title: Brazil Payments Regulation Monitor | World Payments Monitor canonical: https://payments.gi/jurisdictions/brazil/ date_modified: 2026-10-21 publisher: Asymmetric Intelligence # Brazil BR schema world-payments-v1 trajectory: not yet assessed Last updated 2026-10-21 · 14 modules · 62 sourced findings · 114 sources in the cumulative register 14 Modules baseline.modules[] 62 Findings modules[].findings[] 18 Tier-1 sources run_metadata.t1_source_count Confidence mix (sums to 14 rendered modules; click to filter) No modules moved this cycle. ## Jurisdiction brief ###### Latest update · 18 October 2026 #### Lead Signal Brazil's payments regulatory environment is tightening on two fronts simultaneously. Resolução BCB nº 587, approved by the Banco Central do Brasil's board on 17 September 2026 and published in the Diário Oficial da União on 18 September 2026, hardens scheme-level accountability within Pix: an institution that registers a DICT fraud-suspicion flag now bears responsibility for it and must review the flag within seven days if a client contests it, and Pix exclusion penalties take immediate effect, removing the thirty-day adaptation window that previously applied. Separately, BCB Resolution 561, effective 1 October 2026, bars eFX providers, payment institutions, e-money issuers and acquirers from settling the offshore leg of regulated cross-border payments in stablecoins or other crypto assets, requiring settlement instead to run through traditional FX operations or non-resident BRL accounts. Together these developments point toward a payments environment where scheme-level fraud accountability is sharpening at the same time as a new restriction closes off a crypto-settlement channel for regulated cross-border flows. #### Other Developments **Pix Automático is extended to salary accounts.** Under the same Resolução BCB 587 reform package, Pix Automático, the recurring-payment authorisation mechanism, becomes available on salary accounts from 1 July 2027. This extends an existing scheme feature to a new account type rather than introducing a new payment mechanism. **A national fintech framework bill remains at an early stage.** PL 2901/2026 proposes a Sistema Nacional de Integridade Financeira Digital, coordinating the Banco Central, COAF, Receita Federal, Polícia Federal, CADE and ANPD, alongside a permanent regulatory sandbox and tiered BCB-administered obligations scaled by firm size and systemic risk. The bill is at an early stage and this account rests on a single trade-press source without independently retrieved primary legislative text, so its eventual provisions and prospects for enactment remain unconfirmed. **Unauthorised international payment providers face a transition deadline.** Under BCB Resolution 561, providers of international payment services that are not yet authorised may continue temporarily, but must apply for BCB approval by 31 May 2027 to continue operating beyond that date. Authorised institutions already providing eFX services were separately required to update their Unicad registration with the BCB by 30 October 2026. #### Cross-Monitor Connections The BCB Resolution 561 stablecoin-settlement restriction sits alongside a parallel crypto-sector read of the same rule: licensed VASPs and banks retain the ability to use stablecoins for cross-border payments under separate supervision, and retail crypto trading is unaffected, so the restriction targets a specific settlement channel for regulated payment-institution flows rather than crypto-asset use generally. The proposed national fintech framework under PL 2901/2026 also carries AML-architecture significance beyond its payments-licensing dimension, given its coordination role across COAF and other enforcement bodies; a financial-integrity reading of the same bill would foreground its potential to close an enabler gap around anonymous digital accounts rather than its market-access implications for payment institutions. #### Outlook The near-term calendar carries several dated milestones. Anti-duplicate-payment rules for hybrid boleto-and-Pix billing are scheduled to take effect in February 2027, introducing a twenty-four-hour refund duty on duplicate settlement. Pix Automático's extension to salary accounts takes effect 1 July 2027. On the cross-border side, eFX providers without existing authorisation must apply for BCB approval by 31 May 2027. PL 2901/2026's progress through committee remains the item to watch on the legislative side, with no confirmed enactment timeline as of this cycle. Brazil's overall payments regulatory direction is assessed as tightening across scheme compliance, digital-money settlement rules and prospective fintech licensing architecture. _4 earlier updates not shown here._ ###### Standing brief · as of 16 August 2026 _Written before the update above. Where they differ, the update is the more recent position._ #### Lead Signal Brazil's payments regulator has closed the last remaining gap in its authorisation perimeter. BCB Resolution No. 494 requires prior Banco Central do Brasil authorisation for all payment-service modalities regardless of transaction volume, eliminating the volume-based exemptions that previously let smaller payment institutions operate outside direct supervision. The change is paired with a consolidated compliance calendar: BCB Rule No. 495/2025 and Joint Rule No. 14/2025 establish a single regularisation window running 1-31 May 2026 for payment institutions that have been operating without authorisation, replacing what had been a fragmented set of deadlines. Layered onto this, the Pix accreditation deadline for non-authorised payment institutions has been brought forward to a 1 January-1 May 2026 window, compressing a timetable that previously ran to 31 December 2026. Together these three instruments compress the runway available to unauthorised or thinly-capitalised non-bank payment institutions and mark a decisive tightening of Brazil's market-access baseline. #### Other Developments The authorisation tightening does not stand alone. Banco Central do Brasil has also moved on the operational-resilience front, tightening Pix device-level security: accounts accessed from unregistered devices are now subject to transfer limits of roughly US$40 per transaction and roughly US$201 per day, backed by a precautionary lock mechanism. A parallel rule requires Pix participants that connect through a payment-scheme technology infrastructure provider to demonstrate, via a CVM-registered auditor's report, that BCB-registered private signing keys are not shared with that provider; absent such certification a BRL 15,000 transaction limit applies, with a possible 90-day BCB waiver. Separately, BCB Resolution No. 506 amended the founding Pix resolution, BCB Resolution No. 1/2020, revising authorisation criteria, penalties and fraud-prevention measures at the scheme level. On the structural side, Banco Central do Brasil is rewriting minimum-capital requirements to tie them to activities rather than institutional labels, with phase-in beginning 1 July 2026 at one quarter of the capital gap, rising to half by January 2027 and the full amount by January 2028. Industry estimates cited in the reporting put roughly 92% of peer-to-peer lenders and roughly 63% of payment institutions at risk of a capital shortfall under the new rule, against only around 5% of full-service banks, an exposure gap that industry commentary frames as likely to price smaller, non-bank players out of payment-system access and drive consolidation. Product development continues alongside the tightening. Banco Central do Brasil is developing new Pix products, automatic Pix, guarantee Pix and international Pix, intended to replicate credit-card-industry functionality at lower cost, and has launched Pix Parcelado, which lets payers spread payments over time while payees still receive the full amount instantly; a future feature enabling Pix receivables to be used as loan collateral is planned for 2026. Meanwhile, Drex, Brazil's central bank digital currency, has been substantially re-scoped after two pilot phases: its 2026 initial version launches without blockchain, focused on credit-lien-reconciliation infrastructure rather than a tokenised retail CBDC. #### Cross-Monitor Connections The BCB's DICT regulation requires institutions in the National Financial System to comply with Brazil's LGPD data-protection law in collecting, handling, storing and sharing Pix-user personal data, an overlap that is directly relevant to data-protection monitoring of the same Pix ecosystem. #### Outlook The regularisation window closes 31 May 2026 and the brought-forward Pix accreditation deadline runs from 1 January to 1 May 2026, meaning the next several months will determine how many currently-unauthorised payment institutions can complete authorisation in time. The minimum-capital phase-in adds a second, longer clock: half the capital gap must be closed by January 2027 and the full amount by January 2028, milestones against which the disproportionate exposure of payment institutions and peer-to-peer lenders relative to banks will be tested. Drex's re-scoped, non-blockchain initial phase will also bear watching as an indicator of whether Brazil's CBDC ambitions are being deferred or genuinely redirected toward infrastructure-first delivery. trust tier: ai_unverified ###### Latest update · 11 October 2026 #### Regulatory Status Brazil's Banco Central do Brasil is pursuing a differentiated payments-regulation posture this cycle: tightening the cross-border virtual-asset and stablecoin perimeter while liberalising domestic instant-payments functionality. Resolucao BCB no 561/2026 bars eFX providers from settling the external leg of international payments using virtual assets including stablecoins, in force since 1 October 2026. Resolucao BCB no 588/2026 adds mandatory COAF reporting for self-custodied virtual-asset transfers of US10,000 or more, also effective 1 October 2026. The PSAV authorisation deadline under Resolucao BCB no 519/2025 falls on 30 October 2026, after which BCB-authorised institutions may not intermediate for unauthorised virtual-asset service providers; eFX providers face a parallel Unicad registration deadline on the same date. In contrast, Resolucao BCB no 587/2026 extends Pix Automatico to salary accounts from 1 July 2027, a liberalising development for domestic recurring payments. Commercial activity continues within this environment: BlindPay raised US3.3 million with Circle's participation while awaiting its own PSAV authorisation, and Brazilian fintechs captured approximately 67 percent of Brazilian startup funding in H1 2026. #### Outlook The 30 October 2026 deadline is the determinative near-term date, closing both the PSAV authorisation window and the eFX Unicad registration requirement simultaneously. The Pix Automatico salary-account extension, effective 1 July 2027, is a longer-horizon development giving the market substantially more lead time to prepare. _1 earlier update not shown here._ ###### Standing brief · as of 16 August 2026 _Written before the update above. Where they differ, the update is the more recent position._ #### Regulatory Status Brazil enters 2026 in the midst of a coordinated tightening cycle across licensing, operational resilience and industry capital structure. BCB Resolution No. 494 requires prior BCB authorisation for all payment-service modalities regardless of transaction volume, closing the volume-based exemption that previously let smaller payment institutions avoid full supervision, and BCB Rule No. 495/2025 together with Joint Rule No. 14/2025 establish a single regularisation window running 1-31 May 2026 for currently-unauthorised payment institutions. The Pix accreditation deadline for non-authorised payment institutions has also been brought forward to a 1 January-1 May 2026 window, well ahead of the previously scheduled 31 December 2026 cut-off. On the operational-resilience side, Banco Central do Brasil has tightened Pix device-level security, imposing transfer limits of roughly US$40 per transaction and roughly US$201 per day for accounts accessed from unregistered devices, backed by a precautionary lock mechanism, alongside a signing-key segregation requirement for Pix participants connecting through a technology infrastructure provider. BCB Resolution No. 506 separately amended the founding Pix resolution, revising authorisation criteria, penalties and fraud-prevention measures at the scheme level. Structurally, Banco Central do Brasil is rewriting minimum-capital requirements to tie them to activities rather than institutional labels, with phase-in beginning 1 July 2026. Industry estimates cited in the reporting put roughly 92% of peer-to-peer lenders and roughly 63% of payment institutions at risk of a capital shortfall under the new rule, against only around 5% of full-service banks, an asymmetry that runs along the same bank-versus-non-bank line as the authorisation and Pix-security changes. Product innovation continues alongside this tightening: Banco Central do Brasil is developing automatic Pix, guarantee Pix and international Pix, has launched Pix Parcelado, and has substantially re-scoped Drex, its central bank digital currency, into a non-blockchain initial phase focused on credit-lien-reconciliation infrastructure. The BCB's DICT regulation also requires institutions in the National Financial System to comply with Brazil's