Brazil (BR)

Licensing, Authorisation & Market Access

The foundational market-access position in Brazil is set by Law 12.865/2012, which created the 'payment institution' (instituição de pagamento) category, and BCB Resolution 80/2021, which defines the operating modalities: e-money issuer, post-paid issuer, acquirer and payment initiator. Payment institutions are supervised by the BCB and CMN. Limited-scope schemes — private-label, closed-loop and meal/benefit arrangements — remain exempt from BCB authorisation under Circular 3.682/2013. This framework defines the non-bank market-access route for PSPs and fintechs entering Brazil and the coexistence of bank-PSPs with non-bank payment institutions that shapes the competitive landscape.

The material change in this cycle is the consolidation of the authorisation trigger. BCB Resolution 494/2025, effective 5 September 2025, eliminated the transaction-volume thresholds that previously gated authorisation — formerly R$300m in transactions or R$30m in held funds under Resolution 257/2022. All payment-institution modalities now require authorisation, with a unified regularisation window from 1 to 31 May 2026. This removes the de-minimis unauthorised operating window for non-bank PIs and EMIs: every modality must now seek authorisation, materially raising the compliance bar for fintech entrants and for existing unauthorised operators that previously sat below threshold. The position is carried at High confidence pending T1 BCB primary confirmation, as it currently rests on law-firm sourcing.

Prudential calibration was separately updated by Joint Rule No. 14/2025, issued by the BCB and CMN and dated 3 November 2025, which ties minimum capital and net-worth to categories of operational activity reported to the BCB. Authorisation also requires sound governance and disclosure of controllers and qualified shareholdings. Activity-calibrated minimum capital affects both entry cost and the scaling economics for payment institutions across modalities.

The live entry route is illustrated by Boku Inc., which received a BCB payment-institution licence as a payment initiator and e-money issuer in mid-2025, targeting Pix Automático for merchants in early 2026 within the Open Finance ecosystem. This demonstrates the feasibility of foreign-PSP entry as a non-bank PI and the strategic value of Pix Automático merchant rails for new entrants.

The bank-PSP versus non-bank-PI distinction is structurally central here: banks access the system as prudentially supervised credit institutions, while non-bank PIs enter through the Law 12.865/2012 authorisation route, now uniformly required across all modalities following Resolution 494/2025.

Outlook

The PI authorisation regularisation window closes 31 May 2026, the binding near-term deadline for previously sub-threshold operators. The trajectory is established but tightening: the elimination of de-minimis exemptions and activity-calibrated capital both raise the standing compliance bar. A primary-regulatory gap remains — no T1 BCB confirmation of the eliminated thresholds and May 2026 window has been retrieved, capping confidence at High and flagging the most recent 2025 BCB licensing amendments as under-indexed for primary sourcing.

Conduct, Safeguarding & Financial Promotions

Brazil's conduct and safeguarding regime for payment institutions is built on BCB Rule 80/2021, which mandates segregation of client and end-user funds from proprietary assets, transparency and identification obligations, governance requirements, cybersecurity controls and service-continuity provisions. The safeguarding model is distinctive: rather than a UK/EU-style discrete safeguarding regime, Brazil relies on asset-segregation. PIs must hold e-money balances in payment accounts with prudential treatment and keep client funds strictly segregated to prevent commingling in insolvency, supporting insolvency traceability through consolidated prudential supervision rather than structural ring-fencing.

The conduct perimeter extends to Banking-as-a-Service: Joint Resolution No. 16 (CMN/BCB) regulates BaaS arrangements, defining the conduct and accountability boundary that operators must build to. Manager compensation is addressed by BCB Resolution 432/2024. Together these instruments define the consumer-fund protection model for Brazilian PIs and EMIs.

The bank versus non-bank distinction matters in safeguarding: the segregation obligation binds payment institutions specifically, with e-money balances held in payment accounts under prudential treatment, distinct from the deposit-taking treatment of bank-PSPs.

Outlook

The trajectory is established. The segregation-based safeguarding model is settled, with the BaaS conduct perimeter under Joint Resolution 16 and manager-compensation rules under Resolution 432/2024 forming the standing conduct architecture. This module is assessed rather than confirmed, reflecting the secondary sourcing underpinning the consolidated conduct picture.

