BRschema world-payments-v1trajectory: not recorded
Last updated · 14 modules · 62 sourced
findings · 93 sources in the cumulative register
14Modulesbaseline.modules[]
62Findingsmodules[].findings[]
19Tier-1 sourcesrun_metadata.t1_source_count
Confidence mix(sums to 14 rendered modules; click to filter)
Jurisdiction brief
Lead Signal
Brazil's payments regulator has closed the last remaining gap in its authorisation perimeter. BCB Resolution No. 494 requires prior Banco Central do Brasil authorisation for all payment-service modalities regardless of transaction volume, eliminating the volume-based exemptions that previously let smaller payment institutions operate outside direct supervision. The change is paired with a consolidated compliance calendar: BCB Rule No. 495/2025 and Joint Rule No. 14/2025 establish a single regularisation window running 1-31 May 2026 for payment institutions that have been operating without authorisation, replacing what had been a fragmented set of deadlines. Layered onto this, the Pix accreditation deadline for non-authorised payment institutions has been brought forward to a 1 January-1 May 2026 window, compressing a timetable that previously ran to 31 December 2026. Together these three instruments compress the runway available to unauthorised or thinly-capitalised non-bank payment institutions and mark a decisive tightening of Brazil's market-access baseline.
Other Developments
The authorisation tightening does not stand alone. Banco Central do Brasil has also moved on the operational-resilience front, tightening Pix device-level security: accounts accessed from unregistered devices are now subject to transfer limits of roughly US$40 per transaction and roughly US$201 per day, backed by a precautionary lock mechanism. A parallel rule requires Pix participants that connect through a payment-scheme technology infrastructure provider to demonstrate, via a CVM-registered auditor's report, that BCB-registered private signing keys are not shared with that provider; absent such certification a BRL 15,000 transaction limit applies, with a possible 90-day BCB waiver. Separately, BCB Resolution No. 506 amended the founding Pix resolution, BCB Resolution No. 1/2020, revising authorisation criteria, penalties and fraud-prevention measures at the scheme level.
On the structural side, Banco Central do Brasil is rewriting minimum-capital requirements to tie them to activities rather than institutional labels, with phase-in beginning 1 July 2026 at one quarter of the capital gap, rising to half by January 2027 and the full amount by January 2028. Industry estimates cited in the reporting put roughly 92% of peer-to-peer lenders and roughly 63% of payment institutions at risk of a capital shortfall under the new rule, against only around 5% of full-service banks, an exposure gap that industry commentary frames as likely to price smaller, non-bank players out of payment-system access and drive consolidation.
Product development continues alongside the tightening. Banco Central do Brasil is developing new Pix products, automatic Pix, guarantee Pix and international Pix, intended to replicate credit-card-industry functionality at lower cost, and has launched Pix Parcelado, which lets payers spread payments over time while payees still receive the full amount instantly; a future feature enabling Pix receivables to be used as loan collateral is planned for 2026. Meanwhile, Drex, Brazil's central bank digital currency, has been substantially re-scoped after two pilot phases: its 2026 initial version launches without blockchain, focused on credit-lien-reconciliation infrastructure rather than a tokenised retail CBDC.
Cross-Monitor Connections
The BCB's DICT regulation requires institutions in the National Financial System to comply with Brazil's LGPD data-protection law in collecting, handling, storing and sharing Pix-user personal data, an overlap that is directly relevant to data-protection monitoring of the same Pix ecosystem.
Outlook
The regularisation window closes 31 May 2026 and the brought-forward Pix accreditation deadline runs from 1 January to 1 May 2026, meaning the next several months will determine how many currently-unauthorised payment institutions can complete authorisation in time. The minimum-capital phase-in adds a second, longer clock: half the capital gap must be closed by January 2027 and the full amount by January 2028, milestones against which the disproportionate exposure of payment institutions and peer-to-peer lenders relative to banks will be tested. Drex's re-scoped, non-blockchain initial phase will also bear watching as an indicator of whether Brazil's CBDC ambitions are being deferred or genuinely redirected toward infrastructure-first delivery.
trust tier: ai_unverified
Regulatory Status
Brazil enters 2026 in the midst of a coordinated tightening cycle across licensing, operational resilience and industry capital structure. BCB Resolution No. 494 requires prior BCB authorisation for all payment-service modalities regardless of transaction volume, closing the volume-based exemption that previously let smaller payment institutions avoid full supervision, and BCB Rule No. 495/2025 together with Joint Rule No. 14/2025 establish a single regularisation window running 1-31 May 2026 for currently-unauthorised payment institutions. The Pix accreditation deadline for non-authorised payment institutions has also been brought forward to a 1 January-1 May 2026 window, well ahead of the previously scheduled 31 December 2026 cut-off.
On the operational-resilience side, Banco Central do Brasil has tightened Pix device-level security, imposing transfer limits of roughly US$40 per transaction and roughly US$201 per day for accounts accessed from unregistered devices, backed by a precautionary lock mechanism, alongside a signing-key segregation requirement for Pix participants connecting through a technology infrastructure provider. BCB Resolution No. 506 separately amended the founding Pix resolution, revising authorisation criteria, penalties and fraud-prevention measures at the scheme level.
Structurally, Banco Central do Brasil is rewriting minimum-capital requirements to tie them to activities rather than institutional labels, with phase-in beginning 1 July 2026. Industry estimates cited in the reporting put roughly 92% of peer-to-peer lenders and roughly 63% of payment institutions at risk of a capital shortfall under the new rule, against only around 5% of full-service banks, an asymmetry that runs along the same bank-versus-non-bank line as the authorisation and Pix-security changes. Product innovation continues alongside this tightening: Banco Central do Brasil is developing automatic Pix, guarantee Pix and international Pix, has launched Pix Parcelado, and has substantially re-scoped Drex, its central bank digital currency, into a non-blockchain initial phase focused on credit-lien-reconciliation infrastructure. The BCB's DICT regulation also requires institutions in the National Financial System to comply with Brazil's LGPD data-protection law when handling Pix-user personal data.
Outlook
Brazil's risk trajectory is tightening: the regularisation window closes 31 May 2026, the brought-forward Pix accreditation window closes 1 May 2026, and the minimum-capital phase-in reaches half the capital gap by January 2027 and full compliance by January 2028. The combined effect of universal authorisation, Pix security hardening and activity-based capital requirements is a materially higher compliance floor for non-bank payment institutions relative to full-service banks, a dynamic that is likely to drive consolidation over the horizon tracked here. Merchant-acquiring dynamics and correspondent-banking access were not resolved this cycle and remain open gaps for the next research pass.
