BRschema world-payments-v1trajectory: not recorded
Last updated · 14 modules · 62 sourced
findings · 94 sources in the cumulative register
14Modulesbaseline.modules[]
62Findingsmodules[].findings[]
19Tier-1 sourcesrun_metadata.t1_source_count
Confidence mix(sums to 14 rendered modules; click to filter)
Jurisdiction brief
Lead Signal
Brazil's payments regime now concentrates systemic and policy leverage in a single regulator to an unusual degree. The Banco Central do Brasil directly owns and operates the dominant domestic rail, Pix, which has settled 24/7 via the BCB-operated SPI and DICT alias directory since 16 November 2020, coexisting with legacy TED, DOC and boleto instruments. The same central bank sets scheme economics directly — debit interchange is capped at a single 0.5% rate from 2023, and a 0.7% prepaid interchange cap took effect in April 2024 with settlement harmonised to the two-day debit cycle. It also operates settlement finality through the STR Reserves Transfer System, an RTGS providing irrevocable, unconditional real-time finality underpinned by Law 10.214/2001. The cumulative effect is a market in which licensing, scheme pricing and settlement all run through one institution, leaving operators with comparatively little structural distance from policy.
The most consequential single event shaping this environment is the late-June 2025 C&M Software breach. Attackers using bribed-employee credentials injected fraudulent Pix orders, draining roughly R$800m (about US$140m) from the reserve accounts of at least six institutions, with follow-on hits to Sinqia (~R$400m) and Monbank (~R$4.9m). The incident exposed systemic risk in payment-system technical infrastructure providers and directly triggered Brazil's 2025-26 cybersecurity rule package. Third-party supply-chain exposure is now the leading payments-resilience threat vector in the jurisdiction, layered onto an existing regime in which CMN Resolution 4.893/2021 and BCB Resolution 85/2021 already establish that regulatory responsibility for outsourced and cloud activity is non-transferable.
Other Developments
The market-access bar for non-bank payment institutions has materially risen. BCB Resolution 494/2025, effective 5 September 2025, eliminated the transaction-volume thresholds that previously gated authorisation (formerly R$300m in transactions or R$30m in held funds under Resolution 257/2022). All payment-institution modalities now require authorisation, with a unified regularisation window of 1 to 31 May 2026. This ends the prior unauthorised-operating runway for sub-threshold fintechs operating under Law 12.865/2012 and BCB Resolution 80/2021. Capital requirements were separately recalibrated by Joint Rule No. 14/2025, dated 3 November 2025, which ties minimum capital and net-worth to categories of operational activity reported to the BCB.
Brazil's posture toward crypto in payments has become distinctly restrictive. The VASP framework — Law 14.478/2022 plus BCB Resolutions 519, 520 and 521 of 10 November 2025 — entered into force on 2 February 2026, with a 270-day transition running to 30 October 2026 and three licence modalities covering intermediaries, custodians and brokers. Layered onto this, BCB Resolution 561, published 30 April 2026 and effective 1 October 2026, bars eFX providers from using stablecoins, bitcoin or crypto to settle the offshore leg of regulated international payments. The combined effect reroutes crypto-native remittance flows back onto regulated FX-transaction and US correspondent-bank rails.
Consumer fraud-redress continues escalating from reactive to preventive. The Pix Special Return Mechanism (MED), introduced in November 2021, is being extended by MED 2.0 under BCB Resolution 493/2025, which traces and blocks funds across cascading account hops; it became mandatory on 2 February 2026, with a sanctioning grace period to 10 May 2026 under Resolution 546. The push reflects historically low recovery rates — around 9% in 2023.
The commercial cycle has re-accelerated. PicPay raised US$434m in a Nasdaq IPO, listing on 29 January 2026 under ticker PICS — the first major Brazilian fintech US listing since Nubank in 2021. Nubank received conditional OCC approval in January 2026 for a US national bank charter, and Brazilian startups raised US$692m in Q3 2025, up 47% year-on-year per Crunchbase.
Cross-Monitor Connections
The AML/CFT dimension carries significant cross-monitor weight. Brazil's COAF financial intelligence unit, established under Law 9.613/1998 and administratively linked to the BCB, operates alongside BCB Circular 3.978/2020, and the 2023 FATF/GAFILAT mutual evaluation flagged beneficial-ownership access and non-bank supervision gaps. Crypto-Pix laundering vectors and the AML significance of the roughly US$6-8bn-per-month, stablecoin-dominated crypto market warrant original illicit-finance analysis in the Financial Intelligence Monitor; the W11 module here carries the Sentinel feed only and does not re-analyse illicit-finance use.
Outlook
The near-term horizon is dense with in-force-pending deadlines. The PI authorisation regularisation window closes 31 May 2026; the MED 2.0 sanctioning grace expires 10 May 2026; the cybersecurity package adaptation falls due in March 2026; the eFX crypto-settlement ban takes effect 1 October 2026; and the VASP transition ends 30 October 2026, after which BCB-supervised institutions are barred from dealing with unauthorised VASPs. The trajectory across the spine is a tightening regulatory perimeter combined with escalating operational-resilience and fraud risk, set against a recovering commercial environment. Several baseline positions rest on point-in-time or non-primary sourcing — acquiring concentration data dates to 2020Q1, leading-fintech customer figures are Q3 2025, and the Res. 494/2025 thresholds rely on law-firm sources pending T1 BCB confirmation.
trust tier: ai_unverified
Regulatory Status
This cycle establishes a full 13-module WPM baseline for Brazil, a mature and BCB-centric payments jurisdiction. The central bank concentrates systemic and policy leverage to an unusual degree: it directly owns and operates the dominant domestic rail (Pix, live since 16 November 2020 via the BCB-operated SPI), sets scheme economics through interchange caps (a single 0.5% debit cap from 2023 and a 0.7% prepaid cap from April 2024), and operates settlement finality via the STR RTGS under Law 10.214/2001.
The regulatory perimeter is tightening across licensing, crypto and consumer protection. On licensing (W1a), BCB Resolution 494/2025 eliminated transaction-volume authorisation thresholds, requiring all payment-institution modalities to seek authorisation under a unified window of 1-31 May 2026, with capital recalibrated by Joint Rule No. 14/2025. The non-bank PI route under Law 12.865/2012 and BCB Resolution 80/2021 now carries no de-minimis exemption. Conduct and safeguarding (W1b) rest on segregation-based protection under Rule 80/2021, with BaaS regulated by Joint Resolution 16.