Stablecoins & Digital Money

Brazil's stablecoin and digital-money perimeter has escalated sharply. The VASP framework — Law 14.478/2022 plus BCB Resolutions 519, 520 and 521 of 10 November 2025 — saw its core rules enter into force on 2 February 2026, with a 270-day transition running to 30 October 2026. It establishes three licence modalities (Intermediary, Custodian and Broker), mandates client-asset segregation and monthly proof-of-reserves, and leaves the CVM with jurisdiction over securities tokens. Importantly, e-money is excluded from the virtual-asset definition under Law 12.865, keeping the PI and VASP perimeters distinct. From 30 October 2026, BCB-supervised institutions are barred from dealing with unauthorised VASPs. This framework establishes the licensing perimeter for stablecoin and crypto payment and remittance operators in Brazil's roughly US$6-8bn-per-month crypto market, around 90% of which is stablecoins.

Layered onto the licensing framework is a settlement restriction. BCB Resolution 561, published 30 April 2026 and effective 1 October 2026, bars eFX providers from using stablecoins, bitcoin or crypto to settle the offshore leg of regulated international payments, restricts eFX to BCB-authorised institutions, and requires segregated client-fund accounts plus monthly reporting. It targets firms such as Nomad and Braza Bank that had used stablecoin settlement on the XRP Ledger in Brazil-US flows. The effect is to close the stablecoin cross-border settlement vector for eFX providers, forcing crypto-native remittance operators back onto FX-transaction or non-resident BRL account rails.

The combined posture is restrictive: Brazil licenses VASPs while deliberately containing stablecoin use in cross-border payments. A vendor-sourced claim of an official BCB Pix-USDC integration has been excluded as unverified, conflicting with the Resolution 561 settlement ban and lacking primary confirmation.

Outlook

Two in-force-pending deadlines dominate: the eFX crypto-settlement ban takes effect 1 October 2026, and the VASP transition ends 30 October 2026, after which dealing with unauthorised VASPs is prohibited for supervised institutions. The trajectory is escalating and containment-directed. The retracted Pix-USDC claim flags a vendor/launch-hype over-indexing risk, where private fintech USDC-Pix on/off-ramp services may be conflated with official BCB policy.

Operational Resilience & Critical Infrastructure

Brazil governs operational resilience through a layered regime rather than a single DORA-style omnibus instrument. CMN Resolution 4.893/2021 applies to financial institutions (effective 1 July 2021) and BCB Resolution 85/2021 to payment institutions, with a 2025-26 cybersecurity package (BCB Resolution 538/2025 and CMN Resolution 5.274/2025) layered on top and an adaptation deadline in March 2026. Outsourcing is permitted, but regulatory responsibility is non-transferable: the institution retains full accountability for outsourced and cloud activity, the BCB holds audit and access rights, crisis-situation incidents must be reported to the BCB, and records kept for at least five years.

The defining event crystallising this regime was the late-June 2025 C&M Software breach. The incident — the largest cyber-heist in Brazilian history — exposed systemic risk in payment-system technical infrastructure providers and directly triggered the 2025-26 cybersecurity rule package, reframing PSTI and Pix-IT-provider supply-chain risk for the whole market. Third-party risk is now the leading payments-resilience threat vector in the jurisdiction.

The regime applies to both bank-PSPs (under CMN 4.893/2021) and non-bank PIs (under BCB 85/2021), with the non-transferable-responsibility principle binding regardless of institution type.

Outlook

The trajectory is escalating post-C&M breach. The binding near-term milestone is the cybersecurity package adaptation deadline in March 2026. The structural direction is toward sharper critical-third-party and PSTI obligations, with the breach having permanently elevated supply-chain exposure as the central resilience concern.

Scheme & Network Compliance

The BCB exercises direct regulatory control over four-party scheme economics in Brazil. Debit interchange is capped at a single 0.5% rate from 2023 (originally an 0.8% maximum and 0.5% average from 2018), while prepaid interchange carries a 0.7% cap effective April 2024, with prepaid settlement harmonised to the two-day debit cycle, down from up to 28 days previously. Scheme fees are reported quarterly to the BCB. Beyond capping conventional scheme economics, the BCB itself sets and operates the Pix scheme rules under Resolution 1/2020 — an unusual degree of direct regulatory ownership of a national scheme.

