Brazil tightens central bank cyber rules

Update August 29, 2026: Details were added on BCB Resolution No. 584/2026 covering precautionary retention in cryptoasset transactions and its reach over transfers abroad and self-custodied wallets. The update also notes that, depending on risk, the measure can apply to transactions below US$10,000.

The Central Bank of Brazil put 14 minimum cybersecurity controls in force for supervised financial institutions on March 1, 2026. The rules affect core banking, identity and access management, SOC and SIEM operations, and cloud architecture. The bank also set Dec. 31, 2026 as the deadline for full compliance with the Banking as a Service model under Joint Resolution 16.

What changed for supervised banking?

As of March 2026, entities under Central Bank supervision must follow 14 minimum cybersecurity controls defined by the monetary authority. According to Solutis’ analysis, the scope reaches sensitive operational areas, from core banking to IAM and MFA, as well as SOC, SIEM, and cloud architecture decisions.

How did the Central Bank respond to attacks?

According to Estadão, the Central Bank tightened rules for participants in the financial system after cyberattacks. The tougher framework targets technology service providers, communications with the Rede do Sistema Financeiro Nacional, and especially Pix and the Reserve Transfer System environments.

The same report says the rules call for multifactor authentication, environment isolation, and tighter control over credentials and private keys. In parallel, ICL Notícias reported that the BC is considering giving banks and fintechs more time to review high-value Pix transactions made overnight, with the option to hold funds for up to 72 hours.

What is the BC expecting for Pix and cryptoassets?

The Central Bank’s agenda includes rules with objective criteria for identifying suspicious Pix activity, which could be published by the end of 2026, although no publication or effective date has been set. On the crypto side, Valor Econômico reported that the authority is preparing a system to monitor and share alerts on threats tied to the virtual asset market.

That move overlaps with BCB Resolution No. 584/2026. According to CryptoID, starting Jan. 1, 2027, transfers to entities incorporated abroad that operate with virtual assets, or to self-custodied wallets, will be subject to a review window with precautionary retention of up to 24 hours when they exceed the equivalent of US$10,000 in a single transaction or in a customer’s daily total.

IMG Ordiano added that this precautionary retention can also apply to transactions below US$10,000 if an institution’s risk management models classify them as having higher fraud exposure, broadening the practical scope of the rule. Crypto.news also reported that virtual asset service providers will have to impose the 24-hour preventive hold on transfers above US$10,000 starting Jan. 1, 2027, in line with the crypto threat monitoring and alert system.

What role does cloud infrastructure play in this framework?

Cloud contracting and data hosting can no longer be decided on price or convenience alone. Lacerda Diniz said institutions authorized by the Central Bank are subject to CMN Resolution No. 4,893/2021, which governs cyber policy and the requirements for contracting data processing and storage services and cloud computing.

Interney added that the rule was already fully in force in August 2026, and that the requirement for a contract or prior authorization to host data abroad became a decisive factor in architecture decisions. In that context, Solutis said modernization is no longer optional for banks, fintechs, and other institutions in Brazil’s financial system.