An AI agent serving bank customers in Brazil or Mexico answers to three frameworks: the LGPD for personal data and automated decisions, Banco Central do Brasil’s CMN Resolution 4,893 for contracting cloud and data services, and the CNBV’s rules for Mexican banks’ providers.
This article sums up what each one asks for, what it means in practice for a conversational agent and which questions to ask any vendor before taking the project to the Risk review.
LGPD: review and clear criteria for automated decisions
Article 20 of the LGPD gives data subjects the right to request a review of decisions made solely through automated processing of personal data that affect their interests, including those that define their consumer and credit profile (Confidata). The controller must also provide clear and adequate information on the criteria and procedures used, subject to trade secrets (DIO).
For a collections or origination agent, this translates into three capabilities:
- Every decision is recorded with the data and the agent version that made it.
- The agent can explain which criteria it used, such as past-due balance, payment history and current policy.
- There is a path for a person to review the decision when the customer asks.
Banco Central do Brasil: CMN Resolution 4,893
CMN Resolution 4,893 of 2021 governs the cybersecurity policy and the contracting of data processing, storage and cloud services. It gives guidance on confidentiality and security, audit reports, service monitoring, processing locations, access control, data recovery and audit rights (Google Cloud). It also requires identifying and segregating the institution’s customer data through physical or logical controls (Convergência Digital).
The December 2025 update added authentication, encryption, traceability and access controls to the minimum requirements (OKAI), with an adaptation deadline of March 1 (Monitor Mercantil).
CNBV: a set of rules and third-party approval
Mexico has no general artificial intelligence law: the financial sector operates under a set of rules (Excelsior). For providers, the CNBV requires certain entities to obtain its approval before hiring a third party to carry out operational activities or database or systems management (AWS).
What they have in common
The three frameworks lead to the same list, which is what a Risk team reviews before approving an agent:
| Requirement | What the agent must be able to show |
|---|---|
| Traceability | What happened in each conversation, with which version and which tools it used |
| Access | Who can see and change what, with a record of every action |
| Data location | Where data is processed and stored, separated from other customers |
| Human review | How a person reviews or takes over a decision when needed |
How Coru handles it
In ADI Platform, every conversation turn is recorded with the published agent version; access is controlled by roles and permissions, with a record of every administrative action; deployment can be in a dedicated cloud or inside the bank’s network, with isolation per organization; and the agent hands over to a person under rules the institution defines. Mandatory guardrails, such as blocking personal data exfiltration, run in code, outside the model.
Five questions for any vendor
- How do I reconstruct a conversation from six months ago, with the agent version that answered?
- How does the agent explain the criteria behind a decision, and how is a review requested?
- Where is data processed and how is it kept separate from other customers?
- Which authentication, encryption and access controls does the platform apply?
- What documentation do you provide for a Banco Central review or a CNBV approval?
Is your Risk team reviewing an agent? Bring their checklist and we will show you each control in the platform. See security and guardrails or book a conversation.
Frequently asked questions
What does the LGPD require from an AI agent that makes decisions?
When a decision is made solely through automated processing and affects the data subject, such as a credit profile, the LGPD gives them the right to request a review and to receive clear information on the criteria and procedures used.
Which Banco Central do Brasil rule applies to cloud and data providers?
CMN Resolution 4,893 of 2021, which sets the cybersecurity policy and the requirements for contracting data processing, storage and cloud computing. It was updated in December 2025.
Does Mexico have an AI law for banks?
There is no general AI law. A set of rules applies, and the CNBV requires approval of certain third parties before they are hired for operational activities or database and systems management.
What do the three frameworks have in common?
They ask to know what happened in each interaction, control who has access, define where data lives and be able to review a decision. These four points are what a Risk team checks before approving an agent.
Keep reading
Informational content. Not legal advice. Check the current rule and your legal team for each case.