Brazil's Central Bank tightens Pix security

Update October 15, 2026: Brazil's Central Bank added usage and volume data for Pix, plus new details on MED 2.0. The system processed nearly 80 billion transactions and moved more than R$35 trillion in 2025, while inter-institution tracing to reconstruct the money trail became mandatory in February 2026.

Brazil's Central Bank announced a new round of regulatory changes for Pix tied to the security of the payment system, according to its official statement, titled "Pix amplia funcionalidades e reforça segurança com nova ...". The available information does not make it possible to identify the full content of the measures, but it does confirm changes related to fraud-suspicion handling and the review process for those records.

What was disclosed about the new measures?

The Central Bank's official notice said only that Pix will receive new regulatory improvements aimed at strengthening security. The published text does not spell out all of the provisions included in the update, so the full scope of the rule cannot be reconstructed from the material available.

What changes when fraud is suspected?

According to Agência Brasil, the institution that records a fraud suspicion must notify the customer, indicate the date of the record, and allow a review to be requested. If the analysis does not confirm the suspicion, the flag must be removed. That framework is meant to formalize how records are handled and leave a trail for the affected user.

How will record reviews work in the DICT?

IstoÉ Dinheiro reported that institutions will have to provide channels to contest records of well-founded fraud suspicion in the DICT and respond to the request within a maximum of seven days. That adds to what Agência Brasil reported and points to a procedure with defined deadlines for both the response and the internal review.

Brazil's Central Bank also released the Pix Management Report 2023-2025, which says Pix processed nearly 80 billion transactions and moved more than R$35 trillion in 2025, according to the Ministry of Finance. In parallel, Abranet said 148 million people and 12.8 million companies made or received at least one Pix payment in 2025.

What volume did Pix reach in 2025 and 2026?

Pix maintained massive usage throughout 2025 and stayed at very high levels in September 2026, according to figures released by the authorities and in the reports cited. The official report and data published by Agência Brasil show continued growth in transactions, total value moved, and the number of users.

In September 2026, the Central Bank of Brazil's Instant Payment System, or SPI, processed about 7.1 billion transactions worth roughly R$3.2 trillion, according to Agência Brasil. The figure underscores the scale Pix continues to hold in Brazil's financial system.

What changes with MED 2.0?

MED 2.0 establishes mandatory tracing among participating institutions to reconstruct the path of the money after a victim formally files a dispute, and its general mandatory use began in February 2026, according to O Dia. The mechanism adds an operational layer to fraud fighting within Pix.

The three reports agree that the focus of the update is security and the handling of fraud suspicions within the Pix ecosystem. However, based on the material available, it is not possible to specify broader compliance obligations, penalties, or general implementation deadlines.