Brazil's Central Bank rolls out crypto retention rule and Pix security upgrades

The Banco Central do Brasil announced a series of measures aimed at strengthening the security of the country's payment ecosystem. Starting on 10 August 2026, banks will receive detailed tracking information for Pix transfers, and on 1 September 2026 the contestation period for the Special Refund Mechanism (MED) will be extended from 30 to 80 days. A new “orange‑account” monitoring tool will also be deployed to flag accounts used in fraud schemes.

In a separate regulation that takes effect on 1 January 2027, virtual‑asset service providers must retain cryptocurrency transfers exceeding US$10,000 for up to 24 hours for additional risk analysis. The rule targets stablecoins and other crypto assets that are increasingly used to move proceeds of fraud quickly, especially to foreign destinations or self‑custody wallets.

The Central Bank also faces an internal challenge dubbed “PixExit,” as senior technical staff responsible for the design and operation of Pix are leaving for other public agencies, raising concerns about the continuity of innovation and security. Discussions are under way about a shared, federated fraud‑data platform that could provide a common baseline of protection for all financial institutions.