A healthcare organization reported a data breach to the ANPD and posted a notice on its own website. The Authority opened a sanctioning proceeding anyway — because the duty to notify has content and a channel defined by regulation, and neither is the controller's to choose.
BCB Resolution No. 584 bars newly deposited funds from leaving for a foreign entity or self-custody wallet within 24 hours. Releasing early is discretionary — and requires a reasoned, documented decision. Effective January 1, 2027.
The Brazilian Central Bank will add to each infraction notification the hop depth at which a transaction sits along the fraud trail. Layering stops being invisible to whoever receives the notification — and the first-hop problem finally gets a number.
As of September 1, the window to contest a Pix return transaction goes from 30 to 80 days. It is the recourse available to whoever was debited by a MED they consider improper — and every wrong call along that chain has an owner named by the rulebook.
The standard that classifies authenticators puts SMS codes and app codes in the same bucket: neither one holds up against phishing. The attack that dominates today doesn't break the code — it lets you type it correctly and keeps the result.
The coverage read Chainalysis's report as escalation. The data says otherwise — and the finding that deserved the headline is a different one: illicit flow doesn't spread out, it piles up in five addresses.
Screening answers a question about the address. What supervisors ask about is who stands behind it — two different questions, with answers that rarely line up.
Those who move illicit money in crypto tend to confuse pseudonymity with invisibility. They are not the same thing, and the difference surfaces at precisely the moment they need to turn it into spendable money.
What determines whether a case has anywhere to go is rarely what happens the following week. It's what gets preserved — or unwittingly destroyed — in the first hours, by someone who doesn't yet know they'll need it.
The meaningful shift isn't a new line item on the checklist. It's where the burden sits: what used to be "there was no way to know" becomes "there was a duty to know."
A bureau tells you what someone is today. An investigation tells you what they did, with whom, and how it can be proven. The difference isn't one of depth — it's one of kind.