To ensure greater cybersecurity and operational resilience in the National Financial System (SFN), the Central Bank of Brazil (BCB) continues to strengthen its regulatory framework. Recently, amendments were made to BCB Resolutions No. 494, 495, and 496, published on September 9, 2025, with the aim of introducing relevant changes to the regulatory framework governing the operation of Payment Institutions (PIs) and Information Technology Service Providers (ITSPs), both institutions that operate within the SFN, with significant impacts on the business model of fintechs, payment institutions, and infrastructure providers.
Among the main points, the most notable is the advancement of the deadline for investment institutions (IPs) to request operating authorization from the Central Bank of Brazil (BCB): now, the request must be made by May 2026, and no longer by December 2029. It is also expressly prohibited to begin operations without prior regulatory authorization. An increase in the minimum share capital of IPs to R$ 7 million was also approved, reinforcing the regulator's commitment to the financial soundness of the sector and the mitigation of systemic risks.
The regulations also impose new requirements on PSTIs – companies that enable the operation of services such as Pix, TED, and DOC for institutions that are not direct participants in the SFN (National Financial System). From now on, PSTIs must observe more robust governance and risk management standards, as well as demonstrate a minimum capital of R$ 15 million. In case of non-compliance, precautionary measures may be applied or even the institution may be de-accredited, which represents a structural change for the financial market in its current configuration. The deadline for compliance is up to four months from the entry into force of the resolutions.
Another relevant measure is the temporary limitation of R$ 15,000 per Pix and TED transaction for unauthorized IPs or those connected via PSTI, until they adopt and demonstrate compliance with the new cybersecurity controls. This restriction impacts the operational dynamics of institutions that process payments for companies with high transaction values. Finally, a transition period of up to 90 days was foreseen for institutions to demonstrate the implementation of these controls, in order to avoid abrupt service disruptions.
Furthermore, existing contracts between IPs and PSTIs must be adjusted within 180 days of the publication date of the regulations to meet the new requirements, including the stipulation that only institutions belonging to segments S1 to S4, which are not cooperatives, may act as intermediaries for Pix for unauthorized IPs.
Regulations are in place that require institutions to reject payment transactions destined for accounts (checking, savings, or prepaid payment accounts) that are under reasonable suspicion of fraud. This analysis must be carried out through internal electronic systems or public or private databases. Furthermore, institutions must notify the account holder whenever a transaction is rejected based on suspicion. The deadline for adapting systems to comply with the Resolution is October 13, 2025.
The new measures demonstrate the Central Bank of Brazil's (BCB) effort to strengthen the operational resilience of the National Financial System (SFN) and reduce vulnerabilities in critical payment services. For regulated institutions, the current situation calls for a careful review of contracts, governance policies, and information security practices. The changes also reflect an institutional response to recently exposed weaknesses, such as the misuse of fintech structures by criminal organizations and the increase in cyber incidents, reinforcing the need for more robust controls and continuous monitoring.
To consult the complete version of BCB Resolutions No. 494, 495 and 496, amended on September 5, 2025 and Resolution 501 and Normative Instruction No. 664 September 11, 2025.
Contact us for more information.