These controls materially affect prepaid-heavy fintech economics and acquirer margins. The prepaid settlement harmonisation improved merchant liquidity in a high-base-rate environment by shortening the settlement cycle. The regime applies across both bank-PSPs and non-bank PIs operating as issuers or acquirers within four-party arrangements.

Outlook

The trajectory is established. Interchange caps and settlement harmonisation are settled, with the BCB's direct operation of Pix scheme rules forming the structural anchor. The principal forward tension is the commercial dispute over prepaid-versus-debit interchange classification, tracked under W7, whose outcome bears on prepaid-card economics across the market.

Payment Corridor Dynamics

Pix is the dominant domestic rail and the strategic core of Brazil's corridor positioning. Created and operated by the BCB, live since 16 November 2020, it settles 24/7 via the BCB-operated SPI and DICT alias directory, coexisting with legacy TED, DOC and boleto instruments. The BCB is exploring Pix internationalisation and interlinking, whether bilaterally or via Project Nexus, though no in-force cross-border Pix corridor has yet been confirmed.

The principal regulated USD corridor infrastructure runs through the FX Clearinghouse, through which over 90% of daily FX trades settle. BRL legs clear via the STR at the BCB, while USD legs settle through designated US correspondent banks over Fedwire. This correspondent-banking access route is the structural choke point into which BCB Resolution 561 reroutes crypto-native remittance flows: by barring crypto settlement on the eFX offshore leg, the regulation forces those flows back onto regulated FX-transaction and US correspondent-bank rails.

The USD-leg correspondent dependency is a bank-PSP feature, tying the W5 corridor analysis to the settlement-access asymmetry covered in W12. Corridor economics are central to any operator's Brazil strategy.

Outlook

The trajectory is established domestically with cross-border exploratory. The BR-US corridor is in a rerouting phase under Resolution 561, effective 1 October 2026. Pix internationalisation remains exploratory and under-indexed pending concrete corridor announcements; no bilateral or Nexus link has been confirmed in force.

Industry Structure & Commercial Dynamics

The Brazilian acquiring market is highly concentrated. Cielo, Rede, Getnet and Stone together dominated over 83% of acquiring in 2020Q1, the top-five issuers held around 80% of issuing, and Cielo and Redecard historically accounted for over 90% of card acceptance. This reflects bank-controlled acquirer incumbency set against listed challengers and a long tail of payment-institution sub-acquirers. The concentration figures are point-in-time 2020Q1 data and have likely shifted with sub-acquirer growth; current 2025-26 market-share figures have not been retrieved.

The dominant competitive force reshaping the market is Nubank, with roughly 110m Brazil customers (127m globally as of Q3 2025) and a structurally low cost-to-serve of around US$0.80 per customer per month. Nubank surpassed Petrobras in October 2025 to become Brazil's most valuable company, at roughly US$77-85bn. These customer figures are Q3 2025 and should be treated as point-in-time, potentially understating current scale. As a non-bank PI/EMI by origin, Nubank's scale and cost structure are the leading disruption vector against bank-controlled acquirer incumbency.

Outlook

The trajectory is fintech-led concentration. The structural picture is bank-controlled acquiring incumbency under pressure from sub-acquirer growth and from Nubank's scale. Two data gaps temper confidence: acquiring concentration data is stale at 2020Q1, and leading-fintech customer figures are roughly nine months old at the baseline date despite quarterly reporting cadence. Current merchant-acquiring operational data is under-indexed.

Legal & Litigation

Two developments anchor the litigation picture. First, the late-June 2025 C&M Software Pix supply-chain breach — with the attack around 30 June 2025 and BCB disclosure in early July 2025 — saw bribed-employee credentials used to inject fraudulent Pix orders, draining roughly R$800m (around US$140m) from the reserve accounts of at least six institutions, with follow-on hits to Sinqia (~R$400m) and Monbank (~R$4.9m). It is the largest cyber-heist in Brazilian history and the defining operational-resilience event, having triggered the 2025-26 cybersecurity rule package.

