Brazil Central Bank tightens Pix, crypto rules

Brazil’s Resolução BCB nº 584/2026 requires virtual asset service providers, or PSAVs, to hold crypto transfers abroad or to self-custody for up to 24 hours when they exceed $10,000 per transaction or in the daily total. The measure takes effect on January 1, 2027, is already drawing pushback in Brazil’s Congress, and comes alongside new security rules for Pix that are also being rolled out in stages.

What does the new crypto resolution require?

The rule establishes a preventive hold, not a permanent one, for virtual asset operations that exceed the threshold set by the Central Bank. According to the Ministry of Finance’s official note, the measure is strictly precautionary and can be lifted before the 24 hours are up if the risk review finds no irregularities, as long as the decision is documented and recorded.

During that period, institutions must deepen their review of the transaction, taking into account at a minimum the customer profile, the characteristics of the operation, the counterparty involved and the destination jurisdiction. The ministry also said internal risk management policies and structures may extend the hold to transactions below $10,000.

Who does it apply to, and from when?

The rule targets transfers of cryptoassets to foreign virtual asset service providers or self-custody wallets, according to UPay’s analysis. The $10,000 threshold can be reached by a single transfer or by the accumulated value of a customer’s transactions on the same day.

SpaceMoney reported that the operational application of the hold will begin on January 1, 2027. The same coverage said Projeto de Decreto Legislativo (PDL) No. 926/2026 has already been introduced in Brazil’s Congress seeking to block the measure.

How do the new security rules change Pix?

Instrução Normativa BCB nº 766 introduces a gradual rollout of new rules on incident reporting and fraud analysis in Pix, with a first phase starting on August 10, 2026 and a second phase on September 1, 2026, when the deadline to respond to a fraud refund request through MED is extended to 80 days.

FEEB-PR and other local outlets describe the scheme as a kind of MED 2.0, capable of tracing suspicious transactions even when funds have been broken into several accounts. MixVale and Alerta Gov agree that victims have 80 calendar days to request activation of the refund mechanism, though the sooner the process starts, the better the chances of recovery.

What changes for digital asset companies?

A compliance guide cited by MSN Brasil says companies that provide digital asset services have until October 30, 2026 to align with Central Bank rules. From that date, firms without authorization must stop operating, and authorized firms will not be allowed to deal with participants outside the regulatory regime.

Mercado Hoje added that, as of February 2026, exchanges, custodians and crypto brokers were reclassified as Prestadoras de Serviços de Ativos Virtuais, or PSAVs, and need Central Bank authorization to operate under ongoing supervision for compliance and risk management.

What other requirements apply to the financial sector?

A technology compliance blog said the rules issued by the Conselho Monetário Nacional, including Resolução CMN nº 4.893 and successor standards, require a Cybersecurity Policy and an incident response structure that explicitly covers third-party technology providers. In parallel, analyses on LGPD and privacy note that Resolução CD/ANPD nº 15/2024 sets criteria for incident reporting and a three-business-day deadline to notify the ANPD and affected individuals when there is relevant risk or harm.

That regulatory overlap also appears in materials from the Ministry of Finance, which project new stages for Pix through 2030 with more security and integration with Open Finance, and in Eutrop.io’s update on IN BCB nº 767/2026, which sets October 26, 2026 as the date for certain sections to enter into force and for the revocation provided for in the earlier rule.