BRAZIL Trends and Developments Contributed by: Roberto Panucci Filho, Tiago Severo Pereira Gomes, Diogo Octavio Nebias and Guilherme Teles, Panucci, Severo e Nebias Advogados
Challenges and guardrails At the same time, regulators are reinforcing the sys- tem’s guardrails. The 2023‒24 incident, whereby a mid-sized bank relied excessively on deposit insur- ance to fund risky assets, triggered reforms to the Deposit Insurance Fund ( Fundo Garantidor de Crédi- tos , or FGC) to deter moral hazard. The New Legal Framework for Secured Transactions modernised collateral law to reduce credit costs and improve recovery rates. And a pipeline of new rules on credit, financing and investment companies ( sociedades de crédito, financiamento e investimento , or SCFIs) (collectively, “finance companies”), BaaS, and virtual asset service providers (VASPs) will bring more play- ers inside the prudential perimeter while preserving room for innovation. Payments security, AML and supervisory tightening A mid-2025 cyber-enabled heist exposed fragilities at the intersection of payments and third-party connec- tivity. In early July 2025, attackers exploited a third- party connectivity provider ( provedor de serviços de tecnologia da informação , or PSTI) used by multiple participants. A BaaS provider reported approximately BRL400 million drained from its reserve account amid a broader incident initially estimated at BRL800 million across eight institutions, prompting emergency con- tainment and sector-wide reviews of PSTI interfaces. In parallel, Brazilian authorities launched sweeping AML actions in late August 2025. Operação Carbono Oculto (Operation Hidden Carbon) alleged that an organised network used payment institutions as a “parallel bank” and layered proceeds through at least 40 investment funds. The episode intensified scrutiny of fund governance and administrators’ AML controls. Immediate risk-mitigation measures The Central Bank of Brazil introduced a tempo- rary BRL15,000 ceiling per Pix/TED ( Transferência Eletrônica Disponível ) electronic fund transfer for non- authorised payment institutions and for participants connecting via PSTIs, with a time-limited waiver (up to 90 days) for firms evidencing robust information- security controls. The package also raised the bar for PSTI governance and minimum capital (BRL15 mil-
lion), signalling that third-party connectivity is now treated as critical infrastructure. Authorisation becomes a hard gate BCB Resolution 494 (5 September 2025) closes leg- acy “start-first, authorise-later” pathways to payment institutions; all new payment institutions must obtain prior authorisation before commencing activities. For incumbents that started operations under historical thresholds, the regularisation window is fixed between 1–31 May 2026. Failure to file within that window trig- gers cessation of activity and prompt return of client funds. Resolution 495 tightens the authorisation fil- ing requirements, enabling the Central Bank of Brazil to demand independent technical certifications and reinforcing premises and governance requirements. New regime for PSTIs BCB Resolution 498 (5 September 2025) institutes a formal credentialling regime for PSTIs that intermedi- ate access to the National Financial System Network ( Rede do Sistema Financeiro Nacional , or RSFN). The rule elevates minimum standards for capital, govern- ance, cybersecurity, fraud monitoring and continuity; non-compliance may lead to cautions, tighter operat- ing limits, suspension from the RSFN or de-creden- tialling. Transition timelines apply to PSTIs already in operation. Market impact Collectively, the measures strengthen AML oversight and reduce fraud vectors across Pix and interbank rails, while increasing compliance costs and bring- ing previously lightly regulated actors firmly within the perimeter. For managers, administrators and trustees, the enforcement wave around Operação Carbono Oculto raises the expectation of enhanced investor due diligence files, beneficial ownership transparen- cy, and transaction monitoring around flows between payment institutions and funds. In short, regulators are moving to a more mature, risk-based regime that safeguards innovation while tightening operational and financial-crime controls. Global relevance For foreign clients, Brazil is not only a large market but also a regulatory laboratory. Lessons from Pix, open finance, and soon Drex (the Brazilian central bank dig-
67 CHAMBERS.COM
Powered by FlippingBook