Brazil: Central Bank of Brazil adopted regulation on authorisation, penalties and fraud-prevention measures in Pix payment scheme including cybersecurity regulation

On 26 September 2025, the Central Bank of Brazil (BCB) adopted Resolution No. 506, amending Resolution No. 1 of 12 August 2020 to introduce cybersecurity provisions in the Pix payment scheme. The resolution establishes that Pix participants may only set transaction limits based on criteria for mitigating risks of fraud and breaches of anti-money laundering and counter-terrorism financing regulations, and requires participants to adopt minimum criteria defined by the BCB for assessing suspected fraud in Pix transactions. It further obliges participants to reject requests for Pix key registrations, portability, or possession claims when users are associated with transactional fraud notifications, and to block all transactions involving such users or accounts except for refunds. The resolution also requires Pix participants to create and accept fraud notifications, allowing the marking of individual or corporate taxpayer numbers (CPF or CNPJ) linked to specific fraudulent Pix transactions, and establishes that notifications of non-compliance, corrective action plans, and penalties, including suspension and exclusion from Pix, may be applied in cases of failure to comply with these obligations.