On stablecoins and digital money (W2), the VASP framework (Law 14.478/2022 plus BCB Resolutions 519/520/521) entered into force on 2 February 2026, with a transition to 30 October 2026, while BCB Resolution 561 bars crypto settlement on the eFX offshore leg from 1 October 2026 — a restrictive, containment-directed posture. Operational resilience (W3) is governed by a layered regime (CMN 4.893/2021, BCB 85/2021, plus the 2025-26 cybersecurity package) crystallised by the late-June 2025 C&M Software Pix supply-chain breach, which drained roughly R$800m and is the defining resilience event. Consumer protection (W10) is escalating via MED 2.0 cascading-block, mandatory from 2 February 2026 with a sanctioning grace to 10 May 2026.
Market structure (W6) shows fintech-led concentration, with Nubank surpassing Petrobras in October 2025 as Brazil's most valuable company, set against a highly concentrated, bank-controlled acquiring market. Settlement access (W12) turns on the direct-versus-indirect IP-account asymmetry between bank-PSPs and non-bank PIs. The AML/CFT picture (W11), carried via the Sentinel feed, rests on COAF/Law 9.613/1998 and BCB Circular 3.978/2020, with the 2023 FATF/GAFILAT evaluation flagging beneficial-ownership and non-bank supervision gaps. Commercially (W13), the cycle reopened the fintech IPO window via PicPay's US$434m Nasdaq listing and saw Nubank secure conditional OCC charter approval.
The overall jurisdiction risk level is ELEVATED, with operational-resilience and fraud risk escalating while the regulatory perimeter tightens.
Outlook
The near-term horizon is dense with in-force-pending deadlines: the PI authorisation regularisation window closes 31 May 2026; the MED 2.0 sanctioning grace expires 10 May 2026; the cybersecurity package adaptation falls due in March 2026; the eFX crypto-settlement ban takes effect 1 October 2026; and the VASP transition ends 30 October 2026, after which supervised institutions are barred from dealing with unauthorised VASPs. The BR-US corridor is in a rerouting phase under Resolution 561. Several baseline positions carry sourcing caveats — acquiring concentration data is 2020Q1, leading-fintech customer figures are Q3 2025, and the Res. 494/2025 thresholds rest on law-firm sources pending T1 BCB confirmation. This status is AI-unverified pending expert review.
14 of 14 modules
Signal
Density
Selections OR within a group, AND across groups. Press / to search.
Brazil's payments regime is anchored in BCB regulation of the SFN/SPB: Pix governance under Resolution 1/2020 as amended by Resolutions 493/2025 and 506/2025; an activities-based minimum-capital rule for payment institutions phasing in from 1 July 2026; and a completed VASP authorisation regime (Resolutions 519/520/521, effective 2 February 2026).
Movement — NEWVASP authorisation regime completed; new minimum-capital rule introducedFirst-cycle baseline establishment of W1a standing content for Brazil.
Open gap — wpm-int-4Res. 494/2025 authorisation-trigger update relies on T3 law-firm sources only; no T1 BCB primary confirmation of the eliminated thresholds and May 2026 window retrieved, capping confidence at High.Primary-regulatory under-indexing for the most recent (2025) BCB licensing amendments.
Standing sub-brief445 words · last cycle wpm-2026-08-05
Licensing, Authorisation & Market Access
The foundational market-access position in Brazil is set by Law 12.865/2012, which created the 'payment institution' (instituição de pagamento) category, and BCB Resolution 80/2021, which defines the operating modalities: e-money issuer, post-paid issuer, acquirer and payment initiator. Payment institutions are supervised by the BCB and CMN. Limited-scope schemes — private-label, closed-loop and meal/benefit arrangements — remain exempt from BCB authorisation under Circular 3.682/2013. This framework defines the non-bank market-access route for PSPs and fintechs entering Brazil and the coexistence of bank-PSPs with non-bank payment institutions that shapes the competitive landscape.
The material change in this cycle is the consolidation of the authorisation trigger. BCB Resolution 494/2025, effective 5 September 2025, eliminated the transaction-volume thresholds that previously gated authorisation — formerly R$300m in transactions or R$30m in held funds under Resolution 257/2022. All payment-institution modalities now require authorisation, with a unified regularisation window from 1 to 31 May 2026. This removes the de-minimis unauthorised operating window for non-bank PIs and EMIs: every modality must now seek authorisation, materially raising the compliance bar for fintech entrants and for existing unauthorised operators that previously sat below threshold. The position is carried at High confidence pending T1 BCB primary confirmation, as it currently rests on law-firm sourcing.
Prudential calibration was separately updated by Joint Rule No. 14/2025, issued by the BCB and CMN and dated 3 November 2025, which ties minimum capital and net-worth to categories of operational activity reported to the BCB. Authorisation also requires sound governance and disclosure of controllers and qualified shareholdings. Activity-calibrated minimum capital affects both entry cost and the scaling economics for payment institutions across modalities.
The live entry route is illustrated by Boku Inc., which received a BCB payment-institution licence as a payment initiator and e-money issuer in mid-2025, targeting Pix Automático for merchants in early 2026 within the Open Finance ecosystem. This demonstrates the feasibility of foreign-PSP entry as a non-bank PI and the strategic value of Pix Automático merchant rails for new entrants.
The bank-PSP versus non-bank-PI distinction is structurally central here: banks access the system as prudentially supervised credit institutions, while non-bank PIs enter through the Law 12.865/2012 authorisation route, now uniformly required across all modalities following Resolution 494/2025.
Outlook
The PI authorisation regularisation window closes 31 May 2026, the binding near-term deadline for previously sub-threshold operators. The trajectory is established but tightening: the elimination of de-minimis exemptions and activity-calibrated capital both raise the standing compliance bar. A primary-regulatory gap remains — no T1 BCB confirmation of the eliminated thresholds and May 2026 window has been retrieved, capping confidence at High and flagging the most recent 2025 BCB licensing amendments as under-indexed for primary sourcing.
