On the MED clock, the only deadline that releases the money belongs to the victim's bank

Version 4.4 of the Special Return Mechanism (MED) implementation guide takes effect on September 1, and the change it brings has already been covered here: the window to contest a return transaction rises from 30 to 80 days, matching that of the original transaction. On October 26, the second change in the same version arrives — the tracing-graph layer in the infraction report.

Between those two dates, what doesn't change is the clock. And the clock holds the least-discussed part of the mechanism: MED deadlines are not all of the same nature, and the difference between them determines who foots the bill when the return never happens.

The six deadlines

The MED flow for well-founded suspicion of fraud is set out in section 4.2.4 of the guide, across thirteen steps. Drawn from that section and from the Pix Timing Manual, the timeframes are as follows:

Five of these are service-level indicators: the Central Bank measures them by percentile, and non-compliance surfaces as participant performance. The sixth is of a different order altogether.

What happens when each one runs out

The first stretch of the clock belongs to the defrauded customer's bank, and it is short. The guide requires that the Funds Recovery be opened immediately after the complaint — it recommends ten minutes and measures thirty in 95% of cases. More significant than the number is the prohibition that comes with it: at that moment, the PSP must not assess the merits of the complaint, nor request supporting documentation, police report included. Analysis comes later; the procedure is opened first, because every minute cuts the odds that the money is still there.

Once the report is filed, the freeze on the receiving end is immediate, and if the account lacks sufficient balance, whatever is there gets frozen — including credits that arrive afterward, accumulated up to the amount claimed.

From that point on, every PSP that received funds along the chain has seven calendar days to state whether its own customer committed the fraud. Accepting keeps the freeze in place; rejecting releases the funds and simultaneously voids all reports in the downstream layers that depended on that link.

Once analysis concludes, the ball returns to the victim's bank. And this is where the clock changes character.

The inverted 72 hours

With the analysis stage complete, the paying PSP has 72 hours to initiate the return. If it doesn't, the guide is explicit about the effect, in a footnote to step 8: DICT automatically closes the Funds Recovery, and the recipients' PSPs must unfreeze the funds in their customers' accounts and notify them.

It's worth rereading what that means. The money was frozen. The banks that received it had already acknowledged the fraud. And what releases the freeze is nobody's decision on the merits: it is the silence of the victim's own bank, converted by the system into an automatic act.

No other MED deadline is designed this way. Missing the thirty-minute target, or the six-hour one, produces a poor indicator. Missing the 72 hours releases the money to whoever received it.

Liability follows the clock

Section 4.2.5 closes the loop, and it's the part that matters to anyone accountable for compliance.

The general rule is that no one covers fraud out of their own pocket: if the receiving PSP rejects the return for insufficient balance or a closed account, it has no obligation to make up the difference; and neither does the paying PSP, provided it complied with the Pix Regulation on transaction authorization.

There are two exceptions, and both stem from the participant's conduct, not the fraudster's. If the receiving PSP rejects the infraction report in a case that was, in fact, fraud, it becomes liable for the return. And if the report was accepted by the recipient but the paying PSP cancelled the recovery or failed to request the return, liability for reimbursement falls on the paying PSP. In both scenarios the user may bring a dispute against the institution under the Pix Dispute Resolution Manual, with the courts open to whichever side loses.

In other words: the 72 hours are not merely an operational deadline. They are the point at which the victim's bank's inaction stops being slowness and becomes its own civil liability.

Why the chain stretches the clock

One detail remains, and it reframes everything above. Return requests do not go out in parallel. DICT sends to one PSP, waits for completion, assesses whether there is still a balance to recover, and only then sends to the next. That's six hours per participant, sequentially. The guide does the math itself: with four PSPs in the chain, the return stage can take up to 24 hours.

That's why the layer matters, and why the information arriving on October 26 — the transaction's position in the tracing graph — is not a technical footnote. Money that has passed through many accounts isn't just harder to find: it is returned more slowly, because the mechanism chases it one link at a time.

The takeaway

MED is often described as a button: you press it and the money comes back, or it doesn't. Read through the clock, it is something else — a chain of obligations on distinct timeframes, in which most deadlines are measured statistically and only one produces an immediate, irreversible effect on the money.

For anyone running compliance at a PSP, the practical consequence is that monitoring the 72 hours in step 8 is not the same job as chasing a service-level indicator. It is direct liability risk management.

For the defrauded customer, the reading is simpler and more uncomfortable: between the funds being frozen and their release back to the recipient lies a three-day window that depends entirely on their own bank taking action.

Sources

Guia de implementação dos procedimentos de devolução no Pix, com ênfase no Mecanismo Especial de Devolução — version 4.4, sections 4.2.4 and 4.2.5, effective September 1 and October 26, 2026.

Manual de Tempos do Pix — version 7.0, sections 4.2.1.1, 4.2.1.6, 4.2.1.8 and 4.2.2.7.

Manual de Resolução de Disputas do Pix — Section 3, dispute resolution between Pix participants and end users.