LGPD data-protection law when handling Pix-user personal data. #### Outlook Brazil's risk trajectory is tightening: the regularisation window closes 31 May 2026, the brought-forward Pix accreditation window closes 1 May 2026, and the minimum-capital phase-in reaches half the capital gap by January 2027 and full compliance by January 2028. The combined effect of universal authorisation, Pix security hardening and activity-based capital requirements is a materially higher compliance floor for non-bank payment institutions relative to full-service banks, a dynamic that is likely to drive consolidation over the horizon tracked here. Merchant-acquiring dynamics and correspondent-banking access were not resolved this cycle and remain open gaps for the next research pass. 14 of 14 modules Signal Density Selections OR within a group, AND across groups. Press / to search. ### W1a Licensing, Authorisation & Market Access Confirmed confirmed 2026-06-23 BCB requires prior authorisation for all payment institutions; the deadline for payment institutions operating without authorisation to request it was brought forward from Dec 2029 to May 2026. BCB segments institutions S1-S5 for proportional prudential treatment; only S1-S4 non-cooperative institutions may act as Pix 'responsible participant' for unauthorised payment institutions. Horizon · 2026-05 (±quarter) PI authorisation regularisation window (Res. 494/2025)_in_force_pending · T3_ Standing sub-brief · as of 16 August 2026 270 words · last cycle 2026-10-18 #### Licensing, Authorisation & Market Access Banco Central do Brasil has eliminated the last volume-based carve-outs in its payment-institution authorisation regime. BCB Resolution No. 494 requires prior BCB authorisation for all payment-service modalities regardless of transaction volume, closing a gap that had allowed smaller non-bank payment institutions to operate below the supervisory threshold. The rule applies to both bank and non-bank payment-service providers, but its practical effect falls heaviest on the non-bank payment-institution and e-money sector, which previously relied on volume exemptions to defer full authorisation. BCB Rule No. 495/2025 and Joint Rule No. 14/2025 establish a single regularisation window running 1-31 May 2026 for payment institutions that have been operating without authorisation, consolidating what had been a fragmented set of prior deadlines into one compliance date. Non-bank payment institutions that have not yet regularised their status face a hard deadline to do so within this window. Compounding the timeline pressure, the Pix accreditation deadline for non-authorised payment institutions has been brought forward to a 1 January-1 May 2026 window, materially earlier than the previously scheduled 31 December 2026 cut-off. The net effect is a compressed authorisation and accreditation calendar concentrated in the first five months of 2026, disproportionately affecting non-bank payment institutions and e-money issuers relative to already-licensed banks. #### Outlook The regularisation window closes 31 May 2026 and the brought-forward Pix accreditation window closes 1 May 2026, making the first half of 2026 the decisive compliance period for Brazil's non-bank payment-institution sector. Institutions that miss either deadline face loss of Pix accreditation and authorisation exposure, a risk that compounds with the incoming activity-based capital regime tracked separately under industry structure. Periodic update · new data 2026-10-18 #### Licensing, Authorisation & Market Access PL 2901/2026 proposes a national regulatory framework for fintechs and digital financial platforms, the Marco Nacional de Fintechs e Plataformas Digitais, built around a proposed Sistema Nacional de Integridade Financeira Digital that would coordinate the Banco Central, COAF, Receita Federal, Polícia Federal, CADE and ANPD. The bill proposes a permanent regulatory sandbox and tiered obligations administered by the BCB, scaled according to firm size and systemic risk. As an early-stage bill, this account rests on a single trade-press source without independently retrieved primary legislative text, so the precise market-access implications for payment institutions and crypto-asset operators cannot yet be confirmed. Separately, a dated transitional deadline applies to international payment service providers operating under BCB Resolution 561's cross-border framework: providers not yet authorised may continue temporarily but must apply for BCB approval by 31 May 2027 to continue operating beyond that date. This is a market-access deadline attaching to an existing cross-border payments rule rather than a feature of the proposed PL 2901/2026 framework. Together, these developments describe a market-access landscape with one confirmed, dated transitional deadline for cross-border payment providers and one early-stage legislative proposal whose eventual effect on licensing and market access for fintech and digital-platform firms remains unconfirmed. #### Outlook PL 2901/2026's committee progress is the item to track for any confirmed market-access implications; no enactment timeline is established as of this cycle. The 31 May 2027 BCB approval deadline for unauthorised international payment providers is a fixed, dated milestone that will determine which providers retain cross-border market access beyond that date. **4 earlier distinct update(s)** Periodic update · new data 2026-10-04 #### Licensing, Authorisation & Market Access A rewritten activity-based minimum-capital rule has materially raised the capital bar for institutions offering Pix in Brazil. Offering Pix alone now adds an estimated R$5 million to an institution's minimum capital requirement. The Central Bank's own estimate puts the combined shortfall across affected institutions at roughly R$8 billion, approximately US$1.55 billion, spread across 679 of Brazil's 1,751 relevant institutions, about 39 percent of that population, equal to roughly half a percent of the financial system's reference equity. The source characterises this estimate itself with Uncertain confidence, so the headline figures should be read as indicative of scale rather than as a settled regulatory fact pending confirmation. The rule applies specifically to non-bank payment institutions and e-money institutions rather than to banks as a class, reflecting the Central Bank's activity-based approach to capital requirements: an institution's capital obligation now scales with which payment activities, including Pix participation, it actually offers, rather than resting solely on its licence category. For smaller fintechs whose core proposition is Pix access, this converts what was previously a near-costless scheme obligation into a material capital commitment. #### Outlook The scale and even the direction of this development's ultimate market impact depends on whether the Central Bank's R$8 billion shortfall estimate is confirmed as implementation guidance is published. Given the estimate's own Uncertain sourcing, the near-term signal to watch is whether the Central Bank issues a corrected or confirmed figure, and whether any transition period is granted to institutions found short of the new requirement. Periodic update · new data 2026-09-28 #### Licensing, Authorisation & Market Access Two distinct BCB instruments moved Brazil's payments licensing baseline this cycle. First, Resolução no. 587, published 18 September 2026, ends mandatory Pix participation for institutions with 500,000 or more active accounts -- a threshold that captures the largest banks and payment institutions specifically -- while simultaneously tightening fraud-marking responsibility for those that remain participants. The same instrument opens salary accounts to Pix Automático recurring-payment functionality from 1 July 2027 and brings hybrid boleto-plus-Pix-QR billing under formal regulation from 1 February 2027, extending the scheme's regulatory perimeter into billing structures that had previously operated in a less formalised space. Second, and separately, a rewritten minimum-capital rule ties required regulatory capital to activities performed rather than to entity label: offering Pix alone now adds approximately R$5 million to a firm's capital requirement, phasing in from 25% of the requirement on 1 July 2026 to full requirement by January 2028. These two instruments pull in different directions for different segments of the market. The participation-mandate removal reduces a specific compliance burden for the largest bank and non-bank institutions that had been compelled to participate in Pix regardless of business model; the activity-based capital rule increases the compliance burden specifically for smaller non-bank payment institutions and EMIs that offer Pix as one of several services, since capital requirements now scale with the activities a firm actually performs rather than being fixed by its licence category alone. This carries forward the standing baseline set by BCB Resolution 506 (26 September 2025, amending Resolution 1/2020), which revised Pix authorisation criteria and fraud-prevention measures for payment institutions on a phased timeline running through May 2026; the two 2026 instruments sit on top of that authorisation baseline rather than replacing it. The bank-versus-non-bank distinction is the analytical spine of both changes: the participation-mandate removal chiefly affects large banks and large non-bank PSPs alike above the 500,000-account threshold, while the activity-based capital rule specifically targets non-bank payment institutions and EMIs whose capital requirements had previously been decoupled from the specific activities -- like Pix provision -- that they perform. #### Outlook The capital rule's phase-in through January 2028 gives smaller Pix-offering non-bank institutions a multi-year runway to raise capital, but the 1 July 2026 start of the 25% phase-in means the compliance clock is already running. Watch for whether the BCB issues further guidance disaggregating Resolutions 519-521 from Resolução 587 and the capital rule, since the current record does not fully disaggregate how these instruments interact for a firm offering both VASP-adjacent and Pix services. Periodic update · new data 2026-09-21 #### Licensing, Authorisation & Market Access The Banco Central do Brasil materially compressed the compliance timeline for unauthorised payment institutions this cycle, bringing forward the deadline to request formal BCB authorisation from December 2029 to May 2026. This is a confirmed, high-impact development that narrows the runway for non-bank payment institutions and e-money issuers still operating outside the authorised perimeter, applying specifically to the nonbank_pi_emi segment rather than to bank-affiliated PSPs. Separately, BCB Resolution 506 revised Pix authorisation criteria alongside fraud-prevention and penalty measures for payment institutions, effective from 26 September 2025, amending the foundational Resolution 1/2020 that governs the Pix arrangement. This revision applies across both bank and non-bank participants in the Pix scheme, reflecting the dual-track bank/nonbank structure of Brazil's instant-payments ecosystem. Taken together, these two developments indicate that BCB is narrowing the compliance window on two fronts simultaneously: bringing unauthorised non-bank institutions into the formal authorisation regime faster than previously scheduled, and tightening the standards that authorised Pix participants, bank and non-bank alike, must meet on fraud prevention. The compressed 2029-to-2026 deadline shift is particularly significant for market-access planning, since it removes what had been a multi-year runway for institutions that had not yet sought authorisation. #### Outlook The May 2026 deadline is the key date to track: watch for enforcement activity or a wave of late authorisation applications as the compressed deadline approaches, and for whether BCB signals any further acceleration of authorisation requirements for other categories of payment institution. Periodic update · new data 2026-08-11 #### Licensing, Authorisation & Market Access Brazil's payments and digital-asset licensing perimeter tightened materially this cycle. Banco Central do Brasil's Resolution 506, adopted 26 September 2025, revised Pix authorisation criteria for payment institutions, including provisions addressing non-authorised entities. Building on that, a new activities-based minimum-capital rule for payment institutions offering Pix begins phasing in from 1 July 2026, reaching half the required capital amount in January 2027 and the full amount in January 2028, a change that falls specifically on non-bank payment institutions rather than banks. Most significantly, BCB's Resolutions 519, 520 and 521, published 10 November 2025 and effective 2 February 2026, complete a formal authorisation regime for virtual-asset service providers across intermediation, custody and brokerage modalities, with no exemption category, and a two-hundred-seventy-day transition running to 30 October 2026. Taken together, these three instruments push both non-bank payment institutions and virtual-asset service providers toward capital and authorisation standards that more closely resemble those already applied to banks, formalising market access in both sectors simultaneously rather than sequentially. #### Outlook The clearest near-term markers are