Periodic update · new data 2026-08-11 · run wpm-2026-08-05
Licensing, Authorisation & Market Access
Brazil's payments and digital-asset licensing perimeter tightened materially this cycle. Banco Central do Brasil's Resolution 506, adopted 26 September 2025, revised Pix authorisation criteria for payment institutions, including provisions addressing non-authorised entities. Building on that, a new activities-based minimum-capital rule for payment institutions offering Pix begins phasing in from 1 July 2026, reaching half the required capital amount in January 2027 and the full amount in January 2028, a change that falls specifically on non-bank payment institutions rather than banks. Most significantly, BCB's Resolutions 519, 520 and 521, published 10 November 2025 and effective 2 February 2026, complete a formal authorisation regime for virtual-asset service providers across intermediation, custody and brokerage modalities, with no exemption category, and a two-hundred-seventy-day transition running to 30 October 2026.
Taken together, these three instruments push both non-bank payment institutions and virtual-asset service providers toward capital and authorisation standards that more closely resemble those already applied to banks, formalising market access in both sectors simultaneously rather than sequentially.
Outlook
The clearest near-term markers are the phased capital thresholds, arriving in January 2027 and January 2028, and the 30 October 2026 VASP authorisation deadline, after which unauthorised virtual-asset service providers lose the ability to transact with BCB-supervised entities. Both will test how much of the current non-bank payment and virtual-asset population can meet bank-comparable standards without exiting the market or consolidating.
Brazil's safeguarding regime requires payment institutions to segregate client/end-user funds from proprietary assets and supports traceability and auditability; e-money balances are held in payment accounts with prudential treatment. BCB Rule 80/2021 sets conduct, transparency (institutions must identify themselves as PIs and disclose services), governance and cybersecurity-policy obligations. Joint Resolution No. 16 (CMN/BCB) regulates Banking-as-a-Service, and BCB Resolution 432/2024 set manager compensation policies — collectively tightening conduct accountability.
Standing sub-brief215 words · last cycle wpm-2026-06-23
Conduct, Safeguarding & Financial Promotions
Brazil's conduct and safeguarding regime for payment institutions is built on BCB Rule 80/2021, which mandates segregation of client and end-user funds from proprietary assets, transparency and identification obligations, governance requirements, cybersecurity controls and service-continuity provisions. The safeguarding model is distinctive: rather than a UK/EU-style discrete safeguarding regime, Brazil relies on asset-segregation. PIs must hold e-money balances in payment accounts with prudential treatment and keep client funds strictly segregated to prevent commingling in insolvency, supporting insolvency traceability through consolidated prudential supervision rather than structural ring-fencing.
The conduct perimeter extends to Banking-as-a-Service: Joint Resolution No. 16 (CMN/BCB) regulates BaaS arrangements, defining the conduct and accountability boundary that operators must build to. Manager compensation is addressed by BCB Resolution 432/2024. Together these instruments define the consumer-fund protection model for Brazilian PIs and EMIs.
The bank versus non-bank distinction matters in safeguarding: the segregation obligation binds payment institutions specifically, with e-money balances held in payment accounts under prudential treatment, distinct from the deposit-taking treatment of bank-PSPs.
Outlook
The trajectory is established. The segregation-based safeguarding model is settled, with the BaaS conduct perimeter under Joint Resolution 16 and manager-compensation rules under Resolution 432/2024 forming the standing conduct architecture. This module is assessed rather than confirmed, reflecting the secondary sourcing underpinning the consolidated conduct picture.
No periodic updates recorded against this sub-brief.
Sources and findings (4)
T1BCB Resolutions 80/81/2021 — PI conduct/governance (bcb.gov.br)
E-money is regulated under Law 12.865/2013 as a prepaid payment-account balance, distinct from virtual assets. Brazil implemented a banking-grade virtual-asset/VASP regime via Law 14.478/2022 and BCB Resolutions 519/520/521 of 10 Nov 2025 (in force 2 Feb 2026), with the BCB as supervisor and CVM retaining securities-token jurisdiction. Resolution 521 brought stablecoin and crypto FX operations into the foreign-exchange perimeter; Resolution 561 (Apr 2026) then barred crypto/stablecoin settlement on the offshore leg of regulated eFX. A 270-day transition runs to 30 Oct 2026.
Open gap — wpm-int-1Pix-USDC integration claim (vendor-sourced, April 2026) retracted per challenger f-002: no T1/T2 BCB primary source confirms official BCB Pix-USDC integration, and the claim conflicts with Res. 561's stablecoin-settlement ban. Excluded from structured claims pending primary confirmation.Vendor/launch-hype over-indexing risk: private fintech USDC-Pix on/off-ramp services may be conflated with official BCB policy.
Standing sub-brief331 words · last cycle wpm-2026-08-05
Stablecoins & Digital Money
Brazil's stablecoin and digital-money perimeter has escalated sharply. The VASP framework — Law 14.478/2022 plus BCB Resolutions 519, 520 and 521 of 10 November 2025 — saw its core rules enter into force on 2 February 2026, with a 270-day transition running to 30 October 2026. It establishes three licence modalities (Intermediary, Custodian and Broker), mandates client-asset segregation and monthly proof-of-reserves, and leaves the CVM with jurisdiction over securities tokens. Importantly, e-money is excluded from the virtual-asset definition under Law 12.865, keeping the PI and VASP perimeters distinct. From 30 October 2026, BCB-supervised institutions are barred from dealing with unauthorised VASPs. This framework establishes the licensing perimeter for stablecoin and crypto payment and remittance operators in Brazil's roughly US$6-8bn-per-month crypto market, around 90% of which is stablecoins.
Layered onto the licensing framework is a settlement restriction. BCB Resolution 561, published 30 April 2026 and effective 1 October 2026, bars eFX providers from using stablecoins, bitcoin or crypto to settle the offshore leg of regulated international payments, restricts eFX to BCB-authorised institutions, and requires segregated client-fund accounts plus monthly reporting. It targets firms such as Nomad and Braza Bank that had used stablecoin settlement on the XRP Ledger in Brazil-US flows. The effect is to close the stablecoin cross-border settlement vector for eFX providers, forcing crypto-native remittance operators back onto FX-transaction or non-resident BRL account rails.
The combined posture is restrictive: Brazil licenses VASPs while deliberately containing stablecoin use in cross-border payments. A vendor-sourced claim of an official BCB Pix-USDC integration has been excluded as unverified, conflicting with the Resolution 561 settlement ban and lacking primary confirmation.