14 of 14 modules
Signal
Density
Selections OR within a group, AND across groups. Press / to search.
BCB requires prior authorisation for all payment institutions; the deadline for payment institutions operating without authorisation to request it was brought forward from Dec 2029 to May 2026. BCB segments institutions S1-S5 for proportional prudential treatment; only S1-S4 non-cooperative institutions may act as Pix 'responsible participant' for unauthorised payment institutions.
Movement — CHANGEDAuthorisation deadline brought forward to May 2026.New BCB deadline compression identified this cycle.
Standing sub-brief270 words · last cycle wpm-2026-09-02
Licensing, Authorisation & Market Access
Banco Central do Brasil has eliminated the last volume-based carve-outs in its payment-institution authorisation regime. BCB Resolution No. 494 requires prior BCB authorisation for all payment-service modalities regardless of transaction volume, closing a gap that had allowed smaller non-bank payment institutions to operate below the supervisory threshold. The rule applies to both bank and non-bank payment-service providers, but its practical effect falls heaviest on the non-bank payment-institution and e-money sector, which previously relied on volume exemptions to defer full authorisation.
BCB Rule No. 495/2025 and Joint Rule No. 14/2025 establish a single regularisation window running 1-31 May 2026 for payment institutions that have been operating without authorisation, consolidating what had been a fragmented set of prior deadlines into one compliance date. Non-bank payment institutions that have not yet regularised their status face a hard deadline to do so within this window. Compounding the timeline pressure, the Pix accreditation deadline for non-authorised payment institutions has been brought forward to a 1 January-1 May 2026 window, materially earlier than the previously scheduled 31 December 2026 cut-off. The net effect is a compressed authorisation and accreditation calendar concentrated in the first five months of 2026, disproportionately affecting non-bank payment institutions and e-money issuers relative to already-licensed banks.
Outlook
The regularisation window closes 31 May 2026 and the brought-forward Pix accreditation window closes 1 May 2026, making the first half of 2026 the decisive compliance period for Brazil's non-bank payment-institution sector. Institutions that miss either deadline face loss of Pix accreditation and authorisation exposure, a risk that compounds with the incoming activity-based capital regime tracked separately under industry structure.
Periodic update · new data 2026-09-14 · run wpm-2026-09-02
Licensing, Authorisation & Market Access
The Banco Central do Brasil materially compressed the compliance timeline for unauthorised payment institutions this cycle, bringing forward the deadline to request formal BCB authorisation from December 2029 to May 2026. This is a confirmed, high-impact development that narrows the runway for non-bank payment institutions and e-money issuers still operating outside the authorised perimeter, applying specifically to the nonbank_pi_emi segment rather than to bank-affiliated PSPs. Separately, BCB Resolution 506 revised Pix authorisation criteria alongside fraud-prevention and penalty measures for payment institutions, effective from 26 September 2025, amending the foundational Resolution 1/2020 that governs the Pix arrangement. This revision applies across both bank and non-bank participants in the Pix scheme, reflecting the dual-track bank/nonbank structure of Brazil's instant-payments ecosystem.
Taken together, these two developments indicate that BCB is narrowing the compliance window on two fronts simultaneously: bringing unauthorised non-bank institutions into the formal authorisation regime faster than previously scheduled, and tightening the standards that authorised Pix participants, bank and non-bank alike, must meet on fraud prevention. The compressed 2029-to-2026 deadline shift is particularly significant for market-access planning, since it removes what had been a multi-year runway for institutions that had not yet sought authorisation.
Outlook
The May 2026 deadline is the key date to track: watch for enforcement activity or a wave of late authorisation applications as the compressed deadline approaches, and for whether BCB signals any further acceleration of authorisation requirements for other categories of payment institution.
1 earlier distinct update(s)
Periodic update · new data 2026-08-11 · run wpm-2026-08-05
Licensing, Authorisation & Market Access
Brazil's payments and digital-asset licensing perimeter tightened materially this cycle. Banco Central do Brasil's Resolution 506, adopted 26 September 2025, revised Pix authorisation criteria for payment institutions, including provisions addressing non-authorised entities. Building on that, a new activities-based minimum-capital rule for payment institutions offering Pix begins phasing in from 1 July 2026, reaching half the required capital amount in January 2027 and the full amount in January 2028, a change that falls specifically on non-bank payment institutions rather than banks. Most significantly, BCB's Resolutions 519, 520 and 521, published 10 November 2025 and effective 2 February 2026, complete a formal authorisation regime for virtual-asset service providers across intermediation, custody and brokerage modalities, with no exemption category, and a two-hundred-seventy-day transition running to 30 October 2026.
Taken together, these three instruments push both non-bank payment institutions and virtual-asset service providers toward capital and authorisation standards that more closely resemble those already applied to banks, formalising market access in both sectors simultaneously rather than sequentially.
Outlook
The clearest near-term markers are the phased capital thresholds, arriving in January 2027 and January 2028, and the 30 October 2026 VASP authorisation deadline, after which unauthorised virtual-asset service providers lose the ability to transact with BCB-supervised entities. Both will test how much of the current non-bank payment and virtual-asset population can meet bank-comparable standards without exiting the market or consolidating.
Brazil's safeguarding regime requires payment institutions to segregate client/end-user funds from proprietary assets and supports traceability and auditability; e-money balances are held in payment accounts with prudential treatment. BCB Rule 80/2021 sets conduct, transparency (institutions must identify themselves as PIs and disclose services), governance and cybersecurity-policy obligations. Joint Resolution No. 16 (CMN/BCB) regulates Banking-as-a-Service, and BCB Resolution 432/2024 set manager compensation policies — collectively tightening conduct accountability.
Standing sub-brief215 words · last cycle wpm-2026-06-23
Conduct, Safeguarding & Financial Promotions
Brazil's conduct and safeguarding regime for payment institutions is built on BCB Rule 80/2021, which mandates segregation of client and end-user funds from proprietary assets, transparency and identification obligations, governance requirements, cybersecurity controls and service-continuity provisions. The safeguarding model is distinctive: rather than a UK/EU-style discrete safeguarding regime, Brazil relies on asset-segregation. PIs must hold e-money balances in payment accounts with prudential treatment and keep client funds strictly segregated to prevent commingling in insolvency, supporting insolvency traceability through consolidated prudential supervision rather than structural ring-fencing.
