In light of organized crime's involvement in the recent attacks on financial and payment institutions, the Central Bank announced today (09/05/2025) a package of measures, effective immediately, to strengthen security in the National Financial System.
𝗪𝗵𝗮𝘁 𝗰𝗵𝗮𝗻𝗴𝗲𝘀 𝗣𝗲𝗿-𝘁𝗿𝗮𝗻𝘀𝗮𝗰𝘁𝗶𝗼𝗻 𝗰𝗮𝗽: a cap of R$ 15,000 per transaction (Pix and TED) for unauthorized payment institutions and for those connected to the National Financial System through a PSTI (IT service provider). 𝗧𝗵𝗲 𝗰𝗮𝗽 𝗱𝗼𝗲𝘀 𝗻𝗼𝘁 𝗮𝗽𝗽𝗹𝘆 𝘁𝗼 𝗮𝘂𝘁𝗵𝗼𝗿𝗶𝘇𝗲𝗱 𝗶𝗻𝘀𝘁𝗶𝘁𝘂𝘁𝗶𝗼𝗻𝘀 𝘁𝗵𝗮𝘁 𝗰𝗼𝗻𝗻𝗲𝗰𝘁 𝗱𝗶𝗿𝗲𝗰𝘁𝗹𝘆. The limit may be lifted once the participant and its PSTI comply with the new security processes; there is a temporary waiver of up to 90 days for those that certify the adoption of information security controls.
𝗠𝗮𝗻𝗱𝗮𝘁𝗼𝗿𝘆 𝗽𝗿𝗶𝗼𝗿 𝗮𝘂𝘁𝗵𝗼𝗿𝗶𝘇𝗮𝘁𝗶𝗼𝗻: no payment institution may begin operations without Central Bank authorization. In addition, the final deadline for currently unauthorized payment institutions to apply for authorization has been brought forward from December 2029 to May 2026.
𝗣𝗜𝗫 – 𝘁𝗲𝗰𝗵𝗻𝗶𝗰𝗮𝗹 𝘀𝗽𝗼𝗻𝘀𝗼𝗿: only members of segments S1, S2, S3 or S4 (other than cooperatives) may act as "Pix sponsors" for unauthorized payment institutions. Existing contracts must be adjusted within 180 days.
𝗜𝗻𝗱𝗲𝗽𝗲𝗻𝗱𝗲𝗻𝘁 𝗰𝗲𝗿𝘁𝗶𝗳𝗶𝗰𝗮𝘁𝗶𝗼𝗻: the Central Bank may require a technical certification/assessment issued by a qualified firm and order a payment institution whose authorization application is denied to wind up its activities within 30 days.
𝗣𝗦𝗧𝗜𝘀: strengthened governance and risk management and a new minimum capital of R$ 15 million for accreditation; non-compliance may lead to precautionary measures or loss of accreditation. Effective immediately, with 4 months for PSTIs in operation to comply.
𝗖𝗿𝗶𝘁𝗶𝗰𝗮𝗹 𝗱𝗲𝗮𝗱𝗹𝗶𝗻𝗲𝘀 𝐈𝐦𝐦𝐞𝐝𝐢𝐚𝐭𝐞: R$ 15,000 per-transaction cap (Pix and TED) for unauthorized payment institutions and those connected through a PSTI; Central Bank powers to require certification; minimum capital requirement for PSTIs begins. 𝟗𝟎 𝐝𝐚𝐲𝐬: temporary waiver of the cap for those certifying security controls. 𝟏𝟐𝟎 𝐝𝐚𝐲𝐬: operating PSTIs must comply. 𝟏𝟖𝟎 𝐝𝐚𝐲𝐬: contractual adjustments in arrangements where the Pix sponsor serves an unauthorized payment institution. 𝐌𝐚𝐲 𝟐𝟎𝟐𝟔: final deadline for currently unauthorized payment institutions to file for authorization (brought forward from December 2029)
The rule has not yet been formally published. We will keep monitoring and share updates as soon as there is official news.
Authors: Roberto Panucci and Tiago Severo Gomes