Second, GetNet (Santander) filed a claim for roughly R$62m in damages against Nubank and Mastercard over prepaid-card acceptance losses, alleging that Nubank promotes its prepaid card as a debit-function card. This landmark commercial dispute tests the prepaid-versus-debit interchange classification commercially and intersects the W4 interchange reform; its outcome bears on prepaid-card economics across the market.

The litigation touches both bank-PSPs (Santander/GetNet as claimant) and non-bank PIs (Nubank as defendant), with Mastercard joined as a scheme defendant.

Outlook

The trajectory is escalating. The C&M breach prosecution and the GetNet v Nubank/Mastercard prepaid dispute are the two active threads. The prepaid-interchange dispute is the most commercially consequential, given its bearing on prepaid-card classification and economics.

Merchant Acquiring & Risk

The Brazilian acquiring framework governs merchant acquiring and risk through acquirer and sub-acquirer accreditation agreements combined with BCB scheme and interchange rules. The merchant discount rate (MDR), inclusive of interchange, is a merchant cost. The 2023/24 prepaid settlement harmonisation to the two-day debit cycle improved merchant liquidity. Card chargebacks, which are issuer-mediated, are distinct from the Pix Special Return Mechanism (MED).

A structural feature shapes the competitive dynamics: sub-acquirers are not card-network members and process at low cost across brands, positioning them as a disruption vector against bank-controlled acquirers. On the Pix side, MED debits the recipient merchant's settlement and offers no merchant evidence-submission process, a materially different risk profile from card chargebacks. Together these mechanics define the acquirer and sub-acquirer settlement, chargeback and MDR economics that govern merchant-acquiring P&L in Brazil.

The framework spans both bank-controlled acquirers and non-bank sub-acquirers, with the sub-acquirer model the principal non-bank entry route into merchant acquiring.

Outlook

The trajectory is established. Settlement harmonisation and the sub-acquirer competitive model are settled features. The principal forward tension is the prepaid-interchange classification question, tracked under W7, which bears directly on acquiring economics.

Product Innovation & Market Development

Brazil is a global instant-payments innovation leader, with the BCB extending Pix into a product family. Live products include Pix Agendado (scheduled), Pix por Aproximação (contactless, launched 28 February 2025) and Pix Automático (recurring, launched 2025). The pipeline extends to Pix Parcelado (installment), Pix Garantido (credit-backed), and cross-border and offline Pix. This sits alongside an active Open Finance programme and a Regulatory Sandbox covering real-asset tokenisation.

The Pix product roadmap — Automático, Garantido and cross-border in particular — is the principal product-innovation vector that operators must integrate to capture recurring and credit-backed flows. The product family extends the rail's reach across recurring, contactless and credit use cases. The roadmap applies to both bank-PSPs and non-bank PIs participating in Pix, given the rail's universal participation model.

Outlook

The trajectory is leading. The forward roadmap — Pix Garantido, Pix Parcelado, cross-border and offline Pix — is the principal product-development trajectory. The cross-border element ties to the W5 internationalisation exploration, which remains pending concrete corridor announcements.

Consumer Protection & APP Fraud

Brazil's consumer-redress regime for instant payments centres on the Pix Special Return Mechanism (MED), introduced in November 2021, which provides an 80-day registration period, 7-day review and full or partial refund. The regime is being upgraded substantially. MED 2.0, under BCB Resolution 493/2025, traces and blocks funds across cascading account hops; it became optional on 23 November 2025 and mandatory on 2 February 2026, with a sanctioning grace period to 10 May 2026 under Resolution 546. A self-service MED button was mandated under Resolution 589 by October 2025, and Resolution 501/2025 requires institutions to reject transfers to fraud-flagged accounts.

The upgrade responds to historically low recovery rates — around 9% in 2023, with roughly 89% of MED requests denied for insufficient funds or closed accounts. The cascading-block design directly targets that gap. The MED 2.0 cascading-block and fraud-flag rejection obligations are a core consumer-protection compliance load for every Pix participant, bank-PSP and non-bank PI alike. The escalation from reactive MED to preventive-plus-tracing reflects Brazil's position as a global testbed for instant-payment fraud defence.

Outlook

The trajectory is escalating. The binding near-term milestone is the MED 2.0 sanctioning grace expiry on 10 May 2026, following the mandatory adoption date of 2 February 2026. The structural direction is toward preventive interdiction rather than after-the-fact recovery.

