In light of the involvement of organized crime in the recent attacks on financial and payment institutions, the Central Bank announced today (09/05/2025) a package of measures, effective immediately, to strengthen security in the National Financial System.
What changes
- Per-Transaction Cap: A cap of R$ 15,000 per transaction (Pix and TED) for unauthorized payment institutions and for those that connect to the SFN through a PSTI. The cap does not apply to authorized institutions that connect directly to the SFN. The limit may be lifted once the participant and its PSTI comply with the new security processes; a temporary exemption of up to 90 days is available to those who attest to the adoption of information security controls.
- Mandatory prior authorization: no payment institution may begin operations without authorization from the Central Bank. In addition, the final deadline for currently unauthorized payment institutions to apply for authorization has been moved up from December 2029 to May 2026.
- PIX, technical representative: only members of segments S1, S2, S3 or S4 (excluding cooperatives) may act as "Pix representatives" for unauthorized payment institutions. Existing contracts must be adjusted within 180 days.
- Independent certification: the Central Bank may require technical certification or an assessment issued by a qualified firm and may order a payment institution whose authorization request is denied to cease its activities within 30 days.
- PSTI: strengthened governance and risk management and a new minimum capital requirement of R$ 15 million for accreditation; noncompliance may result in precautionary measures or revocation of accreditation. Effective immediately, with 4 months for PSTIs already in operation to come into compliance.
Critical Deadlines
- Immediate: cap of R$ 15,000 per transaction (Pix and TED) for unauthorized payment institutions and for those that connect to the SFN through a PSTI; Central Bank powers to require certification; start of the minimum capital requirement for PSTIs.
- 90 days: temporary exemption from the cap for those who attest to security controls.
- 120 days: PSTIs in operation must come into compliance.
- 180 days: contractual adjustments in arrangements where the Pix representative serves an unauthorized payment institution.
- May 2026: final deadline for currently unauthorized payment institutions to file an authorization request (moved up from December 2029)
The rule has not yet been formally published. We will continue to monitor it and will report any developments as soon as there is an official update.
