BCB Normative Instruction No. 291

BCB NORMATIVE INSTRUCTION No. 291, OF 29 JULY 2022

Establishes the necessary procedures for joining Pix.

The Head of the Department of Competition and Financial Market Structure (Decem), using the authority conferred by art. 97-A, item X, subitem "b", of the Internal Rules of the Central Bank of Brazil, annexed to Administrative Rule No. 84,287, of 27 February 2015, and considering the provisions of § 3 of art. 25 of the Regulation annexed to BCB Resolution No. 1, of 12 August 2020,

R E S O L V E S :

Art. 1 The process of joining Pix consists of three stages:

I - registration stage;
II - homologation stage; and
III - restricted operation stage.

CHAPTER I OF THE REGISTRATION STAGE

Art. 2 For institutions that have authorization to operate issued by the Central Bank of Brazil and that intend to act as transactional account providers, the registration stage comprises the sending of the institution's information, according to the template available in Annex I of this Normative Instruction, and of the products it will offer, according to the template available in Annex I of BCB Normative Instruction No. 290, of 29 July 2022. Art. 2 For institutions that have authorization to operate issued by the Central Bank of Brazil and that intend to act as transactional account providers, the registration stage comprises the sending, and subsequent approval by Decem, of the following documents: (Wording given, as of 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)

I - Pix joining form, containing the institution's information, according to the template available in Annex I of this Normative Instruction; (Included, as of 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)
II - form of products and services it will offer, according to the template available in Annex I of BCB Normative Instruction No. 290, of 29 July 2022; and (Included, as of 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)
III - self-assessment questionnaire on security, duly signed by the director responsible for the cybersecurity policy: (Included, as of 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)
- a) according to the template available in Annex VI of this Normative Instruction, if it intends to directly access the DICT and be a direct participant in the SPI; or (Included, as of 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)
- b) according to the template available in Annex VII of this Normative Instruction, if it intends to indirectly access the DICT and be an indirect participant in the SPI. (Included, as of 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)

§ 1 Institutions exclusively offering prepaid payment accounts must have prior authorization from the Central Bank of Brazil to issue electronic money, except in the cases of exemption provided for in art. 16 of BCB Resolution No. 80, of 25 March 2021. § 1 Institutions exclusively offering prepaid payment accounts must have prior authorization from the Central Bank of Brazil to issue electronic money, or be exempt from doing so, as provided for in specific regulations. (Wording given, as of 1/3/2023, by BCB Normative Instruction No. 352, of 15/2/2023.)

§ 2 Only joining requests filed with the CNPJ of the head office will be accepted.

§ 3 At the discretion of the applicant institution, the same director may be appointed for matters related to Pix and the Instant Payment System (SPI).

Art. 3 For institutions that have authorization to operate issued by the Central Bank of Brazil and that intend to act exclusively as special settlement agents, the registration stage comprises the sending of the institution's information, according to the template available in Annex II of this Normative Instruction. Art. 3 For institutions that have authorization to operate issued by the Central Bank of Brazil and that intend to act exclusively as special settlement agents, the registration stage comprises the sending, and subsequent approval by Decem, of the following documents: (Wording given, as of 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)

I - Pix joining form, containing the institution's information, according to the template available in Annex II of this Normative Instruction; and (Included, as of 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)
II - self-assessment questionnaire on security, according to the template available in Annex VIII of this Normative Instruction, duly signed by the director responsible for the cybersecurity policy. (Included, as of 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)

§ 1 Only joining requests filed with the CNPJ of the head office will be accepted.

§ 2º At the discretion of the requesting institution, the same director may be designated for matters related to Pix and the Instant Payment System (SPI).

Art. 4º For institutions that do not have authorization to operate issued by the Central Bank of Brazil, the registration stage comprises the submission of the institution's information, according to the template available in Annex III of this Normative Instruction, and of the products it will offer, according to the template available in Annex II of BCB Normative Instruction No. 290, of 2022. Art. 4º For institutions that do not have authorization to operate issued by the Central Bank of Brazil, the registration stage comprises the submission, and subsequent approval by Decem, of the following documents: (Text given, as of 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)

I - Pix membership form, containing the institution's information, according to the template available in Annex III of this Normative Instruction; (Included, as of 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)
II - form of products and services it will offer, according to the template available in Annex II of BCB Normative Instruction No. 290, of 29 July 2022; (Included, as of 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)
III - security self-assessment questionnaire, according to the template available in Annex VII of this Normative Instruction, duly signed by the director responsible for the cybersecurity policy; (Included, as of 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)
IV - contract signed with the responsible participant, under the terms of the Pix Regulation; and (Included, as of 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)
V - declaration signed by the responsible participant that, under the terms of the Pix Regulation, the contracting institution has paid in the required minimum capital amount. (Included, as of 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)

§ 1º In addition to the aforementioned information, the institutions referred to in the caput must also submit:

I - contract signed with the responsible participant, under the terms of the Pix Regulation; and
II - declaration signed by the responsible participant that, under the terms of the Pix Regulation, the contracting institution has paid in the required minimum capital amount.

§ 1º (Repealed, as of 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)

§ 2º Only membership applications filed with the CNPJ of the head office will be accepted.

