Brazil's Central Bank tightens Pix rules

Update September 21, 2026: Brazil's Central Bank added two new changes to the Pix rulebook, hybrid billing with boleto bancário and the option to flag CPFs and CNPJs tied to well-founded fraud suspicions. Both measures join the broader package of adjustments already announced for security, participation and fraud remediation.

Brazil's Central Bank rolled out a September package of changes that tightens oversight of Pix, virtual asset service providers, banks and fintechs. The measures cover fraud rules, incident reporting, system participation, cloud contracting and PSAV authorization, with a staggered timeline running through July 2027 and other deadlines in March 2026 and October 2026.

What changes in cloud security and cybersecurity?

BCB Resolution 538 and CMN Resolution 5,274 update the 2021 cybersecurity and cloud framework for institutions authorized to operate by the Central Bank, and set compliance through March 1, 2026. According to Merc Group, BCB 538 makes annual penetration tests mandatory, carried out by an independent company or professional, with documentation, a corrective action plan and evidence retention.

The same analysis says the resolution also tightens due diligence for cloud and technology outsourcing. That includes requirements for data location, continuity and exit planning, and it expands scrutiny of third parties and the subcontracting chain.

What changes for virtual assets?

BCB Resolution 520 makes virtual asset service provision in Brazil a Central Bank-authorized activity starting February 2, 2026, rather than an open one. FCM Law says applicants must show compliance with market, credit, operational and liquidity risk rules, plus a cybersecurity policy with an action plan and incident response.

FinanceFeeds adds that, under Article 91 of the same resolution, banks and payment institutions will not be allowed to offer virtual asset transactions involving unauthorized providers or providers that have not started the authorization process in Brazil after October 30, 2026. The outlet also says firms already providing virtual asset services must file their application within 270 days, a deadline that also falls on October 30, 2026.

How is oversight of banks and fintechs tightening?

Serasa says CMN Resolution 5,261, in force since December 2025, requires banks to close deposit accounts when they detect serious irregularities or misuse to move third-party funds. BCB Resolution 518 extends similar obligations to payment institutions in a package of rules aimed at curbing improper account use and fraud.

The same note says Joint Resolution 6, in force since 2023, requires banks and fintechs to share data on fraud indicators through a common electronic system. That setup strengthens collaborative risk monitoring among institutions.

What changes in Pix?

The Central Bank approved changes to the Pix rules to expand the tool's use and reinforce security and anti-fraud mechanisms, with rollout staggered through July 2027, according to G1. The changes were formalized in BCB Resolution 587, which introduces blocks of measures with specific dates: devices with no special deadline starting September 18, 2026, new hybrid billing rules from February 2027, and Pix Automático for payroll accounts starting July 1, 2027.

Agência Brasil says the new rule also redefines the obligation to participate in Pix. The Central Bank may exempt institutions with more than 500,000 active transaction accounts when their customer profile or business model does not justify access to the infrastructure, replacing a purely numerical test with a risk and need analysis.

The same resolution clarifies responsibility for well-founded fraud suspicion flags in the DICT. The institution that accepts a violation notice or records a flag becomes responsible, must notify the affected user, respond to review requests within seven days and remove the flag if the suspicion is not confirmed.

Poder360 details that BCB Resolution No. 587 creates a hybrid billing model that links a boleto bancário to a Pix charge. Once payment is made through one channel, the other is automatically invalidated, and institutions must keep their systems synchronized to prevent duplicate payments.

The same outlet explains that the resolution formally introduces the option to flag CPF and CNPJ records involved in transactions with a well-founded suspicion of fraud in Pix. It also requires rejection of transactions tied to those notices and sets out mechanisms for users to challenge the flags, according to the Central Bank's own rule.

What other fraud and remediation measures are being added?

Campo Grande News reports that, starting in February 2027, Pix participant institutions must notify individual account holders of security incidents involving personal data related to databases used in system components or infrastructure. The coverage also describes tighter controls, with CPF and CNPJ flagging for suspected cases, stronger transaction rejection procedures and changes to appeals against Central Bank decisions.

Mix Vale adds that the Central Bank has reworked the Special Return Mechanism, known as MED 2.0, to reorganize security protocols and make it easier to compensate users hit by fraud, transfers under physical coercion or digital scams. Tribuna do Sertão also notes that some provisions take effect immediately in September 2026, while others are phased in during 2027, and that disconnection of sanctioned participants becomes effective immediately after notification of the final decision.

What is at stake with the future cybersecurity law?

TIInside reported that CNCiber presented a draft General Cybersecurity Law for Brazil in April 2026, aimed at organizing national digital security rules and creating a National Cybersecurity System and a National Authority to supervise the sector. The same column says that, if approved, companies would have 180 days to adapt, a timeline that would also apply to financial institutions and international remittance operations.