Outlook
Two in-force-pending deadlines dominate: the eFX crypto-settlement ban takes effect 1 October 2026, and the VASP transition ends 30 October 2026, after which dealing with unauthorised VASPs is prohibited for supervised institutions. The trajectory is escalating and containment-directed. The retracted Pix-USDC claim flags a vendor/launch-hype over-indexing risk, where private fintech USDC-Pix on/off-ramp services may be conflated with official BCB policy.
Periodic update · new data 2026-08-11 · run wpm-2026-08-05
Stablecoins & Digital Money
Approximately ninety percent of Brazilian crypto-transaction volume is stablecoin-denominated, which makes the new virtual-asset service provider authorisation regime effectively a stablecoin-oversight framework in practice. Under the VASP framework established by BCB Resolutions 519, 520 and 521, issuers and exchanges handling that stablecoin volume face stricter reserve-transparency requirements, bringing stablecoin flows inside the central bank's foreign-exchange and capital-controls supervisory perimeter rather than leaving them to operate outside conventional payments oversight. The transition to full authorisation runs to 30 October 2026, the same deadline that governs the wider VASP regime.
Outlook
Reserve-transparency compliance among stablecoin issuers and exchanges is the practical marker to watch as the 30 October 2026 deadline approaches; given that ninety percent of Brazilian crypto volume already runs through stablecoins, the degree to which issuers can demonstrate compliant reserves will materially shape how much of that volume continues to route through authorised channels versus offshore alternatives.
Sources and findings (5)
T1BCB Resolutions 519/520/521 (SPSAV/VASP, eff. 2 Feb 2026) (bcb.gov.br)
T1BCB Resolutions 519/520/521 (bcb.gov.br)
T1BCB Resolution 521 — virtual-asset FX (bcb.gov.br)
Operational resilience is governed by CMN Resolution 4.893/2021 (financial institutions) and BCB Resolution 85/2021 (payment institutions), effective from 2021, which mandate cybersecurity policies, incident response, business-continuity testing, and rules for contracting data-processing/storage and cloud services in-country or abroad — with the institution retaining full accountability for outsourced activity and the BCB granted audit/access rights. Institutions must report security incidents that constitute a 'crisis situation' to the BCB and retain documentation for at least five years. The June 2025 C&M Software breach exposed third-party (PSTI) supply-chain risk and triggered new cybersecurity rules (Res. 538/2025; CMN 5.274/2025, adaptation to March 2026).
Standing sub-brief229 words · last cycle wpm-2026-06-23
Operational Resilience & Critical Infrastructure
Brazil governs operational resilience through a layered regime rather than a single DORA-style omnibus instrument. CMN Resolution 4.893/2021 applies to financial institutions (effective 1 July 2021) and BCB Resolution 85/2021 to payment institutions, with a 2025-26 cybersecurity package (BCB Resolution 538/2025 and CMN Resolution 5.274/2025) layered on top and an adaptation deadline in March 2026. Outsourcing is permitted, but regulatory responsibility is non-transferable: the institution retains full accountability for outsourced and cloud activity, the BCB holds audit and access rights, crisis-situation incidents must be reported to the BCB, and records kept for at least five years.
The defining event crystallising this regime was the late-June 2025 C&M Software breach. The incident — the largest cyber-heist in Brazilian history — exposed systemic risk in payment-system technical infrastructure providers and directly triggered the 2025-26 cybersecurity rule package, reframing PSTI and Pix-IT-provider supply-chain risk for the whole market. Third-party risk is now the leading payments-resilience threat vector in the jurisdiction.
The regime applies to both bank-PSPs (under CMN 4.893/2021) and non-bank PIs (under BCB 85/2021), with the non-transferable-responsibility principle binding regardless of institution type.
Outlook
The trajectory is escalating post-C&M breach. The binding near-term milestone is the cybersecurity package adaptation deadline in March 2026. The structural direction is toward sharper critical-third-party and PSTI obligations, with the breach having permanently elevated supply-chain exposure as the central resilience concern.
No periodic updates recorded against this sub-brief.
Brazil regulates card-scheme economics directly: since October 2018 the BCB caps debit-card interchange, and in 2023 (effective April 2024) it simplified the debit cap to 0.5% and introduced a 0.7% cap on prepaid-card interchange while harmonising the prepaid settlement cycle (previously up to 28 days) with debit (2 days). Card schemes Visa/Mastercard operate four-party models with acquirers and sub-acquirers; the BCB collects interchange and scheme-fee data quarterly from authorised scheme participants. Pix scheme rules are set and operated by the BCB itself (BCB Resolution 1/2020 and follow-ons).
Standing sub-brief192 words · last cycle wpm-2026-06-23
Scheme & Network Compliance
The BCB exercises direct regulatory control over four-party scheme economics in Brazil. Debit interchange is capped at a single 0.5% rate from 2023 (originally an 0.8% maximum and 0.5% average from 2018), while prepaid interchange carries a 0.7% cap effective April 2024, with prepaid settlement harmonised to the two-day debit cycle, down from up to 28 days previously. Scheme fees are reported quarterly to the BCB. Beyond capping conventional scheme economics, the BCB itself sets and operates the Pix scheme rules under Resolution 1/2020 — an unusual degree of direct regulatory ownership of a national scheme.
These controls materially affect prepaid-heavy fintech economics and acquirer margins. The prepaid settlement harmonisation improved merchant liquidity in a high-base-rate environment by shortening the settlement cycle. The regime applies across both bank-PSPs and non-bank PIs operating as issuers or acquirers within four-party arrangements.
Outlook
The trajectory is established. Interchange caps and settlement harmonisation are settled, with the BCB's direct operation of Pix scheme rules forming the structural anchor. The principal forward tension is the commercial dispute over prepaid-versus-debit interchange classification, tracked under W7, whose outcome bears on prepaid-card economics across the market.
No periodic updates recorded against this sub-brief.
Domestic rails are dominated by Pix (BCB-operated instant payments, launched Nov 2020), alongside legacy TED/DOC and boleto. Cross-border corridors run through the regulated eFX regime (BCB Resolution 561/2026 governs digital international payments and bars crypto on the offshore leg), traditional FX operations, and the FX Clearinghouse, which historically uses US correspondent banks for the USD leg. The BCB is actively exploring Pix internationalisation and interlinking with other instant-payment systems (bilaterally or via multilateral platforms such as Project Nexus) to improve cross-border speed, cost and access per G20 goals.