Art. 5º For institutions that have authorization to operate issued by the Central Bank of Brazil and that intend to act exclusively as initiators, the registration stage comprises the submission of the institution's information, according to the template available in Annex IV of this Normative Instruction, and of the products it will offer, according to the template available in Annex III of BCB Normative Instruction No. 290, of 2022. Art. 5º For institutions that have authorization to operate issued by the Central Bank of Brazil and that intend to act exclusively as initiators, the registration stage comprises the submission, and subsequent approval by Decem, of the following documents: (Text given, as of 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)

I - Pix membership form, containing the institution's information, according to the template available in Annex IV of this Normative Instruction; (Included, as of 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)
II - form of products and services it will offer, according to the template available in Annex III of BCB Normative Instruction No. 290, of 2022; and (Included, as of 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)
III - security self-assessment questionnaire, duly signed by the director responsible for the cybersecurity policy: (Included, as of 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)
- a) according to the template available in Annex IX of this Normative Instruction, if it intends to access DICT directly; (Included, as of 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)
- b) according to the template available in Annex X of this Normative Instruction, if it intends to access DICT indirectly; or (Included, as of 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)
- c) according to the template available in Annex XI of this Normative Instruction, if it intends not to access DICT. (Included, as of 2/5/2023, by Normative Instruction BCB No. 373, of 25/4/2023.)

§ 1º The transactional account provider that intends to offer the payment initiation service must indicate its option by submitting the form available in Annex I of this Normative Instruction, and the products form, as per the model available in Annex I of Normative Instruction BCB No. 290, of 2022.

§ 2º Direct credit societies, peer-to-peer lending societies, microentrepreneur and small business credit societies, securities distribution societies, and securities brokerage societies may only request exclusive participation in the initiator modality if they hold prior authorization to act as payment transaction initiators, duly granted by the Central Bank of Brazil, under the terms of Resolution BCB No. 80, of 2021. § 2º Institutions that intend to offer the payment transaction initiation service must have prior authorization from the Central Bank of Brazil or be exempt from doing so, as provided in specific regulations. (Text given, as of 1º/3/2023, by Normative Instruction BCB No. 352, of 15/2/2023.)

Art. 6º The entity of the organized cooperative system of two or three levels that intends to act as a settlement agent in the SPI for at least one singular credit cooperative affiliated with a central credit cooperative, in addition to the information referred to in art. 2º, must provide, for each singular credit cooperative, the following information:

I - CNPJ registration; and
II - number of active customer accounts at the time of the membership request, in the following modalities:
- a) number of demand deposit accounts;
- b) number of savings deposit accounts; and
- c) number of prepaid payment accounts.

§ 1º Singular credit cooperatives affiliated with a central credit cooperative whose registration has been carried out under the terms of the caput are exempt from sending the registration information referred to in art. 2º.

§ 2º The CNPJ registration referred to in item I of the caput must refer to the registration of the head office of the legal entity.

Art. 7º Except for information regarding the number and modality of active customer accounts, the other information and documents presented in the registration stage must be kept updated with the Central Bank of Brazil during the membership process and while the institution is a Pix participant. Art. 7º Except for information regarding the number, modality of active customer accounts, and the evidence demonstrating compliance with the items in the security self-assessment questionnaire, the other information and documents presented in the registration stage must be kept updated with the Central Bank of Brazil during the membership process and while the institution is a Pix participant. (Text given, as of 2/5/2023, by Normative Instruction BCB No. 373, of 25/4/2023.)

Sole paragraph. The information and documents referred to in this Chapter, including any changes to information and documents already sent, must be forwarded to Decem exclusively through the Digital Protocol of the Central Bank of Brazil (Digital Protocol), observing the guidelines in Annex V of this Normative Instruction. Sole paragraph. (Revoked, as of 2/5/2023, by Normative Instruction BCB No. 373, of 25/4/2023.)

§ 1º The information and documents referred to in this Chapter, including any changes to information and documents already sent, must be forwarded to Decem exclusively through the Digital Protocol of the Central Bank of Brazil (Digital Protocol), observing the guidelines in Annex V of this Normative Instruction. (Included, as of 2/5/2023, by Normative Instruction BCB No. 373, of 25/4/2023.)

§ 2º Pix participants must store the evidence demonstrating compliance with the items in the security self-assessment questionnaire for a minimum period of 5 (five) years and, when requested, forward them to the Central Bank of Brazil in accordance with the defined format and deadlines. (Included, as of 2/5/2023, by Normative Instruction BCB No. 373, of 25/4/2023.)

§ 3º The minimum period referred to in § 2º shall be counted from the sending, to the Central Bank of Brazil, of the information contained in the security self-assessment questionnaire. (Included, as of 2/5/2023, by Normative Instruction BCB No. 373, of 25/4/2023.)

Art. 8º Pending issues arising from inaccuracies in the information provided or documents submitted, as well as from the absence of mandatory information and documents provided for in this Chapter, must be resolved within thirty days counted from the date of Decem's communication in response to the membership request.

Sole paragraph. Failure to comply with the deadline set forth in the caput implies the loss of validity of the request and the termination of the membership process.

