Brazil's Central Bank tightens Pix security

Update October 15, 2026: The Central Bank of Brazil added Pix usage and volume data, along with new details on MED 2.0. The system processed nearly 80 billion transactions and moved more than R$35 trillion in 2025, while tracing between institutions to reconstruct the money trail became mandatory in February 2026.

The Central Bank of Brazil said it has introduced a new round of regulatory improvements for Pix tied to payment system security, according to its official statement titled "Pix amplia funcionalidades e reforça segurança com nova ...". The information available does not allow a full reconstruction of the measures, but it does confirm changes related to fraud-suspicion handling and to the review mechanism for those records.

What is known about the new measures?

The Central Bank of Brazil’s official announcement only said that Pix will receive new regulatory improvements aimed at strengthening security. The text released does not spell out every provision in the update, so the full scope of the rule cannot be determined from the material available.

What changes when fraud is suspected?

According to Agência Brasil, the institution that logs a fraud suspicion must notify the customer, state the date of the record and allow a review request. If the analysis does not confirm the suspicion, the flag must be removed. The process is intended to formalize how records are handled and leave a trail for the affected user.

How will records be reviewed in the DICT?

IstoÉ Dinheiro reported that institutions must provide channels to respond to records of well-founded fraud suspicion in the DICT and answer the request within a maximum of seven days. That adds detail to what Agência Brasil reported and points to a procedure with defined deadlines for response and internal review.

The Central Bank of Brazil also released the Pix Management Report 2023-2025, which says Pix processed nearly 80 billion transactions and moved more than R$35 trillion during 2025, according to the Ministry of Finance. In parallel, Abranet said 148 million people and 12.8 million companies made or received at least one Pix payment in 2025.

What volume did Pix reach in 2025 and 2026?

Pix maintained massive usage throughout 2025 and remained at very high levels in September 2026, according to figures released by the authorities and the coverage cited. The official report and data published by Agência Brasil show steady growth in transactions, amounts moved and user numbers.

In September 2026, the Central Bank of Brazil’s Instant Payments System, or SPI, processed about 7.1 billion transactions for an estimated volume of R$3.2 trillion, according to Agência Brasil. The figure underscores the scale Pix continues to hold in Brazil’s financial system.

What changes with MED 2.0?

MED 2.0 establishes mandatory tracing between participating institutions to reconstruct the path of the money after a victim formally files a challenge, and the general obligation took effect in February 2026, according to O Dia. The mechanism adds another operational layer to fraud fighting within Pix.

The three reports agree that the update is focused on security and on how fraud suspicions are handled within the Pix ecosystem. However, with the material available, it is not possible to specify broader compliance obligations, penalties or general implementation deadlines.

What do the new Pix rules say about fraud?

The new Pix rules strengthen the handling of fraud suspicions and require institutions to notify the customer when they log that kind of alert. They also allow for a review request and, if the suspicion is not confirmed, for the flag to be canceled.

The available material also says institutions must provide channels to respond to those records in the DICT and reply within a maximum of seven days. In addition, MED 2.0 was set as a mandatory tracing mechanism between institutions to reconstruct the money trail.