Fintech & Digital Payments Compliance in Brazil

Brazil is open to digital payment and e-money businesses, but only as licensed institutions. Between 2024 and 2026 the BCB closed the routes that let unlicensed payment companies operate: it ended the volume thresholds below which no authorisation was needed and made a licence a condition of access to Pix. With the CMN, it also regulated banking as a service (BaaS) and barred payment firms from presenting themselves as banks.

The BCB licenses and supervises payment institutions under rules set with the National Monetary Council (CMN). COAF receives suspicious and threshold reports. The National Data Protection Agency (ANPD) enforces data protection rules, including those on the biometric data captured at onboarding.

For a new entrant, the biggest obstacle is the authorisation itself. It requires capital calculated by activity, qualified managers and a dedicated head office. The firm must also run a complete anti-money laundering (AML) programme and keep responsibility for customer checks even when it distributes through partners.

1. Who regulates this sector

Consumer protection and competition authorities can also sanction payment institutions under their own laws (Lei nº 12.865/2013, art. 11, sole paragraph).

2. Licensing and authorisation

Which licence

Under Lei nº 12.865, de 9 de outubro de 2013 (the payments law), a payment institution manages payment accounts, issues payment instruments, accredits merchants, executes remittances or issues electronic money, and needs BCB authorisation (arts. 6, III and 9, V). Resolução BCB nº 80/2021 sets four types, which one firm may combine: electronic money issuer (prepaid accounts), post-paid instrument issuer, acquirer and payment initiation service provider (art. 3). Digital lenders use a separate licence as a direct credit company or a peer-to-peer lending company (Resolução CMN nº 5.050/2022).

No more threshold exemption

Resolução BCB nº 494/2025 rewrote art. 9 of Resolução BCB nº 80: a payment institution must obtain authorisation before it starts providing a payment service, and the old volume thresholds below which unauthorised operation was tolerated were revoked. E-money issuers that started before 1 March 2021, and post-paid issuers and acquirers that started before 5 September 2025, had to apply between 1 and 31 May 2026 if not yet authorised (art. 9-A). Firms that missed the window, or filed an inadequate application, could continue for only 30 days. Limited-purpose arrangements and benefit programmes remain exempt (art. 2).

Requirements and refusal

Resolução BCB nº 81/2021, as amended by Resolução BCB nº 495/2025, requires qualified managers, minimum capital and a head office for exclusive use; coworking spaces and virtual offices are not accepted (art. 2, X and § 6). If an application is finally refused, a firm already operating must, within 30 days, stop its payment services and transfer balances to accounts in the users' names at authorised institutions (art. 17). Payment account balances are legally ring-fenced from the institution's estate (Lei nº 12.865/2013, art. 12).

Capital, Pix access and naming

Resolução Conjunta nº 14/2025 [In force] sets minimum capital according to the institution's activities, investments and funding. Existing institutions phase it in: their previous minimum until 30 June 2026, then that minimum plus 25% of the increase until 31 December 2026, 50% until 30 June 2027 and 75% until 31 December 2027, with the full amount from 1 January 2028 (art. 12). Using "bank" in the name adds R$30 million (art. 11). Since 1 January 2025 only authorised institutions may apply to join Pix, and a firm providing Pix transaction accounts (credit cooperatives excepted) must keep at least R$5 million in paid-in capital and equity from 1 January 2026. A participant that missed its deadline to apply for authorisation, or falls below the capital floor (unless Pix is mandatory for it, as for institutions with over 500,000 active accounts), loses its Pix participation (Resolução BCB nº 1/2020, arts. 3 and 3-A; Pix Regulation, art. 31, as amended by Resolução BCB nº 587/2026). Resolução Conjunta nº 17/2025 bars names, brands or domains suggesting an activity the firm is not authorised for, so a payment institution cannot present itself as a bank (art. 3).

3. AML, KYC and customer due diligence

Payment institutions are obliged persons under Lei nº 9.613, de 3 de março de 1998 (the AML law), art. 9, sole paragraph, IV and VIII. The detailed rules are in Circular nº 3.978/2020, which applies to every BCB-authorised institution. The FATF mutual evaluation of Brazil, published in December 2023, rated it largely compliant on customer due diligence, compliant on money or value transfer services and partially compliant on new technologies.

Risk assessment

Covers customers, business model, products and every distribution channel; reviewed every two years (arts. 10 and 12).

Identification

At least full name and CPF for individuals, or legal name and CNPJ for companies, verified and validated, including against public and private databases (art. 16, as amended by Resolução BCB nº 119/2021). Non-residents without a CPF can use a travel document.

Qualification and classification

Place of residence or head office and financial capacity (income or turnover), checks for politically exposed persons (PEPs) and their family members and close associates, and allocation to a risk category, all kept up to date (arts. 18 to 20 and 27).