CHAPTER II OF THE HOMOLOGATION STAGE

Art. 9º The homologation stage comprises:

I - formal homologation tests in the SPI;
II - homologation tests between the indirect participant in the SPI and its settlement agent;
III - formal homologation tests in the Transactional Account Identifier Directory (DICT);
IV - verification of the adherence of the solutions developed for end users;
V - formal QR Code validation tests;
VI - formal validation tests for the provision of payment transaction initiation services; and
VII - formal homologation tests for the publication of information related to the cash withdrawal service.

Art. 10. From the communication of the conclusion of the registration stage referred to in Chapter I, the institution in the process of joining must conclude the homologation stage within five months.

§ 1 During the homologation stage, the institution in the process of joining that does not have a Sisbacen code must obtain it from the Central Bank of Brazil, observing the guidelines set out in Annex V of this Normative Instruction.

§ 2 Until the end of the homologation stage, a declaration signed by the responsible participant must be sent to Decem stating that, under the terms of the Pix Regulation, the contracting institution has the technical and operational capacity to fulfill the duties and obligations set out in the Pix Regulation.

§ 3 Until the end of the homologation stage, the institution in the process of joining must register with the Information System on Entities of Interest to the Central Bank (Unicad) a director responsible for matters related to participation in Pix. § 3 Until the end of the homologation stage, the institution in the process of joining must register with the Information System on Entities of Interest to the Central Bank (Unicad): (Wording given, as of 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)

I - director responsible for matters related to participation in Pix; and (Included, as of 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)
II - director responsible for the cybersecurity policy. (Included, as of 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)

§ 4 The period referred to in the caput may be extended only once, before its end, for up to two months, upon request by the institution in the process of joining, sent to Decem through the Digital Protocol, observing the guidelines set out in Annex V of this Normative Instruction.

§ 5 The period for concluding the homologation stage is not to be confused with the period for concluding the SPI homologation tests referred to in Art. 11. § 5 For institutions that are in the process of joining as direct SPI participants, the extension of the period for concluding the tests referred to in Art. 11 automatically implies the extension of the period referred to in § 4. (Wording given, as of 1/3/2023, by BCB Normative Instruction No. 352, of 15/2/2023.)

§ 6 Failure to observe the periods and provisions referred to in this article implies the loss of validity of the request and the consequent termination of the joining process.

§ 7 An institution that fails the homologation stage may only apply for a new joining request after 90 days have elapsed from the date of the notification of failure.

§ 8 An institution shall be considered to have failed the homologation stage if: (Included, as of 1/3/2023, by BCB Normative Instruction No. 352, of 15/2/2023.) § 8 An institution shall be considered to have failed the homologation stage if: (Wording given, as of 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)

I - it has not concluded, within the period referred to in the caput and except for the possible extension referred to in § 4, the homologation tests to which it is subject; (Included, as of 1/3/2023, by BCB Normative Instruction No. 352, of 15/2/2023.)
II - it fails the formal DICT homologation tests referred to in Art. 13; (Included, as of 1/3/2023, by BCB Normative Instruction No. 352, of 15/2/2023.)
III - it fails the stage of verification of the adherence of the solutions to end users referred to in Art. 17; or (Included, as of 1/3/2023, by BCB Normative Instruction No. 352, of 15/2/2023.)
III - it fails the stage of verification of the adherence of the solutions to end users referred to in Art. 17; (Wording given, as of 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)
IV - it withdraws from the Pix joining process. (Included, as of 1/3/2023, by BCB Normative Instruction No. 352, of 15/2/2023.)
IV - it withdraws from the Pix joining process; (Wording given, as of 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)
V - that intends to access the DICT indirectly and that has indicated a direct participant not authorized to provide services in the DICT, referred to in art. 14, until the end of the term referred to in the caput, except for any extension referred to in § 4; or (Included, as of 2/5/2023, by Instrução Normativa BCB nº 373, of 25/4/2023.)
VI - that intends to be an indirect participant in the SPI and that has indicated a direct participant not approved in the formal homologation tests, referred to in art. 11, until the end of the term referred to in the caput, except for any extension referred to in § 4. (Included, as of 2/5/2023, by Instrução Normativa BCB nº 373, of 25/4/2023.)

§ 9 For institutions required to have a transactional account to join Pix and that have declared, in the registration stage, that they do not make any account available, the institution must submit, until the end of the homologation stage, a declaration, in free format and signed by the director responsible for Pix, that it has, as of the date of the declaration, at least one active transactional account, specifying the type of transactional account, as defined in the Pix Regulation. (Included, as of 1º/12/2023, by Instrução Normativa BCB nº 422, of 24/11/2023.)

Section I On the Formal Homologation Tests in the SPI

Art. 11. Institutions that meet the mandatory criteria or that, optionally, wish to participate in the SPI in the direct modality must perform the formal homologation tests, as set forth in specific regulation.

Section II On the Homologation Tests between the Indirect Participant in the SPI and its Settling Agent

Art. 12. Institutions that meet the criteria for mandatory indirect participation in the SPI or that, optionally, wish to participate in the SPI in the indirect modality must perform homologation tests with their settling agent.

§ 1 The homologation tests referred to in the caput must be defined by the settling agent in the SPI, so that it is able to declare the operational aptitude of the indirect participant.

§ 2 The direct participant must keep the documentation and evidence of the performance of the homologation tests at the disposal of the Banco Central do Brasil.