Movement — NEWPix Automático launched; Apple/CADE NFC dispute nearing settlementNew product/dispute findings this cycle.
Open gap — wpm-int-5Pix cross-border interlinking (Project Nexus, bilateral links) is exploratory; no in-force cross-border Pix corridor confirmed. Emerging-market rail-linkage detail under-developed.Emerging-market cross-border rail linkage (Pix internationalisation) is under-indexed pending concrete corridor announcements.
Standing sub-brief224 words · last cycle wpm-2026-08-05
Payment Corridor Dynamics
Pix is the dominant domestic rail and the strategic core of Brazil's corridor positioning. Created and operated by the BCB, live since 16 November 2020, it settles 24/7 via the BCB-operated SPI and DICT alias directory, coexisting with legacy TED, DOC and boleto instruments. The BCB is exploring Pix internationalisation and interlinking, whether bilaterally or via Project Nexus, though no in-force cross-border Pix corridor has yet been confirmed.
The principal regulated USD corridor infrastructure runs through the FX Clearinghouse, through which over 90% of daily FX trades settle. BRL legs clear via the STR at the BCB, while USD legs settle through designated US correspondent banks over Fedwire. This correspondent-banking access route is the structural choke point into which BCB Resolution 561 reroutes crypto-native remittance flows: by barring crypto settlement on the eFX offshore leg, the regulation forces those flows back onto regulated FX-transaction and US correspondent-bank rails.
The USD-leg correspondent dependency is a bank-PSP feature, tying the W5 corridor analysis to the settlement-access asymmetry covered in W12. Corridor economics are central to any operator's Brazil strategy.
Outlook
The trajectory is established domestically with cross-border exploratory. The BR-US corridor is in a rerouting phase under Resolution 561, effective 1 October 2026. Pix internationalisation remains exploratory and under-indexed pending concrete corridor announcements; no bilateral or Nexus link has been confirmed in force.
Periodic update · new data 2026-08-11 · run wpm-2026-08-05
Payment Corridor Dynamics
Brazil's core instant-payments corridor, Pix, both expanded functionally and faced a significant platform-access dispute this cycle. Pix Automático launched in June 2026 to serve recurring billing use cases, eliminating the card-expiry failures and interchange fees that have historically affected subscription payments processed through card rails. At the same time, Apple has reportedly signalled willingness to negotiate a settlement with Brazil's competition authority, CADE, over its NFC-chip lockout, which has prevented native contactless Pix functionality on iPhones and drawn complaints from Nubank, PicPay and other fintechs seeking equal access to the device's near-field-communication hardware.
Outlook
A negotiated CADE settlement, if confirmed, would be the clearest resolution of the NFC-access dispute and would materially expand contactless Pix availability on Apple devices; terms and timing are not yet confirmed by a primary CADE source. Pix Automático's adoption curve among merchants offering recurring billing is a second corridor-dynamics marker to watch as it displaces card-based subscription rails.
Brazil's payments market is highly concentrated and fintech-led at the consumer edge. The acquiring market is dominated by Cielo, Rede, Getnet and Stone (>83% in 2020Q1), and issuing is similarly concentrated among the top five issuers (~80%). On the consumer side, digital banks/fintechs Nubank, PicPay and Mercado Pago lead by customers; Nubank reported ~110m Brazil customers (127m globally) in Q3 2025 and in October 2025 surpassed Petrobras as Brazil's most valuable company. The market combines incumbent bank-controlled acquirers, listed challengers, and a long tail of PIs and sub-acquirers.
Movement — NEWPicPay IPO; Nubank charter; customer-share shiftsNew commercial-structure findings this cycle.
Open gap — wpm-int-2Acquiring/issuing concentration data is 2020Q1 (Cielo/Rede/Getnet/Stone >83%); no current (2025-26) market-share figures retrieved. Treat concentration claim as point-in-time, likely shifted by sub-acquirer growth.Merchant-acquiring operational data is under-indexed; need current acquirer market-share figures.
Open gap — wpm-int-3Nubank/PicPay customer figures are Q3 2025 (~9 months stale at June 2026 baseline date). More recent Q4 2025/Q1 2026 figures not retrieved despite Nubank's quarterly reporting. Challenger f-005.no under-indexing note recorded
Standing sub-brief223 words · last cycle wpm-2026-08-05
Industry Structure & Commercial Dynamics
The Brazilian acquiring market is highly concentrated. Cielo, Rede, Getnet and Stone together dominated over 83% of acquiring in 2020Q1, the top-five issuers held around 80% of issuing, and Cielo and Redecard historically accounted for over 90% of card acceptance. This reflects bank-controlled acquirer incumbency set against listed challengers and a long tail of payment-institution sub-acquirers. The concentration figures are point-in-time 2020Q1 data and have likely shifted with sub-acquirer growth; current 2025-26 market-share figures have not been retrieved.
The dominant competitive force reshaping the market is Nubank, with roughly 110m Brazil customers (127m globally as of Q3 2025) and a structurally low cost-to-serve of around US$0.80 per customer per month. Nubank surpassed Petrobras in October 2025 to become Brazil's most valuable company, at roughly US$77-85bn. These customer figures are Q3 2025 and should be treated as point-in-time, potentially understating current scale. As a non-bank PI/EMI by origin, Nubank's scale and cost structure are the leading disruption vector against bank-controlled acquirer incumbency.
Outlook
The trajectory is fintech-led concentration. The structural picture is bank-controlled acquiring incumbency under pressure from sub-acquirer growth and from Nubank's scale. Two data gaps temper confidence: acquiring concentration data is stale at 2020Q1, and leading-fintech customer figures are roughly nine months old at the baseline date despite quarterly reporting cadence. Current merchant-acquiring operational data is under-indexed.
Periodic update · new data 2026-08-11 · run wpm-2026-08-05
Industry Structure & Commercial Dynamics
Brazilian fintech reached a capital-markets milestone this cycle. PicPay completed a $434 million Nasdaq initial public offering on 29 January 2026, targeting a $2.46 billion valuation and marking the first major Brazilian fintech listing since Nubank's 2021 debut, reopening a capital-markets access channel for the sector that had been largely dormant since that listing. Separately, Nu Holdings received conditional approval from the US Office of the Comptroller of the Currency in January 2026 for a US national bank charter, while Nubank announced in December 2025 its intent to acquire a Brazilian banking licence during 2026, a dual-track expansion of its regulatory footprint on both sides of its core markets.
