in technological governance and the need for integrated approaches that go beyond formal controls to ensure cybersecurity in the Brazilian financial sector.