Section III On the Formal Homologation Tests in the DICT

Art. 13. Institutions that meet the criteria for mandatory direct access to the DICT or that, optionally, wish to access the DICT directly must perform formal homologation tests.

Art. 14. Pix participants with direct access to the DICT must be approved in the formal homologation tests with at least one institution with indirect access, if they wish to provide the service of access to the DICT to other institutions.

Art. 15. Pix participants with indirect access to the DICT must be approved in the formal homologation tests if they wish to access the DICT directly.

Art. 16. The requirements for complying with the tests referred to in this section are set out in BCB Normative Instruction No. 290 of 2022.

Section IV On the Process of Verifying the Alignment of Solutions with End Users

Art. 17. Transactional account provider participants must comply with the stage of verifying the alignment of the solutions developed for end users, which comprises: Art. 17. Transactional account provider participants must comply with the stage of verifying the alignment of the solutions developed for end users, which comprises the approval of a mobile phone application project intended for individual users. (Wording given, as of 1º/3/2023, by BCB Normative Instruction No. 352 of 15/2/2023.)

I - the submission of a mobile phone application project intended for individual users; and
I - (Repealed, as of 1º/3/2023, by BCB Normative Instruction No. 352 of 15/2/2023.)
II - the possible submission of up to two adjusted versions of the project, if requested by Decem.
II - (Repealed, as of 1º/3/2023, by BCB Normative Instruction No. 352 of 15/2/2023.)

§ 1º Only the main mobile phone application made available to individual customers will be evaluated.

§ 2º For the purposes of the provisions of § 1º, the main mobile phone application is considered to be the application with the highest number of users among the applications made available by the institution.

§ 3º The project must contain illustrative screens of the mobile phone application, demonstrating only the items detailed in the section "Items to be evaluated in the process of verifying the alignment of solutions with end users" contained in Annex I of the "Minimum Requirements for User Experience".

§ 4º Each illustrative screen of the project must make explicit reference to the item or items detailed in the section "Items to be evaluated in the process of verifying the alignment of solutions with end users" contained in Annex I of the "Minimum Requirements for User Experience".

§ 5º The project must be organized in the order of the items detailed in the section "Items to be evaluated in the process of verifying the alignment of solutions with end users" contained in Annex I of the "Minimum Requirements for User Experience".

§ 6º The project must be submitted to Decem's evaluation at least thirty days in advance of the final date of the deadline for completing the homologation stage provided for in the main clause of art. 10.

§ 7º Adjusted versions of projects shall contain only the pages and items for which adjustments were requested. (Included, as of 1º/3/2023, by BCB Normative Instruction No. 352 of 15/2/2023.)

Art. 18. The following shall be rejected in the stage of verifying the alignment of solutions with end users, with the consequent termination of the adhesion process:

I - the institution that has not submitted the project within the deadline set forth in § 6º of art. 17; and
II - the institution that does not obtain approval by the third version of the project.

Art. 19. The project and its eventual adjustments must be sent to Decem through the Digital Protocol, observing the guidelines contained in Annex V of this Normative Instruction.

Art. 20. Institutions shall develop and implement the application in alignment with the final version of the project submitted.

§ 1º All obligations contained in the "Minimum Requirements for User Experience", including those not listed in the section "Items to be evaluated in the process of verifying the alignment of solutions with end users" contained in Annex I of the "Minimum Requirements for User Experience", must be present in the application made available to users.

§ 2º Subsequent changes to the application must comply with the provisions of the Pix Regulation, which includes the "Minimum Requirements for User Experience".

§ 3º Subsequent changes to an implemented application, as referred to in § 2º, will not be submitted to Decem's evaluation.

Art. 21. The following are exempt from complying with the stages of the process of verifying the alignment of solutions with end users:

I - transactional account providers that use a mobile phone application provided by another Pix participant; and
II - transactional account providers that have no individual customers.

Sole paragraph. For the purposes of the exemption referred to in item I, the Pix participant that provides the mobile phone application must submit an exemption request to be forwarded to Decem through the Digital Protocol, observing the guidelines contained in Annex V of this Normative Instruction.

Art. 22. Mobile phone applications intended exclusively for corporate end users are not subject to analysis by Decem.

Art. 23. The special liquidator and the initiator must be approved in the verification of the alignment of solutions referred to in this Subsection if they wish to change their participation modality to transactional account provider offering an account to individual users.

Section V On the Formal Validation Tests of QR Codes

Art. 24. Transactional account provider participants and initiator participants, under the terms of the Pix Regulation, must be approved in the formal validation tests of QR Codes, under the terms of BCB Normative Instruction No. 290 of 2022.

Art. 25. The following are exempt from complying with the QR Code validation tests:

I - the transactional account provider that uses a mobile phone application provided by another Pix participant;
II - the transactional account provider that has exclusively legal entity users and does not offer products and services related to QR Code; and
III - the initiator that does not offer the QR Code reading service.

§ 1º For the purposes of the waiver referred to in item I of the caput, the Pix participant that provides the mobile phone application must submit a waiver request to be forwarded to Decem via the Digital Protocol, observing the guidelines set forth in Annex V of this Normative Instruction.

