BCB Instruction Normative No. 667 — Waiver of the R$15,000 Pix Emission Limit for Institutions Connecting via IT Service Providers

INSTRUCTION NORMATIVE BCB NO. 667, OF SEPTEMBER 22, 2025

Regulates the waiver of compliance with the emission limit for Pix transactions exceeding R$15,000.00 (fifteen thousand reais) by institutions that connect to the National Financial System Network – RSFN through an Information Technology Service Provider – PSTI.

The Head of the Information Technology Department – Deinf, the Head of the Strategic Management and Specialized Supervision Department – Degef, and the Head of the Banking Operations and Payment Systems Department – Deban, in the exercise of their powers, having regard to the provisions of art. 23, item I, letter “a”, art. 70, item I, letter “a”, and art. 112, item IV, letters “a” and “b”, all of the Internal Regulations of the Central Bank of Brazil, annexed to BCB Resolution No. 340, of September 21, 2023, and considering the provision of art. 37, § 6º, item II, of the Regulation Annexed to BCB Resolution No. 1, of August 12, 2020,

R E S O L V E:

Art. 1º This Instruction Normative regulates the temporary waiver of compliance with the emission limit for Pix transactions exceeding R$15,000.00 (fifteen thousand reais) by institutions that connect to the National Financial System Network – RSFN through an Information Technology Service Provider – PSTI.

Sole Paragraph. The waiver referred to in the caput shall only be applied on weekdays, from Monday to Friday, during the period from 6:30 AM to 6:30 PM.

Art. 2º To obtain the waiver, for a period of ninety days, of the maximum limit referred to in art. 1º, the institution authorized to operate by the Central Bank of Brazil and which is a Pix participant must file a request accompanied by a formal document demonstrating the constitution of the guarantee referred to in art. 3º and describing the measures adopted for the implementation of the information security controls described in arts. 4º and 5º, and must also be accompanied by the reasonable assurance report referred to in art. 6º.

Sole Paragraph. The temporary waiver referred to in the caput shall only take effect from the formal communication to the participant of the joint decision of the Banking Operations and Payment Systems Department (Deban), the Information Technology Department (Deinf), and the Strategic Management and Specialized Supervision Department (Degef) of the Central Bank of Brazil, after analysis of the documentation presented by the institution.

Art. 3º The requesting institution, as a guarantee, must maintain, at a minimum, a capital surplus in the amount of 100% (one hundred percent) on the maximum daily volume of interbank transfers carried out from its PI Account referred to in art. 2º, item VI, of the Regulation Annexed to BCB Resolution No. 195, of March 3, 2022, during the period between August 1, 2025, and August 29, 2025.

§ 1º The capital surplus, whose value, for the purposes of the guarantee referred to in this Instruction Normative, shall correspond to at least the amount provided in the caput, is defined as:

I - for conglomerates and type 1 and type 3 institutions belonging to segments S1 to S4, the smallest capital excess in relation to the requirements for minimum Core Capital, Tier 1, and Reference Equity, calculated in accordance with current regulation;

II - for conglomerates and type 1 and type 3 institutions belonging to segment S5, the capital excess in relation to the minimum requirement for S5 Reference Equity (PRS5), calculated in accordance with current regulation; and

III - for type 2 conglomerates and institutions, the capital excess in relation to the minimum requirement for IP Reference Equity (PRIP), calculated in accordance with current regulation.

§ 2º The requirement referred to in the caput shall be cumulative with the guarantee presented based on BCB Instruction Normative No. 666, of September 22, 2025.

Art. 4º In the case where data processing services related to Pix emission and connectivity for access to the RSFN provided by a PSTI are used, the institution must attest that:

I - it does not share with the PSTI, or store in the provider's environment, the private keys, related to the digital certificates registered with the Central Bank of Brazil, which are used for signing messages;

II - the digital certificates, related to the private keys used for signing messages that were in the PSTI's environment or to which the PSTI had access, were revoked by the respective certifying authority and deactivated in Pix;

III - it uses distinct digital certificates for different environments;

IV - it adopts separate digital certificates for signing messages and for establishing channels in Pix;

V - it implements periodic and timely review of access permissions, especially for third-party collaborators with access to the institution's computational environment and reserve operation;

VI - regarding fraud management:

a) validates the integrity of transactions before their signing, ensuring that the information has not been fraudulently generated, corrupted, or manipulated during the message generation process; and

b) performs monitoring twenty-four hours a day, seven days a week, for real-time identification, based on historical and behavioral patterns, of atypical or fraudulent transactions, evaluating deviations from the expected parameters, including:

1. the transactioned values;

2. the volume of transactions; and

3. the quantity of transactions per unit of time; and

VII - it has mechanisms for interrupting the processing of transactions in case of suspicion of serious compromise of its systems or the systems of the contracted PSTI.

