title: Brazil — Legal & Litigation | World Payments Monitor canonical: https://payments.gi/jurisdictions/brazil/w7/ publisher: Asymmetric Intelligence ### W7 Legal & Litigation Probable confirmed 2026-06-23 Enforcement is dominated by the June 2025 C&M Software breach — the largest cyber-heist in Brazilian history — in which attackers used credentials of a bribed C&M employee to inject fraudulent Pix orders, draining over R$1bn (≈R$813m+ commonly cited) from at least six institutions' reserve accounts; the Federal Police opened an investigation and the BCB suspended parts of C&M's operations. Follow-on incidents hit Sinqia and Monbank. Major Polícia Federal operations (Magna Fraus, Lusocoin, Carbono Oculto exposing PCC laundering via fintechs) and BCB administrative enforcement (intervention, extrajudicial liquidation, manager liability, RAET) shape the regime. A notable commercial dispute: GetNet (Santander) sued Nubank and Mastercard over prepaid-card interchange losses. Standing sub-brief · as of 23 June 2026 199 words · last cycle 2026-09-28 #### Legal & Litigation Two developments anchor the litigation picture. First, the late-June 2025 C&M Software Pix supply-chain breach — with the attack around 30 June 2025 and BCB disclosure in early July 2025 — saw bribed-employee credentials used to inject fraudulent Pix orders, draining roughly R$800m (around US$140m) from the reserve accounts of at least six institutions, with follow-on hits to Sinqia (~R$400m) and Monbank (~R$4.9m). It is the largest cyber-heist in Brazilian history and the defining operational-resilience event, having triggered the 2025-26 cybersecurity rule package. Second, GetNet (Santander) filed a claim for roughly R$62m in damages against Nubank and Mastercard over prepaid-card acceptance losses, alleging that Nubank promotes its prepaid card as a debit-function card. This landmark commercial dispute tests the prepaid-versus-debit interchange classification commercially and intersects the W4 interchange reform; its outcome bears on prepaid-card economics across the market. The litigation touches both bank-PSPs (Santander/GetNet as claimant) and non-bank PIs (Nubank as defendant), with Mastercard joined as a scheme defendant. #### Outlook The trajectory is escalating. The C&M breach prosecution and the GetNet v Nubank/Mastercard prepaid dispute are the two active threads. The prepaid-interchange dispute is the most commercially consequential, given its bearing on prepaid-card classification and economics. Periodic update · new data 2026-09-28 #### Legal & Litigation USTR's Section 301 investigation into Brazil's Pix scheme produced findings published in the US Federal Register on 4 June 2026, concluding that three specific features of Pix's design -- its mandatory-participation rule, its app-prominence mandate, and its business-transaction fee caps -- unfairly disadvantaged US payment companies including Visa and Mastercard. Roughly three months later, BCB Resolução no. 587, published 18 September 2026, removed the mandatory-participation requirement for institutions with 500,000 or more active accounts. The BCB frames this change on business-model grounds rather than as a direct response to the US finding, but the sequence and timing indicate the litigation and trade-policy dimension of Brazil's payments framework materially influenced Brazil's payments regulatory design, even absent an explicit acknowledgment of that link in the BCB's own framing. Two of the three US demands remain unaddressed: the app-prominence mandate, which governs how Pix is displayed relative to competing payment options within apps, and the business-transaction fee caps, which constrain the fees payment companies can charge on Pix-adjacent business transactions. Both remain in place following Resolução no. 587, meaning the underlying trade dispute is only partially resolved by this cycle's regulatory change. This is a live cross-border legal-exposure matter: the US Section 301 process gives Washington a continuing formal channel to press the two unresolved demands, and Brazil's partial accommodation on the third demand may be read either as a good-faith first step or as a calibrated minimum response, depending on how the remaining dispute develops. #### Outlook Watch for any USTR statement responding specifically to Resolução no. 587, which would clarify whether the US considers the participation-mandate removal a meaningful concession or an insufficient partial response. Absent further Brazilian movement on the app-prominence mandate and fee caps, the Section 301 dispute remains a live and only partially resolved legal-exposure matter for Brazil's payments framework. **Sources and findings (4)** 1. T3 [https://www.tenchisecurity.com/en/insights-news/how-third-party-cyber-risk-management-could-have-mitigated-banking-incidents-in-brazil](https://www.tenchisecurity.com/en/insights-news/how-third-party-cyber-risk-management-could-have-mitigated-banking-incidents-in-brazil) retrieved 2026-06-23 2. T3 [https://www.bitdefender.com/en-us/blog/hotforsecurity/hackers-brazil-100-million-heist](https://www.bitdefender.com/en-us/blog/hotforsecurity/hackers-brazil-100-million-heist) retrieved 2026-06-23 3. T3 [https://practiceguides.chambers.com/practice-guides/financial-services-regulation-2025/brazil/trends-and-developments](https://practiceguides.chambers.com/practice-guides/financial-services-regulation-2025/brazil/trends-and-developments) retrieved 2026-06-23 4. T3 [https://www.vixio.com/insights/pc-time-has-come-cap-prepaid-card-interchange-fees-brazil-says](https://www.vixio.com/insights/pc-time-has-come-cap-prepaid-card-interchange-fees-brazil-says) retrieved 2026-06-23