the phased capital thresholds, arriving in January 2027 and January 2028, and the 30 October 2026 VASP authorisation deadline, after which unauthorised virtual-asset service providers lose the ability to transact with BCB-supervised entities. Both will test how much of the current non-bank payment and virtual-asset population can meet bank-comparable standards without exiting the market or consolidating. **Sources and findings (5)** 1. T1 [https://www.bcb.gov.br/en/financialstability/paymentschemes](https://www.bcb.gov.br/en/financialstability/paymentschemes) retrieved 2026-06-23 2. T1 BCB Resolutions 80 & 81/2021, as amended by Res. 257/2022 and Res. 494/2025 (bcb.gov.br) 3. T1 BCB Resolution 494/2025 — all-modality authorisation; Boku PI licence Apr 2025 (bcb.gov.br) 4. T1 BCB payment-schemes framework; Resolutions 80/81/2021 (bcb.gov.br) 5. T1 BCB Resolutions 80/81/2021 (PISP/EMI authorisation) (bcb.gov.br) ### W1b Conduct, Safeguarding & Promotions limited signal Probable confirmed 2026-06-23 Brazil's safeguarding regime requires payment institutions to segregate client/end-user funds from proprietary assets and supports traceability and auditability; e-money balances are held in payment accounts with prudential treatment. BCB Rule 80/2021 sets conduct, transparency (institutions must identify themselves as PIs and disclose services), governance and cybersecurity-policy obligations. Joint Resolution No. 16 (CMN/BCB) regulates Banking-as-a-Service, and BCB Resolution 432/2024 set manager compensation policies — collectively tightening conduct accountability. Standing sub-brief · as of 23 June 2026 215 words · last cycle 2026-10-04 #### Conduct, Safeguarding & Financial Promotions Brazil's conduct and safeguarding regime for payment institutions is built on BCB Rule 80/2021, which mandates segregation of client and end-user funds from proprietary assets, transparency and identification obligations, governance requirements, cybersecurity controls and service-continuity provisions. The safeguarding model is distinctive: rather than a UK/EU-style discrete safeguarding regime, Brazil relies on asset-segregation. PIs must hold e-money balances in payment accounts with prudential treatment and keep client funds strictly segregated to prevent commingling in insolvency, supporting insolvency traceability through consolidated prudential supervision rather than structural ring-fencing. The conduct perimeter extends to Banking-as-a-Service: Joint Resolution No. 16 (CMN/BCB) regulates BaaS arrangements, defining the conduct and accountability boundary that operators must build to. Manager compensation is addressed by BCB Resolution 432/2024. Together these instruments define the consumer-fund protection model for Brazilian PIs and EMIs. The bank versus non-bank distinction matters in safeguarding: the segregation obligation binds payment institutions specifically, with e-money balances held in payment accounts under prudential treatment, distinct from the deposit-taking treatment of bank-PSPs. #### Outlook The trajectory is established. The segregation-based safeguarding model is settled, with the BaaS conduct perimeter under Joint Resolution 16 and manager-compensation rules under Resolution 432/2024 forming the standing conduct architecture. This module is assessed rather than confirmed, reflecting the secondary sourcing underpinning the consolidated conduct picture. Periodic update · new data 2026-10-04 #### Conduct, Safeguarding & Financial Promotions Medida Provisoria 1.394/2026, signed 25 September 2026, prohibits fixed-odds betting nationwide in Brazil. From a payments-conduct perspective, this converts payment-conduct obligations that previously targeted only unlicensed betting operators into obligations that now cover the entire formerly-licensed sector, since that sector has itself become unauthorised by statute. Institutions that maintained payment relationships with licensed betting operators prior to 25 September 2026 face a conduct-obligation landscape that has shifted from a targeted compliance exercise, screening for unlicensed counterparties specifically, into a sector-wide one, where any betting-sector counterparty now falls outside authorised conduct. #### Outlook Whether this sector-wide conduct obligation persists depends on the pending Supremo Tribunal Federal challenge to the Medida Provisoria and its congressional conversion process. A reversal of the underlying prohibition would likely revert payments-conduct obligations toward their prior, narrower scope targeting unlicensed operators specifically. **Sources and findings (4)** 1. T1 BCB Resolutions 80/81/2021 — PI conduct/governance (bcb.gov.br) 2. T1 BCB Resolution 494/2025 (Art. 9 authorisation) (bcb.gov.br) 3. T1 BCB Resolution 494/2025 — IT/cyber & authorisation (bcb.gov.br) 4. T2 BCB Resolutions 80/81/2021 PI conduct framework (bcb.gov.br) ### W2 Stablecoins & Digital Money Confirmed confirmed 2026-06-23 E-money is regulated under Law 12.865/2013 as a prepaid payment-account balance, distinct from virtual assets. Brazil implemented a banking-grade virtual-asset/VASP regime via Law 14.478/2022 and BCB Resolutions 519/520/521 of 10 Nov 2025 (in force 2 Feb 2026), with the BCB as supervisor and CVM retaining securities-token jurisdiction. Resolution 521 brought stablecoin and crypto FX operations into the foreign-exchange perimeter; Resolution 561 (Apr 2026) then barred crypto/stablecoin settlement on the offshore leg of regulated eFX. A 270-day transition runs to 30 Oct 2026. Horizon · 2026-10-30 (±quarter) VASP framework transition deadline_in_force_pending · T3_ Horizon · 2026-10-01 (±quarter) eFX crypto-settlement ban effective (Res. 561)_in_force_pending · T3_ Standing sub-brief · as of 23 June 2026 331 words · last cycle 2026-10-18 #### Stablecoins & Digital Money Brazil's stablecoin and digital-money perimeter has escalated sharply. The VASP framework — Law 14.478/2022 plus BCB Resolutions 519, 520 and 521 of 10 November 2025 — saw its core rules enter into force on 2 February 2026, with a 270-day transition running to 30 October 2026. It establishes three licence modalities (Intermediary, Custodian and Broker), mandates client-asset segregation and monthly proof-of-reserves, and leaves the CVM with jurisdiction over securities tokens. Importantly, e-money is excluded from the virtual-asset definition under Law 12.865, keeping the PI and VASP perimeters distinct. From 30 October 2026, BCB-supervised institutions are barred from dealing with unauthorised VASPs. This framework establishes the licensing perimeter for stablecoin and crypto payment and remittance operators in Brazil's roughly US$6-8bn-per-month crypto market, around 90% of which is stablecoins. Layered onto the licensing framework is a settlement restriction. BCB Resolution 561, published 30 April 2026 and effective 1 October 2026, bars eFX providers from using stablecoins, bitcoin or crypto to settle the offshore leg of regulated international payments, restricts eFX to BCB-authorised institutions, and requires segregated client-fund accounts plus monthly reporting. It targets firms such as Nomad and Braza Bank that had used stablecoin settlement on the XRP Ledger in Brazil-US flows. The effect is to close the stablecoin cross-border settlement vector for eFX providers, forcing crypto-native remittance operators back onto FX-transaction or non-resident BRL account rails. The combined posture is restrictive: Brazil licenses VASPs while deliberately containing stablecoin use in cross-border payments. A vendor-sourced claim of an official BCB Pix-USDC integration has been excluded as unverified, conflicting with the Resolution 561 settlement ban and lacking primary confirmation. #### Outlook Two in-force-pending deadlines dominate: the eFX crypto-settlement ban takes effect 1 October 2026, and the VASP transition ends 30 October 2026, after which dealing with unauthorised VASPs is prohibited for supervised institutions. The trajectory is escalating and containment-directed. The retracted Pix-USDC claim flags a vendor/launch-hype over-indexing risk, where private fintech USDC-Pix on/off-ramp services may be conflated with official BCB policy. Periodic update · new data 2026-10-18 #### Stablecoins & Digital Money BCB Resolution 561, effective 1 October 2026, bars eFX providers, payment institutions, e-money issuers and acquirers from settling the offshore leg of regulated cross-border payments in stablecoins or other crypto assets. Settlement for these regulated flows must instead run through traditional FX operations or non-resident BRL accounts. The restriction targets a specific settlement channel used by licensed payment-sector participants for cross-border flows; it does not extend to retail crypto trading, which remains unaffected, and authorised VASPs and banks retain the ability to use stablecoins for cross-border payments under separate supervisory arrangements outside the regulated eFX settlement context this rule addresses. A dated transitional deadline attaches to this restriction: authorised institutions already providing eFX services were required to update their Unicad registration with the BCB by 30 October 2026, while providers not yet authorised may continue temporarily but must seek BCB approval by 31 May 2027. The restriction and its transitional deadlines together describe a structural narrowing of permissible settlement rails for regulated cross-border payment flows, implemented through BCB resolution rather than through a sector-wide ban on crypto-asset use. #### Outlook The 31 May 2027 deadline for unauthorised eFX providers to seek BCB approval is the principal dated milestone to track. Whether the offshore-leg settlement restriction is extended to further payment-institution categories, or whether the carve-out for authorised VASPs and banks is narrowed, remain open questions not addressed by this cycle's evidence. **2 earlier distinct update(s)** Periodic update · new data 2026-10-11 #### Stablecoins & Digital Money Brazil's stablecoin and digital-money perimeter tightened on two fronts this cycle. Resolucao BCB no 561/2026, in force from 1 October 2026, bars eFX providers from using virtual assets, including stablecoins, to settle, pay or receive the external leg of an international payment or transfer operation. This closes off a specific cross-border settlement use case for stablecoins without touching domestic custody or transfer activity, which continues to be governed by the general PSAV framework under Resolucao BCB no 519-521/2025. Providers already operating the eFX modality must separately register that modality in BCB's Unicad system by 30 October 2026, with non-listed providers required to apply for payment-institution authorisation by 31 May 2027 or cease the activity. Alongside the settlement restriction, Resolucao BCB no 588/2026 adds mandatory COAF reporting for virtual-asset transfers of US10,000 or more to or from a self-custodied wallet, also effective 1 October 2026. This reporting threshold is layered on top of the PSAV authorisation cliff under Resolucao BCB no 519/2025, which falls on 30 October 2026 and will bar BCB-authorised institutions from intermediating for virtual-asset service providers that are neither authorised nor in the authorisation process from that date. Taken together, these three instruments constrain the cross-border and self-custody dimensions of Brazil's virtual-asset market specifically, while leaving the underlying domestic PSAV licensing and custody framework otherwise unchanged this cycle. #### Outlook The 30 October 2026 date is the single most consequential near-term deadline for Brazil's stablecoin and digital-money sector, closing simultaneously the PSAV authorisation window and the eFX Unicad registration requirement. Firms operating cross-border stablecoin corridors, such as BlindPay's partnership with Circle, will need to navigate both the authorisation cliff and the new settlement restriction in the same window. Periodic update · new data 2026-08-11 #### Stablecoins & Digital Money Approximately ninety percent of Brazilian crypto-transaction volume is stablecoin-denominated, which makes the new virtual-asset service provider authorisation regime effectively a stablecoin-oversight framework in practice. Under the VASP framework established by BCB Resolutions 519, 520 and 521, issuers and exchanges handling that stablecoin volume face stricter reserve-transparency requirements, bringing stablecoin flows inside the central bank's foreign-exchange and capital-controls supervisory perimeter rather than leaving them to operate outside conventional payments oversight. The transition to full authorisation runs to 30 October 2026, the same deadline that governs the wider VASP regime. #### Outlook Reserve-transparency compliance among stablecoin issuers and exchanges is the practical marker to watch as the 30 October 2026 deadline approaches; given that ninety percent of Brazilian crypto volume already runs through stablecoins, the degree to which issuers can demonstrate compliant reserves will materially shape how much of that volume continues to route through authorised channels versus offshore alternatives. **Sources and findings (5)** 1. T1 BCB Resolutions 519/520/521 (SPSAV/VASP, eff. 2 Feb 2026) (bcb.gov.br) 2. T1 BCB Resolutions 519/520/521 (bcb.gov.br) 3. T1 BCB Resolution 521 — virtual-asset FX (bcb.gov.br) 4. T1 BCB Resolution 520 — VASP Travel Rule/AML (bcb.gov.br) 5. T1 BCB Resolution 561 (eff. 1 Oct 2026) — eFX stablecoin restriction (bcb.gov.br) ### W3 Operational Resilience & Critical Infrastructure Confirmed confirmed 2026-06-23 Operational resilience is governed by CMN Resolution 4.893/2021 (financial institutions) and BCB Resolution 85/2021 (payment institutions), effective from 2021, which mandate cybersecurity policies, incident response, business-continuity testing, and rules for contracting data-processing/storage and cloud services in-country or abroad — with the institution retaining full accountability for outsourced activity and the BCB granted audit/access rights. Institutions must report security incidents that constitute a 'crisis situation' to the BCB and retain documentation for at least five years. The June 2025 C&M Software breach exposed third-party (PSTI) supply-chain risk and triggered new cybersecurity rules (Res. 538/2025; CMN 5.274/2025, adaptation to March 2026). Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. [Open this jurisdiction's page on Dataprotection.gi →](https://dataprotection.gi/jurisdictions/brazil/) Horizon · 2026-03 (±quarter) Cybersecurity package adaptation deadline (Res. 538/2025; CMN 5.274/2025)_in_force_pending · T3_ Standing sub-brief · as of 16 August 2026 217 words · last cycle 2026-09-28 #### Operational Resilience & Critical Infrastructure Banco Central do Brasil has tightened device-level security controls across the Pix instant-payment rail. Accounts accessed from unregistered devices are now subject to transfer limits of roughly US$40 per transaction and roughly US$201 per day, backed by a precautionary lock mechanism that can freeze suspicious activity. The control applies uniformly to both bank and non-bank Pix participants, reflecting a scheme-wide push to reduce device-takeover fraud rather than a bank-specific or non-bank-specific carve-out. A separate rule targets the technology layer beneath Pix connectivity. Pix participants that connect through a payment-scheme technology infrastructure provider must demonstrate, via a CVM-registered auditor's report, that BCB-registered private signing keys are not shared with that provider; absent such certification a BRL 15,000 transaction limit applies, with a possible 90-day BCB waiver available while certification is completed. This signing-key segregation requirement raises the operational bar for participants that outsource connectivity infrastructure, again applying across the bank and non-bank participant base. #### Outlook Both the device-registration limits and the PSTI signing-key segregation rule are already in effect, shifting the near-term operational burden onto participants' fraud-monitoring and vendor-management functions rather than introducing a further compliance deadline. The direction of travel is toward tighter device- and infrastructure-level controls on the Pix rail, consistent with the broader authorisation and capital tightening running in parallel. Periodic update · new data 2026-09-28 #### Operational Resilience & Critical Infrastructure Pix's operational performance this cycle is, on its own terms, exceptional: the scheme accounted for 29% of all retail payments in the six months to May 2026, with transaction volume up 21.6% over that period, availability above 99.9%, and 99% of transactions settling within 0.449 seconds. These figures describe a payments-critical-infrastructure system operating at very high reliability and at a scale that now constitutes close to a third of Brazil's entire retail-payments volume. That scale sits against a supervisory-capacity signal that this cycle brought into sharper focus: BCB staffing has fallen 42% over the past decade while the number of regulated financial institutions it oversees has grown 50% over the same period. This is a single tier-2 source and the capacity-strain claim has not been independently corroborated, so it should be read as a flagged concern rather than a settled finding. It gains a concrete illustration, however, in the effective shutdown of Banco Master: the BCB intervened amid mounting liquidity pressure at the institution, and police arrested its controlling shareholder. Whether the Banco Master episode reflects a specific institutional failure unrelated to broader supervisory bandwidth, or is illustrative of the capacity strain the staffing figures suggest, cannot be resolved from this cycle's evidence, but the two data points arrived in the same reporting window and are being read together here for that reason. The operational-resilience picture for Pix itself -- the scheme's own uptime and settlement-speed metrics -- remains strong and shows no degradation. The resilience question this cycle is squarely about supervisory capacity to oversee an expanding population of regulated institutions, not about the scheme's own technical robustness. #### Outlook Whether the BCB responds to the staffing-versus-institution-growth gap with additional resourcing, and whether further institutional-stress events follow the Banco Master intervention, will indicate whether the capacity-strain signal identified this cycle is an isolated observation or the leading edge of a broader supervisory-bandwidth problem as Brazil's regulated-institution population continues to grow. **1 earlier distinct update(s)** Periodic update · new data 2026-09-21 #### Operational Resilience & Critical Infrastructure New BCB rules direct Pix participants to deploy historical and behavioural pattern analysis for real-time anomaly detection, and critically, this comes paired with a formal obligation to act on flagged orders, including blocking, rather than a purely advisory monitoring expectation. This is an assessed-confidence finding that shifts fraud-detection responsibility onto the payments infrastructure layer itself, applying across both bank and non-bank participants in the Pix ecosystem, rather than leaving detection and mitigation to end users acting alone. Complementing this behavioural-monitoring mandate, the BCB introduced device-recognition-based Pix transfer limits: R$200 per transaction and R$1,000 per day for transfers originating from unrecognised devices. Alongside the device-based limits sits a 72-hour precautionary hold mechanism for transfers flagged as suspicious, under which Nubank, Itaú Unibanco and Caixa Econômica Federal are named as institutions authorised to apply the hold, with funds remaining in the recipient account but unavailable pending review. This combination of device-recognition limits and a multi-day hold window represents a substantial operational-resilience uplift for the Pix rail, directly targeted at the anomaly-detection gap that unrecognised-device transfers had previously represented. #### Outlook Watch for whether the device-based limits and 72-hour hold mechanism extend beyond the three named institutions to the broader universe of Pix participants, and for the operational load these new obligations place on smaller payment institutions relative to the large banks currently named. **Sources and findings (4)** 1. T1 [https://www.bcb.gov.br/content/about/legislation_norms_docs/BCB_Resolution_No_85_2021.pdf](https://www.bcb.gov.br/content/about/legislation_norms_docs/BCB_Resolution_No_85_2021.pdf) retrieved 2026-06-23 2. T1 [https://www.bcb.gov.br/content/about/legislation_norms_docs/CMN_Resolution_No_4,893_2021.pdf](https://www.bcb.gov.br/content/about/legislation_norms_docs/CMN_Resolution_No_4,893_2021.pdf) retrieved 2026-06-23 3. T3 [https://www.legal500.com/guides/chapter/brazil-banking-finance/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]](https://www.legal500.com/guides/chapter/brazil-banking-finance/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]) 4. T3 [https://en.clickpetroleoegas.com.br/amidst-the-anti-fraud-package-for-the-brazilian-payment-system-the-central-bank-publishes-a-resolution-that-temporarily-suspends-sanctioning-btl96/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]](https://en.clickpetroleoegas.com.br/amidst-the-anti-fraud-package-for-the-brazilian-payment-system-the-central-bank-publishes-a-resolution-that-temporarily-suspends-sanctioning-btl96/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]) ### W4 Scheme & Network Compliance Probable confirmed 2026-06-23 Pix's rulebook moved on 18 September 2026 via Resolução BCB nº 587: mandatory participation above 500,000 active accounts is now exemptible case-by-case; fraud-flag registration carries new accountability duties; exit rules for institutions in extrajudicial liquidation tightened to immediate suspension. Standing sub-brief · as of 16 August 2026 112 words · last cycle 2026-10-18 #### Scheme & Network Compliance Banco Central do Brasil has revised the rulebook underpinning Pix at the scheme level. BCB Resolution No. 506 amended the founding Pix resolution, BCB Resolution No. 1/2020, revising authorisation criteria, penalties and fraud-prevention measures for participants in the scheme. The amendment applies to both bank and non-bank Pix participants and sits alongside the device-security and signing-key changes tracked under operational resilience, forming a single coordinated tightening of Pix scheme governance. #### Outlook The amended scheme rulebook is already in force, and its practical effect will be visible in how the BCB applies the revised penalty and fraud-prevention provisions against participants going forward; no further scheme-level deadline is currently scheduled. Periodic update · new data 2026-10-18 #### Scheme & Network Compliance Resolução BCB nº 587, approved by the Banco Central do Brasil's board on 17 September 2026 and published in the Diário Oficial da União the following day, introduces scheme-level accountability changes to the Pix system. An institution that registers a DICT fraud-suspicion flag is now responsible for that flag and must review it within seven days where a client contests it. Pix exclusion penalties, previously subject to a thirty-day adaptation window, are now immediately effective, removing the grace period institutions previously had before facing exclusion consequences for scheme non-compliance. The reform carries a staged implementation calendar running through July 2027. Two further scheme changes sit within the same Resolução BCB 587 package, both applying to both bank and non-bank participants in the Pix scheme. Pix Automático, the recurring-payment authorisation feature, is extended to salary accounts from 1 July 2027, broadening the account types eligible for the mechanism. Separately, anti-duplicate-payment rules are scheduled to apply from February 2027 to hybrid boleto-and-Pix billing arrangements, introducing a twenty-four-hour refund duty where duplicate settlement occurs across the two payment rails. The combined effect is a scheme compliance environment where accountability for fraud-flagging decisions is sharpened and enforcement timelines are compressed, while functional scope, through salary-account Pix Automático and anti-duplicate billing protections, is simultaneously extended. These are structural scheme-rule changes rather than incident responses, embedded in a single BCB resolution package rather than arising from a specific enforcement episode. #### Outlook The staged implementation calendar for Resolução BCB 587 runs through July 2027, with the salary-account Pix Automático extension landing 1 July 2027 and the anti-duplicate-payment rules for hybrid boleto-and-Pix billing landing in February 2027. The immediate-effect exclusion penalty and the seven-day flag-review requirement are already in force following the resolution's September 2026 publication. **1 earlier distinct update(s)** Periodic update · new data 2026-10-04 #### Scheme & Network Compliance Resolução BCB nº 587/2026 reforms three distinct dimensions of the Pix rulebook simultaneously. First, it ends the blanket obligation for institutions with over 500,000 active transactional accounts to offer Pix; exemption is now assessed case-by-case where a client profile or business model does not justify connection, a liberalising move that gives large institutions a route out of mandatory participation they previously lacked. Second, it imposes a fraud-flag accountability duty: whoever registers a Pix fraud-suspicion marking must inform the affected user, offer a review channel, and respond within seven days, and a marking can attach to a CPF or CNPJ and a Pix key for up to five years, a materially tightening consumer-facing conduct obligation. Third, it tightens the scheme's exit rules: institutions placed under extrajudicial liquidation now face immediate Pix suspension, with exclusion taking effect immediately rather than after the previous 30-day notice period. The combination reads as a scheme maturing under fraud pressure rather than moving in a single regulatory direction: the mandatory-participation change loosens scheme membership obligations for large players, while the fraud-flag and liquidation-exit changes tighten scheme discipline and consumer protection. Two further rulebook changes are scheduled for 2027: salary accounts may initiate Pix Automático payments from 1 July 2027, and hybrid billing combining a boleto and a Pix QR code on one document applies from 1 February 2027. #### Outlook The near-term question is how institutions newly eligible for a Pix-participation exemption respond, and whether the fraud-flag accountability regime produces a measurable reduction