Auditing and Traceability: Fundamental Pillars of the BACEN and NUCLEA Guidelines

Auditing and traceability are fundamental pillars for institutions that operate using the BACEN and NÚCLEA systems, as they make it possible to demonstrate how processes were carried out, identify those responsible, track transactions, and produce evidence for internal controls, audits, and regulatory oversight. 

In practice, this requires technology capable of logging operations, securing access, and ensuring data integrity throughout the entire processing workflow.

In the financial market, it is not enough for a transaction to be processed correctly. The institution must also be able to demonstrate what happened, when it occurred, which systems were involved in the process, and which security mechanisms were used.

This need becomes even more critical in environments connected to the National Financial System (SFN), where banks, fintech companies, credit unions, and payment service providers operate critical systems and must maintain controls that comply with regulatory and operational requirements.

How important are auditing and traceability in the financial market?

Auditing and traceability are complementary concepts.

Traceability makes it possible to reconstruct the history of a specific process, message, file, or transaction. This involves maintaining records that show the steps taken, events, responsible parties, accesses, and results.

The audit, on the other hand, uses this information, along with other controls and documents, to assess whether processes, systems, and procedures are functioning properly and in accordance with applicable standards.

In the financial sector, these mechanisms help to:

• Identify errors and inconsistencies;
• Investigate incidents;
• Verify compliance with internal policies;
• Provide evidence for audits;
• Track access to critical resources;
• Demonstrate compliance with regulatory requirements;
• Speed up the diagnosis of operational problems.

The Central Bank employs a risk-based supervisory model, supported by the pillars of monitoring and supervision. 

As part of this process, it collects and analyzes information from financial market institutions and infrastructure to assess risks both to the system as a whole and to each individual institution.

What does BACEN require of financial institutions?

The Central Bank supervises financial institutions and other authorized organizations to verify, among other things, compliance with applicable regulations, internal controls, and adequate risk management.

BCB Resolution No. 130/2021, currently in effect with subsequent amendments, establishes procedures related to independent audits and requires, for example, the assessment of internal control systems, including electronic data processing and risk management systems. The reports must highlight any material deficiencies identified during the audit.

This helps illustrate why technological traceability is so important: the better structured the operational records are, the greater the institution’s ability to investigate incidents, verify controls, and provide evidence during audit processes.

It is important to note that there is no single requirement known as “BACEN traceability.” The obligations vary depending on the institution, the system used, and the applicable regulations. 

In practice, various regulations require access controls, monitoring, record-keeping, cybersecurity, documentation, and the ability to demonstrate how certain processes were carried out.

What is NÚCLEA's role in this ecosystem?

NÚCLEA serves as a key infrastructure provider for various processes in the Brazilian financial market, including systems related to settlement, registration, portability, and information processing.

Institutions participating in these environments must comply with the standards, technical manuals, and conventions applicable to the services they use. Thus, technological integration must ensure that data is prepared, protected, sent, and received in accordance with the standards defined for each system.

This environment is part of a broader regulatory framework consisting of rules and guidelines issued by the Central Bank of Brazil, as well as regulations from other agencies depending on the institution’s activities, such as the CVM and SUSEP.

For those who operate solutions processed by NÚCLEA, this means that security, integrity, and the ability to reconstruct operational workflows must be built into the architecture—not just added at the time of an audit.

What should an institution do to ensure traceability?

Traceability begins before reports are generated. It must be built into the technological processes.

Centralize and standardize workflows

The more fragmented the processing is, the more difficult it will be to reconstruct an operation.

It is recommended to establish standardized processes for the input, processing, validation, and output of information, thereby preventing critical steps from relying on informal procedures or unrecorded manual actions.

Control access

The organization needs to know which users and applications are authorized to access sensitive resources.

Controls such as RBAC (Role-Based Access Control), certificate-based authentication, and segregation of duties help limit access based on the responsibilities of each user or system.

Protect Keys and Certificates

Cryptographic keys and digital certificates are essential for signing, encrypting, and authenticating communications.

Therefore, its life cycle must be managed in a controlled manner, including creation, custody, use, rotation, and revocation.

Validate messages and files

In critical integrations, it is not enough to simply record that a particular file was transmitted.

It is important to verify that it has been properly prepared, signed, encrypted, and validated in accordance with the protocol used.

Maintain operational records

Logs, processing records, security events, and failure information are important for investigating incidents and supporting audits.

The Central Bank’s own regulations stipulate that reports and certain documents must remain available for supervisory review for specified periods. BCB Resolution No. 130, for example, sets forth various requirements regarding document retention and access by the regulator.

What problems arise when there is no adequate traceability?

The lack of reliable records can turn a relatively simple incident into a complex operational problem.

Imagine that a message sent to a particular system is rejected. Without sufficient traceability, the team may have difficulty determining:

• Which application initiated the processing;
• Which version of the file was used;
• Whether the signature was applied correctly;
• Which certificate was involved in the operation;
• At what stage did the error occur?;
• If there was another attempt;
• What was the final result?

This situation prolongs the time it takes to reach a diagnosis and can complicate audits, investigations, and compliance demonstrations.

How does PRODIST STS support auditing and traceability?

PRODIST STS was developed for institutions that need to integrate with BACEN and NÚCLEA systems, centralizing critical functions related to the security of messages and files.

The solution performs steps such as preparing the SFN packet, encrypting it, signing it, compressing it when necessary, and adding the security header. Upon receipt, it opens the packet, decrypts it, decompresses it if necessary, and validates the signature.

This standardization contributes to auditability because it reduces the dispersion of cryptographic functions across different applications and establishes a specialized layer to handle security packets.

PRODIST STS also offers:

• Packaging of messages and files;
• Validation of security packages;
• Integration via a component, file system, or microservice;
• OAuth2 access control;
• Key custody and management;
• Role-Based Access Control (RBAC);
• mTLS authentication;
• Integration with HSMs, vaults, and cloud-based KMS.

These resources do not replace the institution's audit, but they help establish technical processes that are more controlled, secure, and verifiable.

Key management is also part of traceability

An audit strategy should not focus solely on the messages being processed. It is also important to monitor the cryptographic assets involved in these operations.

In PRODIST STS, the key management process includes the generation, storage, and protection of the keys used to encrypt and decrypt data. The solution can use its own KMS, integrate with certified HSMs, or work with cloud-based vaults and KMS.

For an institution, this makes it easier to establish more consistent policies regarding who can use a particular key, which applications have access to it, and how these assets are protected.

PRODIST supports the institution throughout the entire process

Traceability also facilitates support. The more structured information there is about the processing, the greater the ability to quickly investigate an incident.

PRODIST supports projects from the initial assessment and definition of the architecture through to implementation and go-live.

The company offers direct support from its technical team and responds to inquiries via email within 15 minutes, in addition to tracking and logging support requests.

There are also 24/7 support options and bilingual customer service for operations that require extended availability.

PRODIST: Security and Control for Regulated Operations

Founded in 1987, PRODIST has 39 years of experience developing encryption and security solutions for the financial market. Its solutions for the SFN have been in operation since the launch of the SPB in 2002, and the company serves more than 40 financial institutions, with an SLA of up to 99.96%.

For institutions that need to operate the BACEN and NÚCLEA systems, auditing and traceability should be treated as part of the security and governance architecture.

By centralizing functions such as encryption, digital signatures, packet validation, access control, and key management, PRODIST helps create more standardized and controlled processes, making it easier to investigate incidents and produce the evidence needed for internal controls and audit processes!

FAQ – Auditing and Traceability at BACEN and NÚCLEA