Brazil Central Bank tightens Pix rules

Brazil’s central bank has banned propaganda, commercial offers, ads and external links from Pix payment receipts as part of new security rules aimed at reducing scams and fraud. The measure was added to the new version of Pix’s minimum user experience requirements manual and will take effect on March 1, 2027.

What changes on Pix receipts?

The new rule leaves receipts as an official record of the transfer, without promotional content or references unrelated to the transaction. CNN Brasil reported that the ban covers ads, commercial offers, hyperlinks and any content not tied to the payment. NSC Total added that the goal is to close gaps that have been exploited in scams involving fake files.

Beyond the ban on advertising and links, the package approved by the regulator also includes rules to make refunds easier and strengthen verification of contacts registered in Pix, according to NSC Total. The outlet said the central bank wants to standardize the receipt as a purely formal record, making fraud harder to pull off.

What happened to the MED and suspicious refunds?

The central bank extended the response window for refunds requested through the Special Return Mechanism, or MED, from 30 days to as many as 80 days when someone suspects the request was made fraudulently. BBC News Brasil reported the change, and DOL said the extension is intended to protect merchants and service providers.

According to DOL, the extra time gives them room to gather records such as invoices and delivery receipts to prove the transaction was legitimate. In practice, the regulator is giving the receiving side more time to defend the payment against a disputed return.

What did the central bank tighten in cybersecurity and crypto?

The central bank also said it will keep stepping up regulatory and supervisory actions to raise security, governance and risk management standards across the financial system. Valor Econômico quoted that official position and said the regulator is aiming to preserve operational integrity and the proper functioning of markets.

At the same time, specialized coverage reported that the BC tightened cybersecurity requirements for financial institutions, including secure system integration, access controls, penetration tests, credential monitoring and specific rules for services provided by third parties. That same line also appears in the regulator’s agenda for the virtual asset sector.

What does the new framework for virtual assets require?

Virtual asset companies already operating in Brazil had until October 30, 2026 to submit the first phase of their authorization request to the central bank under the sector’s new regulatory framework. Global Legal Insights said VASPs that existed before February 2, 2026 can keep operating while the regulator reviews the application under a grandfathering regime.

Resolução BCB nº 552 extended compliance, internal controls, audit and cybersecurity rules to authorized virtual asset service providers, according to Fincatch. The same review said existing firms have that deadline to request authorization and that the regime covers governance, audit and security structures across the sector.

InfoMoney reported that the rules require prior authorization, minimum capital aligned with the size of the operation, a physical headquarters in Brazil, separation of company and customer assets, and effective anti-money-laundering controls. BlockBR added that SPSAVs must be legal entities incorporated in Brazil, with an exclusive corporate purpose, tiered minimum capital based on size and operational risk, compliance and risk management policies, KYC and AML processes, and minimum business continuity standards.

Transfeera said firms seeking to enter the market without prior history cannot use the transitional regime, raising the entry barrier and subjecting them to the regulator’s requirements from the outset. Veja added that after the October 30, 2026 deadline, authorized financial institutions will no longer be able to facilitate business with virtual asset service providers that do not have a license or an authorization request in progress. BitNotícias, meanwhile, said exchange audits are now a permanent structural requirement, not a one-off procedure.