The resolution published on 18 September gives institutions seven days to answer a request to cancel a flag, requires them to keep a record of their reasoning, and sets the flag's lifespan at five years. The duty to notify the flagged person, however, only begins on 1 February 2027 — and does not include the reason.
A script injected into Brazilian online stores swaps the Pix QR Code and the copy-and-paste string at the moment of payment, for the exact amount of the purchase. There is no flaw in Pix: the payer's only defense is the payee name that Central Bank rules require the app to display — and that is precisely the name e-commerce has made impossible to verify.
The Banco Central promised that 2026 would bring a lookup showing whether your Pix key had been flagged for fraud — and warned, at the same press conference, that it would not include the reason. As of September 2026, neither exists. The report that does exist has a field called "Situação" (Status), and it answers a different question.
The flag can be created by a single institution acting alone, with no review by any other participant, under a standard the Banco Central itself put in writing that it has yet to define in objective terms. It circulates for five years among every institution — and access to the endpoint that exposes it is barred to the end user.
The rule that extended the contestation window carries two effective dates. Coverage reported the first one. On the second, the infraction report will be required to state which layer of the tracing graph the transaction sits in.
Cronos, the chain maintained by Crypto.com, halted for nine hours and restored the state prior to the Tectonic attack. $68.7 million came back. The roughly $6 million already bridged to Ethereum did not.
Art. 91 of BCB Resolution No. 520 does not merely bar trading crypto with an unlicensed provider. The prohibition reaches the opening and maintenance of payment accounts — and anyone who filed an application is still on the inside.
Law 15.358 turned the payment rail into the enforcement point for unlicensed betting. The National Monetary Council resolution that took effect on 28 August sets the clock: 24 hours to block, 24 to reject a transaction, 48 to report back.
Brazil's Special Return Mechanism has six deadlines, and they don't carry equal weight. Five are service-level targets, measured by percentile. One is a deadline with an automatic consequence — and the party that misses it is the defrauded customer's own PSP.
BCB Resolution No. 584 bars newly deposited funds from leaving for a foreign entity or self-custody wallet within 24 hours. Releasing early is discretionary — and requires a reasoned, documented decision. Effective January 1, 2027.
The Brazilian Central Bank will add to each infraction notification the hop depth at which a transaction sits along the fraud trail. Layering stops being invisible to whoever receives the notification — and the first-hop problem finally gets a number.
As of September 1, the window to contest a Pix return transaction goes from 30 to 80 days. It is the recourse available to whoever was debited by a MED they consider improper — and every wrong call along that chain has an owner named by the rulebook.