On September 5, 2025, the Central Bank of Brazil ("BCB") published a set of rules to strengthen the security of the Brazilian National Financial System (Sistema Financeiro Nacional – "SFN") and the payments ecosystem, in response to recent attacks attributed to organized crime.
The measures seek to raise governance standards and restrict transactions by payment institutions ("PI") not subject to BCB supervision, as well as to accelerate the timelines for obtaining operating authorizations for such institutions. In addition, the Autarquia established more robust requirements for the operation of Information Technology Service Providers (Prestadores de Serviços de Tecnologia da Informação – "PSTI"), through which many unregulated PIs access the payment system.
The set of rules comprises BCB Resolutions Nos. 494, 495, 496, 497, and 498, all dated September 5, 2025.
Set forth below are the main amendments introduced.
1) Payment Institutions: Prior Authorization and Mandatory Regularization Window (amendments to BCB Resolution No. 80, of March 25, 2021, introduced by BCB Resolution No. 494)
(i) Prior authorization is now required for PIs providing any type of payment service. Previously, the requirement applied only to electronic money issuers and payment transaction initiators, it being noted that, in the former case, there was a schedule for obtaining authorization for PIs that commenced activities before March 1, 2021. For the activities of postpaid payment instrument issuers and credentiators, the obtaining of an operating authorization was subject to the attainment of certain financial transaction volumes.
(ii) Electronic money issuers operating before March 1, 2021, as well as postpaid payment instrument issuers and credentiators operating before September 5, 2025, must apply for an operating authorization during the period between May 1, 2026 and May 31, 2026.
(iii) PIs that fail to comply with the authorization application deadline or that file the application in an inadequate manner will be prohibited from operating after 30 (thirty) days from May 31, 2026 or from the date of BCB notification, respectively.
(iv) The new rules took effect on September 5, 2025.
2) Authorization Processes, Registered Office, and Compulsory Cessation of Activities (amendments to BCB Resolution No. 81, of March 25, 2021, introduced by BCB Resolution No. 495):
(i) It is now a requirement for obtaining an operating authorization that the PI be domiciled at an address for its effective and exclusive use, with the indication of a coworking space, virtual office, or other shared space being prohibited (except for institutions belonging to the same conglomerate).
(ii) The new requirement also applies to PIs already authorized to operate as of September 5, 2025.
(iii) In the event of denial or filing of the operating authorization application against which no further appeal is available, a PI already providing payment services must, within 30 (thirty) days of receipt of BCB notification, cease payment services, notify users of the cessation of activities, and return any existing balances.
(iv) The new rules took effect on September 5, 2025 and also apply to authorization applications filed prior to that date.
3) Pix: Transaction Limits and Governance (amendments to BCB Resolution No. 1, of August 12, 2020, introduced by BCB Resolution No. 496):
(i) The deadline for unregulated PIs participating in Pix or in the process of joining (that do not fall within items I and II of §9 of art. 3 of BCB Resolution No. 1) to apply for an operating authorization was reduced from December 31, 2026 to May 1, 2026.
(ii) As a general rule, Pix transactions carried out by the PIs referred to in the item above, as well as by Pix participants that connect to the Brazilian National Financial System Network (Rede do Sistema Financeiro Nacional – "RSFN") through a PSTI, are subject to a maximum limit of R$ 15,000.00 (fifteen thousand reais).
(iii) The limit described above ceases to apply when the Pix participant (a) accesses the RSFN through a PSTI that has completed the BCB credentialing process and (b) demonstrates, through a report prepared by an independent auditor, compliance with certain requirements, such as the non-sharing of private keys with the PSTI.
(iv) In addition to being a transactional account provider or special settlement participant, the Pix participant responsible for the operation of an unregulated PI must comply with the following new requirements: (a) hold direct participation in the Brazilian Instant Payment System (Sistema de Pagamentos Instantâneos – SPI); (b) belong to segments S1 through S4 (S5 is excluded), which may include Type 2 PIs and other institutions referred to in BCB Resolution No. 436, of November 28, 2024; and (c) not be a service confederation or credit cooperative.
(iv) The amendments described in items 3(i) through 3(iii) above took effect on September 5, 2025, while those described in item 3(iv) will take effect on March 4, 2026.
4) TED Wire Transfers: Transaction Limits (amendments to BCB Resolution No. 256, of November 1, 2022, introduced by BCB Resolution No. 497)
(i) In a manner analogous to the restrictions imposed in the context of Pix (see item 3 above), a maximum limit of R$ 15,000.00 was established, as a general rule, for TED wire transfers in favor of clients issued by institutions that connect to the RSFN through a PSTI.
(ii) The limit described above ceases to apply when the institution (a) accesses the RSFN through a PSTI that has completed the BCB credentialing process and (b) demonstrates, through a report prepared by an independent auditor, compliance with certain requirements, such as the non-sharing of private keys with the PSTI.
(iii) The new rules took effect on September 5, 2025.
5) PSTIs: Credentialing, Governance, and Precautionary Measures (BCB Resolution No. 498)
(i) BCB Resolution No. 498 now governs the requirements, procedures, and conditions applicable to the credentialing of PSTIs for the provision of data processing services for the purpose of accessing the RSFN.
(ii) Credentialing is mandatory for PSTIs with access to the RSFN.
(iii) Essential requirements were established (art. 3), including: (a) minimum paid-in share capital and net equity of R$ 15,000,000.00 (fifteen million reais), with the BCB having authority to require higher amounts on a case-by-case basis; (b) appointment of directors responsible for information security/cybersecurity, risk and compliance, and operational crises; (c) implementation of governance, risk management, cybersecurity, internal controls, internal audit, professional liability insurance, and operational risk policies and structures; (d) annual external audit; and (e) information security certification/assurance and a business continuity plan with testing.
(iv) Annual demonstration to the BCB of continued compliance with the essential requirements.
(v) Imposition of requirements for individual controlling shareholders, in a manner similar to what is already required for other BCB-authorized institutions, including unblemished reputation and technical qualification or compatible professional experience.
(vi) Prohibition on certain institutions from being credentialed as PSTIs (art. 6), including financial institutions and other BCB-supervised institutions, except where the institution acts as a PSTI exclusively to serve institutions within the same financial conglomerate (subject to operational segregation).
(vii) Establishment of a minimum governance structure (art. 11), comprising, among other elements: (a) segregation of functions between organizational components; (b) the existence of a collegiate management body with independent members, if the size of the PSTI so warrants; and (c) public disclosure of corporate structure and ultimate beneficial owners (and other corporate transparency measures).
(viii) The new rules took effect on September 5, 2025.
Our team continues to monitor the implementation of these measures and remains available to assess specific impacts on operations and business models.
For further information, please contact the Financial and Capital Markets team at FreitasLeite Advogados.