§ 2º The special liquidator and the initiator, except as provided in items I and II, must be approved in QR Code validation if they wish to change their participation modality to transactional account provider.

§ 3º The initiator must be approved in QR Code validation if it wishes to offer the QR Code reading service.

Section VI On the Formal Validation Tests for the Payment Transaction Initiation Service

Art. 26. Initiator participants and transactional account provider participants that are Open Finance participants, under the terms of Joint Resolution No. 1, of 4 May 2020, must be approved in the formal validation tests for the payment transaction initiation service, under the terms of BCB Normative Instruction No. 290, of 2022. Art. 26. Initiator participants and transactional account provider participants that are Open Finance participants, under the terms set forth in specific regulations, must be approved in the formal validation tests for the payment transaction initiation service, under the terms of BCB Normative Instruction No. 290, of 2022. (Wording given, effective from 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)

Art. 27. The following are exempt from complying with the tests referred to in art. 26:

I - the transactional account provider that is not an Open Finance participant as an account-holding institution, under the terms of Joint Resolution No. 1, of 2020; and
I - the transactional account provider that is not an Open Finance participant as an account-holding institution, under the terms set forth in specific regulations; and (Wording given, effective from 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)
II - the individual credit cooperative, affiliated to the credit central cooperative and having as its liquidator in the SPI an entity of the organized cooperative system of two or three levels.

§ 1º The transactional account provider that is not an Open Finance participant as an account-holding institution, under Joint Resolution No. 1, of 2020, shall be approved in the validation of the payment transaction initiation service, if it becomes an Open Finance participant as an account-holding institution. § 1º The transactional account provider that is not an Open Finance participant as an account-holding institution, under the provisions set forth in specific regulations, shall be approved in the validation of the payment transaction initiation service, if it becomes an Open Finance participant as an account-holding institution. (Wording given, as of 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)

§ 2º The special liquidator that is an Open Finance participant as an account-holding institution, under Joint Resolution No. 1, of 2020, shall be approved in the validation of the payment transaction initiation service, if it wishes to change its participation modality to transactional account provider. § 2º The special liquidator that is an Open Finance participant as an account-holding institution, under the provisions set forth in specific regulations, shall be approved in the validation of the payment transaction initiation service, if it wishes to change its participation modality to transactional account provider. (Wording given, as of 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)

Section VII On the Formal Tests for the Publication of Information Relating to the Withdrawal Service

Art. 28. Institutions that, optionally, wish to facilitate the withdrawal service must be approved in the formal tests for the publication of information relating to the withdrawal service, under BCB Normative Instruction No. 290, of 2022.

§ 1º The entity of the organized cooperative system of two or three tiers that acts or intends to act as a liquidator in the SPI for, at least, one single credit cooperative affiliated with a credit central cooperative, and that has completed the tests referred to in the main clause, must communicate to Decem, through the Digital Protocol, its eventual intention to extend to its affiliated single credit cooperatives the authorization to act in the facilitation of the withdrawal service. (Included, as of 1º/3/2023, by BCB Normative Instruction No. 352, of 15/2/2023.)

§ 2º The extension referred to in § 1º shall apply to all single credit cooperatives affiliated with the credit central cooperative authorized to act as a facilitator of the withdrawal service. (Included, as of 1º/3/2023, by BCB Normative Instruction No. 352, of 15/2/2023.)

§ 3º The extension referred to in § 1º shall apply tacitly to all affiliated single credit cooperatives that become Pix participants as single credit cooperatives affiliated with the credit central cooperative authorized to act as a facilitator of the withdrawal service. (Included, as of 1º/3/2023, by BCB Normative Instruction No. 352, of 15/2/2023.)

§ 4º The affiliated single credit cooperative is unauthorized to continue acting as a facilitator of the withdrawal service, granted by virtue of the extension provided for in § 1º, upon its disaffiliation from the granting credit central cooperative. (Included, as of 1º/3/2023, by BCB Normative Instruction No. 352, of 15/2/2023.)

§ 5º The provision of § 4º does not apply to cases in which the single credit cooperative becomes affiliated with another credit central cooperative that also opted for the extension referred to in § 1º. (Included, as of 1º/3/2023, by BCB Normative Instruction No. 352, of 15/2/2023.)

CHAPTER III ON THE RESTRICTED OPERATION STAGE

Art. 29. The restricted operation stage corresponds to the offering of Pix to a limited number of customers.

Art. 30. The restricted operation stage shall be initiated after the successful completion of the homologation stage, referred to in Chapter II.

§ 1º The institution shall initiate the restricted operation stage within a maximum period of three months, counted from the communication of completion of the homologation stage, except for the period referred to in § 5º.

§ 2º Decem shall define the date of activation of the institution in the Pix production environment. § 2º Decem shall define the date of activation of the institution in the Pix production environment, as well as inform the direct participants of the date and time for going into production in the SPI. (Wording given, as of 1º/3/2023, by BCB Normative Instruction No. 352, of 15/2/2023.)

§ 3º The request shall lose validity and the accession process of the optional participant shall be terminated if it does not go into production within a period of thirty days, counted from the date referred to in § 2º.

§ 4º Prior to the start of the restricted operation stage, Decem may determine that institutions in the accession process execute complementary homologation tests.

