Banking & Financial Services Bulletin: Third Quarter 2025 Updates

Expansion of the scope of action of SCFIs

Published on July 24, 2025, by the Central Bank of Brazil (Banco Central do Brasil – BCB), CMN Resolution No. 5,237 consolidates rules applicable to credit, financing, and investment companies (Sociedades de Crédito, Financiamento e Investimento – SCFIs). It establishes that they must be incorporated as corporations and hold a minimum share capital and net worth of BRL 7 million unless headquartered outside São Paulo and Rio de Janeiro. Additionally, the resolution expands the scope of SCFI activities, permitting operations typical of credit fintechs and payment institutions, as well as allowing them to act as fiduciary agents. Regarding funding sources, SCFIs are now also permitted to use their own capital and raise funds via financial instruments such as certificates of deposit, credit bills, and structured notes.

Pix: Improvements to the Special Refund Mechanism

Published on August 28, 2025, BCB Resolution No. 493 has introduced security-related improvements to Pix regulations, particularly regarding the Special Refund Mechanism (Mecanismo Especial de Devolução – MED).

The procedure for refunding Pix transaction amounts in cases of suspected fraud has been improved within the MED, requiring funds to be immediately blocked in the recipient’s account upon receipt of an infraction notice. Another significant development concerns the introduction of a ‘fund recovery’ feature, which will allow for tracking, blocking, and refunding funds improperly transferred via Pix. This feature will be optional for Pix participants as of November 23, 2025, and will become mandatory as of February 2, 2026.

BCB Normative Instruction No. 653 has also been published to amend Normative Instruction No. 32, which governs the submission of information by Pix participants. The new requirements include reporting transactions, refunds, and cases of precautionary blocking in detail – covering data on quantity, value, the purpose, and the time between the user submitting a complaint and the opening of infraction notifications or recovery processes.

Improvements to the National Financial System and the Brazilian Payments System Security Measures

Payment institution accreditation schedule brought forward

According to BCB Resolution No. 494, dated September 5, 2025, all payment institutions must be accredited by the BCB prior to operating, regardless of the volume of transactions they carry out.

The resolution establishes that electronic money issuers that began operating before March 1, 2021, and postpaid payment instrument issuers and acquirers who have yet to receive authorization and whose operations began before September 5, 2025, must apply for a license between May 1 and May 31, 2026.

Changes to the accreditation process for payment institutions

BCB Resolution No. 495, also dated September 5, 2025, stipulates that existing institutions must cease operations within 30 days of being notified in the event their accreditation request is denied or definitively archived.

Additionally, the regulation now prohibits payment institutions (including those already accredited) from using coworking spaces, virtual offices, or shared spaces as headquarters, except when used by entities belonging to the same conglomerate.

Greater security measures in the Pix system

Published on September 5, 2025, BCB Resolution No. 496 has amended certain aspects of Pix regulations:

• Unauthorized payment institutions that participate in the Pix system must apply for accreditation between January 1, 2026, and May 1, 2026 (deadline brought forward from December 31, 2026);
• Only transactional account providers or special liquidators, direct SPI participants, and members of segments S1 to S4 (except trade associations or credit cooperatives) may act as responsible Pix participants; and
• A BRL 15,000 limit per Pix transaction has been established for unauthorized payment institutions and participants accessing the National Financial System Network (Rede do Sistema Financeiro Nacional – RSFN) via an unaccredited Information Technology Service Provider (Prestador de Serviços de Tecnologia da Informação – PSTI).

PSTIs: accreditation, governance, and compliance deadlines

Published on September 5, BCB Resolution No. 498 has created an accreditation framework for Information Technology Service Providers (PSTIs), institutions that process data to allow access to the RSFN. Key requirements include:

• Proof that the PTSI has the technical and operational capacity to provide services, and compliance with RSFN rules and environment segregation;
• An adequate governance and risk management structure;
• Minimum share capital and net worth of BRL 15 million;
• Information security certification or assurance, annual external auditing, and a business continuity plan; and
• PSTIs are prohibited from accessing private keys used for signing messages of arrangements/systems provided by the BCB.

BCB Normative Instruction No. 664, dated September 11, has established a timeline for implementing the most critical controls related to PSTI accreditation under Resolution No. 498: 15 days for essential security policy items; 30 days for the remaining security policy and fraud management policy; and an additional 15 days to submit a reasonable assurance report by an independent auditor registered with Brazil’s Securities and Exchange Commission (Comissão de Valores Mobiliários – CVM).

