Brazil tightens BC rules for Pix

Update August 22, 2026: The note now includes new Pix limits for transactions from unregistered devices, capped at R$200 per transaction and R$1,000 per day, plus mandatory device validation for higher-value transfers. The phased timetable for the rollout of the system’s rules has also been updated.

Brazil’s Central Bank has added new security rules for Pix while keeping the gradual tightening already announced for the instant payment system. The package also includes holds of up to 24 hours for certain crypto transfers abroad or to self-custody wallets, set to begin on January 1, 2027, along with sector reaction to the measure.

What does the new crypto resolution require?

Resolução BCB nº 584/2026 requires virtual asset service providers, or PSAVs, to hold crypto transfers abroad or to self-custody wallets for up to 24 hours when they exceed $10,000 per transaction or on a daily cumulative basis. The measure takes effect on January 1, 2027, and Brazil’s Ministry of Finance described it as a preventive hold, not a permanent one.

According to the ministry’s official note, the hold can be lifted before 24 hours if the risk review finds no irregularities, as long as the decision is documented and recorded. During that period, institutions must deepen their transaction analysis, at a minimum taking into account the customer profile, the characteristics of the transaction, the counterparty involved and the destination jurisdiction.

The ministry also said internal risk-management policies and structures may extend the hold to transactions below $10,000.

Who is covered, and from when?

The rule targets transfers of cryptoassets to foreign virtual asset service providers or self-custody wallets, according to UPay’s analysis. The $10,000 threshold can be reached by a single transfer or by the cumulative value of a customer’s transactions in the same day.

SpaceMoney reported that operational enforcement of the hold will begin on January 1, 2027. The same coverage said Projeto de Decreto Legislativo (PDL) nº 926/2026 has already been introduced in Brazil’s Congress with the goal of blocking the measure.

How do Pix’s new security rules change things?

Instrução Normativa BCB nº 767 introduces a phased rollout of new rules on incident reporting and fraud analysis in Pix, with changes taking effect in August and September 2026 and new sections of the DICT Operational Manual being activated in stages. The update also tightens the use of unregistered devices.

A report from IstoÉ Dinheiro said the rules set limits of R$200 per transaction and R$1,000 per day for transfers made from unregistered devices, along with mandatory device validation for higher-value operations. Eutrop.io’s technical analysis of IN BCB nº 767/2026 added that on September 1, 2026, specific sections of the DICT Operational Manual will change, confirming a phased implementation.

FEEB-PR and other local media describe the setup as a kind of MED 2.0, capable of tracking suspicious transactions even when funds have been split across multiple accounts. MixVale and Alerta Gov say victims have 80 calendar days to request activation of the reimbursement mechanism, although the sooner the process begins, the better the chances of recovery.

What changes for digital asset companies?

A compliance guide cited by MSN Brasil says companies that provide digital asset services have until October 30, 2026 to align with Central Bank rules. From that date, companies without authorization must stop operating, and authorized firms may not do business with participants outside the regulatory regime.

Mercado Hoje added that, since February 2026, exchanges, custodians and crypto brokers were reclassified as Virtual Asset Service Providers, or PSAVs, and need Central Bank authorization to operate under continuous supervision for compliance and risk management.

What other obligations weigh on the financial sector?

A technology compliance blog said the rules from the Conselho Monetário Nacional, including Resolução CMN nº 4.893 and successor regulations, require a Cybersecurity Policy and an incident response structure that explicitly covers third-party technology providers. At the same time, analyses of LGPD and privacy note that Resolução CD/ANPD nº 15/2024 sets criteria for incident reporting and a three-business-day deadline to notify the ANPD and data subjects when there is relevant risk or harm.

That regulatory overlap also appears in Ministry of Finance materials, which project new Pix developments through 2030 with more security and integration with Open Finance, and in Eutrop.io’s update on IN BCB nº 767/2026, which sets October 26, 2026 as the date for certain sections to take effect and for the earlier rule’s planned revocation.