§ 5º Decem shall communicate to the institutions in the situation referred to in § 4º and shall set a deadline for the completion of the tests.

§ 6º Non-compliance with the time limit referred to in § 5º or failure to carry out the tests referred to in § 4º shall result in non-compliance with a mandatory requirement of the homologation stage and in the closure of the adhesion process.

§ 7º An institution that intends to access the DICT indirectly and whose participant that will provide the direct access has not completed the tests referred to in art. 14 by the time limit referred to in § 1º shall be barred from going into production. (Included, as of 1º/3/2023, by BCB Normative Instruction No. 352, of 15/2/2023.)

§ 8º An institution that intends to participate in the SPI indirectly and whose liquidator has not previously gone into production by the time limit referred to in § 1º shall be barred from going into production. (Included, as of 1º/3/2023, by BCB Normative Instruction No. 352, of 15/2/2023.)

Art. 31. Single-tier credit cooperatives affiliated with a central credit cooperative that are requesting adhesion to Pix and that have as their liquidator in the SPI an entity of the two- or three-tier organized cooperative system that is a Pix participant are exempt from complying with the restricted operation stage.

Sole paragraph. For the exemption referred to in the caput, the two- or three-tier organized cooperative system entity that will act as liquidator in the SPI of the single-tier credit cooperative affiliated with the central credit cooperative shall send to the Decem, through the Digital Protocol, observing the guidelines set out in Annex V of this Normative Instruction, the request for exemption from the restricted operation stage, declaring the full fitness of the single-tier cooperative to provide services to its members without the need to comply with the stage to which the request refers.

Art. 32. The restricted operation stage does not apply to the special liquidator and to the initiator.

Art. 33. The restricted operation stage consists of two phases:

I - phase 1: Pix must be offered to more than 1% and up to 30% of the institution's customers; and
II - phase 2: Pix must be offered to more than 30% and up to 70% of the institution's customers.

§ 1º The restricted operation stage must last between two and eight weeks.

§ 2º Phase 1 and phase 2 must have the same duration period.

§ 3º The duration of each phase shall be defined at the discretion of each participant, respecting the time limits defined in §§ 1º and 2º.

§ 4º In each phase, the institution may gradually increase the number of customers with access to Pix, up to the maximum limit defined in items I and II of the caput.

Art. 34. The customers selected to participate in the restricted operation stage must reflect the profile of the institution's total customer base, by legal nature, by age and by geographic distribution.

Art. 35. Institutions in the restricted operation stage will be active in the Pix production environment and, therefore, subject to the same obligations reserved for institutions in full operation, except for the availability of Pix to a limited number of clients established in Art. 29.

Art. 36. The special settlement agent and the initiator must comply with the restricted operation stage if they wish to change their participation modality to transaction account provider.

Art. 37. At the end of the restricted operation stage, the institution will automatically enter full operation.

CHAPTER III-A TRANSITIONAL PROVISIONS

(Chapter III-A included, as of 1/3/2023, by BCB Normative Instruction No. 352, of 15/2/2023.)

Art. 37-A. The deadline for completion of the homologation stage referred to in Art. 10 does not apply to institutions that are in a transition regime, under the terms of Section IX of Chapter XXII of the Pix Regulation, during the adherence process. (Included, as of 1/3/2023, by BCB Normative Instruction No. 352, of 15/2/2023.)

Sole paragraph. The institutions referred to in the caput must express their eligibility for the transition regime in the Pix adherence form set out in Annexes I or III, depending on whether the institution has or does not have authorization to operate from the Central Bank of Brazil, respectively. (Included, as of 1/3/2023, by BCB Normative Instruction No. 352, of 15/2/2023.)

Art. 37-B. Institutions that filed a request for adherence to Pix by 30 April 2023, and that are awaiting analysis of the request, must send to Decem, through the Digital Protocol and by the end of the eventual registration stage, the self-assessment security questionnaire, duly signed by the director responsible for the cybersecurity policy. (Included, as of 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)

Sole paragraph. The approval of the institutions referred to in the caput in the registration stage of the Pix adherence process is conditioned, in addition to the requirements set out in Chapter I, on Decem's approval regarding the self-assessment security questionnaire. (Included, as of 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)

Art. 37-C. Institutions that filed an application for Pix participation by 30 April 2023, and that are in the registration stage, must send to Decem, through the Digital Protocol and until the end of the eventual homologation stage, the security self-assessment questionnaire, duly signed by the director responsible for the cybersecurity policy. (Included, as of 2/5/2023, by Instrução Normativa BCB nº 373, of 25/4/2023.)

Sole paragraph. The approval of the institutions referred to in the caput in the eventual homologation stage of the Pix participation process is conditioned, in addition to the requirements set forth in Chapter II, on Decem's approval regarding the security self-assessment questionnaire. (Included, as of 2/5/2023, by Instrução Normativa BCB nº 373, of 25/4/2023.)

Art. 37-D. Institutions that filed an application for Pix participation by 30 April 2023, and that are in the homologation stage, must send to Decem, through the Digital Protocol and until the end of that stage, the security self-assessment questionnaire, duly signed by the director responsible for the cybersecurity policy. (Included, as of 2/5/2023, by Instrução Normativa BCB nº 373, of 25/4/2023.)

