Brazil Central Bank tightens PIX rules

Brazil’s Central Bank has announced new PIX security rules that will take effect on March 1, 2027. The package adds changes to payment receipts, gives users more time to respond to suspicious transactions, and imposes new requirements on bank and financial institution apps, with the stated goal of strengthening fraud defenses.

What changes in PIX receipts?

The Central Bank has banned ads, commercial offers, hyperlinks, and any content unrelated to the transaction in PIX payment receipts. According to the official notice cited by Tribuna do Agreste, the measure is meant to keep those receipts from becoming a vector for scams involving malicious links.

The restriction also covers any element that is not part of the operation itself. The decision is part of the new security rules package made public on September 3, 2026, with implementation set for March 1, 2027.

How does fraud dispute handling change in MED?

The deadline to respond to suspicious transactions through the Special Refund Mechanism, known as MED, has been extended from 30 to 80 days, according to Tecmundo and IstoÉ Dinheiro. The Central Bank says the change is intended to improve case review and give merchants and service providers more time to submit evidence.

G1 reported that apps from banks and financial institutions must allow customers to attach documents and receipts when responding to a fraudulent transfer. In practice, that includes tax receipts and delivery records, which the cited coverage says can help prove that a transaction was legitimate.

IstoÉ Dinheiro added that the move to 80 days amounts to a 166% increase in the time available to respond to improper claims. The same report said the Central Bank paired these measures with the future removal of the fixed R$500 cap for contactless PIX payments and with a requirement to map fragmented fund flows across different accounts, in an effort to tighten oversight of money laundering risks in the system.

What other security changes are in the regulatory package?

Beyond PIX, the Central Bank and the National Monetary Council have also tightened rules on crypto and on security requirements for financial institutions. For virtual asset service providers, Central Bank Resolutions No. 519, 520, and 521/2025, in force since February 2, 2026, govern authorization and operations, as well as foreign exchange transactions tied to cryptoassets linked to international markets.

Vidigal Neto Advogados said that regime brought prudential and governance requirements into the VASP sector. Fincatch added that these companies must show they can implement the Travel Rule, ensure operational segregation and the security of client assets, and organize supporting documentation for the authorization process.

TrustSwap said that under those same resolutions, providers are subject to minimum capital requirements of roughly R$10.8 million to R$37.2 million, depending on the activity. It also said foreign platforms must operate through an authorized Brazilian entity and that flows involving stablecoins used for international payments and remittances are now treated as foreign exchange transactions, with per-transaction limits and reporting obligations starting May 4, 2026.

Portal do Bitcoin reported that Coinext’s shutdown reflected a concrete impact of the regulatory tightening on the local market, noting that companies unable to meet the new authorization and control requirements would have to cease operations. TechCripto added that the Central Bank defined the VASP regime as the new regulated category for virtual asset service providers, marking the formal start of prudential and cybersecurity oversight of these entities.

How are security requirements for banks and fintechs expanding?

The update to CMN Resolution No. 5.274/2025 strengthens controls over key and certificate protection, traceability, continuous monitoring, security testing, and vendor risk management, according to Prodist. That framework adds to the cybersecurity policy already required under CMN Resolution No. 4.893/2021.

The regulatory focus also extends to the technology supply chain used by banks, cooperatives, and fintechs. Prodist describes broader oversight of third parties and critical tools, while Fincatch notes that cybersecurity has become evidence of governance within the authorization process for VASPs.

Additional changes in Pix, MED and crypto

On September 11, 2026, Brazil’s Central Bank added anti-fraud measures for virtual asset transactions. The update includes a precautionary hold of up to 24 hours on certain transfers abroad or to self-custody wallets for amounts above US$10,000. It also tightened requirements for IT service providers, with more demanding governance, internal controls, capital, and traceability rules.

The ban on ads, commercial offers, external links, and promotional content in PIX receipts was added to the new version of the manual of minimum requirements for the PIX user experience. CNN Brasil reported that the ban covers ads, commercial offers, hyperlinks, and any content unrelated to the transaction, while NSC Total said the goal is to close gaps that had been exploited in scams involving fake files. Another local report said Central Bank Normative Instruction No. 774 requires users to be informed when a transaction is blocked on well-founded suspicion of fraud.

That same regulatory package also strengthens verification of contacts registered in PIX. In addition, institutions will have up to 11 days to respond if a MED refund request was accepted or deemed valid. TNH1 said MED was explicitly defined as the exclusive mechanism for fraud and scams, and that users still have up to 80 days to request a refund in fraud cases.

BBC News Brasil reported on that change, and DOL said the extension is intended to protect merchants and service providers. According to DOL, the extra time lets them gather records such as invoices and delivery receipts to prove the transaction was legitimate. G1 added that bank and financial institution apps must allow customers to attach documents and receipts when responding to a transfer considered fraudulent under MED.

The specialized outlet Clearing Post added that Normative Instruction No. 766 raised the window for the recipient to respond to a refund made through the Special Refund Mechanism from 30 to 80 days, and that institutions have until March 1, 2027 to adapt their systems to the new receipt rules.

The Central Bank also said it will keep stepping up regulatory and supervisory actions to raise standards for security, governance, and risk management across the financial system. Valor Econômico quoted that official position and said the regulator is aiming to preserve operational integrity and the proper functioning of markets.

In parallel, specialized coverage reported that the Central Bank tightened cybersecurity requirements for financial institutions, with secure system integration, access controls, penetration testing, and credential monitoring. That same line also appears on the regulator’s agenda for the virtual asset sector. One financial analysis piece linked the regulatory tightening to the Master case and added that Resolution No. 584 introduced specific anti-fraud measures for virtual asset services.

Virtual asset companies already operating in Brazil had until October 30, 2026 to submit the first phase of their authorization request to the Central Bank. Global Legal Insights said VASPs that were already active before February 2, 2026 may continue operating while the regulator reviews the request, under a grandfathering regime.

Resolution No. 552 expanded compliance, internal controls, audit, and cybersecurity rules to authorized virtual asset service providers, according to Fincatch. The same review said entities already operating have that deadline to request authorization and that the regime covers governance, audit, and security structures across the sector.

InfoMoney reported that the rules require prior authorization, minimum capital aligned with the operation, a physical headquarters in Brazil, segregation of company and client assets, and effective anti-money-laundering controls. BlockBR added that SPSAVs must be legal entities incorporated in Brazil, with an exclusive corporate purpose, minimum capital scaled by size and operational risk, compliance and risk management policies, KYC and AML processes, and minimum operational continuity standards.

Transfeera said firms seeking to enter the market without prior history cannot rely on the transitional regime, which raises the barrier to entry and subjects them to the regulator’s requirements from the outset. Veja added that once the October 30, 2026 deadline passes, authorized financial institutions will no longer be able to enable business with virtual asset service providers that do not have a license or an authorization request in progress. BitNotícias, for its part, said exchange audits are now a permanent structural requirement, not a one-time procedure.