Brazil tightens BC rules for Pix

The Central Bank of Brazil is tightening rules from 2025 through 2027 for Pix, Banking as a Service and virtual asset transfers, adding independent audits, preventive holds, more monitoring and new governance and control requirements. The regulatory package covers Pix participants, technology providers, BaaS institutions and brokerages or crypto platforms operating in Brazil.

What changed in virtual asset transfers?

Resolução BCB 584 imposes a preventive hold of up to 24 hours on virtual asset transfers when a transaction exceeds $10,000, either in a single transaction or in the total moved by the customer on the same day, according to the official note from Brazil’s Ministry of Finance and Central Bank. The measure can also apply to transactions classified as higher risk under the institutions’ internal models.

According to ConJur, the rule is part of a broader strategy to align PSAV obligations with those of traditional financial institutions in fraud prevention and consumer protection. UPay’s Spanish-language coverage adds that the scope includes transfers from Brazil to foreign virtual asset service providers and self-custody wallets.

Bitnoticias reported that the $10,000 threshold could leave many transfers to overseas exchanges or self-custody wallets on hold, and cited market warnings about a possible exit by players unable to adapt to the new regime. SpaceMoney added that the reaction has already reached Congress through Projeto de Decreto Legislativo 926/2026, which seeks to suspend the measure before it takes effect in 2027.

How is Pix being adjusted?

Pix is also entering a phase of tighter control, with rules aimed at tracing transfers, strengthening the Mecanismo Especial de Devolução and speeding up precautionary action on suspicious transactions. According to the Ministry of Finance, the roadmap through 2030 includes new requirements for participants in the arrangement, improved monitoring and broader sharing of security information among institutions.

Resolução BCB 559 introduced an independent audit requirement for Pix participants tied to the MED, linking continued access to the system with compliance on anti-fraud controls, reconciliation and evidence. Merc Group also said the reinforced version of the MED will allow cascading tracing of funds through intermediary accounts and precautionary blocks of up to 72 hours.

Sindifisco-MS said the Central Bank will impose a lock on new devices, with a limit of R$ 200 per transaction and R$ 1,000 per day for transfers from phones or computers that have never been registered before. The same analysis said MED 2.0 contemplates faster precautionary flags in DICT and blocking funds in the receiving account for up to 72 hours. Seu Crédito Digital added that the security agenda for 2026 includes a fraud probability indicator, improvements in precautionary blocks and an extension of the response deadline to up to 80 days.

What changes for the institutions and providers supporting the ecosystem?

The regulatory tightening also reaches technology providers, BaaS institutions and platforms that process virtual assets, with obligations for due diligence, continuous monitoring and automated internal controls. In several cases, the Central Bank ties operational continuity to compliance with stricter technical and governance standards.

Resolução Conjunta 16/25, issued by the Central Bank of Brazil and the National Monetary Council, created a specific framework for Banking as a Service and set benchmarks for corporate governance, risk management, due diligence procedures and continuous monitoring. According to Migalhas’ analysis, providers must carefully vet partners and clients, monitor the operational and financial soundness of counterparties and maintain automated tools to identify and mitigate unusual activity.

At the same time, financial sector reports said the Central Bank created a specific area to strengthen oversight of PSTs linked to Pix, with a focus on technology and cybersecurity risks. Poder360 said the move was a response to recent cyber incidents in Brazil’s financial system. Portal Zumm added that the BC agenda includes minimum criteria for defining suspicious transactions, standardized fraud alerts and more direct action on keys associated with crimes or with conflicting data.

Resolução CMN 4,893 also appears as part of this package, with requirements for cybersecurity policy and for contracting processing, data storage and cloud computing services. Claro Próximo Nível and TFSF Ventures noted that, although the Central Bank does not regulate AI as a separate category, autonomous agents must be integrated into the technological risk and cybersecurity frameworks of supervised institutions.

What new requirements appear for crypto and fraud?

Digital asset companies operating in Brazil are bound by Resoluções BCB 519, 520 and 521, within a regulatory set that makes activity conditional on authorization and on prudential and control obligations. Bitnoticias also reported that, as of October 30, 2026, companies without authorization must shut down operations and authorized firms will not be allowed to do business with entities outside the regulatory regime.

In the same vein, Cantarino Brasileiro said the new rules on virtual asset transfers require brokerages and platforms to collect and share detailed information about originators and beneficiaries, and to keep risk monitoring systems up to date in order to detect unusual movements. Noncompliance exposes firms to administrative sanctions from the monetary authority.

The package of measures shows a regulatory convergence between the Pix ecosystem, technology providers and the crypto market, with more traceability, more documentary evidence and broader blocking powers for the Central Bank of Brazil.