Sole paragraph. The approval of the institutions referred to in the caput in the homologation stage of the Pix participation process is conditioned, in addition to the requirements set forth in Chapter II, on Decem's approval regarding the security self-assessment questionnaire. (Included, as of 2/5/2023, by Instrução Normativa BCB nº 373, of 25/4/2023.)

Art. 37-E. Within the scope of the Pix participation process, institutions that have completed the homologation stage by 30 April 2023 are exempt from sending the security self-assessment questionnaire. (Included, as of 2/5/2023, by Instrução Normativa BCB nº 373, of 25/4/2023.)

CHAPTER IV GENERAL PROVISIONS

Art. 38. The Banco Central do Brasil reserves the right to require complementary information and documents at any time.

Art. 39. For the purposes of § 1º of art. 6º, of item II of art. 27 and of art. 31, caput, single credit cooperatives that operate through deposit accounts with a specific purpose, under the terms of Circular nº 3.226, of 18 February 2004, and that have as their settlement institution in the SPI the institution that operates these accounts, are treated as equivalent to single credit cooperatives affiliated with a central credit cooperative.

Art. 40. In addition to complying with the provisions of this Instrução Normativa, the successful completion of the Pix participation process implies adherence to the rules, conditions and procedures established in the Pix Regulation.

Art. 40-A At the discretion of the Banco Central do Brasil, the existence of merely formal errors in procedural acts may allow the act to be validated, provided that it does not present a risk to the objectives of the Pix participation process. (Included, as of 1º/12/2023, by Instrução Normativa BCB nº 422, of 24/11/2023.)

Art. 41. The following are revoked:

I - Instrução Normativa BCB nº 203, of 10 December 2021; and
II - Instrução Normativa BCB nº 279, of 13 April 2022.

Art. 42. This Instrução Normativa enters into force on 1º September 2022.

Angelo José Mont Alverne Duarte

Annex I - Pix participation and registration update form for institutions that have authorization to operate from the Banco Central do Brasil and that intend to operate as a transaction account provider

CNPJ registration number

Offers initiation service within the scope of Open Finance (Yes/No)

III

Open Finance participant as an account-holding institution (Yes/No)

Provides cash withdrawal service (Pix Saque and Pix Troco) (Yes/No)

Type of access to DICT (direct or indirect)

Note: Direct access to DICT is mandatory for direct participants in the SPI.

Type of participation in the SPI (direct or indirect)

Note: If indirect, provide the ISPB code of the settlement participant in the SPI:

VII

If a direct participant in the SPI, provide the form of connection to the RSFN (direct or through a PSTI)

If through a PSTI, indicate the name and CNPJ of the PSTI:

Name of the PSTI:
CNPJ of the PSTI:

VIII

Number of active customer accounts at the time of the participation application, in the following categories:

VIII (a)

Demand deposit accounts

VIII (b)

Savings deposit accounts

VIII (c)

Prepaid payment accounts

Offers transaction accounts to end users:

( ) legal entities

( ) natural persons

Identification of the director responsible for handling the Banco Central do Brasil's demands related to matters concerning Pix

Name:

CPF:

Institution's telephone for matters related to Pix

XII

Institution's electronic address (e-mail) for matters related to Pix

Note: Preferably provide an institutional e-mail accessible to more than one user

XIII

Identification of the director responsible for handling the demands of the Central Bank of Brazil related to matters concerning the SPI

Name:

CPF:

XIV

Institution's telephone for matters related to the SPI

Institution's electronic address (e-mail) for matters related to the SPI

We declare that we are aware that:

(i) to complete the Pix adherence process, the Central Bank of Brazil reserves the right to require complementary information and documents at any time; and
(ii) the completion of the Pix adherence process implies adherence to the rules, conditions and procedures established in the Pix Regulation.

______________________________________________________ Name and Position

(Annex I with the wording given, as of 1/3/2023, by Normative Instruction BCB No. 352, of 15/2/2023.)

Annex I - Pix Adherence Form and Registration Update for institutions that have authorization to operate from the Central Bank of Brazil and that intend to act in the transactional account provider modality

Reason for submission

( ) Request for adherence

( ) Registration update of a participant in operation, under the terms set forth in art. 7º

( ) Registration update of an institution adhering to Pix, under the terms set forth in art. 7º

Institution eligible for the transition regime referred to in Section IX of Chapter XXII of the Pix Regulation (Yes/No)

III

CNPJ Registration

Offers initiation service within the scope of Open Finance (Yes/No)

Open Finance participant as an account-holding institution

( ) Yes1

( ) No, the institution is exempt2

( ) The institution is requesting or will request exemption from participation in Open Finance3

Facilitates withdrawal service (Pix Saque and Pix Troco) (Yes/No)

VII

Type of access to DICT (direct or indirect)

Note: Direct access to DICT is mandatory for a direct participant in the SPI.

