Portugal's central bank has hired an outside auditing firm to comb through more than 1,000 IT contracts spanning 11 years, a response to criminal investigations that exposed suspected corruption in the institution's procurement processes. The €108,000 audit, conducted by Eternamix Consulting, aims to clean up internal purchasing controls and restore confidence in one of Portugal's most important financial institutions.
As of mid-2026, the three-month audit is underway, with preliminary findings expected by late summer 2026.
Why This Matters
• Timeline: Eternamix has three months—starting early July 2026—to deliver a preliminary report on irregularities and recommendations.
• Scope: The audit covers all IT goods and services contracts signed between January 1, 2015, and December 31, 2025—averaging 92 contracts annually worth roughly €17M per year.
• Criminal context: Two Banco de Portugal employees were charged following police raids in 2025, one placed under house arrest and suspended from duty.
Criminal Investigations Trigger Overhaul
Portugal's Polícia Judiciária conducted two high-profile raids on the Banco de Portugal headquarters in 2025—Operação Pactum in April and Operação Nexus in July—both targeting alleged manipulation of public tenders for technology services. The investigations revealed suspected cartel activity in which firms submitted controlled, fake-competitive bids to secure contracts predetermined by insiders.
Operação Pactum resulted in 75 searches across Lisbon, Porto, and Braga, with 43 defendants charged (31 individuals, 12 companies). The probe alleged corruption schemes worth at least €17M, involving state entities including the central bank, EPAL water utility, Casa da Moeda mint, and several ministries. Among the accused was Carlos Moura, then-director of the Banco de Portugal's IT Systems and Technologies Department.
Operação Nexus, coordinated with the European Public Prosecutor's Office, widened the net with over 100 searches nationwide. This operation focused on EU-funded contracts, including those under Portugal's Recovery and Resilience Plan, with damages estimated above €20M. A second bank employee, David Gonçalves, was placed under house arrest on charges of passive corruption, abuse of power, and illicit economic participation. The tech firm DecUnify was identified as central to the alleged scheme, allegedly coordinating with insiders to submit predetermined bids that gave the appearance of competition while ensuring contract awards to predetermined vendors.
What the Audit Will Examine
Eternamix Consulting—a management and IT consultancy based in the Óbidos Technology Park—beat out major firms including KPMG, EY, Deloitte, and Forvis Mazars for the contract. The firm's mandate is forensic in scope: verify compliance with public procurement laws, evaluate the entire lifecycle of acquisitions (from planning and vendor risk assessment to invoice payment), and analyze the internal governance model including organizational structure and assigned responsibilities.
The audit is not designed to uncover criminal evidence, but rather to identify procedural weaknesses and align the central bank with international best practices. The findings will remain internal, feeding into action plans for audited departments, the board of directors, and designated contract managers.
According to the Banco de Portugal's procurement portal, the audit will serve as a "documentary repository evaluating the compliance of acquisition processes with legislation and international best practices," forming the foundation for internal reform plans.
Impact on Governance and Transparency
The audit represents the most visible element of a broader institutional housecleaning at Banco de Portugal. Governor Álvaro Santos Pereira, who took office before the scandals broke, has championed a package of preventive measures aimed at restoring public trust.
Key reforms already underway include:
• Creation of a purchasing committee to review all acquisitions exceeding €150,000. The consultative body includes board members, purchasing department heads, and representatives from accounting and compliance.
• Mandatory public procurement training for approximately 60 staff with purchasing responsibilities. Three sessions covering 65 employees were held in 2025, with the program continuing through 2026.
• Rotation of coordinators in the Information Systems Department and formation of a cross-departmental team to monitor IT and telecom purchases.
• Updates to procurement regulations and contract monitoring platforms.
These steps mirror broader European best practices. Central banks across the eurozone, including those within the European System of Central Banks, are subject to rigorous internal and external controls. The European Court of Auditors examines operational efficiency, while independent external auditors verify annual accounts. Portugal's central bank also maintains its own Audit Council, which oversees internal audit, risk management, and compliance functions.
For residents and businesses in Portugal, these reforms signal tighter oversight of how public institutions spend taxpayer money. The central bank's role in financial stability and monetary policy implementation means procurement integrity directly affects confidence in Portugal's banking system—relevant for anyone with deposits, mortgages, or business loans with Portuguese banks.
Real Estate Maneuver Saves Tens of Millions
Beyond procurement reform, Governor Santos Pereira has also moved to rein in the central bank's real estate spending—another area where fiscal discipline had raised questions.
In this move, Banco de Portugal would purchase only one building in Lisbon's Entrecampos district instead of the originally planned two, cutting costs by €35M to €40M compared to the initial agreement. The revised deal, signed with insurer Fidelidade, values the single building at €165M. The governor clarified that the central bank would not forfeit its €57M deposit on the transaction, as some had speculated. "Loss of the deposit only occurs in a limit scenario, if the Banco de Portugal wanted to break the contract," Santos Pereira explained. The institution is working on a memorandum of understanding and an amendment to the Promessa de Compra e Venda (CPCV) agreement to formalize the changes, expected to be signed within months.
The governor emphasized that any calendar adjustments or costs tied to the project redesign would be "more than offset" by the savings—a fiscally prudent pivot at a time when the institution faces scrutiny over past spending.
Broader Implications for Public Sector Procurement
The Banco de Portugal scandal is not an isolated incident. Operação Pactum also implicated the National Registry and Notary Institute, the Justice Ministry's General Secretariat, and other state entities. The recurring pattern—simulated competition, insider coordination, and inflated contracts—points to systemic vulnerabilities in Portugal's public procurement framework, particularly in the technology sector.
EU funds, including those distributed under the Recovery and Resilience Plan, are subject to especially strict oversight. Portugal received €16.6 billion in EU recovery funds, making proper oversight critical for continued disbursements that fund infrastructure, digital transformation, and economic programs affecting daily life in Portugal. The involvement of the European Public Prosecutor's Office in Operação Nexus signals that Brussels is paying close attention. For Portugal, already under pressure to demonstrate effective use of recovery funds, reputational damage from procurement scandals could complicate future disbursements or trigger audits of other programs.
The Eternamix audit results, due later in 2026, will offer the first comprehensive assessment of whether the central bank's procurement lapses were limited to a handful of bad actors or reflect deeper institutional failures. That verdict will shape not only internal reforms but also set a benchmark for transparency expectations across Portugal's public sector.
For now, the message is clear: even Portugal's most venerable financial institution is not immune to the temptations of insider dealing—and accountability, however delayed, is catching up.