in deepfake-enabled fraud once it has been in force long enough to generate data. The two 2027 rulebook additions, Pix Automático for salary accounts and hybrid boleto/Pix billing, are scheduled rather than contingent, and should be treated as settled unless Resolução BCB nº 587/2026 is itself amended before those dates. **Sources and findings (4)** 1. T2 [https://www.kansascityfed.org/documents/11143/PublicAuthorityInvolvementPaymentCardMarkets_VariousCountries_August2025Update.pdf](https://www.kansascityfed.org/documents/11143/PublicAuthorityInvolvementPaymentCardMarkets_VariousCountries_August2025Update.pdf) retrieved 2026-06-23 2. T3 [https://www.vixio.com/insights/pc-time-has-come-cap-prepaid-card-interchange-fees-brazil-says](https://www.vixio.com/insights/pc-time-has-come-cap-prepaid-card-interchange-fees-brazil-says) retrieved 2026-06-23 3. T3 [https://www.sciencedirect.com/science/article/pii/S2666143822000321](https://www.sciencedirect.com/science/article/pii/S2666143822000321) retrieved 2026-06-23 4. T2 [https://www.sec.gov/Archives/edgar/data/1841644/000121390026001029/ea0201690-17.htm](https://www.sec.gov/Archives/edgar/data/1841644/000121390026001029/ea0201690-17.htm) retrieved 2026-06-23 ### W5 Payment Corridor Dynamics Confirmed confirmed 2026-06-23 Domestic rails are dominated by Pix (BCB-operated instant payments, launched Nov 2020), alongside legacy TED/DOC and boleto. Cross-border corridors run through the regulated eFX regime (BCB Resolution 561/2026 governs digital international payments and bars crypto on the offshore leg), traditional FX operations, and the FX Clearinghouse, which historically uses US correspondent banks for the USD leg. The BCB is actively exploring Pix internationalisation and interlinking with other instant-payment systems (bilaterally or via multilateral platforms such as Project Nexus) to improve cross-border speed, cost and access per G20 goals. Standing sub-brief · as of 16 August 2026 180 words · last cycle 2026-09-28 #### Payment Corridor Dynamics Pix remains the dominant instant-payment rail in Brazil, and Banco Central do Brasil is developing new Pix products, automatic Pix, guarantee Pix and international Pix, intended to replicate credit-card-industry functionality at lower cost. International Pix in particular points toward an emerging cross-border corridor ambition, extending Pix's domestic instant-payment model into international flows, though the initiative remains at a developmental stage relative to the domestic products. Alongside this product expansion, the BCB's DICT regulation requires institutions in the National Financial System to comply with Brazil's LGPD data-protection law in collecting, handling, storing and sharing Pix-user personal data. The data-protection overlap applies across the Pix ecosystem regardless of whether the participant is a bank or a non-bank payment institution. #### Outlook Automatic Pix, guarantee Pix and international Pix remain in development rather than general availability; their rollout timing will determine whether Brazil's Pix corridor extends materially beyond domestic instant payments in the near term. The LGPD compliance obligation on Pix-user data is already in force and will remain a standing condition on scheme participation rather than a discrete near-term deadline. Periodic update · new data 2026-09-28 #### Payment Corridor Dynamics Pix's cross-border footprint expanded this cycle, with release and availability metadata showing the scheme reaching eight additional countries as of 3 August 2026. This indicates Brazil's flagship instant-payments scheme continuing to move beyond a purely domestic corridor into an interoperability rollout with a growing number of external markets. The specific country count rests on a single tier-3 source and has not been independently corroborated this cycle, so the precise scope of the eight-country figure should be treated as indicative pending further verification. This cross-border expansion sits alongside, but is analytically distinct from, the US Section 301 trade dispute concerning Pix's domestic participation rules: the corridor-expansion story is about Pix reaching new markets as an interoperable scheme, while the trade dispute concerns the terms on which foreign payment companies can compete within Brazil's domestic Pix ecosystem. Both point to Pix's growing significance as a cross-border-relevant scheme rather than a purely domestic one, but they represent different vectors of that significance. #### Outlook As Pix's cross-border rollout continues, watch for which specific corridors see the most active use and whether the scheme's expansion draws further trade-policy scrutiny of the kind already directed at its domestic rules, given the precedent the Section 301 finding has now set for treating Pix's design choices as a trade-policy matter. **1 earlier distinct update(s)** Periodic update · new data 2026-08-11 #### Payment Corridor Dynamics Brazil's core instant-payments corridor, Pix, both expanded functionally and faced a significant platform-access dispute this cycle. Pix Automático launched in June 2026 to serve recurring billing use cases, eliminating the card-expiry failures and interchange fees that have historically affected subscription payments processed through card rails. At the same time, Apple has reportedly signalled willingness to negotiate a settlement with Brazil's competition authority, CADE, over its NFC-chip lockout, which has prevented native contactless Pix functionality on iPhones and drawn complaints from Nubank, PicPay and other fintechs seeking equal access to the device's near-field-communication hardware. #### Outlook A negotiated CADE settlement, if confirmed, would be the clearest resolution of the NFC-access dispute and would materially expand contactless Pix availability on Apple devices; terms and timing are not yet confirmed by a primary CADE source. Pix Automático's adoption curve among merchants offering recurring billing is a second corridor-dynamics marker to watch as it displaces card-based subscription rails. **Sources and findings (4)** 1. T1 [https://www.bcb.gov.br/en/financialstability/pix_en](https://www.bcb.gov.br/en/financialstability/pix_en) retrieved 2026-06-23 2. T2 [https://www.europeanpaymentscouncil.eu/news-insights/insight/pix-latest-updates-brazils-leading-instant-payment-scheme](https://www.europeanpaymentscouncil.eu/news-insights/insight/pix-latest-updates-brazils-leading-instant-payment-scheme) retrieved 2026-06-23 3. T3 [https://www.coindesk.com/policy/2026/05/02/brazil-s-central-bank-bans-stablecoin-and-crypto-settlement-in-cross-border-payments](https://www.coindesk.com/policy/2026/05/02/brazil-s-central-bank-bans-stablecoin-and-crypto-settlement-in-cross-border-payments) retrieved 2026-06-23 4. T1 [https://www.bis.org/cpmi/publ/d97_br.pdf](https://www.bis.org/cpmi/publ/d97_br.pdf) retrieved 2026-06-23 ### W6 Industry Structure & Commercial Probable confirmed 2026-06-23 Brazil's payments market is highly concentrated and fintech-led at the consumer edge. The acquiring market is dominated by Cielo, Rede, Getnet and Stone (>83% in 2020Q1), and issuing is similarly concentrated among the top five issuers (~80%). On the consumer side, digital banks/fintechs Nubank, PicPay and Mercado Pago lead by customers; Nubank reported ~110m Brazil customers (127m globally) in Q3 2025 and in October 2025 surpassed Petrobras as Brazil's most valuable company. The market combines incumbent bank-controlled acquirers, listed challengers, and a long tail of PIs and sub-acquirers. Standing sub-brief · as of 16 August 2026 212 words · last cycle 2026-09-28 #### Industry Structure & Commercial Dynamics Banco Central do Brasil is rewriting minimum-capital requirements to tie them to activities rather than institutional labels, with phase-in beginning 1 July 2026 at one quarter of the capital gap, rising to half by January 2027 and the full amount by January 2028. The rule applies to institutions performing payment and lending activities regardless of licence category, but its incidence is highly uneven: industry estimates cited in the reporting put roughly 92% of peer-to-peer lenders and roughly 63% of payment institutions at risk of a capital shortfall under the new rule, against only around 5% of full-service banks. That asymmetry sits squarely on the bank-versus-non-bank fault line that runs through this cycle's authorisation and Pix-security changes: non-bank payment institutions and P2P lenders face a materially higher probability of falling short of the new capital floor than already-capitalised banks. #### Outlook The phase-in begins 1 July 2026, rises to half the capital gap by January 2027 and reaches full compliance by January 2028. Given the scale of the exposure gap between non-bank payment institutions and banks, the rule is likely to accelerate consolidation among smaller Brazilian payment institutions and P2P lenders as the capital deadlines approach, a dynamic that compounds the authorisation and Pix-security tightening tracked elsewhere this cycle. Periodic update · new data 2026-09-28 #### Industry Structure & Commercial Dynamics The effective shutdown of Banco Master is the defining industry-structure event of this cycle. The BCB intervened amid mounting liquidity pressure at the institution, and police arrested its controlling shareholder -- a sequence indicating the intervention was driven by both a liquidity crisis and conduct serious enough to draw a criminal law-enforcement response alongside the regulatory one. This is a live industry-structure event with direct implications for market concentration and counterparty confidence in Brazil's banking sector, distinct from the routine licensing and capital-rule changes affecting the broader Pix ecosystem this cycle. The Banco Master intervention is best read alongside the supervisory-capacity signal flagged elsewhere this cycle: BCB staffing has fallen 42% over the past decade while the number of regulated institutions has grown 50%. Whether the Banco Master failure reflects a gap in supervisory bandwidth specifically, or an institution-specific failure that would have occurred regardless of staffing levels, is not resolvable from the available evidence, but the timing of the two signals arriving together in the same reporting window is itself notable for market participants assessing counterparty risk among mid-tier Brazilian banks. #### Outlook The Banco Master resolution process -- asset disposition, any deposit-insurance mechanism activation, and the criminal proceeding against the former controlling shareholder -- will be the concrete markers to watch for whether this event proves contained or triggers wider industry-structure consequences for confidence in Brazil's banking sector. **1 earlier distinct update(s)** Periodic update · new data 2026-08-11 #### Industry Structure & Commercial Dynamics Brazilian fintech reached a capital-markets milestone this cycle. PicPay completed a $434 million Nasdaq initial public offering on 29 January 2026, targeting a $2.46 billion valuation and marking the first major Brazilian fintech listing since Nubank's 2021 debut, reopening a capital-markets access channel for the sector that had been largely dormant since that listing. Separately, Nu Holdings received conditional approval from the US Office of the Comptroller of the Currency in January 2026 for a US national bank charter, while Nubank announced in December 2025 its intent to acquire a Brazilian banking licence during 2026, a dual-track expansion of its regulatory footprint on both sides of its core markets. Central-bank customer-ranking data spanning the fourth quarter of 2025 through the first quarter of 2026 show continued share consolidation among the largest digital players: Nubank added approximately 2.7 million customers to reach roughly 114.7 million, and Mercado Pago added 2.5 million to reach 71.3 million, while Stone recorded the sharpest customer decline among the top twenty institutions, indicating that competitive pressure in Brazil's retail-payments and digital-banking market continues to favour the largest platforms. #### Outlook Nubank's pursuit of a Brazilian banking licence alongside its US charter progress, and PicPay's post-IPO acquisition strategy evidenced by the Kovr Participações deal, both point toward continued consolidation of financial services under Brazil's largest fintech platforms. Whether Stone's customer decline stabilises or continues will be a useful indicator of whether the market-share consolidation trend evidenced this cycle persists. **Sources and findings (4)** 1. T3 [https://www.sciencedirect.com/science/article/pii/S2666143822000321](https://www.sciencedirect.com/science/article/pii/S2666143822000321) retrieved 2026-06-23 2. T3 [https://www.americanbanker.com/news/brazilian-digital-bank-picpay-files-for-u-s-ipo](https://www.americanbanker.com/news/brazilian-digital-bank-picpay-files-for-u-s-ipo) retrieved 2026-06-23 3. T3 [https://www.riotimesonline.com/brazil-fintech-2026-complete-guide/](https://www.riotimesonline.com/brazil-fintech-2026-complete-guide/) retrieved 2026-06-23 4. T1 [https://www.bis.org/cpmi/publ/d97_br.pdf](https://www.bis.org/cpmi/publ/d97_br.pdf) retrieved 2026-06-23 ### W7 Legal & Litigation Probable confirmed 2026-06-23 Enforcement is dominated by the June 2025 C&M Software breach — the largest cyber-heist in Brazilian history — in which attackers used