The conduct perimeter extends to Banking-as-a-Service: Joint Resolution No. 16 (CMN/BCB) regulates BaaS arrangements, defining the conduct and accountability boundary that operators must build to. Manager compensation is addressed by BCB Resolution 432/2024. Together these instruments define the consumer-fund protection model for Brazilian PIs and EMIs.
The bank versus non-bank distinction matters in safeguarding: the segregation obligation binds payment institutions specifically, with e-money balances held in payment accounts under prudential treatment, distinct from the deposit-taking treatment of bank-PSPs.
Outlook
The trajectory is established. The segregation-based safeguarding model is settled, with the BaaS conduct perimeter under Joint Resolution 16 and manager-compensation rules under Resolution 432/2024 forming the standing conduct architecture. This module is assessed rather than confirmed, reflecting the secondary sourcing underpinning the consolidated conduct picture.
No periodic updates recorded against this sub-brief.
Sources and findings (4)
T1BCB Resolutions 80/81/2021 — PI conduct/governance (bcb.gov.br)
E-money is regulated under Law 12.865/2013 as a prepaid payment-account balance, distinct from virtual assets. Brazil implemented a banking-grade virtual-asset/VASP regime via Law 14.478/2022 and BCB Resolutions 519/520/521 of 10 Nov 2025 (in force 2 Feb 2026), with the BCB as supervisor and CVM retaining securities-token jurisdiction. Resolution 521 brought stablecoin and crypto FX operations into the foreign-exchange perimeter; Resolution 561 (Apr 2026) then barred crypto/stablecoin settlement on the offshore leg of regulated eFX. A 270-day transition runs to 30 Oct 2026.
Horizon · 2026-10-30 (±quarter)VASP framework transition deadlinein_force_pending · T3
Horizon · 2026-10-01 (±quarter)eFX crypto-settlement ban effective (Res. 561)in_force_pending · T3
Standing sub-brief331 words · last cycle wpm-2026-08-05
Stablecoins & Digital Money
Brazil's stablecoin and digital-money perimeter has escalated sharply. The VASP framework — Law 14.478/2022 plus BCB Resolutions 519, 520 and 521 of 10 November 2025 — saw its core rules enter into force on 2 February 2026, with a 270-day transition running to 30 October 2026. It establishes three licence modalities (Intermediary, Custodian and Broker), mandates client-asset segregation and monthly proof-of-reserves, and leaves the CVM with jurisdiction over securities tokens. Importantly, e-money is excluded from the virtual-asset definition under Law 12.865, keeping the PI and VASP perimeters distinct. From 30 October 2026, BCB-supervised institutions are barred from dealing with unauthorised VASPs. This framework establishes the licensing perimeter for stablecoin and crypto payment and remittance operators in Brazil's roughly US$6-8bn-per-month crypto market, around 90% of which is stablecoins.
Layered onto the licensing framework is a settlement restriction. BCB Resolution 561, published 30 April 2026 and effective 1 October 2026, bars eFX providers from using stablecoins, bitcoin or crypto to settle the offshore leg of regulated international payments, restricts eFX to BCB-authorised institutions, and requires segregated client-fund accounts plus monthly reporting. It targets firms such as Nomad and Braza Bank that had used stablecoin settlement on the XRP Ledger in Brazil-US flows. The effect is to close the stablecoin cross-border settlement vector for eFX providers, forcing crypto-native remittance operators back onto FX-transaction or non-resident BRL account rails.
The combined posture is restrictive: Brazil licenses VASPs while deliberately containing stablecoin use in cross-border payments. A vendor-sourced claim of an official BCB Pix-USDC integration has been excluded as unverified, conflicting with the Resolution 561 settlement ban and lacking primary confirmation.
Outlook
Two in-force-pending deadlines dominate: the eFX crypto-settlement ban takes effect 1 October 2026, and the VASP transition ends 30 October 2026, after which dealing with unauthorised VASPs is prohibited for supervised institutions. The trajectory is escalating and containment-directed. The retracted Pix-USDC claim flags a vendor/launch-hype over-indexing risk, where private fintech USDC-Pix on/off-ramp services may be conflated with official BCB policy.
Periodic update · new data 2026-08-11 · run wpm-2026-08-05
Stablecoins & Digital Money
Approximately ninety percent of Brazilian crypto-transaction volume is stablecoin-denominated, which makes the new virtual-asset service provider authorisation regime effectively a stablecoin-oversight framework in practice. Under the VASP framework established by BCB Resolutions 519, 520 and 521, issuers and exchanges handling that stablecoin volume face stricter reserve-transparency requirements, bringing stablecoin flows inside the central bank's foreign-exchange and capital-controls supervisory perimeter rather than leaving them to operate outside conventional payments oversight. The transition to full authorisation runs to 30 October 2026, the same deadline that governs the wider VASP regime.
Outlook
Reserve-transparency compliance among stablecoin issuers and exchanges is the practical marker to watch as the 30 October 2026 deadline approaches; given that ninety percent of Brazilian crypto volume already runs through stablecoins, the degree to which issuers can demonstrate compliant reserves will materially shape how much of that volume continues to route through authorised channels versus offshore alternatives.
Sources and findings (5)
T1BCB Resolutions 519/520/521 (SPSAV/VASP, eff. 2 Feb 2026) (bcb.gov.br)
T1BCB Resolutions 519/520/521 (bcb.gov.br)
T1BCB Resolution 521 — virtual-asset FX (bcb.gov.br)
Operational resilience is governed by CMN Resolution 4.893/2021 (financial institutions) and BCB Resolution 85/2021 (payment institutions), effective from 2021, which mandate cybersecurity policies, incident response, business-continuity testing, and rules for contracting data-processing/storage and cloud services in-country or abroad — with the institution retaining full accountability for outsourced activity and the BCB granted audit/access rights. Institutions must report security incidents that constitute a 'crisis situation' to the BCB and retain documentation for at least five years. The June 2025 C&M Software breach exposed third-party (PSTI) supply-chain risk and triggered new cybersecurity rules (Res. 538/2025; CMN 5.274/2025, adaptation to March 2026).
Movement — CHANGEDNew device-based limits and behavioural-monitoring obligations.New Pix resilience/fraud-detection rules identified this cycle.
