Pix Rules in Brazil Tighten on Fraud and Loosen on Who Must Join, From 18 September 2026
BRAZIL · BANKING
Key Facts
- —The instrument The changes come through Resolução BCB nº 587, and the exemption criteria take effect immediately.
- —The exemption Institutions with more than 500,000 active accounts can be exempted from mandatory Pix participation.
- —Fraud marking Whoever registers a fraud flag now owns it, must tell the user and must offer a review channel.
- —The deadline Institutions have a maximum of seven days to answer a review request.
- —How long it lasts A fraud marking can stay attached for up to five years from registration.
- —Salary accounts Salary accounts can initiate Pix Automático payments from 1 July 2027.
- —Billing Hybrid billing, combining a boleto and a Pix QR code on one document, applies from 1 February 2027.
The new Pix rules change who has to offer Pix, what happens when your account is flagged for fraud, and when you can get that flag removed.
What Changed
Brazil’s central bank published a set of changes to the Pix rulebook on 18 September 2026, through Resolução BCB nº 587. They land at different dates, and two of them matter immediately.
The first loosens an obligation. Institutions with more than 500,000 active transactional accounts can now be exempted from mandatory participation in Pix, where their customer profile or business model justifies it.
Until now, size was the trigger for compulsory participation. The exemption recognises that some large institutions hold accounts that are not used for everyday payments at all.
The second tightens accountability for fraud flags. The participant that accepts an infraction notice or registers a fraud suspicion marking is now responsible for that marking, including cancelling it.
A marking attaches to the customer’s CPF or CNPJ, and to the Pix key used where there is one. It follows the person or company rather than the transaction, and it can stay attached for up to five years from registration.
Institutions must tell users when a marking is made, provide a channel for clarification, and answer a request for review within a maximum of seven days. They must cancel a marking when nothing justifies the suspicion.
When those user-facing duties begin is the one thing the coverage does not agree on. Some outlets place them alongside the immediate changes, others from 1 February 2027, and the resolution text was not retrievable for this piece.
Why the Fraud Change Is the Important One
Fraud marking has been the least visible part of Pix and the most consequential for the people it touches. Institutions may reject or block transactions involving a marked key, without a court, a charge or a conversation.
The problem was ownership. A flag could be registered by one institution and then sit in a shared directory, with no single party clearly responsible for reviewing or removing it.
The new rule fixes that by assignment. Whoever raised it owns it, and owning it includes cancelling it when the basis disappears.
The seven-day response deadline is the enforceable part. It converts an open-ended wait into a defined one, which is the difference between a process and a dead end.
This will matter most to small businesses and to foreign residents, the two groups whose transaction patterns most often look irregular to an automated system.
Pix is not a side channel in Brazil. It carries a large share of everyday payments, and an account that cannot use it is an account that struggles to buy lunch.
That is why the review deadline is the substantive change rather than a procedural one. Losing Pix access for a week is an inconvenience; carrying a marking for up to five years is a business problem.
The Slower Changes
Pix Automático, the recurring-payment function, can be initiated from salary accounts from 1 July 2027. Those accounts stay restricted in other respects, and still cannot receive ordinary Pix transfers beyond Treasury payments and refunds.
Hybrid billing applies from 1 February 2027. It puts a boleto and a Pix QR code on the same document, so a payer uses one or the other rather than paying twice or paying wrongly.
From March 2027 the rules also ban advertising inside Pix receipts. It is a small change that removes a channel firms had started using.
Exit rules also change. Institutions in extrajudicial liquidation face immediate suspension, and exclusion from Pix now takes effect immediately rather than after a 30-day notice.
That last change is small in wording and large in effect. A 30-day window in a payment system is a window in which money can still move.
What It Means If You Live in Brazil
If your account is flagged, the resolution gives you a named counterparty and a deadline. Ask which institution registered the marking and put the review request in writing.
For foreign residents, the practical value is in that second point. Accounts opened recently, funded from abroad or used irregularly are the ones that attract automated suspicion.
The 500,000-account exemption is unlikely to touch a retail customer directly. Its effect is on which institutions must build and maintain Pix infrastructure.
For small business owners, the hybrid billing rule is the one to diary for. One document with both payment routes removes a recurring reconciliation problem.
Pix remains free for individuals for ordinary transfers. None of these changes alters that.
What has changed is the balance between speed and safety. Pix was built to move money instantly, and every fraud control added to it trades a little speed for a little more protection.
This package sits firmly on the safety side. The seven-day deadline is the concession to people wrongly caught by it.
What Is Not Yet Clear
The central bank has not published which institutions will seek or receive the participation exemption, and the criteria are assessed case by case.
The operational detail of the fraud review channel is left to each institution. A seven-day deadline says when an answer is due, not what a good answer looks like.
Whether the seven-day deadline will be enforced with penalties, and which ones, is not spelled out in the announcement.
The salary account and hybrid billing changes are far enough out that implementation detail will follow separately.
The central bank also did not say how many institutions currently sit above the 500,000-account threshold, so the practical reach of the exemption is unknown.
Nor is it clear how existing fraud markings will be treated. The new ownership rule is written forward, and flags raised under the old arrangement are already in circulation.
The commencement of the user-notification and review duties is the open question that matters most, and it is the one the secondary coverage splits on.
Connected Coverage
- Pix Is About to Pass Cards at Brazil’s Checkout
- Brazil’s Pix Record: 318 Million Payments in One Day
- Brazil Opens Bank Accounts to Foreigners Through the CPF Tax Number
Sources
- Agência Brasil — Pix terá novas regras para fraudes, cobrança híbrida e contas-salário
- Finsiders Brasil — BC muda regras do Pix e define responsabilidade por fraude
Frequently Asked Questions
Frequently Asked Questions
What are the new Pix rules?
Resolução BCB nº 587 tightens responsibility for fraud markings, allows institutions with more than 500,000 active accounts to be exempted from mandatory Pix participation, opens salary accounts to Pix Automático from 1 July 2027 and regulates hybrid billing from February 2027.
What happens if my account is flagged for fraud?
The institution that registered the marking is responsible for it. It must tell you, give you a channel to ask about it, answer a review request within seven days at most, and cancel the marking if nothing justifies the suspicion. A marking can stay attached for up to five years.
Does the exemption mean big banks can drop Pix?
It means the central bank can exempt an institution with more than 500,000 active transactional accounts from mandatory participation where its customer profile or business model justifies it. It is assessed case by case.
Is Pix still free?
Yes for individuals making ordinary transfers. None of these changes alters that.
This article was produced by The Rio Times’ automated newsroom system. How we use AI · Report an error
Read More from The Rio Times