New fraud prevention requirements in payments

BCB Resolution No. 501, dated September 11, 2025, has amended Resolution No. 142/2021 to require all regulated institutions to reject payment transactions destined for accounts under reasonable suspicion of fraud involvement (deposit and prepaid payment accounts), regardless of the instrument used (Pix, TED, DOC, bank slip, cards, etc.). The institution receiving the funds must notify the account holder of the measure. This resolution took effect on the publication date, while the deadline for implementing adjustments was October 13, 2025.

Transaction limit exemption process (TED and Pix)

On September 22, 2025, the BCB published Normative Instruction No. 666 and Normative Instruction No. 667 detailing the process for requesting a temporary exemption (up to 90 days) from the BRL 15,000 maximum transaction limit for TED and Pix. The requesting institution must maintain, as collateral, a capital surplus equivalent to at least 100% of the daily transfer volume from its PI Account (Pix transactions) or its Reserve or Settlement Account (TED transactions).

In order for institutions connecting to RSFN via unaccredited PSTIs to request an exemption, they must ensure compliance with various security control measures related to certificates and private keys, access controls, fraud management, and network protection, among other measures.

Amended Rules on Transaction Value Limits via Pix

Published on September 29, 2025, BCB Normative Instruction No. 669 has amended Normative Instruction No. 512/2024 and established new provisions regarding value limits for each Pix transaction. As a result, Pix participants are no longer required to use the value limits set for TED when defining Pix limits. In practice, the nighttime transaction limit is now up to BRL 1,000 per transaction for individuals (unless expressly requested otherwise), whereas for legal entities, the limit must be set on a daily basis.

Furthermore, institutions must establish value limits based on the user’s risk profile and behavior. This must consider the user’s financial transaction history, the length of their relationship with the institution, usage patterns and digital behavior, the authentication level for transaction authorization, and whether the recipient is pre-registered or subject to specific limits.

New Obligations and Penalties for Pix Participants

On September 26, 2025, BCB published Resolution No. 506 to amend Resolution No. 1/2020 and set new obligations and penalties for Pix participants. The main changes and impacts provided for in the resolution are outlined below:

• Mandatory registration in BC Correio: Participants must keep their registration in the BCB Electronic Mail System (Sistema de Correio Eletrônico do Banco Central do Brasil – BC Correio) up to date.
• Loss of participant status: Permanent exclusion as a penalty entails revocation of the right to use the Pix brand.
• Fraud assessment: Suspicion or reasonable suspicion of fraud must consider the minimum criteria defined by BCB in a specific document (yet to be published).
• Infraction notification: In the case of non-compliance, the BCB may issue a notification requiring corrective measures, along with an implementation schedule to prevent recurrence.
• Daily fines for non-compliance: Failure to comply with notification requirements may result in daily fines of BRL 10,000, adjusted by a weighting factor based on the institution’s total assets.

For more details on each of the new Pix security measures, please read this article.

Central Bank Announces Public Consultations on eFX Services and Settlement Cycles in Payment Arrangements

Public Consultation No. 124/2025

On September 19, Public Consultation No. 124 was published with a draft regulation aiming to improve the regulation of international payment and transfer services (eFX). The main provisions include restricting eFX services to regulated institutions only, establishing transitional rules for unauthorized entities, strengthening operational transparency and reporting requirements, expanding the scope and permitted operational procedures, as well as maintaining records and compliance.

Public Consultation No. 125/2025

On October 1, the BCB announced Public Consultation No. 125 to gather input on the cost-benefit and impact assessment of reducing settlement cycles in net deferred settlement systems within the Brazilian Payment System. The initiative analyzes shortening current settlement periods, considering a transition from D+2 to D+1 for equity transactions, or to D+1 in specific segments.

Pix Updates and Trends

At the Pix Forum held on October 2, 2025, the BCB discussed improvements and updated the 2025 and 2026 timeline for new Pix functions in light of the fraud prevention measures. Highlights included:

• The introduction of Hybrid Billing, integrating bank slips and Pix QR Codes;
• The launch of Pix Installment regulations in October;
• The use of Pix as collateral, offline tap payment functions for Pix, and Pix for trade bills being postponed to 2026, along with regulations for intermediaries;
• Improved penalties, governance mechanisms and dashboards, including the Transactional Account Identifier Directory (Diretório de Identificadores de Contas Transacionais – DICT) improvements for fraud identification, as well as studies on automatic alerts for institutions outside acceptable parameters.

For more information on these topics, please contact Mattos Filho’s Banking & Financial Services practice area.