Standing sub-brief217 words · last cycle wpm-2026-09-02
Operational Resilience & Critical Infrastructure
Banco Central do Brasil has tightened device-level security controls across the Pix instant-payment rail. Accounts accessed from unregistered devices are now subject to transfer limits of roughly US$40 per transaction and roughly US$201 per day, backed by a precautionary lock mechanism that can freeze suspicious activity. The control applies uniformly to both bank and non-bank Pix participants, reflecting a scheme-wide push to reduce device-takeover fraud rather than a bank-specific or non-bank-specific carve-out.
A separate rule targets the technology layer beneath Pix connectivity. Pix participants that connect through a payment-scheme technology infrastructure provider must demonstrate, via a CVM-registered auditor's report, that BCB-registered private signing keys are not shared with that provider; absent such certification a BRL 15,000 transaction limit applies, with a possible 90-day BCB waiver available while certification is completed. This signing-key segregation requirement raises the operational bar for participants that outsource connectivity infrastructure, again applying across the bank and non-bank participant base.
Outlook
Both the device-registration limits and the PSTI signing-key segregation rule are already in effect, shifting the near-term operational burden onto participants' fraud-monitoring and vendor-management functions rather than introducing a further compliance deadline. The direction of travel is toward tighter device- and infrastructure-level controls on the Pix rail, consistent with the broader authorisation and capital tightening running in parallel.
Periodic update · new data 2026-09-14 · run wpm-2026-09-02
Operational Resilience & Critical Infrastructure
New BCB rules direct Pix participants to deploy historical and behavioural pattern analysis for real-time anomaly detection, and critically, this comes paired with a formal obligation to act on flagged orders, including blocking, rather than a purely advisory monitoring expectation. This is an assessed-confidence finding that shifts fraud-detection responsibility onto the payments infrastructure layer itself, applying across both bank and non-bank participants in the Pix ecosystem, rather than leaving detection and mitigation to end users acting alone.
Complementing this behavioural-monitoring mandate, the BCB introduced device-recognition-based Pix transfer limits: R$200 per transaction and R$1,000 per day for transfers originating from unrecognised devices. Alongside the device-based limits sits a 72-hour precautionary hold mechanism for transfers flagged as suspicious, under which Nubank, Itaú Unibanco and Caixa Econômica Federal are named as institutions authorised to apply the hold, with funds remaining in the recipient account but unavailable pending review. This combination of device-recognition limits and a multi-day hold window represents a substantial operational-resilience uplift for the Pix rail, directly targeted at the anomaly-detection gap that unrecognised-device transfers had previously represented.
Outlook
Watch for whether the device-based limits and 72-hour hold mechanism extend beyond the three named institutions to the broader universe of Pix participants, and for the operational load these new obligations place on smaller payment institutions relative to the large banks currently named.
Brazil regulates card-scheme economics directly: since October 2018 the BCB caps debit-card interchange, and in 2023 (effective April 2024) it simplified the debit cap to 0.5% and introduced a 0.7% cap on prepaid-card interchange while harmonising the prepaid settlement cycle (previously up to 28 days) with debit (2 days). Card schemes Visa/Mastercard operate four-party models with acquirers and sub-acquirers; the BCB collects interchange and scheme-fee data quarterly from authorised scheme participants. Pix scheme rules are set and operated by the BCB itself (BCB Resolution 1/2020 and follow-ons).
Standing sub-brief112 words · last cycle wpm-2026-08-16
Scheme & Network Compliance
Banco Central do Brasil has revised the rulebook underpinning Pix at the scheme level. BCB Resolution No. 506 amended the founding Pix resolution, BCB Resolution No. 1/2020, revising authorisation criteria, penalties and fraud-prevention measures for participants in the scheme. The amendment applies to both bank and non-bank Pix participants and sits alongside the device-security and signing-key changes tracked under operational resilience, forming a single coordinated tightening of Pix scheme governance.
Outlook
The amended scheme rulebook is already in force, and its practical effect will be visible in how the BCB applies the revised penalty and fraud-prevention provisions against participants going forward; no further scheme-level deadline is currently scheduled.
No periodic updates recorded against this sub-brief.
Domestic rails are dominated by Pix (BCB-operated instant payments, launched Nov 2020), alongside legacy TED/DOC and boleto. Cross-border corridors run through the regulated eFX regime (BCB Resolution 561/2026 governs digital international payments and bars crypto on the offshore leg), traditional FX operations, and the FX Clearinghouse, which historically uses US correspondent banks for the USD leg. The BCB is actively exploring Pix internationalisation and interlinking with other instant-payment systems (bilaterally or via multilateral platforms such as Project Nexus) to improve cross-border speed, cost and access per G20 goals.
Standing sub-brief180 words · last cycle wpm-2026-08-16
Payment Corridor Dynamics
Pix remains the dominant instant-payment rail in Brazil, and Banco Central do Brasil is developing new Pix products, automatic Pix, guarantee Pix and international Pix, intended to replicate credit-card-industry functionality at lower cost. International Pix in particular points toward an emerging cross-border corridor ambition, extending Pix's domestic instant-payment model into international flows, though the initiative remains at a developmental stage relative to the domestic products.
Alongside this product expansion, the BCB's DICT regulation requires institutions in the National Financial System to comply with Brazil's LGPD data-protection law in collecting, handling, storing and sharing Pix-user personal data. The data-protection overlap applies across the Pix ecosystem regardless of whether the participant is a bank or a non-bank payment institution.
Outlook
Automatic Pix, guarantee Pix and international Pix remain in development rather than general availability; their rollout timing will determine whether Brazil's Pix corridor extends materially beyond domestic instant payments in the near term. The LGPD compliance obligation on Pix-user data is already in force and will remain a standing condition on scheme participation rather than a discrete near-term deadline.
Periodic update · new data 2026-08-11 · run wpm-2026-08-05
Payment Corridor Dynamics
Brazil's core instant-payments corridor, Pix, both expanded functionally and faced a significant platform-access dispute this cycle. Pix Automático launched in June 2026 to serve recurring billing use cases, eliminating the card-expiry failures and interchange fees that have historically affected subscription payments processed through card rails. At the same time, Apple has reportedly signalled willingness to negotiate a settlement with Brazil's competition authority, CADE, over its NFC-chip lockout, which has prevented native contactless Pix functionality on iPhones and drawn complaints from Nubank, PicPay and other fintechs seeking equal access to the device's near-field-communication hardware.
