This week, Brazil’s central bank announced new regulations to enhance the country’s National Financial System, aimed at combating organised crime.
Changes concern PIX, Brazil’s instant payments platform, and increase the compliance burden on financial institutions.
Noteworthy, the rule excludes institutions with a minimum net worth of less than R$5 million.
The move is part of a bigger plan that the Central Bank has quietly been implementing since early this month to address the vulnerabilities used by criminal groups against banks and payment companies.
Automatic PIX is now mandatory
A new norm, which had been announced by the Central Bank and the National Monetary Council, allows the usage of Automatic PIX for transactions aimed at financial institutions that are not licensed by the monetary authority.
Automatic PIX is used for automated businesses, and the recent rules make it compulsory to avoid these transactions being exploited.
The regulation also provides an additional level of control over the processing of recurring digital transfers by ensuring that unauthorised entities cannot exploit existing gaps in the payments ecosystem.
A broader package of reforms
Earlier in September, the Central Bank announced a comprehensive reform package aimed at closing financial sector flaws.
The reforms aim to strengthen monitoring and guarantee that payment institutions follow stricter criteria aimed at reducing fraud risk.
The new rules are set to take effect on October 13, 2025. Institutions will have until January 1, 2026, to alter their existing contracts, debt authorisations, and compliance protocols to comply with the new requirements.
Key measures introduced
The measures outlined by the Central Bank cover several aspects of PIX operations:
• Net worth requirement: Institutions with less than R$5 million in net worth will be excluded from the system.
• Re-entry timeline: The period for sanctioned participants excluded from PIX to apply for re-entry has been extended from 12 to 60 months.
• Transaction limits: Institutions will be allowed to set transaction value limits based solely on customer risk profiles and behavioural patterns.
• Legal entity precautionary block: A safeguard previously applied only to individual users will now extend to legal entities, broadening the scope of precautionary blocks.
• Fraud notification measures: Institutions that issue or accept fraud notifications must restrict the initiation and receipt of PIX transactions, and they must reject requests for registration, portability, or ownership claims of PIX keys linked to flagged accounts.
Strengthening safeguards against organised crime
The Central Bank’s move mirrors rising fears that organised crime is seeking to penetrate Brazil’s financial system.
Crypto payment service, PIX, was launched as a fast, cheap solution, but it quickly became popular for crime because of these very same features.
The banking regulators are raising barriers to entry, and allowing more room for institutions to owners to ensure the transaction risk, which in turn should contribute to more resilience in the system.
And its new rules governing fraud notifications and claims to key ownership are meant to put an end to the pathways they open for bad actors using hacked accounts to facilitate illegal transactions.
Implementation and transitional period
The compliance timeframe allows institutions just under three months to alter their systems and practices before full enforcement begins in early 2026.
This transitory time will allow businesses to adapt to the new regulations while also assuring continuity for current clients.
The deadline highlights the Central Bank’s simultaneous priority on increasing security while minimising disruption to lawful financial transactions.
Institutions will be required to alter not only technical systems, but also risk assessment procedures and consumer transaction monitoring.
A Reinforced financial ecosystem
When combined, the policies indicate a shift toward a more strictly regulated payments environment in Brazil.
The Central Bank and the National Monetary Council are working to boost confidence in the financial system by tightening eligibility rules, establishing security processes, and improving fraud prevention technologies.
The combination of tougher capital requirements, increased penalties for noncompliance, and focused fraud protection measures demonstrates a holistic plan for securing PIX operations.
Institutions that fail to comply risk being removed from the system by January 2026, demonstrating the regulator’s willingness to plug vulnerabilities exploited by criminal networks.
The post Brazil’s central bank tightens PIX rules to combat financial crime appeared first on Invezz