Fintechs | 5 New Brazilian Central Bank Rules That Will Impact the Operation of ‘Payment Institutions’ (IPs) in Brazil

Fintechs operating in Brazil as Payment Institutions (IPs) will see their operations significantly impacted by the new regulations of the Brazilian Central Bank (Bacen), published on September 5th.

The objective of Resolutions No. 494, 495, 496, 497, and 498 is to strengthen the security of the National Financial System (SFN), in which IPs have become a fundamental role in innovation and cost reduction, although they are also being used as a means to facilitate illicit transactions, as reported in recent cases.

Below are five points to note about the new Bacen rules related to IPs:

1. Transfer limits (TED and PIX): For unauthorized IPs and any financial institutions that connect to the financial system through Information Technology Service Providers (known as PSTIs) transfers via TED and PIX are limited to BRL15,000.00.

This limit may be removed once the PSTIs is accredited by Bacen and an independent audit report is submitted demonstrating robust controls (use of unique private keys, integrity validation, and distinct certificates), as required by the regulation.

The measure takes effect immediately, but Bacen may grant a waiver of up to 90 days upon request.

2. Prior authorization for new IPs and advance authorization deadline for existing IPs: From now on, no payment institution may begin operations without prior authorization from Bacen.

Bacen has moved the deadline for authorization requests for operating IPs from December 2029 to May 2026, ending the escalation mechanism based on transaction volume. IPs that do not submit their requests within the deadline must cease operations within 30 days.

3. Additional authorization requirements: It is now mandatory to indicate the IP’s headquarters address, for effective and exclusive use. Indicating coworking spaces, virtual offices, or shared spaces is prohibited (except for institutions within the same conglomerate).

To demonstrate compliance with the authorization requirements set forth in the regulation, the Central Bank of Brazil may require technical certification or an assessment issued by a qualified independent company.

The new rules also apply to requests filed before publication and come into effect immediately, so authorized IPs must comply.

4. Additional PIX Controls: PIX participants or those in the process of joining must request authorization to operate between January 1 and May 1, 2026.

Furthermore, only members of segments S1, S2, S3, or S4 (except cooperatives) may act as responsible PIX participants for unauthorized PIX participants. Current contracts must be updated within 180 days.

5. Accreditation and Minimum Capital for PSTIs: Bacen established the requirements, procedures, and conditions for the accreditation of PSTIs, entities that provide data processing services to PIX participants and other supervised institutions, for access to the National Financial System Network.

The requirements include (i) proof of share capital of at least BRL15,000,000.00; (ii) designation of director(s) responsible for information security, cybersecurity, risk management and compliance, and operational crisis management; (iii) proof of corporate governance and risk management, as described in the standard; and (iv) proof of contracting an external auditor for information security and, where applicable, for preventing money laundering and terrorist financing.

Accreditation requests must be submitted within four months of the publication date of the new standard, and the PSTI must demonstrate annually that it continues to meet the requirements established by Bacen, under penalty of de-accreditation.

It will be the responsibility of contracting institutions to ensure that contracts entered into with the PSTI address the obligations established in BCB Resolution No. 498/2025.

Given these significant changes, IPs in the process of authorization or already in operation must carefully analyze and comply with these new Bacen regulations to avoid being forced to cease operations.