Outlook
A negotiated CADE settlement, if confirmed, would be the clearest resolution of the NFC-access dispute and would materially expand contactless Pix availability on Apple devices; terms and timing are not yet confirmed by a primary CADE source. Pix Automático's adoption curve among merchants offering recurring billing is a second corridor-dynamics marker to watch as it displaces card-based subscription rails.
Brazil's payments market is highly concentrated and fintech-led at the consumer edge. The acquiring market is dominated by Cielo, Rede, Getnet and Stone (>83% in 2020Q1), and issuing is similarly concentrated among the top five issuers (~80%). On the consumer side, digital banks/fintechs Nubank, PicPay and Mercado Pago lead by customers; Nubank reported ~110m Brazil customers (127m globally) in Q3 2025 and in October 2025 surpassed Petrobras as Brazil's most valuable company. The market combines incumbent bank-controlled acquirers, listed challengers, and a long tail of PIs and sub-acquirers.
Standing sub-brief212 words · last cycle wpm-2026-08-16
Industry Structure & Commercial Dynamics
Banco Central do Brasil is rewriting minimum-capital requirements to tie them to activities rather than institutional labels, with phase-in beginning 1 July 2026 at one quarter of the capital gap, rising to half by January 2027 and the full amount by January 2028. The rule applies to institutions performing payment and lending activities regardless of licence category, but its incidence is highly uneven: industry estimates cited in the reporting put roughly 92% of peer-to-peer lenders and roughly 63% of payment institutions at risk of a capital shortfall under the new rule, against only around 5% of full-service banks. That asymmetry sits squarely on the bank-versus-non-bank fault line that runs through this cycle's authorisation and Pix-security changes: non-bank payment institutions and P2P lenders face a materially higher probability of falling short of the new capital floor than already-capitalised banks.
Outlook
The phase-in begins 1 July 2026, rises to half the capital gap by January 2027 and reaches full compliance by January 2028. Given the scale of the exposure gap between non-bank payment institutions and banks, the rule is likely to accelerate consolidation among smaller Brazilian payment institutions and P2P lenders as the capital deadlines approach, a dynamic that compounds the authorisation and Pix-security tightening tracked elsewhere this cycle.
Periodic update · new data 2026-08-11 · run wpm-2026-08-05
Industry Structure & Commercial Dynamics
Brazilian fintech reached a capital-markets milestone this cycle. PicPay completed a $434 million Nasdaq initial public offering on 29 January 2026, targeting a $2.46 billion valuation and marking the first major Brazilian fintech listing since Nubank's 2021 debut, reopening a capital-markets access channel for the sector that had been largely dormant since that listing. Separately, Nu Holdings received conditional approval from the US Office of the Comptroller of the Currency in January 2026 for a US national bank charter, while Nubank announced in December 2025 its intent to acquire a Brazilian banking licence during 2026, a dual-track expansion of its regulatory footprint on both sides of its core markets.
Central-bank customer-ranking data spanning the fourth quarter of 2025 through the first quarter of 2026 show continued share consolidation among the largest digital players: Nubank added approximately 2.7 million customers to reach roughly 114.7 million, and Mercado Pago added 2.5 million to reach 71.3 million, while Stone recorded the sharpest customer decline among the top twenty institutions, indicating that competitive pressure in Brazil's retail-payments and digital-banking market continues to favour the largest platforms.
Outlook
Nubank's pursuit of a Brazilian banking licence alongside its US charter progress, and PicPay's post-IPO acquisition strategy evidenced by the Kovr Participações deal, both point toward continued consolidation of financial services under Brazil's largest fintech platforms. Whether Stone's customer decline stabilises or continues will be a useful indicator of whether the market-share consolidation trend evidenced this cycle persists.
Enforcement is dominated by the June 2025 C&M Software breach — the largest cyber-heist in Brazilian history — in which attackers used credentials of a bribed C&M employee to inject fraudulent Pix orders, draining over R$1bn (≈R$813m+ commonly cited) from at least six institutions' reserve accounts; the Federal Police opened an investigation and the BCB suspended parts of C&M's operations. Follow-on incidents hit Sinqia and Monbank. Major Polícia Federal operations (Magna Fraus, Lusocoin, Carbono Oculto exposing PCC laundering via fintechs) and BCB administrative enforcement (intervention, extrajudicial liquidation, manager liability, RAET) shape the regime. A notable commercial dispute: GetNet (Santander) sued Nubank and Mastercard over prepaid-card interchange losses.
Standing sub-brief199 words · last cycle wpm-2026-06-23
Legal & Litigation
Two developments anchor the litigation picture. First, the late-June 2025 C&M Software Pix supply-chain breach — with the attack around 30 June 2025 and BCB disclosure in early July 2025 — saw bribed-employee credentials used to inject fraudulent Pix orders, draining roughly R$800m (around US$140m) from the reserve accounts of at least six institutions, with follow-on hits to Sinqia (~R$400m) and Monbank (~R$4.9m). It is the largest cyber-heist in Brazilian history and the defining operational-resilience event, having triggered the 2025-26 cybersecurity rule package.
Second, GetNet (Santander) filed a claim for roughly R$62m in damages against Nubank and Mastercard over prepaid-card acceptance losses, alleging that Nubank promotes its prepaid card as a debit-function card. This landmark commercial dispute tests the prepaid-versus-debit interchange classification commercially and intersects the W4 interchange reform; its outcome bears on prepaid-card economics across the market.
The litigation touches both bank-PSPs (Santander/GetNet as claimant) and non-bank PIs (Nubank as defendant), with Mastercard joined as a scheme defendant.
Outlook
The trajectory is escalating. The C&M breach prosecution and the GetNet v Nubank/Mastercard prepaid dispute are the two active threads. The prepaid-interchange dispute is the most commercially consequential, given its bearing on prepaid-card classification and economics.
No periodic updates recorded against this sub-brief.
Acquiring is governed by accreditation agreements between acquirers/sub-acquirers and merchants and by BCB scheme/interchange rules. Acquirers and sub-acquirers (the latter not card-network members) capture, process, settle and credit merchant transactions and handle chargebacks; the MDR (including interchange) is the merchant cost. The 2023/2024 interchange reform harmonised prepaid settlement to the 2-day debit cycle, materially improving merchant liquidity in a high-base-rate environment. Card chargebacks are issuer-mediated consumer-protection reversals, distinct from Pix's MED.