Beneficial ownership

The ownership chain must be traced to the natural person who is the beneficial owner. Each institution sets its own ownership threshold, which may not exceed 25% counting direct and indirect holdings (arts. 24 and 25).

No business relationship may begin until identification and qualification are complete. If only qualification data are missing, it may start for up to 30 days (art. 23).

Monitoring and reporting

Alerts are analysed within 45 days, in Brazil and without outsourcing the analysis (arts. 43 and 44). Suspicious operations are reported to COAF by the business day after the decision to report, without informing the customer (arts. 48 and 50). Threshold reports are due by the next business day under art. 49, as amended by Resolução BCB nº 591/2026:

• cash deposits, top-ups and withdrawals of R$50,000 or more;
• payments, receipts and transfers made against cash of R$50,000 or more, and requests to schedule cash withdrawals of R$50,000 or more;
• foreign exchange with delivery of foreign currency in cash of US$10,000 or more [In force];
• virtual-asset transfers to or from self-custodied wallets of US$10,000 or more [In force].

Operations in the last two categories made between 1 October and 31 December 2026 are reported on the first business day of January 2027. An institution that files no reports in a calendar year must declare this within ten business days after the year ends (art. 54). Customer and transaction records are kept for ten years (art. 67).

Sanctions

Assets of persons designated by the United Nations Security Council are frozen immediately, and freezes and attempted transfers are reported at once to the BCB, the Ministry of Justice and Public Security and COAF (Resolução BCB nº 44/2020, arts. 2 and 4, implementing Lei nº 13.810/2019).

4. Identity verification and onboarding

Resolução BCB nº 96/2021 governs payment accounts. Institutions must verify and validate the identity and qualification of the holder and any representative, including against public or private databases (art. 4). No BCB rule prescribes a biometric or liveness technology, and BCB guidance confirms there is no official document list: any identity document recognised by Brazilian law is valid, and each institution sets its own list in its KYC manual (Circular nº 3.978, art. 22).

• Simplified accounts. An account may be opened with simplified qualification if the institution sets appropriate limits on balance and top-ups (art. 4, § 2). The BCB does not fix those limits; they must appear in the account contract (art. 6, V).
• Restriction register (BC Protege+). Since 1 December 2025, institutions must check the BCB system where people can register, free of charge, that no account be opened in their name, before opening a prepaid account or adding a holder or representative. Overriding it needs a documented exceptional reason (an outage is not one), and evidence is kept for ten years (art. 4-A; Resolução BCB nº 475/2025; Instrução Normativa BCB nº 661/2025, arts. 3 and 10).
• CPF and CNPJ status. An account must be closed if the holder's CPF is "suspended", "cancelled" or "null", or the company's CNPJ is "unfit", "closed" or "null" (art. 13, § 1).

For merchants and other companies, administrators, representatives and the beneficial owner are also identified (Circular nº 3.978, arts. 21 and 24).

5. Digital channels: what's different

Bottom line: the identity and AML rules are channel-neutral, and remote opening is expressly permitted. The differences sit in the payment rails: Pix requires registered devices and fraud controls, and BaaS distribution must run through electronic integration with a licensed provider that keeps responsibility for know-your-customer checks.

Remote opening is the default, not the exception

Payment accounts may be opened through remote channels without face-to-face contact; only voice telephone is excluded (Resolução BCB nº 96/2021, art. 5; for deposit accounts, Resolução CMN nº 4.753/2019, art. 3). Circular nº 3.978 does not make non-face-to-face onboarding an enhanced due diligence trigger; channel risk is weighed in the risk assessment (art. 10).

Pix security controls

The Pix Regulation requires a fraud-risk solution using the security data in the Pix directory (DICT), refreshed at least every six months, and blocks Pix for accounts in an accepted fraud notification except refunds (art. 89, §§ 1 to 3). Individuals' Pix payments and key changes must come from a registered access device (art. 89, § 6). Registering a device requires confirming the account holder's identity, either by checking personal and account data or through secure mechanisms such as tokens, one-time passwords or biometric access, plus two-factor verification codes. From an unregistered device, Pix is capped at R$200 per transaction and R$1,000 per day (Instrução Normativa BCB nº 491/2024, arts. 4 and 9, as amended by Instrução Normativa BCB nº 594/2025).

BaaS and embedded finance

Resolução Conjunta nº 16/2025 lets a licensed institution offer accounts, payments, acquiring and credit through a non-licensed brand, only by electronic integration and with accounts held at the provider (art. 4). The provider stays responsible for KYC, fraud prevention and AML; the brand performs only accessory tasks and must tell customers it is not authorised (arts. 8 and 10). Contracts in force when the rule was published must comply by 31 December 2026 [Existing contracts: 31 Dec 2026] (art. 22).

