title: Brazil — Operational Resilience & Critical Infrastructure | World Payments Monitor canonical: https://payments.gi/jurisdictions/brazil/w3/ publisher: Asymmetric Intelligence ### W3 Operational Resilience & Critical Infrastructure Confirmed confirmed 2026-06-23 Operational resilience is governed by CMN Resolution 4.893/2021 (financial institutions) and BCB Resolution 85/2021 (payment institutions), effective from 2021, which mandate cybersecurity policies, incident response, business-continuity testing, and rules for contracting data-processing/storage and cloud services in-country or abroad — with the institution retaining full accountability for outsourced activity and the BCB granted audit/access rights. Institutions must report security incidents that constitute a 'crisis situation' to the BCB and retain documentation for at least five years. The June 2025 C&M Software breach exposed third-party (PSTI) supply-chain risk and triggered new cybersecurity rules (Res. 538/2025; CMN 5.274/2025, adaptation to March 2026). Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. [Open this jurisdiction's page on Dataprotection.gi →](https://dataprotection.gi/jurisdictions/brazil/) Horizon · 2026-03 (± a quarter) Cybersecurity package adaptation deadline (Res. 538/2025; CMN 5.274/2025)_Adopted, not yet in force · Tier 3 source_ Standing sub-brief · as of 16 August 2026 217 words · last cycle 2026-09-28 #### Operational Resilience & Critical Infrastructure Banco Central do Brasil has tightened device-level security controls across the Pix instant-payment rail. Accounts accessed from unregistered devices are now subject to transfer limits of roughly US$40 per transaction and roughly US$201 per day, backed by a precautionary lock mechanism that can freeze suspicious activity. The control applies uniformly to both bank and non-bank Pix participants, reflecting a scheme-wide push to reduce device-takeover fraud rather than a bank-specific or non-bank-specific carve-out. A separate rule targets the technology layer beneath Pix connectivity. Pix participants that connect through a payment-scheme technology infrastructure provider must demonstrate, via a CVM-registered auditor's report, that BCB-registered private signing keys are not shared with that provider; absent such certification a BRL 15,000 transaction limit applies, with a possible 90-day BCB waiver available while certification is completed. This signing-key segregation requirement raises the operational bar for participants that outsource connectivity infrastructure, again applying across the bank and non-bank participant base. #### Outlook Both the device-registration limits and the PSTI signing-key segregation rule are already in effect, shifting the near-term operational burden onto participants' fraud-monitoring and vendor-management functions rather than introducing a further compliance deadline. The direction of travel is toward tighter device- and infrastructure-level controls on the Pix rail, consistent with the broader authorisation and capital tightening running in parallel. Periodic update · new data 2026-09-28 #### Operational Resilience & Critical Infrastructure Pix's operational performance this cycle is, on its own terms, exceptional: the scheme accounted for 29% of all retail payments in the six months to May 2026, with transaction volume up 21.6% over that period, availability above 99.9%, and 99% of transactions settling within 0.449 seconds. These figures describe a payments-critical-infrastructure system operating at very high reliability and at a scale that now constitutes close to a third of Brazil's entire retail-payments volume. That scale sits against a supervisory-capacity signal that this cycle brought into sharper focus: BCB staffing has fallen 42% over the past decade while the number of regulated financial institutions it oversees has grown 50% over the same period. This is a single tier-2 source and the capacity-strain claim has not been independently corroborated, so it should be read as a flagged concern rather than a settled finding. It gains a concrete illustration, however, in the effective shutdown of Banco Master: the BCB intervened amid mounting liquidity pressure at the institution, and police arrested its controlling shareholder. Whether the Banco Master episode reflects a specific institutional failure unrelated to broader supervisory bandwidth, or is illustrative of the capacity strain the staffing figures suggest, cannot be resolved from this cycle's evidence, but the two data points arrived in the same reporting window and are being read together here for that reason. The operational-resilience picture for Pix itself -- the scheme's own uptime and settlement-speed metrics -- remains strong and shows no degradation. The resilience question this cycle is squarely about supervisory capacity to oversee an expanding population of regulated institutions, not about the scheme's own technical robustness. #### Outlook Whether the BCB responds to the staffing-versus-institution-growth gap with additional resourcing, and whether further institutional-stress events follow the Banco Master intervention, will indicate whether the capacity-strain signal identified this cycle is an isolated observation or the leading edge of a broader supervisory-bandwidth problem as Brazil's regulated-institution population continues to grow. **1 earlier distinct update(s)** Periodic update · new data 2026-09-21 #### Operational Resilience & Critical Infrastructure New BCB rules direct Pix participants to deploy historical and behavioural pattern analysis for real-time anomaly detection, and critically, this comes paired with a formal obligation to act on flagged orders, including blocking, rather than a purely advisory monitoring expectation. This is an assessed-confidence finding that shifts fraud-detection responsibility onto the payments infrastructure layer itself, applying across both bank and non-bank participants in the Pix ecosystem, rather than leaving detection and mitigation to end users acting alone. Complementing this behavioural-monitoring mandate, the BCB introduced device-recognition-based Pix transfer limits: R$200 per transaction and R$1,000 per day for transfers originating from unrecognised devices. Alongside the device-based limits sits a 72-hour precautionary hold mechanism for transfers flagged as suspicious, under which Nubank, Itaú Unibanco and Caixa Econômica Federal are named as institutions authorised to apply the hold, with funds remaining in the recipient account but unavailable pending review. This combination of device-recognition limits and a multi-day hold window represents a substantial operational-resilience uplift for the Pix rail, directly targeted at the anomaly-detection gap that unrecognised-device transfers had previously represented. #### Outlook Watch for whether the device-based limits and 72-hour hold mechanism extend beyond the three named institutions to the broader universe of Pix participants, and for the operational load these new obligations place on smaller payment institutions relative to the large banks currently named. **Sources and findings (4)** 1. T1 [https://www.bcb.gov.br/content/about/legislation_norms_docs/BCB_Resolution_No_85_2021.pdf](https://www.bcb.gov.br/content/about/legislation_norms_docs/BCB_Resolution_No_85_2021.pdf) retrieved 2026-06-23 2. T1 [https://www.bcb.gov.br/content/about/legislation_norms_docs/CMN_Resolution_No_4,893_2021.pdf](https://www.bcb.gov.br/content/about/legislation_norms_docs/CMN_Resolution_No_4,893_2021.pdf) retrieved 2026-06-23 3. T3 [https://www.legal500.com/guides/chapter/brazil-banking-finance/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]](https://www.legal500.com/guides/chapter/brazil-banking-finance/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]) 4. T3 [https://en.clickpetroleoegas.com.br/amidst-the-anti-fraud-package-for-the-brazilian-payment-system-the-central-bank-publishes-a-resolution-that-temporarily-suspends-sanctioning-btl96/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]](https://en.clickpetroleoegas.com.br/amidst-the-anti-fraud-package-for-the-brazilian-payment-system-the-central-bank-publishes-a-resolution-that-temporarily-suspends-sanctioning-btl96/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication])