EN
Contact us

Guide

Open Finance data partnerships already have the controls the rule needs.

In the partnership model, companies that do not take part in Open Finance directly build products with data received through an authorized institution, the Receiver. The Central Bank is revisiting this model, and standardizing what serious participants already do is the way for it to grow safely.

Author
Gustavo Lino, Head of Policy
Published
Oct 16, 2026

The partner receives data through an authorized institution.

Open Finance was born in Brazil as a Central Bank public policy, focused on standardized data sharing.

In the partnership model, the partner company does not access the ecosystem directly. It receives the data through a Receiver, an authorized institution, and builds its product on top of it.

The model accounts for more than 20% of consents.

More than 20% of Open Finance's more than 180 million consents come from the partnership model (July 2026, according to the Open Finance Brasil Citizen Dashboard), one of the drivers of the ecosystem's fast growth in recent months. Use cases in production already reach education, credit, fraud prevention, agribusiness and transportation.

The Receiver is accountable for the data.

To the customer and to the Central Bank, responsibility for the data lies with the Receiver. It runs KYC (know your customer) and due diligence on the partner, monitors the relationship continuously and acts as the regulatory filter.

The financial system already uses this logic elsewhere. In payments, acquirers answer for the sub-acquirers they enable, and the arrangement scaled. Concentrating responsibility in the regulated institution is what allows access to open without giving up supervision.

The controls already exist in practice.

Well-structured participants already operate with a set of controls the rule can consolidate:

  • documented due diligence on the partner before any data flows, covering technical capability, governance and track record;
  • contracts with strict purpose limitation;
  • compliance monitoring throughout the partnership;
  • auditable access logs;
  • fast offboarding of the partner when a risk is identified;
  • transparency to the customer and the Central Bank about who accesses the data and why.

Standardizing turns good practice into a minimum requirement.

Standardization does not create a barrier to entry. It makes mandatory what committed participants already do:

  • eligibility criteria for partners;
  • information security certification;
  • documented, auditable policies;
  • clear contractual obligations.

Precedents point to more controls, not bans.

When it regulated Banking as a Service (BaaS), in Joint Resolution No. 16/2025, the Central Bank did not close the door on non-regulated entities. It built a framework of controls, responsibilities and audits, with the regulated institution fully accountable for the relationship's compliance. The United Kingdom and Canada follow the same direction.

A study by the Bank for International Settlements (BIS) on international experience with data sharing shows concrete results when regulation is well designed: more investment in innovation, new credit relationships for small businesses and better conditions for people the traditional financial system does not serve.

Strict supervision protects those who operate seriously.

The model's evolution depends on every side. Participants follow the rule and the Open Finance guidelines. The ecosystem's governance and the regulator improve monitoring, with supervision able to penalize anyone who breaks the rules, whatever their size.

Sources

About the author

Gustavo Lino, Head of Policy · Cumbuca.

Leads regulatory policy, legal and compliance at Cumbuca.

Previously at Quanto and Swap. Executive director of INIT, the Brazilian Association of Payment Transaction Initiators.