Medida Provisória No. 1,394, published on the night of 25 September, terminates federal and state fixed-odds betting authorisations within thirty days, with no refund of the grant fee. Bettors' balances go back by CPF, through the financial institutions. And part of what was announced during the day is not in the text.
The resolution published on 18 September gives institutions seven days to answer a request to cancel a flag, requires them to keep a record of their reasoning, and sets the flag's lifespan at five years. The duty to notify the flagged person, however, only begins on 1 February 2027 — and does not include the reason.
Two different scams are circulating under the same name. In one, the QR Code hides a link and leads to a fake site. In the other, the QR is a payment and the payee has been swapped. The figure that made headlines measures only the first — and the defense against one is useless against the other.
A script injected into Brazilian online stores swaps the Pix QR Code and the copy-and-paste string at the moment of payment, for the exact amount of the purchase. There is no flaw in Pix: the payer's only defense is the payee name that Central Bank rules require the app to display — and that is precisely the name e-commerce has made impossible to verify.
The Banco Central promised that 2026 would bring a lookup showing whether your Pix key had been flagged for fraud — and warned, at the same press conference, that it would not include the reason. As of September 2026, neither exists. The report that does exist has a field called "Situação" (Status), and it answers a different question.
The flag can be created by a single institution acting alone, with no review by any other participant, under a standard the Banco Central itself put in writing that it has yet to define in objective terms. It circulates for five years among every institution — and access to the endpoint that exposes it is barred to the end user.
The rule that extended the contestation window carries two effective dates. Coverage reported the first one. On the second, the infraction report will be required to state which layer of the tracing graph the transaction sits in.
The SPA's public consultation closes on 9 September. The text repeals Ordinance 827/2024 in full, replaces two grounds for denial with twelve, and reaches operators that are already licensed.
Art. 91 of BCB Resolution No. 520 does not merely bar trading crypto with an unlicensed provider. The prohibition reaches the opening and maintenance of payment accounts — and anyone who filed an application is still on the inside.
Law 15.358 turned the payment rail into the enforcement point for unlicensed betting. The National Monetary Council resolution that took effect on 28 August sets the clock: 24 hours to block, 24 to reject a transaction, 48 to report back.
Brazil's Special Return Mechanism has six deadlines, and they don't carry equal weight. Five are service-level targets, measured by percentile. One is a deadline with an automatic consequence — and the party that misses it is the defrauded customer's own PSP.
The Brazilian Central Bank will add to each infraction notification the hop depth at which a transaction sits along the fraud trail. Layering stops being invisible to whoever receives the notification — and the first-hop problem finally gets a number.