Standing sub-brief190 words · last cycle wpm-2026-06-23
Merchant Acquiring & Risk
The Brazilian acquiring framework governs merchant acquiring and risk through acquirer and sub-acquirer accreditation agreements combined with BCB scheme and interchange rules. The merchant discount rate (MDR), inclusive of interchange, is a merchant cost. The 2023/24 prepaid settlement harmonisation to the two-day debit cycle improved merchant liquidity. Card chargebacks, which are issuer-mediated, are distinct from the Pix Special Return Mechanism (MED).
A structural feature shapes the competitive dynamics: sub-acquirers are not card-network members and process at low cost across brands, positioning them as a disruption vector against bank-controlled acquirers. On the Pix side, MED debits the recipient merchant's settlement and offers no merchant evidence-submission process, a materially different risk profile from card chargebacks. Together these mechanics define the acquirer and sub-acquirer settlement, chargeback and MDR economics that govern merchant-acquiring P&L in Brazil.
The framework spans both bank-controlled acquirers and non-bank sub-acquirers, with the sub-acquirer model the principal non-bank entry route into merchant acquiring.
Outlook
The trajectory is established. Settlement harmonisation and the sub-acquirer competitive model are settled features. The principal forward tension is the prepaid-interchange classification question, tracked under W7, which bears directly on acquiring economics.
No periodic updates recorded against this sub-brief.
Brazil is a global instant-payments innovation leader. Pix has expanded from one-time P2P/P2B transfers into a product family: Pix Agendado (scheduled), Pix por Aproximação (contactless, launched Feb 2025), Pix Automático (recurring/direct-debit-style, launched 2025), and Pix Parcelado/Installment Pix and Pix Garantido (credit-backed) in the pipeline; offline and cross-border Pix are being explored. Open Finance Brazil is a maturing build-out feeding new products, and the BCB maintains an active Regulatory Sandbox (e.g. real-asset tokenisation).
Standing sub-brief193 words · last cycle wpm-2026-09-02
Product Innovation & Market Development
Banco Central do Brasil has launched Pix Parcelado, which lets payers spread payments over time while payees still receive the full amount instantly; a future feature enabling Pix receivables to be used as loan collateral is planned for 2026. The instalment mechanism sits alongside the automatic Pix, guarantee Pix and international Pix products under development, together forming a broader push to layer credit-card-like functionality onto the Pix rail at lower cost than traditional card networks.
Separately, Drex, Brazil's central bank digital currency, has been substantially re-scoped after two pilot phases: its 2026 initial version launches without blockchain, focused on credit-lien-reconciliation infrastructure rather than a tokenised retail CBDC. The shift marks a pragmatic, infrastructure-first turn in Brazil's CBDC development rather than an abandonment of the underlying digital-currency ambition.
Outlook
Pix Parcelado's receivables-as-collateral feature is planned for 2026 and will be a marker of how far the BCB pushes Pix into credit-substitute territory. Drex's non-blockchain initial phase will similarly bear watching in 2026 as a test of whether the re-scoped, infrastructure-first approach is a durable design choice or an interim step ahead of a later return to a tokenised model.
Periodic update · new data 2026-09-14 · run wpm-2026-09-02
Product Innovation & Market Development
CMN Resolution 5.298/2026, effective 4 May 2026, bars the use of derivatives lacking real economic backing. This is an assessed-confidence, dated dashboard-tier finding rather than a full structural development, and its practical significance in the payments space lies in its function as a regulatory lever against unregulated prediction-market products that compete for the same consumer attention and settlement rails as Pix-settled, regulated betting and payments flows. The resolution cross-references a separate blocking action taken by the SPA against prediction-market platforms, indicating coordinated use of financial-market and gambling-regulatory tools against the same product category.
A further item on the product-development horizon, the MED 2.0 fund-recovery enhancement expected to go live in February 2026, was not independently confirmed as live this cycle and stands only on the previously expected date. This is flagged as a gap rather than a confirmed development, and its status should be treated as unresolved pending confirmation in a future cycle.
Outlook
The key open item is whether MED 2.0 fund-recovery functionality actually launched on its expected February 2026 date; this was not confirmed this cycle. Separately, watch for whether CMN Resolution 5.298/2026's derivatives-backing requirement produces further prediction-market blocking actions coordinated with the betting regulator.
The Pix Special Return Mechanism (MED), created Nov 2021, is the core consumer-redress tool for fraud/scams/operational failure: victims register within 80 days, receiving-institution funds are blocked, both institutions review within 7 days and refunds (full or partial, subject to available balance) follow. Recovery has historically been low (~9% in 2023) because fraudsters move funds onward, prompting MED 2.0 (BCB Res. 493/2025) to trace and block across up to five 'cascading' account hops (optional Nov 2025, mandatory 2 Feb 2026; sanctioning grace via Res. 546 to 10 May 2026). A self-service MED button was mandated (Res. 589, by Oct 2025) and Res. 501/2025 requires rejecting transfers to fraud-flagged accounts. Consumer-protection law (CDC) also applies, including to crypto operations.
Movement — CHANGED72-hour hold authorisation and 43% fraud-loss increase.New consumer-protection instrument and driving statistic identified this cycle.
Standing sub-brief218 words · last cycle wpm-2026-09-02
Consumer Protection & APP Fraud
Brazil's consumer-redress regime for instant payments centres on the Pix Special Return Mechanism (MED), introduced in November 2021, which provides an 80-day registration period, 7-day review and full or partial refund. The regime is being upgraded substantially. MED 2.0, under BCB Resolution 493/2025, traces and blocks funds across cascading account hops; it became optional on 23 November 2025 and mandatory on 2 February 2026, with a sanctioning grace period to 10 May 2026 under Resolution 546. A self-service MED button was mandated under Resolution 589 by October 2025, and Resolution 501/2025 requires institutions to reject transfers to fraud-flagged accounts.
The upgrade responds to historically low recovery rates — around 9% in 2023, with roughly 89% of MED requests denied for insufficient funds or closed accounts. The cascading-block design directly targets that gap. The MED 2.0 cascading-block and fraud-flag rejection obligations are a core consumer-protection compliance load for every Pix participant, bank-PSP and non-bank PI alike. The escalation from reactive MED to preventive-plus-tracing reflects Brazil's position as a global testbed for instant-payment fraud defence.