Central-bank customer-ranking data spanning the fourth quarter of 2025 through the first quarter of 2026 show continued share consolidation among the largest digital players: Nubank added approximately 2.7 million customers to reach roughly 114.7 million, and Mercado Pago added 2.5 million to reach 71.3 million, while Stone recorded the sharpest customer decline among the top twenty institutions, indicating that competitive pressure in Brazil's retail-payments and digital-banking market continues to favour the largest platforms.
Outlook
Nubank's pursuit of a Brazilian banking licence alongside its US charter progress, and PicPay's post-IPO acquisition strategy evidenced by the Kovr Participações deal, both point toward continued consolidation of financial services under Brazil's largest fintech platforms. Whether Stone's customer decline stabilises or continues will be a useful indicator of whether the market-share consolidation trend evidenced this cycle persists.
Enforcement is dominated by the June 2025 C&M Software breach — the largest cyber-heist in Brazilian history — in which attackers used credentials of a bribed C&M employee to inject fraudulent Pix orders, draining over R$1bn (≈R$813m+ commonly cited) from at least six institutions' reserve accounts; the Federal Police opened an investigation and the BCB suspended parts of C&M's operations. Follow-on incidents hit Sinqia and Monbank. Major Polícia Federal operations (Magna Fraus, Lusocoin, Carbono Oculto exposing PCC laundering via fintechs) and BCB administrative enforcement (intervention, extrajudicial liquidation, manager liability, RAET) shape the regime. A notable commercial dispute: GetNet (Santander) sued Nubank and Mastercard over prepaid-card interchange losses.
Standing sub-brief199 words · last cycle wpm-2026-06-23
Legal & Litigation
Two developments anchor the litigation picture. First, the late-June 2025 C&M Software Pix supply-chain breach — with the attack around 30 June 2025 and BCB disclosure in early July 2025 — saw bribed-employee credentials used to inject fraudulent Pix orders, draining roughly R$800m (around US$140m) from the reserve accounts of at least six institutions, with follow-on hits to Sinqia (~R$400m) and Monbank (~R$4.9m). It is the largest cyber-heist in Brazilian history and the defining operational-resilience event, having triggered the 2025-26 cybersecurity rule package.
Second, GetNet (Santander) filed a claim for roughly R$62m in damages against Nubank and Mastercard over prepaid-card acceptance losses, alleging that Nubank promotes its prepaid card as a debit-function card. This landmark commercial dispute tests the prepaid-versus-debit interchange classification commercially and intersects the W4 interchange reform; its outcome bears on prepaid-card economics across the market.
The litigation touches both bank-PSPs (Santander/GetNet as claimant) and non-bank PIs (Nubank as defendant), with Mastercard joined as a scheme defendant.
Outlook
The trajectory is escalating. The C&M breach prosecution and the GetNet v Nubank/Mastercard prepaid dispute are the two active threads. The prepaid-interchange dispute is the most commercially consequential, given its bearing on prepaid-card classification and economics.
No periodic updates recorded against this sub-brief.
Acquiring is governed by accreditation agreements between acquirers/sub-acquirers and merchants and by BCB scheme/interchange rules. Acquirers and sub-acquirers (the latter not card-network members) capture, process, settle and credit merchant transactions and handle chargebacks; the MDR (including interchange) is the merchant cost. The 2023/2024 interchange reform harmonised prepaid settlement to the 2-day debit cycle, materially improving merchant liquidity in a high-base-rate environment. Card chargebacks are issuer-mediated consumer-protection reversals, distinct from Pix's MED.
Standing sub-brief190 words · last cycle wpm-2026-06-23
Merchant Acquiring & Risk
The Brazilian acquiring framework governs merchant acquiring and risk through acquirer and sub-acquirer accreditation agreements combined with BCB scheme and interchange rules. The merchant discount rate (MDR), inclusive of interchange, is a merchant cost. The 2023/24 prepaid settlement harmonisation to the two-day debit cycle improved merchant liquidity. Card chargebacks, which are issuer-mediated, are distinct from the Pix Special Return Mechanism (MED).
A structural feature shapes the competitive dynamics: sub-acquirers are not card-network members and process at low cost across brands, positioning them as a disruption vector against bank-controlled acquirers. On the Pix side, MED debits the recipient merchant's settlement and offers no merchant evidence-submission process, a materially different risk profile from card chargebacks. Together these mechanics define the acquirer and sub-acquirer settlement, chargeback and MDR economics that govern merchant-acquiring P&L in Brazil.
The framework spans both bank-controlled acquirers and non-bank sub-acquirers, with the sub-acquirer model the principal non-bank entry route into merchant acquiring.
Outlook
The trajectory is established. Settlement harmonisation and the sub-acquirer competitive model are settled features. The principal forward tension is the prepaid-interchange classification question, tracked under W7, which bears directly on acquiring economics.
No periodic updates recorded against this sub-brief.
Brazil is a global instant-payments innovation leader. Pix has expanded from one-time P2P/P2B transfers into a product family: Pix Agendado (scheduled), Pix por Aproximação (contactless, launched Feb 2025), Pix Automático (recurring/direct-debit-style, launched 2025), and Pix Parcelado/Installment Pix and Pix Garantido (credit-backed) in the pipeline; offline and cross-border Pix are being explored. Open Finance Brazil is a maturing build-out feeding new products, and the BCB maintains an active Regulatory Sandbox (e.g. real-asset tokenisation).
Standing sub-brief168 words · last cycle wpm-2026-06-23
Product Innovation & Market Development
Brazil is a global instant-payments innovation leader, with the BCB extending Pix into a product family. Live products include Pix Agendado (scheduled), Pix por Aproximação (contactless, launched 28 February 2025) and Pix Automático (recurring, launched 2025). The pipeline extends to Pix Parcelado (installment), Pix Garantido (credit-backed), and cross-border and offline Pix. This sits alongside an active Open Finance programme and a Regulatory Sandbox covering real-asset tokenisation.