credentials of a bribed C&M employee to inject fraudulent Pix orders, draining over R$1bn (≈R$813m+ commonly cited) from at least six institutions' reserve accounts; the Federal Police opened an investigation and the BCB suspended parts of C&M's operations. Follow-on incidents hit Sinqia and Monbank. Major Polícia Federal operations (Magna Fraus, Lusocoin, Carbono Oculto exposing PCC laundering via fintechs) and BCB administrative enforcement (intervention, extrajudicial liquidation, manager liability, RAET) shape the regime. A notable commercial dispute: GetNet (Santander) sued Nubank and Mastercard over prepaid-card interchange losses. Standing sub-brief · as of 23 June 2026 199 words · last cycle 2026-09-28 #### Legal & Litigation Two developments anchor the litigation picture. First, the late-June 2025 C&M Software Pix supply-chain breach — with the attack around 30 June 2025 and BCB disclosure in early July 2025 — saw bribed-employee credentials used to inject fraudulent Pix orders, draining roughly R$800m (around US$140m) from the reserve accounts of at least six institutions, with follow-on hits to Sinqia (~R$400m) and Monbank (~R$4.9m). It is the largest cyber-heist in Brazilian history and the defining operational-resilience event, having triggered the 2025-26 cybersecurity rule package. Second, GetNet (Santander) filed a claim for roughly R$62m in damages against Nubank and Mastercard over prepaid-card acceptance losses, alleging that Nubank promotes its prepaid card as a debit-function card. This landmark commercial dispute tests the prepaid-versus-debit interchange classification commercially and intersects the W4 interchange reform; its outcome bears on prepaid-card economics across the market. The litigation touches both bank-PSPs (Santander/GetNet as claimant) and non-bank PIs (Nubank as defendant), with Mastercard joined as a scheme defendant. #### Outlook The trajectory is escalating. The C&M breach prosecution and the GetNet v Nubank/Mastercard prepaid dispute are the two active threads. The prepaid-interchange dispute is the most commercially consequential, given its bearing on prepaid-card classification and economics. Periodic update · new data 2026-09-28 #### Legal & Litigation USTR's Section 301 investigation into Brazil's Pix scheme produced findings published in the US Federal Register on 4 June 2026, concluding that three specific features of Pix's design -- its mandatory-participation rule, its app-prominence mandate, and its business-transaction fee caps -- unfairly disadvantaged US payment companies including Visa and Mastercard. Roughly three months later, BCB Resolução no. 587, published 18 September 2026, removed the mandatory-participation requirement for institutions with 500,000 or more active accounts. The BCB frames this change on business-model grounds rather than as a direct response to the US finding, but the sequence and timing indicate the litigation and trade-policy dimension of Brazil's payments framework materially influenced Brazil's payments regulatory design, even absent an explicit acknowledgment of that link in the BCB's own framing. Two of the three US demands remain unaddressed: the app-prominence mandate, which governs how Pix is displayed relative to competing payment options within apps, and the business-transaction fee caps, which constrain the fees payment companies can charge on Pix-adjacent business transactions. Both remain in place following Resolução no. 587, meaning the underlying trade dispute is only partially resolved by this cycle's regulatory change. This is a live cross-border legal-exposure matter: the US Section 301 process gives Washington a continuing formal channel to press the two unresolved demands, and Brazil's partial accommodation on the third demand may be read either as a good-faith first step or as a calibrated minimum response, depending on how the remaining dispute develops. #### Outlook Watch for any USTR statement responding specifically to Resolução no. 587, which would clarify whether the US considers the participation-mandate removal a meaningful concession or an insufficient partial response. Absent further Brazilian movement on the app-prominence mandate and fee caps, the Section 301 dispute remains a live and only partially resolved legal-exposure matter for Brazil's payments framework. **Sources and findings (4)** 1. T3 [https://www.tenchisecurity.com/en/insights-news/how-third-party-cyber-risk-management-could-have-mitigated-banking-incidents-in-brazil](https://www.tenchisecurity.com/en/insights-news/how-third-party-cyber-risk-management-could-have-mitigated-banking-incidents-in-brazil) retrieved 2026-06-23 2. T3 [https://www.bitdefender.com/en-us/blog/hotforsecurity/hackers-brazil-100-million-heist](https://www.bitdefender.com/en-us/blog/hotforsecurity/hackers-brazil-100-million-heist) retrieved 2026-06-23 3. T3 [https://practiceguides.chambers.com/practice-guides/financial-services-regulation-2025/brazil/trends-and-developments](https://practiceguides.chambers.com/practice-guides/financial-services-regulation-2025/brazil/trends-and-developments) retrieved 2026-06-23 4. T3 [https://www.vixio.com/insights/pc-time-has-come-cap-prepaid-card-interchange-fees-brazil-says](https://www.vixio.com/insights/pc-time-has-come-cap-prepaid-card-interchange-fees-brazil-says) retrieved 2026-06-23 ### W8 Merchant Acquiring & Risk Probable confirmed 2026-06-23 Acquiring is governed by accreditation agreements between acquirers/sub-acquirers and merchants and by BCB scheme/interchange rules. Acquirers and sub-acquirers (the latter not card-network members) capture, process, settle and credit merchant transactions and handle chargebacks; the MDR (including interchange) is the merchant cost. The 2023/2024 interchange reform harmonised prepaid settlement to the 2-day debit cycle, materially improving merchant liquidity in a high-base-rate environment. Card chargebacks are issuer-mediated consumer-protection reversals, distinct from Pix's MED. Standing sub-brief · as of 23 June 2026 190 words · last cycle 2026-06-23 #### Merchant Acquiring & Risk The Brazilian acquiring framework governs merchant acquiring and risk through acquirer and sub-acquirer accreditation agreements combined with BCB scheme and interchange rules. The merchant discount rate (MDR), inclusive of interchange, is a merchant cost. The 2023/24 prepaid settlement harmonisation to the two-day debit cycle improved merchant liquidity. Card chargebacks, which are issuer-mediated, are distinct from the Pix Special Return Mechanism (MED). A structural feature shapes the competitive dynamics: sub-acquirers are not card-network members and process at low cost across brands, positioning them as a disruption vector against bank-controlled acquirers. On the Pix side, MED debits the recipient merchant's settlement and offers no merchant evidence-submission process, a materially different risk profile from card chargebacks. Together these mechanics define the acquirer and sub-acquirer settlement, chargeback and MDR economics that govern merchant-acquiring P&L in Brazil. The framework spans both bank-controlled acquirers and non-bank sub-acquirers, with the sub-acquirer model the principal non-bank entry route into merchant acquiring. #### Outlook The trajectory is established. Settlement harmonisation and the sub-acquirer competitive model are settled features. The principal forward tension is the prepaid-interchange classification question, tracked under W7, which bears directly on acquiring economics. no periodic updates on record for this sub-brief ** Sources and findings (4)** 1. T2 [https://www.sec.gov/Archives/edgar/data/1841644/000121390026001029/ea0201690-17.htm](https://www.sec.gov/Archives/edgar/data/1841644/000121390026001029/ea0201690-17.htm) retrieved 2026-06-23 2. T3 [https://www.vixio.com/insights/pc-fair-and-correct-pagbrasil-ceos-verdict-new-interchange-rules](https://www.vixio.com/insights/pc-fair-and-correct-pagbrasil-ceos-verdict-new-interchange-rules) retrieved 2026-06-23 3. T1 [https://www.bcb.gov.br/conteudo/eventos/Documents/Conferencia_anual_bc/2024/3B_3A_TIAGO_CAVALCANTI_A_CommentsAcquirers.pdf](https://www.bcb.gov.br/conteudo/eventos/Documents/Conferencia_anual_bc/2024/3B_3A_TIAGO_CAVALCANTI_A_CommentsAcquirers.pdf) retrieved 2026-06-23 4. T3 [https://docs.ebanx.com/docs/payments/guides/after-payments/med-pix-overview/](https://docs.ebanx.com/docs/payments/guides/after-payments/med-pix-overview/) retrieved 2026-06-23 ### W9 Product Innovation & Market Development Probable confirmed 2026-06-23 Brazil is a global instant-payments innovation leader. Pix has expanded from one-time P2P/P2B transfers into a product family: Pix Agendado (scheduled), Pix por Aproximação (contactless, launched Feb 2025), Pix Automático (recurring/direct-debit-style, launched 2025), and Pix Parcelado/Installment Pix and Pix Garantido (credit-backed) in the pipeline; offline and cross-border Pix are being explored. Open Finance Brazil is a maturing build-out feeding new products, and the BCB maintains an active Regulatory Sandbox (e.g. real-asset tokenisation). Standing sub-brief · as of 16 August 2026 193 words · last cycle 2026-10-11 #### Product Innovation & Market Development Banco Central do Brasil has launched Pix Parcelado, which lets payers spread payments over time while payees still receive the full amount instantly; a future feature enabling Pix receivables to be used as loan collateral is planned for 2026. The instalment mechanism sits alongside the automatic Pix, guarantee Pix and international Pix products under development, together forming a broader push to layer credit-card-like functionality onto the Pix rail at lower cost than traditional card networks. Separately, Drex, Brazil's central bank digital currency, has been substantially re-scoped after two pilot phases: its 2026 initial version launches without blockchain, focused on credit-lien-reconciliation infrastructure rather than a tokenised retail CBDC. The shift marks a pragmatic, infrastructure-first turn in Brazil's CBDC development rather than an abandonment of the underlying digital-currency ambition. #### Outlook Pix Parcelado's receivables-as-collateral feature is planned for 2026 and will be a marker of how far the BCB pushes Pix into credit-substitute territory. Drex's non-blockchain initial phase will similarly bear watching in 2026 as a test of whether the re-scoped, infrastructure-first approach is a durable design choice or an interim step ahead of a later return to a tokenised model. Periodic update · new data 2026-10-11 #### Product Innovation & Market Development Resolucao BCB no 587/2026 extends Pix Automatico, the recurring-payment feature within Brazil's Pix instant-payments scheme, to salary accounts from 1 July 2027, enabling recurring-bill payments to be drawn from salary accounts under the automatico mechanism. The same resolution introduces new anti-duplicate-charge rules governing how recurring-payment instructions are processed, addressing a specific operational risk in automated recurring-debit functionality. This is a liberalising development, expanding the reach of an existing instant-payments feature to a new account category rather than introducing a wholly new payment rail. The extension sits in contrast to this cycle's tightening of the cross-border virtual-asset perimeter under W2, illustrating that Brazil's payments regulator is pursuing a differentiated rather than uniformly restrictive posture: domestic instant-payments functionality is expanding even as cross-border virtual-asset settlement is being constrained. The 1 July 2027 effective date gives the market a substantial lead time, in contrast to the near-term 30 October 2026 deadlines governing the virtual-asset perimeter. #### Outlook The Pix Automatico salary-account extension will not take effect until 1 July 2027. The intervening period gives payment institutions and employers time to adapt systems to the new anti-duplicate-charge rules ahead of the extension's effective date. **2 earlier distinct update(s)** Periodic update · new data 2026-10-04 #### Product Innovation & Market Development Instrução Normativa BCB 746, signed 16 June 2026, revokes article 16-A of Instrução Normativa BCB 512/2024, removing the R$500 ceiling that previously capped contactless Pix payments, effective from 1 October 2026. In place of the fixed regulatory cap, customers will now agree the proximity-payment ceiling directly with their institution, shifting the limit-setting function from the regulator to a bilateral customer-institution arrangement. This is a liberalising product development distinct from the fraud-and-conduct-focused changes moving through the rest of the Pix rulebook this cycle: it expands what contactless Pix can be used for at the point of sale by removing a fixed transactional ceiling, rather than adding a new consumer-protection or scheme-discipline obligation. #### Outlook The practical effect of this change will depend on how individual institutions set customer-specific proximity-payment ceilings in practice; whether institutions adopt materially higher limits than the previous R$500 cap, or converge informally around a similar figure, will determine whether this functions as a meaningful liberalisation or a largely administrative delegation of a limit that stays similar in practice. Periodic update · new data 2026-09-21 #### Product Innovation & Market Development CMN