Outlook
The trajectory is escalating. The binding near-term milestone is the MED 2.0 sanctioning grace expiry on 10 May 2026, following the mandatory adoption date of 2 February 2026. The structural direction is toward preventive interdiction rather than after-the-fact recovery.
Periodic update · new data 2026-09-14 · run wpm-2026-09-02
Consumer Protection & APP Fraud
Febraban reported that Pix-enabled fraud and scam disbursement losses rose 43 percent to R$2.7 billion, an industry-body figure cited as the direct driver behind a package of new consumer-protection rules introduced this cycle. In direct response, financial institutions, specifically Nubank, Itaú Unibanco and Caixa Econômica Federal as named in reporting, are now authorised to hold incoming transfers for up to 72 hours where fraud is suspected, with funds remaining visible in the recipient's account but unavailable for use pending review. This hold mechanism operates alongside the device-recognition-based transfer limits described under Operational Resilience, capping transfers from unrecognised devices at R$200 per transaction and R$1,000 per day.
The scale of the reported fraud-loss increase, a 43 percent year-on-year rise to R$2.7 billion, frames these new consumer-protection measures as a direct regulatory and industry response to a documented and escalating harm, rather than a precautionary or anticipatory rule. The named institutions' authorisation to apply the hold is confirmed only for those three entities in the reporting reviewed this cycle; broader applicability across the Pix participant base is plausible but not independently confirmed.
Outlook
The clearest indicator to track next cycle is whether the Febraban-reported fraud-loss figure declines following the introduction of the hold mechanism and device-based limits, and whether the 72-hour hold authorisation is extended to a wider set of Pix-participating institutions beyond the three currently named.
1 earlier distinct update(s)
Periodic update · new data 2026-08-11 · run wpm-2026-08-05
Consumer Protection & APP Fraud
Brazil's central bank moved on two fronts to address Pix-related fraud this cycle. BCB Resolution 493/2025 restructured Pix Forum governance and strengthened the Special Return Mechanism, the scheme's dedicated fraud fund-recovery process, making fund recovery mandatory from 2 February 2026 rather than discretionary. Separately, new transfer limits of approximately BRL200 (roughly USD40) now apply to transactions initiated from unrecognised devices, paired with a seventy-two-hour precautionary hold, both aimed squarely at account-takeover fraud, a pattern in which a compromised device is used to authorise unauthorised Pix transfers before the legitimate account holder can intervene.
Outlook
The mandatory fund-recovery requirement under the strengthened Special Return Mechanism is the clearer consumer-facing protection to monitor, since it converts what was previously a best-efforts recovery process into an enforceable obligation from February 2026. The device-recognition limits and holding period will be tested by how effectively they reduce account-takeover losses without materially degrading the user experience that has driven Pix's adoption.
[SENTINEL-FED] Payments-context AML/CFT position only. Brazil's AML/CFT regime centres on Law 9.613/1998 (the AML Law, amended by Laws 10.701/2003, 12.683/2012, 13.974/2020), which created COAF as the financial intelligence unit (operationally autonomous, administratively linked to the BCB). BCB Circular 3.978/2020 sets the AML/CFT policy, procedures and internal-controls framework for supervised entities, including payment institutions. Brazil is a FATF and GAFILAT member; the 2023 FATF/GAFILAT mutual evaluation noted strengths and gaps (notably BO access and non-bank supervision). For payments: institutions must KYC, monitor transactions, keep records, and report suspicious activity to COAF.
Standing sub-brief216 words · last cycle wpm-2026-06-23
AML/CFT & Financial Crime
This module carries the Sentinel.gi feed only and does not re-analyse illicit finance; original illicit-finance analysis is routed to the Financial Intelligence Monitor. As reported via the Sentinel feed, Brazil operates its payments-context AML/CFT regime through Law 9.613/1998, which created the COAF financial intelligence unit — operationally autonomous and administratively linked to the BCB — together with BCB Circular 3.978/2020 setting AML/CFT policy and internal-controls obligations for supervised entities including payment institutions. Brazil is a FATF/GAFILAT member. The 2023 mutual evaluation noted beneficial-ownership access and non-bank supervision gaps. Suspicious-transaction reporting is required within 24 hours, records kept for at least five years, with reporting from transactions of R$10,000. The Sentinel feed also notes crypto-Pix laundering vectors and VASP/gold AML expansion.
The regime defines the AML/CFT obligation set — KYC, monitoring and COAF STR filing — that payment institutions must operate, and the bank-versus-non-bank supervision gap identified in the 2023 evaluation is a structural payments-AML risk specific to the non-bank PI perimeter.
Outlook
The trajectory is stable but reform-directed, per the Sentinel feed. The beneficial-ownership access and non-bank supervision gaps flagged by FATF/GAFILAT in 2023 are the standing reform pressure points. Original illicit-finance typologies — including crypto-Pix vectors and PCC-related laundering — are carried into the Financial Intelligence Monitor rather than analysed here.
No periodic updates recorded against this sub-brief.
T?FIM (sentinel.gi) per-JID baseline profile — Brazil — AML Law 9613/1998 with COAF (FIU) at its centre, coordinated via the ENCCLA inter-agency mechanism; joint FATF/GAFILAT MER (Dec 2023) found improved risk understanding and TF criminalisation but weak DNFBP supervision and unpopulated BO data. New BCB Resolutions 519-521 (Nov 2025) create a VASP licensing regime effective Feb 2026.
Interbank settlement runs through the STR (Reserves Transfer System), a BCB-operated RTGS providing irrevocable, unconditional real-time finality, underpinned by Law 10.214/2001 (settlement finality, multilateral netting, collateral seizure in insolvency). Reserve/settlement accounts at the BCB are mandatory for some institutions and optional for others; the BCB extends fully collateralised free intraday credit to reserve-account holders. Pix settles via the SPI through Instant Payment (IP) accounts, accessed directly or via accredited PSTIs. Cross-border USD legs route through the FX Clearinghouse and US correspondent banks. Payment institutions can access SPI directly (IP account) or indirectly via a direct participant.
Movement — CHANGEDJoint tax liability regime and virtual-asset FX perimeter fold-in.New correspondent-banking/settlement-access findings this cycle.