AML/CFT & Financial Crime

This module carries the Sentinel.gi feed only and does not re-analyse illicit finance; original illicit-finance analysis is routed to the Financial Intelligence Monitor. As reported via the Sentinel feed, Brazil operates its payments-context AML/CFT regime through Law 9.613/1998, which created the COAF financial intelligence unit — operationally autonomous and administratively linked to the BCB — together with BCB Circular 3.978/2020 setting AML/CFT policy and internal-controls obligations for supervised entities including payment institutions. Brazil is a FATF/GAFILAT member. The 2023 mutual evaluation noted beneficial-ownership access and non-bank supervision gaps. Suspicious-transaction reporting is required within 24 hours, records kept for at least five years, with reporting from transactions of R$10,000. The Sentinel feed also notes crypto-Pix laundering vectors and VASP/gold AML expansion.

The regime defines the AML/CFT obligation set — KYC, monitoring and COAF STR filing — that payment institutions must operate, and the bank-versus-non-bank supervision gap identified in the 2023 evaluation is a structural payments-AML risk specific to the non-bank PI perimeter.

Outlook

The trajectory is stable but reform-directed, per the Sentinel feed. The beneficial-ownership access and non-bank supervision gaps flagged by FATF/GAFILAT in 2023 are the standing reform pressure points. Original illicit-finance typologies — including crypto-Pix vectors and PCC-related laundering — are carried into the Financial Intelligence Monitor rather than analysed here.

Correspondent Banking, Settlement & Access

The analytical spine of this module is the bank versus non-bank settlement-access asymmetry. Settlement finality runs through the STR (Reserves Transfer System) RTGS, which provides irrevocable, unconditional real-time finality underpinned by Law 10.214/2001 — covering settlement finality, multilateral netting and collateral seizure in insolvency. Pix flows settle via the SPI through Instant Payment (IP) accounts, which can be accessed directly or via an accredited PSTI. The access asymmetry is the spine: non-bank PIs can access the SPI directly via an IP account or indirectly via a direct participant, where direct IP-account access is the key settlement-access differentiator versus indirect-participant dependency. Reserve accounts are mandatory for some institutions and optional for others, and the BCB extends fully collateralised free intraday credit. IP accounts must remain non-negative, with remuneration governed by Resolution 195/2022.

On the cross-border side, the USD corridor depends on US correspondent banks for the USD leg over Fedwire, while BRL legs settle via the STR — a bank-PSP-mediated dependency that defines the structural choke point for the BR-US corridor.

Outlook

The trajectory is established. The standing structural question is the settlement-access differential between non-bank PIs with direct IP-account access and those dependent on indirect participation. The USD correspondent dependency remains the key cross-border access constraint, tied to the Resolution 561 rerouting tracked under W5.

Commercial Intelligence (M&A, Investment & Product)

Three discrete commercial events define the cycle. First, PicPay raised US$434m in a completed Nasdaq IPO, listing on 29 January 2026 under ticker PICS and selling 22.86m shares — the first major Brazilian fintech US listing since Nubank in 2021. PicPay reported 66m Brazil customer accounts as of 30 September 2025, up 12% year-on-year. As a non-bank PI/EMI, PicPay's listing reopens the Brazil fintech IPO window and provides a sector valuation reference; the IPO value is publicly disclosed.

Second, Nubank received conditional OCC approval in January 2026 for a US national bank charter and opened an Abu Dhabi HQ for its global push. This event is a pending regulatory partnership-restructuring milestone; its value is not publicly disclosed. A US national bank charter would materially expand Nubank's cross-border product reach and regulatory standing.

Third, at the sector-aggregate level, Brazilian startups raised US$692m in Q3 2025, up 47% year-on-year and 92% quarter-on-quarter per Crunchbase. This is a sector aggregate rather than a single deal, and the value is publicly disclosed; it indicates a recovering investment environment underpinning continued fintech entry and product investment.

Outlook

The trajectory is active. The reopening of the Brazil fintech IPO pipeline, signalled by PicPay, and Nubank's charter pursuit point to renewed public-market appetite and cross-border expansion. The recovering funding environment supports continued sector entry. The Nubank OCC charter remains a pending regulatory milestone to watch.