Resolution 5.298/2026, effective 4 May 2026, bars the use of derivatives lacking real economic backing. This is an assessed-confidence, dated dashboard-tier finding rather than a full structural development, and its practical significance in the payments space lies in its function as a regulatory lever against unregulated prediction-market products that compete for the same consumer attention and settlement rails as Pix-settled, regulated betting and payments flows. The resolution cross-references a separate blocking action taken by the SPA against prediction-market platforms, indicating coordinated use of financial-market and gambling-regulatory tools against the same product category. A further item on the product-development horizon, the MED 2.0 fund-recovery enhancement expected to go live in February 2026, was not independently confirmed as live this cycle and stands only on the previously expected date. This is flagged as a gap rather than a confirmed development, and its status should be treated as unresolved pending confirmation in a future cycle. #### Outlook The key open item is whether MED 2.0 fund-recovery functionality actually launched on its expected February 2026 date; this was not confirmed this cycle. Separately, watch for whether CMN Resolution 5.298/2026's derivatives-backing requirement produces further prediction-market blocking actions coordinated with the betting regulator. **Sources and findings (4)** 1. T3 [https://www.pagbrasil.com/blog/pix/differences-between-the-types-of-pix/](https://www.pagbrasil.com/blog/pix/differences-between-the-types-of-pix/) retrieved 2026-06-23 2. T3 [https://paymentscmi.com/insights/pix-in-brazil-latest-statistics-central-bank/](https://paymentscmi.com/insights/pix-in-brazil-latest-statistics-central-bank/) retrieved 2026-06-23 3. T3 [https://www.boku.com/blog/pix-payments-how-brazils-instant-payment-system-rewrote-the-rules](https://www.boku.com/blog/pix-payments-how-brazils-instant-payment-system-rewrote-the-rules) retrieved 2026-06-23 4. T3 [https://www.globallegalinsights.com/practice-areas/blockchain-cryptocurrency-laws-and-regulations/brazil/](https://www.globallegalinsights.com/practice-areas/blockchain-cryptocurrency-laws-and-regulations/brazil/) retrieved 2026-06-23 ### W10 Consumer Protection & APP Fraud Confirmed confirmed 2026-06-23 The Pix Special Return Mechanism (MED), created Nov 2021, is the core consumer-redress tool for fraud/scams/operational failure: victims register within 80 days, receiving-institution funds are blocked, both institutions review within 7 days and refunds (full or partial, subject to available balance) follow. Recovery has historically been low (~9% in 2023) because fraudsters move funds onward, prompting MED 2.0 (BCB Res. 493/2025) to trace and block across up to five 'cascading' account hops (optional Nov 2025, mandatory 2 Feb 2026; sanctioning grace via Res. 546 to 10 May 2026). A self-service MED button was mandated (Res. 589, by Oct 2025) and Res. 501/2025 requires rejecting transfers to fraud-flagged accounts. Consumer-protection law (CDC) also applies, including to crypto operations. Horizon · 2026-05-10 (±quarter) MED 2.0 cascading-block sanctioning grace expiry (Res. 546)_in_force_pending · T3_ Standing sub-brief · as of 23 June 2026 218 words · last cycle 2026-10-04 #### Consumer Protection & APP Fraud Brazil's consumer-redress regime for instant payments centres on the Pix Special Return Mechanism (MED), introduced in November 2021, which provides an 80-day registration period, 7-day review and full or partial refund. The regime is being upgraded substantially. MED 2.0, under BCB Resolution 493/2025, traces and blocks funds across cascading account hops; it became optional on 23 November 2025 and mandatory on 2 February 2026, with a sanctioning grace period to 10 May 2026 under Resolution 546. A self-service MED button was mandated under Resolution 589 by October 2025, and Resolution 501/2025 requires institutions to reject transfers to fraud-flagged accounts. The upgrade responds to historically low recovery rates — around 9% in 2023, with roughly 89% of MED requests denied for insufficient funds or closed accounts. The cascading-block design directly targets that gap. The MED 2.0 cascading-block and fraud-flag rejection obligations are a core consumer-protection compliance load for every Pix participant, bank-PSP and non-bank PI alike. The escalation from reactive MED to preventive-plus-tracing reflects Brazil's position as a global testbed for instant-payment fraud defence. #### Outlook The trajectory is escalating. The binding near-term milestone is the MED 2.0 sanctioning grace expiry on 10 May 2026, following the mandatory adoption date of 2 February 2026. The structural direction is toward preventive interdiction rather than after-the-fact recovery. Periodic update · new data 2026-10-04 #### Consumer Protection & APP Fraud Deepfake-enabled financial fraud has risen sharply in Brazil through 2026: synthetic and deepfake content now accounts for roughly 1 in 15, or 6.5 percent, of detected financial-fraud cases, up from 0.1 percent in March 2025, an increase reported at 830 percent, drawing on data from Febraban, the Federal Police and VU. This is the direct driver behind the new Pix fraud-flag accountability duty introduced in Resolução BCB nº 587/2026: whoever registers a Pix fraud-suspicion marking must now inform the affected user, offer a review channel, and respond within seven days. A fraud-suspicion marking can attach to a customer's CPF or CNPJ and to a specific Pix key for up to five years, giving the marking a materially longer practical consequence than a single transaction dispute. The pairing of these two developments, a sharply rising fraud typology and a new accountability duty tied directly to it, positions Brazil's response as a direct regulatory reaction to a measured and recent threat trend rather than a general scheme-hygiene update. #### Outlook The key indicator to watch is whether the 6.5 percent deepfake-fraud share stabilises, continues rising, or falls once the fraud-flag accountability duty has had time to change institutional behaviour around fraud-marking decisions. The five-year marking duration itself may become a point of contention if false-positive markings prove to carry disproportionate consequence for affected customers. **2 earlier distinct update(s)** Periodic update · new data 2026-09-21 #### Consumer Protection & APP Fraud Febraban reported that Pix-enabled fraud and scam disbursement losses rose 43 percent to R$2.7 billion, an industry-body figure cited as the direct driver behind a package of new consumer-protection rules introduced this cycle. In direct response, financial institutions, specifically Nubank, Itaú Unibanco and Caixa Econômica Federal as named in reporting, are now authorised to hold incoming transfers for up to 72 hours where fraud is suspected, with funds remaining visible in the recipient's account but unavailable for use pending review. This hold mechanism operates alongside the device-recognition-based transfer limits described under Operational Resilience, capping transfers from unrecognised devices at R$200 per transaction and R$1,000 per day. The scale of the reported fraud-loss increase, a 43 percent year-on-year rise to R$2.7 billion, frames these new consumer-protection measures as a direct regulatory and industry response to a documented and escalating harm, rather than a precautionary or anticipatory rule. The named institutions' authorisation to apply the hold is confirmed only for those three entities in the reporting reviewed this cycle; broader applicability across the Pix participant base is plausible but not independently confirmed. #### Outlook The clearest indicator to track next cycle is whether the Febraban-reported fraud-loss figure declines following the introduction of the hold mechanism and device-based limits, and whether the 72-hour hold authorisation is extended to a wider set of Pix-participating institutions beyond the three currently named. Periodic update · new data 2026-08-11 #### Consumer Protection & APP Fraud Brazil's central bank moved on two fronts to address Pix-related fraud this cycle. BCB Resolution 493/2025 restructured Pix Forum governance and strengthened the Special Return Mechanism, the scheme's dedicated fraud fund-recovery process, making fund recovery mandatory from 2 February 2026 rather than discretionary. Separately, new transfer limits of approximately BRL200 (roughly USD40) now apply to transactions initiated from unrecognised devices, paired with a seventy-two-hour precautionary hold, both aimed squarely at account-takeover fraud, a pattern in which a compromised device is used to authorise unauthorised Pix transfers before the legitimate account holder can intervene. #### Outlook The mandatory fund-recovery requirement under the strengthened Special Return Mechanism is the clearer consumer-facing protection to monitor, since it converts what was previously a best-efforts recovery process into an enforceable obligation from February 2026. The device-recognition limits and holding period will be tested by how effectively they reduce account-takeover losses without materially degrading the user experience that has driven Pix's adoption. **Sources and findings (4)** 1. T1 [https://www.bcb.gov.br/en/financialstability/pixfaqen](https://www.bcb.gov.br/en/financialstability/pixfaqen) retrieved 2026-06-23 2. T3 [https://www.qedinvestors.com/blog/the-frontlines-of-fraud-how-brazil-is-becoming-a-global-testbed-for-financial-crime-prevention](https://www.qedinvestors.com/blog/the-frontlines-of-fraud-how-brazil-is-becoming-a-global-testbed-for-financial-crime-prevention) retrieved 2026-06-23 3. T3 [https://en.clickpetroleoegas.com.br/amidst-the-anti-fraud-package-for-the-brazilian-payment-system-the-central-bank-publishes-a-resolution-that-temporarily-suspends-sanctioning-btl96/](https://en.clickpetroleoegas.com.br/amidst-the-anti-fraud-package-for-the-brazilian-payment-system-the-central-bank-publishes-a-resolution-that-temporarily-suspends-sanctioning-btl96/) retrieved 2026-06-23 4. T3 [https://www.commercegate.com/central-bank-of-brazil-and-febraban-to-change-pix-refund-mechanism-for-fraud-victims/](https://www.commercegate.com/central-bank-of-brazil-and-febraban-to-change-pix-refund-mechanism-for-fraud-victims/) retrieved 2026-06-23 ### W11 AML/CFT & Financial Crime (Sentinel.gi-fed) [Sourced from Sentinel.gi ↗](https://sentinel.gi/jurisdictions/brazil/#sec-dom-D7) Confirmed confirmed 2026-06-23 [SENTINEL-FED] Payments-context AML/CFT position only. Brazil's AML/CFT regime centres on Law 9.613/1998 (the AML Law, amended by Laws 10.701/2003, 12.683/2012, 13.974/2020), which created COAF as the financial intelligence unit (operationally autonomous, administratively linked to the BCB). BCB Circular 3.978/2020 sets the AML/CFT policy, procedures and internal-controls framework for supervised entities, including payment institutions. Brazil is a FATF and GAFILAT member; the 2023 FATF/GAFILAT mutual evaluation noted strengths and gaps (notably BO access and non-bank supervision). For payments: institutions must KYC, monitor transactions, keep records, and report suspicious activity to COAF. Standing sub-brief · as of 23 June 2026 216 words · last cycle 2026-06-23 #### AML/CFT & Financial Crime This module carries the Sentinel.gi feed only and does not re-analyse illicit finance; original illicit-finance analysis is routed to the Financial Intelligence Monitor. As reported via the Sentinel feed, Brazil operates its payments-context AML/CFT regime through Law 9.613/1998, which created the COAF financial intelligence unit — operationally autonomous and administratively linked to the BCB — together with BCB Circular 3.978/2020 setting AML/CFT policy and internal-controls obligations for supervised entities including payment institutions. Brazil is a FATF/GAFILAT member. The 2023 mutual evaluation noted beneficial-ownership access and non-bank supervision gaps. Suspicious-transaction reporting is required within 24 hours, records kept for at least five years, with reporting from transactions of R$10,000. The Sentinel feed also notes crypto-Pix laundering vectors and VASP/gold AML expansion. The regime defines the AML/CFT obligation set — KYC, monitoring and COAF STR filing — that payment institutions must operate, and the bank-versus-non-bank supervision gap identified in the 2023 evaluation is a structural payments-AML risk specific to the non-bank PI perimeter. #### Outlook The trajectory is stable but reform-directed, per the Sentinel feed. The beneficial-ownership access and non-bank supervision gaps flagged by FATF/GAFILAT in 2023 are the standing reform pressure points. Original illicit-finance typologies — including crypto-Pix vectors and PCC-related laundering — are carried into the Financial Intelligence Monitor rather than analysed here. no periodic updates on record for this sub-brief ** Sources and findings (8)** 1. T3 [https://fincrimecentral.com/brazil-aml-reforms-fines-financial-crime-coaf/](https://fincrimecentral.com/brazil-aml-reforms-fines-financial-crime-coaf/) retrieved 2026-06-23 2. T? FIM (sentinel.gi) per-JID baseline profile — Brazil — AML Law 9613/1998 with COAF (FIU) at its centre, coordinated via the ENCCLA inter-agency mechanism; joint FATF/GAFILAT MER (Dec 2023) found improved risk understanding and TF criminalisation but weak DNFBP supervision and unpopulated BO data. New BCB Resolutions 519-521 (Nov 2025) create a VASP licensing regime effective Feb 2026. 