Art. 5º In cases where only the connectivity service provided by a PSTI for access to the RSFN is used, in addition to the requirements provided in art. 4º, the institution must attest that:

I - it implements mechanisms for encryption, intrusion prevention and detection, information leak prevention, and protection against malicious software;

II - it implements transaction traceability mechanisms that include, at a minimum:

a) end-to-end processing audit trails of data and information, including the definition and generation of logs that allow identifying processing failures or atypical behavior, as well as supporting analyses;

b) definition of information retention time according to the type of processing performed; and

c) secure retention of audit trails;

III - it implements data and information backup management;

IV - it performs vulnerability assessment and correction that includes, at a minimum:

a) periodic tests and analyses for detecting vulnerabilities in information systems;

b) periodic physical scans of the technological environment that allow identifying devices improperly connected to the corporate network that may establish connection with external technology assets;

c) periodic analyses of the technological environment with the objective of identifying vulnerabilities that may compromise the security of technology assets; and

d) periodic intrusion tests;

V - it implements an access control policy that includes, at a minimum:

a) mechanisms to limit access to the corporate network to authorized users and devices;

b) periodic and timely review of access permissions, especially for third-party collaborators with access to the institution's computational environment;

c) establishment of multiple authentication factors for access to the corporate network from external environments; and

d) administrative access using multiple authentication factors, for the internal Pix processing environments;

VI - it has a process for the regular evaluation and application of security patches;

VII - it deploys network protection mechanisms that include, at a minimum:

a) establishment of firewall rules, as well as connection monitoring, avoiding connection attempts to critical systems from technology assets located outside the institution's corporate network;

b) definition of criteria for establishing and monitoring connections with external environments, especially during nighttime or unconventional hours;

c) mechanisms to identify and prevent improper connections to external environments from the institution's computational environment; and

d) implementation and maintenance of processes and tools for identifying, analyzing, and treating atypical events in the environment, such as the opening of virtual private networks - VPN and attempts at privileged access, especially during nighttime or unconventional hours, as well as analysis of the implementation of more robust controls that mitigate risks of improper access on these occasions;

VIII - it segregates computational environments, limiting access to the production environment and critical computational resources;

IX - it physically and logically isolates the Pix processing environment from other systems, maintaining a dedicated and separate instance from other environments in cases of public cloud use;

X - it performs digital certificate management that includes, at a minimum:

a) monitoring the use of digital certificates and controls for the storage of this information; and

b) validation of revoked certificates with certifying authorities; and

XI - it implements a fraud management policy, adopting the following measures:

a) establishment of a channel for reporting indications of fraud; and

b) establishment of a system for identifying atypical or fraudulent transactions in real time, evaluating deviations from expected parameters.

Art. 6º The fulfillment of the requirements referred to in arts. 4º and 5º must be attested by a reasonable assurance report prepared by an independent audit firm registered with the Securities and Exchange Commission – CVM, which must be presented to the Central Bank of Brazil for the filing of the request referred to in art. 2º.

§ 1º The independent audit firm contracted by the institution must possess technical, administrative, and operational capacity compatible with the performance of the reasonable assurance work provided for in this Instruction Normative.

§ 2º The Central Bank of Brazil may deny the temporary waiver request or adopt the measure referred to in art. 9º if it detects, at any time, that the contracted audit firm does not meet the requirements of § 1º and the norms and audit procedures determined by the CVM and the Federal Accounting Council.

Art. 7º The request referred to in art. 2º must be signed by a Statutory Director responsible for cybersecurity policy, designated by the institution in accordance with current regulation, who will commit to the veracity of the information presented to the Central Bank of Brazil, subjecting himself/herself to the measures provided in Law No. 13.506, of November 13, 2017.

Art. 8º The temporary waiver referred to in art. 1º may be extended for successive periods of, at most, ninety days, until the institution meets the requirements provided in art. 37, § 4º of the Regulation Annexed to BCB Resolution No. 1, of August 12, 2020, and provided that it has not presented serious operational deficiencies or failures during previous waiver periods.

Art. 9º The temporary waiver referred to in art. 1º may be revoked at any time, if the institution:

I - presents serious operational deficiencies or failures;

II - maintains outdated information about its capital; or

III - does not observe the provisions of art. 3º.

Art. 10. When filing the information and documents required in this Instruction Normative, institutions must select, in the Central Bank of Brazil's Digital Protocol, the subject “Documents for evaluation of waiver of established limits – Pix – PSTI” for destination to Degef.

Art. 11. This Instruction Normative enters into force on the date of its publication.

CAIO MOREIRA FERNANDES

Head of Deinf

ARISTIDES ANDRADE CAVALCANTE NETO

Head of Degef

FABIO MARTINS TRAJANO DE ARRUDA

Head of Deban