Brazil's Central Bank Overhauls Pix Rules with Immediate Exclusion Power and New Fraud Duties

What the Central Bank Changed in the Latest Pix Regulation

Brazil's Central Bank published a new set of Pix regulations on Friday, 18 September 2026, updating operational procedures and security mechanisms for the country's most widely used instant payment system. Some provisions took effect immediately, while the most demanding customer-facing obligations were scheduled for early 2027.

One of the most consequential changes concerns penalties. Previously, a participant excluded under the penalty mechanism had a 30-day period before the measure was applied. The new rule makes exclusion effective immediately after the final decision is communicated. The Central Bank said the change is intended to reduce risks to the security and functioning of the payment arrangement.

The regulation also introduces an opt-out path: the Central Bank may waive mandatory Pix participation for institutions with more than 500,000 active transactional accounts when their client profile or business model does not justify access to the payment infrastructure. Admission rules were tightened as well. Approvals obtained with false information or relevant omissions can now be annulled, and institutions placed under extrajudicial liquidation are immediately suspended. The liquidator may ask the Central Bank for an orderly exit within 30 days.

On fraud prevention, the rules make a Pix participant expressly responsible for any DICT fraud mark it accepts or registers, including eventual cancellation. Institutions must inform the user when a mark is made, state the registration date, explain that the measure can be reviewed, and provide channels for clarification and review requests. They must respond to review requests within seven days and cancel marks that no longer have supporting elements. User-notification duties take effect on 1 February 2027; the other fraud-marking provisions are immediate. The Central Bank also adjusted Pix Automático so it can be used in salary accounts from 1 July 2027, and updated hybrid collection rules to allow safer coexistence between Pix and boleto.

How the New Pix Rules Shift Risk Among Banks, Fintechs and Users

DICT Fraud Marks Now Carry Explicit Institutional Responsibility

The regulation shifts legal and operational accountability for fraud marks squarely onto participating institutions. An institution that registers a founded suspicion of fraud, or accepts an infraction notification, becomes responsible for the mark and its eventual cancellation. That matters because users will now have a formal route to challenge marks, and institutions must respond within seven days. The practical consequence is higher compliance and customer-service burden, but also a clearer framework that may reduce arbitrary or outdated marks.

Immediate Exclusion Removes the 30-Day Safety Margin

Under the previous rule, a participant facing exclusion had 30 days before the measure took effect. The new rule eliminates that transition period. The Central Bank's stated rationale is to reduce security and operational risk to the Pix arrangement. For participants, however, the change raises the stakes of any definitive penalty: losing access to Brazil's dominant instant payment rail could disrupt transaction revenue and customer relationships overnight, making dispute management and regulatory engagement far more urgent.

The 500,000-Account Waiver Creates a Strategic Exit Door

The regulation allows the Central Bank to release some large institutions from mandatory Pix participation if their clients or business model do not justify access. The threshold is more than 500,000 active transactional accounts. This creates a potentially useful path for institutions whose customers rarely use Pix or whose product mix makes participation costly without clear commercial benefit. It may also create competitive asymmetry: some large players could reduce Pix-related obligations while others remain fully bound.

2027 Deadlines Force Planning for Salary-Account Pix and User Notices

Two implementation dates give institutions room to build, but also create hard deadlines. From 1 February 2027, customers must be notified when they are marked for suspected fraud and must be able to seek review. From 1 July 2027, Pix Automático must be able to operate in salary accounts. These changes require systems, processes and legal workflows, not merely policy updates. Institutions that treat the dates as distant could face a late scramble, especially because the underlying fraud-marking rules are already in force.

Compliance Steps for Pix Participants and What Users Gain

The regulation imposes specific obligations on Pix participants and creates new rights for users. The most immediate work is compliance and process design.

• Map every DICT fraud-marking flow now. From 1 February 2027, customers must be told when they are marked, on what date, and how to request review. Build or update notification and case-management channels to meet the seven-day response deadline.
• Revalidate admission records. The Central Bank can annul Pix approvals obtained with false information or relevant omissions, so compliance teams should review the original application file before regulators do.
• If your institution has more than 500,000 active transactional accounts and an atypical client base, assess whether the new opt-out from mandatory Pix participation is worth pursuing. Document why access to the payment infrastructure is not justified for your model.
• Institutions under extrajudicial liquidation should decide within 30 days whether to request an orderly exit, because suspension is now immediate.
• Prepare Pix Automático for salary accounts by 1 July 2027, including payroll-account compatibility and authorization flows.
• For users: from February 2027, if you are marked for suspected fraud in Pix, you should receive a notification and can demand review. The institution must answer within seven days and cancel unfounded marks.