Fintech 2026

BRAZIL Law and Practice Contributed by: Eduardo Castro, Pedro Nasi and Gabriel Libanori, Machado, Meyer, Sendacz e Opice

pants. Based on the projects’ results, the applicable regulator may or may not change the current rules to regulate innovative activities or business structures. There is no official news regarding additional cycles. 2.6 Jurisdiction of Regulators The Brazilian financial ecosystem is comprehensively regulated. The legal framework for banking activities, payment services and securities offering/trading is underpinned by Law No 4,595/64, Law No 12,865/13, Law No 6,385/76 and Law No 4,728/65. In general, fintech companies are subject to rules issued by the BCB, the CMN and the CVM, depending on the nature of the services rendered, the attainment of certain thresholds (as applicable) and the market in which the fintech company operates (or intends to operate). In addition, self-regulatory organisations may play an important role through binding standards for their members and participants, depending on the busi - ness model implemented by fintechs in Brazil – eg, the Brazilian Financial and Capital Markets Association ( Associação Brasileira das Entidades dos Mercados Financeiro e de Capitais – ANBIMA), the B3 supervi - sory body ( BSM Supervisão de Mercados ) and private payment arrangement settlors. 2.7 No-Action Letters Regulators in Brazil do not issue “no-action” letters. 2.8 Outsourcing of Regulated Functions Certain regulated functions may be “outsourced” through contractual arrangements maintained between regulated and non-regulated entities, between two regulated entities or through more than one regulated entity. The outsourcing of regulated functions is usually achieved through two kinds of contractual arrange - ments, as follows. Banking as a Service In BaaS, one entity retains another to provide regu - lated services to its clients through technological inte - gration (ie, white-label or co-branded solutions). BaaS

providers must always be regulated entities, but BaaS contractors can be either regulated or non-regulated. This relationship was recently regulated by the BCB through the enactment of CMN BCB Joint Resolution No 16/2025, which provides a dedicated regulatory framework for BaaS. Full regulatory accountability has been assigned to the BaaS provider, requiring robust corporate governance, adequate risk management and internal controls, as well as operational and infor - mation security measures consistent with the nature of the services offered. Banking Correspondence Regulated and non-regulated entities can function as banking correspondents of institutions authorised to operate by the BCB. This relationship is regulated by CMN Resolution No 4,935 of 29 July 2021. This Reso - lution provides that the banking correspondent must offer services under the guidelines of the contracting entity, which is fully liable for the service provided to end users through its banking correspondents. There are also specific contract requirements concerning remuneration and forbidden activities, etc. 2.9 Gatekeeper Liability Fintech providers are indirectly deemed as gatekeep - ers responsible for the regulated activities on their platform, especially regarding AML/CFT and the pro - liferation of weapons of mass destruction, based on the provisions of BCB Circular No 3,978 of 23 January 2020. Also, regulated entities are viewed as gatekeep - ers with respect to cybersecurity, internal controls (which include antifraud measures) and risk manage - ment requirements when carrying out their activities. 2.10 Significant Enforcement Actions Enforcement actions taken by the BCB and the CVM are based on Law No 13,506 of 13 November 2017. This law establishes a procedure for the imposition of administrative sanctions within the regulatory scope of the BCB and the CVM, listing acts considered as administrative wrongdoings. BCB Resolution No 131/21 details administrative sanctioning proceed - ings, criteria for violations classification, procedural rules and penalties guidelines. CVM Resolution No 45/21 governs the administrative sanctions proce - dural rules.

104 CHAMBERS.COM