The Pix product roadmap — Automático, Garantido and cross-border in particular — is the principal product-innovation vector that operators must integrate to capture recurring and credit-backed flows. The product family extends the rail's reach across recurring, contactless and credit use cases. The roadmap applies to both bank-PSPs and non-bank PIs participating in Pix, given the rail's universal participation model.
Outlook
The trajectory is leading. The forward roadmap — Pix Garantido, Pix Parcelado, cross-border and offline Pix — is the principal product-development trajectory. The cross-border element ties to the W5 internationalisation exploration, which remains pending concrete corridor announcements.
No periodic updates recorded against this sub-brief.
The Pix Special Return Mechanism (MED), created Nov 2021, is the core consumer-redress tool for fraud/scams/operational failure: victims register within 80 days, receiving-institution funds are blocked, both institutions review within 7 days and refunds (full or partial, subject to available balance) follow. Recovery has historically been low (~9% in 2023) because fraudsters move funds onward, prompting MED 2.0 (BCB Res. 493/2025) to trace and block across up to five 'cascading' account hops (optional Nov 2025, mandatory 2 Feb 2026; sanctioning grace via Res. 546 to 10 May 2026). A self-service MED button was mandated (Res. 589, by Oct 2025) and Res. 501/2025 requires rejecting transfers to fraud-flagged accounts. Consumer-protection law (CDC) also applies, including to crypto operations.
Standing sub-brief218 words · last cycle wpm-2026-08-05
Consumer Protection & APP Fraud
Brazil's consumer-redress regime for instant payments centres on the Pix Special Return Mechanism (MED), introduced in November 2021, which provides an 80-day registration period, 7-day review and full or partial refund. The regime is being upgraded substantially. MED 2.0, under BCB Resolution 493/2025, traces and blocks funds across cascading account hops; it became optional on 23 November 2025 and mandatory on 2 February 2026, with a sanctioning grace period to 10 May 2026 under Resolution 546. A self-service MED button was mandated under Resolution 589 by October 2025, and Resolution 501/2025 requires institutions to reject transfers to fraud-flagged accounts.
The upgrade responds to historically low recovery rates — around 9% in 2023, with roughly 89% of MED requests denied for insufficient funds or closed accounts. The cascading-block design directly targets that gap. The MED 2.0 cascading-block and fraud-flag rejection obligations are a core consumer-protection compliance load for every Pix participant, bank-PSP and non-bank PI alike. The escalation from reactive MED to preventive-plus-tracing reflects Brazil's position as a global testbed for instant-payment fraud defence.
Outlook
The trajectory is escalating. The binding near-term milestone is the MED 2.0 sanctioning grace expiry on 10 May 2026, following the mandatory adoption date of 2 February 2026. The structural direction is toward preventive interdiction rather than after-the-fact recovery.
Periodic update · new data 2026-08-11 · run wpm-2026-08-05
Consumer Protection & APP Fraud
Brazil's central bank moved on two fronts to address Pix-related fraud this cycle. BCB Resolution 493/2025 restructured Pix Forum governance and strengthened the Special Return Mechanism, the scheme's dedicated fraud fund-recovery process, making fund recovery mandatory from 2 February 2026 rather than discretionary. Separately, new transfer limits of approximately BRL200 (roughly USD40) now apply to transactions initiated from unrecognised devices, paired with a seventy-two-hour precautionary hold, both aimed squarely at account-takeover fraud, a pattern in which a compromised device is used to authorise unauthorised Pix transfers before the legitimate account holder can intervene.
Outlook
The mandatory fund-recovery requirement under the strengthened Special Return Mechanism is the clearer consumer-facing protection to monitor, since it converts what was previously a best-efforts recovery process into an enforceable obligation from February 2026. The device-recognition limits and holding period will be tested by how effectively they reduce account-takeover losses without materially degrading the user experience that has driven Pix's adoption.
[SENTINEL-FED] Payments-context AML/CFT position only. Brazil's AML/CFT regime centres on Law 9.613/1998 (the AML Law, amended by Laws 10.701/2003, 12.683/2012, 13.974/2020), which created COAF as the financial intelligence unit (operationally autonomous, administratively linked to the BCB). BCB Circular 3.978/2020 sets the AML/CFT policy, procedures and internal-controls framework for supervised entities, including payment institutions. Brazil is a FATF and GAFILAT member; the 2023 FATF/GAFILAT mutual evaluation noted strengths and gaps (notably BO access and non-bank supervision). For payments: institutions must KYC, monitor transactions, keep records, and report suspicious activity to COAF.
Open gap — wpm-int-6W11 AML/CFT content is Sentinel-fed carry only; original illicit-finance analysis (PCC laundering typologies, crypto-Pix vectors) is routed to FIM and not analysed here.no under-indexing note recorded
Standing sub-brief216 words · last cycle wpm-2026-06-23
AML/CFT & Financial Crime
This module carries the Sentinel.gi feed only and does not re-analyse illicit finance; original illicit-finance analysis is routed to the Financial Intelligence Monitor. As reported via the Sentinel feed, Brazil operates its payments-context AML/CFT regime through Law 9.613/1998, which created the COAF financial intelligence unit — operationally autonomous and administratively linked to the BCB — together with BCB Circular 3.978/2020 setting AML/CFT policy and internal-controls obligations for supervised entities including payment institutions. Brazil is a FATF/GAFILAT member. The 2023 mutual evaluation noted beneficial-ownership access and non-bank supervision gaps. Suspicious-transaction reporting is required within 24 hours, records kept for at least five years, with reporting from transactions of R$10,000. The Sentinel feed also notes crypto-Pix laundering vectors and VASP/gold AML expansion.
The regime defines the AML/CFT obligation set — KYC, monitoring and COAF STR filing — that payment institutions must operate, and the bank-versus-non-bank supervision gap identified in the 2023 evaluation is a structural payments-AML risk specific to the non-bank PI perimeter.
Outlook
The trajectory is stable but reform-directed, per the Sentinel feed. The beneficial-ownership access and non-bank supervision gaps flagged by FATF/GAFILAT in 2023 are the standing reform pressure points. Original illicit-finance typologies — including crypto-Pix vectors and PCC-related laundering — are carried into the Financial Intelligence Monitor rather than analysed here.
No periodic updates recorded against this sub-brief.