3. T3 FIM (sentinel.gi) regulatory_horizon_register (issue FIM-BASE-HRZ-001) — SPSAV VASP authorisation deadline for existing crypto firms 4. T1 FIM (sentinel.gi) sanctions_change_register (issue FIM-BASE-SANC-003) — Sanctions: OFAC listing 5. T1 FIM (sentinel.gi) enforcement_action_register (issue FIM-BASE-ENF-006) — Enforcement: OFAC (US Treasury) — Pixwave Solucoes de Pagamentos, Victory Trading, Wave Construcoes (Brazilian entities linked to PCC) 6. T? FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-004) — Gap: capacity-deficit 7. T? FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-005) — Gap: enforcement-absence 8. T? FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-002) — Gap: regulatory-failure ### W12 Correspondent Banking, Settlement & Access Confirmed confirmed 2026-06-23 Interbank settlement runs through the STR (Reserves Transfer System), a BCB-operated RTGS providing irrevocable, unconditional real-time finality, underpinned by Law 10.214/2001 (settlement finality, multilateral netting, collateral seizure in insolvency). Reserve/settlement accounts at the BCB are mandatory for some institutions and optional for others; the BCB extends fully collateralised free intraday credit to reserve-account holders. Pix settles via the SPI through Instant Payment (IP) accounts, accessed directly or via accredited PSTIs. Cross-border USD legs route through the FX Clearinghouse and US correspondent banks. Payment institutions can access SPI directly (IP account) or indirectly via a direct participant. Standing sub-brief · as of 23 June 2026 220 words · last cycle 2026-09-02 #### Correspondent Banking, Settlement & Access The analytical spine of this module is the bank versus non-bank settlement-access asymmetry. Settlement finality runs through the STR (Reserves Transfer System) RTGS, which provides irrevocable, unconditional real-time finality underpinned by Law 10.214/2001 — covering settlement finality, multilateral netting and collateral seizure in insolvency. Pix flows settle via the SPI through Instant Payment (IP) accounts, which can be accessed directly or via an accredited PSTI. The access asymmetry is the spine: non-bank PIs can access the SPI directly via an IP account or indirectly via a direct participant, where direct IP-account access is the key settlement-access differentiator versus indirect-participant dependency. Reserve accounts are mandatory for some institutions and optional for others, and the BCB extends fully collateralised free intraday credit. IP accounts must remain non-negative, with remuneration governed by Resolution 195/2022. On the cross-border side, the USD corridor depends on US correspondent banks for the USD leg over Fedwire, while BRL legs settle via the STR — a bank-PSP-mediated dependency that defines the structural choke point for the BR-US corridor. #### Outlook The trajectory is established. The standing structural question is the settlement-access differential between non-bank PIs with direct IP-account access and those dependent on indirect participation. The USD correspondent dependency remains the key cross-border access constraint, tied to the Resolution 561 rerouting tracked under W5. Periodic update · new data 2026-09-21 #### Correspondent Banking, Settlement & Access Two developments this cycle extend correspondent-banking-style counterparty-risk obligations onto sectors that have not traditionally carried them. Decreto 13.033 and Ministério da Fazenda Portaria 1.766 impose joint tax liability, under Complementary Law 224/2025 Article 6, on banks, payment institutions and payment arrangers that continue processing transactions for unauthorised betting operators after formal notification. This is the analytical spine of this module's finding: it extends a due-diligence and counterparty-screening duty, structurally similar to correspondent-banking know-your-customer's-customer obligations, onto payment institutions and payment arrangers, a class of firm that has historically operated under lighter counterparty-risk expectations than bank correspondents. Separately, BCB Resolution 521/2025 folds certain virtual-asset cross-border operations, including payments, stablecoin transactions and self-hosted-wallet transfers, into Brazil's existing FX-market regulatory perimeter, effective 2 February 2026. From the settlement-and-access lens, this development matters because it brings a previously FX-perimeter-adjacent category of cross-border value transfer inside the same regulatory access framework that governs traditional correspondent FX activity, with direct implications for which institutions can settle these flows and under what screening obligations. This finding carries direct overlap with the crypto monitor's stablecoin-regime coverage of the same resolution; this module's contribution is the settlement-access and counterparty-screening reading rather than the digital-asset classification question. The bank-versus-non-bank distinction is the analytical throughline across both developments: payment institutions and payment arrangers, non-bank entities, are being brought into counterparty-risk and screening obligations that more closely resemble what has historically applied only to bank correspondents. #### Outlook Watch for whether the joint tax liability regime produces measurable changes in payment institutions' willingness to process for betting-sector counterparties, and for further detail on how BCB Resolution 521's FX-perimeter integration affects settlement access for virtual-asset cross-border flows as the 2 February 2026 effective date is followed through. **Sources and findings (4)** 1. T1 [https://www.bcb.gov.br/Pom/Spb/Ing/Introduction.asp?frame=1](https://www.bcb.gov.br/Pom/Spb/Ing/Introduction.asp?frame=1) retrieved 2026-06-23 2. T1 [https://www.bcb.gov.br/content/financialstability/spi_annual_reports/SPI_2024.pdf](https://www.bcb.gov.br/content/financialstability/spi_annual_reports/SPI_2024.pdf) retrieved 2026-06-23 3. T1 [https://www.bcb.gov.br/pom/spb/ing/GuideforOpeningReserves.pdf](https://www.bcb.gov.br/pom/spb/ing/GuideforOpeningReserves.pdf) retrieved 2026-06-23 4. T1 [https://www.bis.org/cpmi/publ/d97_br.pdf](https://www.bis.org/cpmi/publ/d97_br.pdf) retrieved 2026-06-23 ### W13 Commercial Intelligence (M&A, Investment & Product) Probable confirmed 2026-06-23 Trailing-12-month (≈Jun 2025-Jun 2026) commercial activity: the IPO window reopened with PicPay's $434m Nasdaq listing (29 Jan 2026, ticker PICS) — the first major Brazil fintech listing since Nubank (2021); Nubank received conditional OCC approval (Jan 2026) for a US national bank charter and opened an Abu Dhabi HQ. Brazilian startup funding recovered (US$692m raised in Q3 2025, +47% YoY). Product launches centred on Pix Automático and Pix-USDC integration. Undisclosed values are marked amount_disclosed=false. Standing sub-brief · as of 16 August 2026 151 words · last cycle 2026-10-11 #### Commercial Intelligence & Fintech No discrete M&A, funding or product-launch event was confirmed for Brazilian payment institutions this cycle; the material commercial signal instead comes from the structural capital rewrite's exposure profile. Industry estimates cited in the reporting put roughly 92% of peer-to-peer lenders and roughly 63% of payment institutions at risk of a capital shortfall under the new minimum-capital rule, against only around 5% of full-service banks. That gap frames the coming period as one in which smaller non-bank payment institutions and P2P lenders become plausible consolidation or acquisition targets for better-capitalised banks and larger fintechs, though no specific transaction has been disclosed. #### Outlook Watch for discrete M&A, investment or partnership activity involving Brazilian payment institutions and P2P lenders as the capital phase-in deadlines of January 2027 and January 2028 approach; the exposure asymmetry documented this cycle is the leading indicator for where consolidation activity is most likely to surface. Periodic update · new data 2026-10-11 #### Commercial Intelligence & Fintech Brazilian crypto-payments fintech BlindPay raised US3.3 million (reported as R16.9 million) in a funding round with participation from US stablecoin issuer Circle, announced 23 September 2026. The stated purpose of the investment was to expand cross-border stablecoin payment infrastructure between Brazil and the United States. The amount of the round is disclosed at US3.3 million; other terms, including valuation, were not publicly disclosed. BlindPay's own PSAV authorisation application remains pending ahead of the 30 October 2026 deadline, meaning the company is building out cross-border infrastructure and raising capital from a major stablecoin issuer while still navigating Brazil's own virtual-asset authorisation process. More broadly, Brazilian fintechs are reported to have captured approximately 67 percent of all Brazilian startup funding in the first half of 2026, a concentration figure indicating continuing investor appetite for the fintech sector specifically, independent of the regulatory tightening occurring around virtual-asset cross-border activity this cycle. This is a discrete commercial-intelligence data point about funding concentration rather than a structural market-dynamics finding. #### Outlook Whether BlindPay secures PSAV authorisation ahead of the 30 October 2026 deadline is the specific event to watch for this company; the broader fintech funding-concentration figure is a standing data point for assessing investor sentiment toward the Brazilian fintech sector going into the remainder of 2026. **1 earlier distinct update(s)** Periodic update · new data 2026-08-11 #### Commercial Intelligence & Fintech PicPay completed the acquisition of insurtech Kovr Participações S.A. on 3 August 2026, following clearances from the central bank, the competition authority CADE, and the insurance regulator SUSEP. The deal's financial terms were not publicly disclosed. The stated rationale is to embed insurance products directly into PicPay's existing payments and banking application, following closely on the heels of the company's $434 million Nasdaq initial public offering completed on 29 January 2026, which itself targeted a $2.46 billion valuation and marked the first major Brazilian fintech listing since Nubank's 2021 debut. #### Outlook PicPay's acquisition-following-IPO sequence suggests further bolt-on acquisitions targeting adjacent financial-services verticals, such as insurance, are plausible as the company deploys IPO proceeds; whether Kovr's insurance products achieve meaningful embedded-attachment rates within PicPay's core payments app is the practical commercial marker to watch next. **Sources and findings (4)** 1. T3 [https://www.connectingthedotsinfin.tech/a-big-day-for-brazilian-fintech-picpay-ipos-in-the-us-as-nubank-secures-us-bank-approval/](https://www.connectingthedotsinfin.tech/a-big-day-for-brazilian-fintech-picpay-ipos-in-the-us-as-nubank-secures-us-bank-approval/) retrieved 2026-06-23 2. T3 [https://www.riotimesonline.com/brazil-fintech-2026-complete-guide/](https://www.riotimesonline.com/brazil-fintech-2026-complete-guide/) retrieved 2026-06-23 3. T3 [https://www.riotimesonline.com/brazil-fintech-2026-complete-guide/](https://www.riotimesonline.com/brazil-fintech-2026-complete-guide/) retrieved 2026-06-23 4. T3 [https://www.chainalysis.com/blog/brazil-crypto-asset-regulatory-framework-2025/](https://www.chainalysis.com/blog/brazil-crypto-asset-regulatory-framework-2025/) retrieved 2026-06-23 ** No modules match.** Filters combine as OR inside a group and AND across groups. ## Editorial metadata Provenance only. Nothing below gates publication or affects the render. Editorial metadata for Brazil| Field | Value | |---|---| | `trust.lawyer_review.status` | never_reviewed | | `trust.lawyer_review.reviewer` | no reviewer on record | | ` trust.content_source` | ai_generated | ## Provenance and declared absence **Disclosure model:** module cards load OPEN; standing positions render in full; sub-briefs and jurisdiction briefs load as a clamped teaser with an explicit “read full” control carrying the true word count; earlier updates stay collapsed behind a counted summary. No text is hidden without disclosing how much of it there is. **Sentinel-fed modules** receive no special rendering treatment. `sentinel_feed` is an attribution chip only: it does not suppress content, does not generate an absence reason code, and does not exclude the module from any count, filter, search index or export on this page. **Family taxonomy** is renderer-level presentation config, not a JID field. Colour is always duplicated in text and is never the sole carrier of meaning. **Suppressed by doctrine:** derived risk score; per-module RAG traffic light; `derived_scores` = `{}`. **Band honesty:** uncertainty bands are computed against a frozen build clock of 2026-10-21. A year-precision row is never promoted into a tighter band. **Orphan deltas:** 2 cycle_delta row(s) target non-module objects and are listed in the rail rather than attached to a card. **Envelope:** baseline resolved at `jurisdiction_json.baseline`; 14 module(s), 62 finding(s), 114 source(s) in the cumulative register. Think something on this page is wrong? [Report an error](https://payments.gi/legal/#contact).