.svg)
On July 22, 2024, the Central Bank of Brazil (BCB) published two resolutions to improve Pix's security mechanisms and has set June 15, 2025, as the new launch date for its Pix Automatic product.
BCB Resolution No. 402/2024 and BCB Resolution No. 403/2024 establish a new general rule to be applied to access devices, such as cell phones or computers, which are used to initiate Pix transactions.
The bigger picture
The BCB continues to advance its state-owned instant payment system, Pix. At the start of July, the BCB announced new open finance rules that included enabling Pix by approximation (in effect, providing contactless payments).
BCB Resolution No. 402/2024 and BCB Resolution No. 403/2024 continue to carry this initiative forward by establishing rules for unregistered devices and announcing a new launch date for the Pix Automatic product.
How do things change?
According to the BCB, the rule states that the initiation of Pix transactions using an unregistered access device may only continue for transactions of up to R$200 (approx. US$35), provided that the daily limit does not exceed R$1,000 (approx. US$177). For transactions outside these limits, the customer must have previously registered the access device. This registration requirement only applies to access devices that have never been used to initiate a Pix transaction.
Resolution highlights
BCB Resolution No. 402/2024 modifies the Pix regulations attached to BCB Resolution No. 1/2020 and includes:
- Amendments regarding payment authorisations using Pix Automatic.
- Requirements for all participants providing transactional accounts to make Pix Automatic available to their customers, in cases where they are acting as service providers to the paying user.
BCB Resolution No. 403/2024 modifies the Pix regulations attached to BCB Resolution No. 1/2020 and includes:
- A requirement for Pix participants to make the initiation of a Pix transaction available through the participant's main application (in terms of number of users), which is offered to natural persons and that is accessible via cell phone.
- Amendments to Articles 89 and 90 of BCB Resolution No. 1/2020 regarding risk management procedures for more robust mechanisms to ensure security of Pix participants.
Implementation timelines
- July 22, 2024: The two resolutions take effect.
- October 28, 2024: Pix participants must comply with BCB Resolution No. 402/2024’s requirements relating to the recurring scheduling of payment transactions related to the scheduled Pix product.
- November 1, 2024: Pix participants must comply with the amendments to Article 89 of BCB Resolution No. 403/2024.
- June 25, 2025: Pix participants must comply with BCB Resolution No. 402/2024’s requirements relating to the initiation of payment transactions related to the Pix Automatic product and its other functionalities.
Why should you care?
Firms will need to consider and understand the operational impacts and legal obligations of the BCB resolutions if they are to meet the forthcoming compliance deadlines. Early compliance and integration can also provide a competitive edge and improve a firm’s attractiveness to customers as the payments sphere evolves in Brazil.
The enhanced security mechanisms mandated by the new regulations should be considered for protecting sensitive customer information and mitigating fraud risks, and only through ensuring that systems and processes align with the latest regulations will companies offering access devices avoid potential regulatory scrutiny.