T?FIM (sentinel.gi) per-JID baseline profile — Brazil — AML Law 9613/1998 with COAF (FIU) at its centre, coordinated via the ENCCLA inter-agency mechanism; joint FATF/GAFILAT MER (Dec 2023) found improved risk understanding and TF criminalisation but weak DNFBP supervision and unpopulated BO data. New BCB Resolutions 519-521 (Nov 2025) create a VASP licensing regime effective Feb 2026.
Interbank settlement runs through the STR (Reserves Transfer System), a BCB-operated RTGS providing irrevocable, unconditional real-time finality, underpinned by Law 10.214/2001 (settlement finality, multilateral netting, collateral seizure in insolvency). Reserve/settlement accounts at the BCB are mandatory for some institutions and optional for others; the BCB extends fully collateralised free intraday credit to reserve-account holders. Pix settles via the SPI through Instant Payment (IP) accounts, accessed directly or via accredited PSTIs. Cross-border USD legs route through the FX Clearinghouse and US correspondent banks. Payment institutions can access SPI directly (IP account) or indirectly via a direct participant.
Standing sub-brief220 words · last cycle wpm-2026-06-23
Correspondent Banking, Settlement & Access
The analytical spine of this module is the bank versus non-bank settlement-access asymmetry. Settlement finality runs through the STR (Reserves Transfer System) RTGS, which provides irrevocable, unconditional real-time finality underpinned by Law 10.214/2001 — covering settlement finality, multilateral netting and collateral seizure in insolvency. Pix flows settle via the SPI through Instant Payment (IP) accounts, which can be accessed directly or via an accredited PSTI. The access asymmetry is the spine: non-bank PIs can access the SPI directly via an IP account or indirectly via a direct participant, where direct IP-account access is the key settlement-access differentiator versus indirect-participant dependency. Reserve accounts are mandatory for some institutions and optional for others, and the BCB extends fully collateralised free intraday credit. IP accounts must remain non-negative, with remuneration governed by Resolution 195/2022.
On the cross-border side, the USD corridor depends on US correspondent banks for the USD leg over Fedwire, while BRL legs settle via the STR — a bank-PSP-mediated dependency that defines the structural choke point for the BR-US corridor.
Outlook
The trajectory is established. The standing structural question is the settlement-access differential between non-bank PIs with direct IP-account access and those dependent on indirect participation. The USD correspondent dependency remains the key cross-border access constraint, tied to the Resolution 561 rerouting tracked under W5.
No periodic updates recorded against this sub-brief.
Trailing-12-month (≈Jun 2025-Jun 2026) commercial activity: the IPO window reopened with PicPay's $434m Nasdaq listing (29 Jan 2026, ticker PICS) — the first major Brazil fintech listing since Nubank (2021); Nubank received conditional OCC approval (Jan 2026) for a US national bank charter and opened an Abu Dhabi HQ. Brazilian startup funding recovered (US$692m raised in Q3 2025, +47% YoY). Product launches centred on Pix Automático and Pix-USDC integration. Undisclosed values are marked amount_disclosed=false.
Movement — NEWPicPay/Kovr acquisition completedNew M&A event this cycle.
Standing sub-brief234 words · last cycle wpm-2026-08-05
Three discrete commercial events define the cycle. First, PicPay raised US$434m in a completed Nasdaq IPO, listing on 29 January 2026 under ticker PICS and selling 22.86m shares — the first major Brazilian fintech US listing since Nubank in 2021. PicPay reported 66m Brazil customer accounts as of 30 September 2025, up 12% year-on-year. As a non-bank PI/EMI, PicPay's listing reopens the Brazil fintech IPO window and provides a sector valuation reference; the IPO value is publicly disclosed.
Second, Nubank received conditional OCC approval in January 2026 for a US national bank charter and opened an Abu Dhabi HQ for its global push. This event is a pending regulatory partnership-restructuring milestone; its value is not publicly disclosed. A US national bank charter would materially expand Nubank's cross-border product reach and regulatory standing.
Third, at the sector-aggregate level, Brazilian startups raised US$692m in Q3 2025, up 47% year-on-year and 92% quarter-on-quarter per Crunchbase. This is a sector aggregate rather than a single deal, and the value is publicly disclosed; it indicates a recovering investment environment underpinning continued fintech entry and product investment.
Outlook
The trajectory is active. The reopening of the Brazil fintech IPO pipeline, signalled by PicPay, and Nubank's charter pursuit point to renewed public-market appetite and cross-border expansion. The recovering funding environment supports continued sector entry. The Nubank OCC charter remains a pending regulatory milestone to watch.
Periodic update · new data 2026-08-11 · run wpm-2026-08-05
Commercial Intelligence & Fintech
PicPay completed the acquisition of insurtech Kovr Participações S.A. on 3 August 2026, following clearances from the central bank, the competition authority CADE, and the insurance regulator SUSEP. The deal's financial terms were not publicly disclosed. The stated rationale is to embed insurance products directly into PicPay's existing payments and banking application, following closely on the heels of the company's $434 million Nasdaq initial public offering completed on 29 January 2026, which itself targeted a $2.46 billion valuation and marked the first major Brazilian fintech listing since Nubank's 2021 debut.
Outlook
PicPay's acquisition-following-IPO sequence suggests further bolt-on acquisitions targeting adjacent financial-services verticals, such as insurance, are plausible as the company deploys IPO proceeds; whether Kovr's insurance products achieve meaningful embedded-attachment rates within PicPay's core payments app is the practical commercial marker to watch next.
Filters combine as OR inside a group and AND across
groups.
Editorial metadata
Provenance only. Nothing below gates publication or affects the render.
Editorial metadata for Brazil
Field
Value
trust.lawyer_review.status
never_reviewed
trust.lawyer_review.reviewer
not recorded
trust.content_source
ai_generated
Provenance and declared absence
Disclosure model: module cards load OPEN; standing positions render in full; sub-briefs and jurisdiction briefs load as a clamped teaser with an explicit “read full” control carrying the true word count; earlier updates stay collapsed behind a counted summary. No text is hidden without disclosing how much of it there is.
Sentinel-fed modules receive no special rendering treatment. sentinel_feed is an attribution chip only: it does not suppress content, does not generate an absence reason code, and does not exclude the module from any count, filter, search index or export on this page.
Family taxonomy is renderer-level presentation config, not a JID field. Colour is always duplicated in text and is never the sole carrier of meaning.