Brazil tightens Pix rules, fines TikTok

Brazil’s Central Bank has published new Pix rules that will take effect on March 1, 2027. The package adds stricter cybersecurity requirements for financial institutions, changes to the Special Return Mechanism, and new restrictions on payment receipts. At the same time, the ANPD formalized a R$153.7 million fine against ByteDance over data protection failures involving children and teenagers on TikTok.

What changes in Pix starting in March 2027?

Instrução Normativa BCB nº 774 releases version 7.4 of the Minimum Requirements for the Pix User Experience and sets its effective date for March 1, 2027, with a compliance deadline up to that date to review processes, update interfaces, and adjust compliance. The rule revokes Instrução Normativa BCB nº 689, dated December 11, 2025.

Beyond setting the rollout, the Central Bank also tightened cybersecurity requirements for financial institutions, with an emphasis on secure system integration, access controls, penetration testing, credential monitoring, and specific rules for services provided by third parties, according to coverage by Valor Econômico.

What happens with receipts and the MED?

Version 7.4 prohibits advertising, commercial offers, and hyperlinks on payment receipts, and that requirement will also apply from March 1, 2027. Coverage from Atlas Público says the package also adds security alerts for favorite contacts and a new flow for attaching documents and describing the case when using the Special Return Mechanism.

At the same time, Instrução Normativa BCB nº 766 extended the deadline for a recipient to respond to a MED-initiated refund from 30 to 80 days. Apogeu.tech detailed that the clock starts on the date of the refund, meaning the actual debit from the account, and that the response must be made to the institution where the funds were received, with evidence such as an invoice, delivery receipt, and buyer data.

What did the Central Bank say about other risks?

Coverage from Jornal de Brasília indicated that the Central Bank also stepped up monitoring of artificial intelligence use by financial institutions and mapped associated risks. That move was aligned with the regulatory package aimed at organizing interfaces, operational security, and internal controls across the financial ecosystem.

How did the TikTok sanction move forward?

The ANPD published its sanctioning decision against ByteDance in the Diário Oficial da União and imposed a R$153.7 million fine for a set of repeated failures to protect minors’ data, both in registered accounts and in experiences that do not require registration. International coverage added that the case involved five specific LGPD violations.

People of Internet said one of those violations involved the use of data in the feed accessible without registration, which helps redefine the scope of what counts as personal data processing under Brazilian law. Neoteo added that the decision requires a review of default privacy settings for users under 16 and stronger technical and design safeguards.

O Globo added that, after the fine, the Federal Public Prosecutor’s Office issued an additional recommendation to the platform after detecting mercury ads aimed at garimpeiros in Brazil, and noted that the ANPD decision was published on August 25. La República Online framed the case as one of the largest penalties applied so far under the LGPD.