6. Data protection and biometrics

The Brazilian Data Protection Law (LGPD, Lei nº 13.709/2018) applies to all identity capture. Biometric data are sensitive personal data (art. 5, II). Without consent, onboarding can rely on legal or regulatory obligation, or on fraud prevention and security in electronic identification and authentication (art. 11, II, a and g). Consent, where used, must be specific and highlighted (art. 11, I). The ANPD can fine up to 2% of the group's revenue in Brazil, capped at R$50 million per infringement (art. 52, II). Specific ANPD rules on biometric data are on its regulatory agenda: a call for input ran from 2 June to 1 August 2025, and no draft had been published as of November 2026.

Personal data may be kept after processing ends to meet a legal or regulatory obligation (art. 16, I), which covers the ten-year AML retention. Since 1 March 2026, payment institutions' cyber security policies must include multi-factor authentication for remote access, end-to-end audit trails and penetration testing (Resolução BCB nº 85/2021, art. 3, as amended by Resolução BCB nº 538/2025).

7. Sector-specific obligations

Closing accounts used for unauthorised services

Since 1 December 2025, an institution must close a payment account whose holder uses it to provide financial or payment services without legal authorisation. An example is paying and receiving on behalf of third parties in a way that hides who they are. Criteria are board-approved and kept with closure records for ten years (Resolução BCB nº 96/2021, art. 13, as amended by Resolução BCB nº 518/2025).

Naming and communications

Institutions must use their own internet domain in every email and link sent to customers, and may not partner with unlicensed entities whose names suggest a regulated institution (Resolução Conjunta nº 17/2025, arts. 6 and 8).

8. Risk indicators and red flags

Indicators listed by the BCB (Carta Circular nº 4.001/2020)

• Batch openings: several accounts opened on the same day or in a short period with common elements such as address, phone or holders.
• Shared IP or email: the same email or IP address used by unrelated customers.
• Conflicting data: documents and information that conflict with public records, or are hard to verify.
• Pass-through flows: funds received and immediately used to pay or transfer to third parties without justification.
• Structuring: transfers in round thousands or just below reporting limits.
• Prepaid card cycling: foreign-currency prepaid cards topped up from many sources, or topped up and then withdrawn at once at ATMs.

9. Enforcement and penalties

Two penalty regimes apply. Under the AML law, breaches of identification, record-keeping and reporting duties bring a warning, a fine capped at twice the operation's value, twice the profit or R$20 million, disqualification of managers for up to ten years, or loss of authorisation (Lei nº 9.613/1998, art. 12). Under the BCB's sanctioning law, fines for other breaches reach the greater of 0.5% of the previous year's financial revenue or R$2 billion, alongside public admonition, activity bans and disqualification (Lei nº 13.506/2017, arts. 5 and 7).

On 11 May 2026 the BCB's sanctioning committee (Copas) fined Banco Topázio S.A. R$16.28 million for inadequate AML controls, failure to report suspicious transactions to COAF and failure to qualify foreign-exchange customers. It also barred the bank for two years from certain foreign-exchange operations linked to virtual-asset trading.

10. Recent changes and what to watch

• 1 October 2026, Resolução BCB nº 591[In force]: adds cash foreign exchange and self-custodied wallet transfers of US$10,000 or more to threshold reporting.
• 2 October 2026, Resolução BCB nº 597[In force]: Pix participants must block transactions for fixed-odds betting, following Medida Provisória nº 1.394/2026. A provisional measure has force of law but lapses unless Congress converts it.
• 31 May 2026[Deadline passed]: final window for legacy unauthorised e-money issuers, post-paid issuers and acquirers to apply for authorisation (Resolução BCB nº 494/2025).
• 1 December 2025, BaaS and naming rules[Existing contracts: 31 Dec 2026]: Resolução Conjunta nº 16 regulates BaaS; Resolução Conjunta nº 17 bars misleading names and requires partnerships to be adapted within one year.
• 3 November 2025, minimum capital[In force]: activity-based capital under Resolução Conjunta nº 14 (published 4 November 2025), in full from 1 January 2028.
• 1 December 2025, account opening safeguards[In force]: restriction register check before opening prepaid accounts, and mandatory closure of accounts used for unauthorised financial services (Resoluções BCB nº 476 and 518/2025).

11. What this means for identity verification

• CPF first. Validate the CPF or CNPJ and its status, and refuse or close accounts with an irregular status.
• Documented method. No technology is prescribed, so the KYC manual must justify the documents, database checks and biometric steps used for each risk category.
• Restriction register. Check it before account creation and on every change of holder, and keep the evidence for ten years.
• Devices as identity. Pix device registration requires identity confirmation and two-factor codes, so enrolment works as a step-up check.
• BaaS liability. A licensed provider must control and be able to audit any checks its brand partners perform.