Standing sub-brief220 words · last cycle wpm-2026-09-02
Correspondent Banking, Settlement & Access
The analytical spine of this module is the bank versus non-bank settlement-access asymmetry. Settlement finality runs through the STR (Reserves Transfer System) RTGS, which provides irrevocable, unconditional real-time finality underpinned by Law 10.214/2001 — covering settlement finality, multilateral netting and collateral seizure in insolvency. Pix flows settle via the SPI through Instant Payment (IP) accounts, which can be accessed directly or via an accredited PSTI. The access asymmetry is the spine: non-bank PIs can access the SPI directly via an IP account or indirectly via a direct participant, where direct IP-account access is the key settlement-access differentiator versus indirect-participant dependency. Reserve accounts are mandatory for some institutions and optional for others, and the BCB extends fully collateralised free intraday credit. IP accounts must remain non-negative, with remuneration governed by Resolution 195/2022.
On the cross-border side, the USD corridor depends on US correspondent banks for the USD leg over Fedwire, while BRL legs settle via the STR — a bank-PSP-mediated dependency that defines the structural choke point for the BR-US corridor.
Outlook
The trajectory is established. The standing structural question is the settlement-access differential between non-bank PIs with direct IP-account access and those dependent on indirect participation. The USD correspondent dependency remains the key cross-border access constraint, tied to the Resolution 561 rerouting tracked under W5.
Periodic update · new data 2026-09-14 · run wpm-2026-09-02
Correspondent Banking, Settlement & Access
Two developments this cycle extend correspondent-banking-style counterparty-risk obligations onto sectors that have not traditionally carried them. Decreto 13.033 and Ministério da Fazenda Portaria 1.766 impose joint tax liability, under Complementary Law 224/2025 Article 6, on banks, payment institutions and payment arrangers that continue processing transactions for unauthorised betting operators after formal notification. This is the analytical spine of this module's finding: it extends a due-diligence and counterparty-screening duty, structurally similar to correspondent-banking know-your-customer's-customer obligations, onto payment institutions and payment arrangers, a class of firm that has historically operated under lighter counterparty-risk expectations than bank correspondents.
Separately, BCB Resolution 521/2025 folds certain virtual-asset cross-border operations, including payments, stablecoin transactions and self-hosted-wallet transfers, into Brazil's existing FX-market regulatory perimeter, effective 2 February 2026. From the settlement-and-access lens, this development matters because it brings a previously FX-perimeter-adjacent category of cross-border value transfer inside the same regulatory access framework that governs traditional correspondent FX activity, with direct implications for which institutions can settle these flows and under what screening obligations. This finding carries direct overlap with the crypto monitor's stablecoin-regime coverage of the same resolution; this module's contribution is the settlement-access and counterparty-screening reading rather than the digital-asset classification question.
The bank-versus-non-bank distinction is the analytical throughline across both developments: payment institutions and payment arrangers, non-bank entities, are being brought into counterparty-risk and screening obligations that more closely resemble what has historically applied only to bank correspondents.
Outlook
Watch for whether the joint tax liability regime produces measurable changes in payment institutions' willingness to process for betting-sector counterparties, and for further detail on how BCB Resolution 521's FX-perimeter integration affects settlement access for virtual-asset cross-border flows as the 2 February 2026 effective date is followed through.
Trailing-12-month (≈Jun 2025-Jun 2026) commercial activity: the IPO window reopened with PicPay's $434m Nasdaq listing (29 Jan 2026, ticker PICS) — the first major Brazil fintech listing since Nubank (2021); Nubank received conditional OCC approval (Jan 2026) for a US national bank charter and opened an Abu Dhabi HQ. Brazilian startup funding recovered (US$692m raised in Q3 2025, +47% YoY). Product launches centred on Pix Automático and Pix-USDC integration. Undisclosed values are marked amount_disclosed=false.
Standing sub-brief151 words · last cycle wpm-2026-08-16
Commercial Intelligence & Fintech
No discrete M&A, funding or product-launch event was confirmed for Brazilian payment institutions this cycle; the material commercial signal instead comes from the structural capital rewrite's exposure profile. Industry estimates cited in the reporting put roughly 92% of peer-to-peer lenders and roughly 63% of payment institutions at risk of a capital shortfall under the new minimum-capital rule, against only around 5% of full-service banks. That gap frames the coming period as one in which smaller non-bank payment institutions and P2P lenders become plausible consolidation or acquisition targets for better-capitalised banks and larger fintechs, though no specific transaction has been disclosed.
Outlook
Watch for discrete M&A, investment or partnership activity involving Brazilian payment institutions and P2P lenders as the capital phase-in deadlines of January 2027 and January 2028 approach; the exposure asymmetry documented this cycle is the leading indicator for where consolidation activity is most likely to surface.
Periodic update · new data 2026-08-11 · run wpm-2026-08-05
Commercial Intelligence & Fintech
PicPay completed the acquisition of insurtech Kovr Participações S.A. on 3 August 2026, following clearances from the central bank, the competition authority CADE, and the insurance regulator SUSEP. The deal's financial terms were not publicly disclosed. The stated rationale is to embed insurance products directly into PicPay's existing payments and banking application, following closely on the heels of the company's $434 million Nasdaq initial public offering completed on 29 January 2026, which itself targeted a $2.46 billion valuation and marked the first major Brazilian fintech listing since Nubank's 2021 debut.
Outlook
PicPay's acquisition-following-IPO sequence suggests further bolt-on acquisitions targeting adjacent financial-services verticals, such as insurance, are plausible as the company deploys IPO proceeds; whether Kovr's insurance products achieve meaningful embedded-attachment rates within PicPay's core payments app is the practical commercial marker to watch next.
Filters combine as OR inside a group and AND across
groups.
Editorial metadata
Provenance only. Nothing below gates publication or affects the render.
Editorial metadata for Brazil
Field
Value
trust.lawyer_review.status
never_reviewed
trust.lawyer_review.reviewer
not recorded
trust.content_source
ai_generated
Provenance and declared absence
Disclosure model: module cards load OPEN; standing positions render in full; sub-briefs and jurisdiction briefs load as a clamped teaser with an explicit “read full” control carrying the true word count; earlier updates stay collapsed behind a counted summary. No text is hidden without disclosing how much of it there is.
Sentinel-fed modules receive no special rendering treatment. sentinel_feed is an attribution chip only: it does not suppress content, does not generate an absence reason code, and does not exclude the module from any count, filter, search index or export on this page.
Family taxonomy is renderer-level presentation config, not a JID field. Colour is always duplicated in text and is never the sole carrier of meaning.