Brazil tightens Pix and crypto reporting rules

Brazil’s central bank has updated the Pix rulebook and the Penalties Manual with new fraud prevention and mitigation rules, along with the flagging of CPF and CNPJ numbers linked to suspicions and the rejection of transactions tied to those notices. At the same time, it expanded reporting to Coaf for certain transfers involving virtual assets. Brazilian media outlets and the regulatory follow-up cited in the coverage reported the measures.

What changed in Pix?

Resolution BCB No. 587/2026 introduced measures aimed at strengthening the system’s security and organizing the response to transactions flagged for suspected fraud. According to CNN Brasil and Poder360, the rule updated both the Pix regulations and the Penalties Manual, adding tools for prevention, mitigation, and handling alerts involving identified accounts or keys.

TI Inside said the resolution formally holds responsible the participant that accepts an infringement notice or records a flag based on a well-founded fraud suspicion, including any eventual cancellation. Agência Brasil described the changes as an expansion of Pix functionality, a security upgrade, and an improvement to the rules governing institutional participation.

How does the fraud-suspicion flag work?

The flag can apply to CPF and CNPJ numbers linked to fraud suspicions, and it is recorded in the DICT for five years, according to legal analysis by GSGA. That same analysis said the user can request cancellation of the flag, and the institution must resolve that request within seven days.

TI Inside added that institutions must inform the user that the flag exists, disclose the date it was recorded, and provide channels for clarification and review requests. The same coverage said the maximum response time for those requests is seven days. It also said the obligation to notify users about the fraud-suspicion flag takes effect on Feb. 1, 2027.

What changes for flagged transactions?

Pix participants are subject to additional security obligations and to protection and challenge mechanisms for transactions flagged for suspected fraud. According to CNN Brasil, the goal is for the system to be able to reject transactions linked to active fraud notices while still offering a formal path for review and clarification.

Poder360 said the resolution also affects the fraud prevention and mitigation framework, while TI Inside noted that responsibility extends to the participant that accepts an infringement notice or records a justified flag. The combined rules are meant to give alert handling concrete operational effects across the Pix ecosystem.

What changed for cryptoasset rules?

CNN Brasil reported that new central bank resolutions on virtual assets establish specific reports to Coaf for transfers to or from self-custody wallets worth at least the equivalent of US$10,000. The outlet added that the resolutions would take effect on Oct. 1, 2026.

In the same vein, the change expands the reporting scope required from institutions in virtual asset transactions and adds an explicit threshold for movements tied to self-custody wallets. The regulatory package appeared on Brazil’s central bank agenda alongside the Pix reforms and its anti-fraud controls.