VIII

Type of participation in the SPI (direct or indirect)

Note: If indirect, inform the ISPB code of the settling participant in the SPI:

If a direct participant in the SPI, inform the form of connection to the RSFN (direct or through a PSTI)

If through a PSTI, indicate the name and CNPJ of the PSTI:

Name of the PSTI:
CNPJ of the PSTI:

Number of active customer accounts at the time of the adherence request, in the following modalities:

X (a)

Demand deposit accounts

X (b)

Savings deposit accounts

X (c)

Prepaid payment accounts

Offers transactional accounts to end users:

( ) legal entities

( ) natural persons

XII

Identification of the director responsible for meeting the demands of the Central Bank of Brazil related to issues concerning Pix

Name:

CPF:

XIII

Institution's telephone number for matters related to Pix

XIV

Institution's electronic address (e-mail) for matters related to Pix

Note: Preferably provide an institutional e-mail accessible to more than one user

Identification of the director responsible for meeting the demands of the Central Bank of Brazil related to issues concerning the SPI

Name:

CPF:

XVI

Institution's telephone number for matters related to the SPI

XVII

Institution's electronic address (e-mail) for matters related to the SPI

1 Participation in Open Finance as an account holder is mandatory for all financial institutions, payment institutions and other institutions authorized to operate by the Central Bank of Brazil, under the terms of Joint Resolution No. 1, of 2020.

2 Proof of exemption from participation in Open Finance must be sent to Decem upon submission of the adhesion request or during the period referred to in Art. 8, caput.

3 Exemption from participation in Open Finance is obtained under the terms of Joint Resolution No. 1, of 2020, and must be submitted to Decem by the end of the homologation stage of the Pix adhesion process. Otherwise, the institution shall submit to the tests referred to in Art. 26.

We acknowledge awareness that:

(i) to complete the Pix adhesion process, the Central Bank of Brazil reserves the right to request additional information and documents at any time; and
(ii) completion of the Pix adhesion process implies adherence to the rules, conditions and procedures established in the Pix Regulation.

_______________________________________________ Name and Title

(Annex I with wording given, from 2/5/2023, by Normative Instruction BCB No. 373, of 25/4/2023.)

Annex I - Pix Adhesion Form and Registration Update for institutions holding authorization to operate from the Central Bank of Brazil that intend to act in the transactional account provider modality

Reason for submission

( ) Adhesion request

( ) Registration update of a participant in operation, under the terms set forth in Art. 7

( ) Registration update of an institution adhering to Pix, under the terms set forth in Art. 7

Institution eligible for the transition regime referred to in Section IX of Chapter XXII of the Pix Regulation (Yes/No)

III

CNPJ Registration

Offers initiation service within the scope of Open Finance (Yes/No)

Participant in Open Finance as an account-holding institution

( ) Yes1

( ) No, the institution is exempt2

( ) The institution is requesting or will request exemption from participation in Open Finance3

Facilitates withdrawal service (Pix Saque and Pix Troco) (Yes/No)

VII

Type of access to DICT (direct or indirect)

Note: Direct access to DICT is mandatory for a direct participant in the SPI.

VIII

Type of participation in the SPI (direct or indirect)

Note: If indirect, inform the ISPB code of the settling participant in the SPI:

If a direct participant in the SPI, inform the form of connection to the RSFN (direct or through a PSTI)

If through a PSTI, indicate the name and CNPJ of the PSTI:

Name of the PSTI:
CNPJ of the PSTI:

Number of active customer accounts at the time of the adhesion request, in the following modalities:

X (a)

Demand deposit accounts

X (b)

Savings deposit accounts

X (c)

Prepaid payment accounts

Offers transactional accounts to end users:

( ) legal entities

( ) natural persons

XII

Identification of the director responsible for addressing the demands of the Central Bank of Brazil related to matters concerning Pix

Name:

CPF:

XIII

Institution's telephone number for matters related to Pix

XIV

Institution's electronic address (e-mail) for matters related to Pix

Note: Preferably provide an institutional e-mail accessible to more than one user

Identification of the director responsible for responding to demands from the Central Bank of Brazil related to issues concerning the SPI

Name:

CPF:

XVI

Institution's telephone number for matters related to the SPI

XVII

Institution's electronic address (e-mail) for matters related to the SPI

2 Proof of exemption from participation in Open Finance must be sent to Decem upon submission of the adhesion request or within the period referred to in art. 8º, caput.

3 Exemption from participation in Open Finance is obtained under the terms provided in specific regulation, and must be presented to Decem by the end of the homologation stage of the Pix adhesion process. Otherwise, the institution must submit to the tests referred to in art. 26.

We acknowledge that:

(i) to complete the Pix adhesion process, the Central Bank of Brazil reserves the right to request additional information and documents at any time; and
(ii) completion of the Pix adhesion process implies adherence to the rules, conditions and procedures established in the Pix Regulation.

______________________________________________________ Name and Title

Annex II - Pix adhesion and registration update form for institutions holding an operating authorization from the Central Bank of Brazil that intend to act exclusively in the special settler modality

CNPJ Registration

If a direct participant in the SPI, indicate the form of connection to the RSFN (direct or through a PSTI)

If through a PSTI, indicate the name and CNPJ of the PSTI:

Name of the PSTI:
CNPJ of the PSTI:

III

Number of active customer accounts at the time of the adhesion request, in the following modalities:

III (a)

Demand deposit accounts

III (b)

Savings deposit accounts

III (c)

Prepaid payment accounts

Identification of the director responsible for responding to demands from the Central Bank of Brazil related to issues concerning the Pix

Name:

CPF:

Institution's telephone number for matters related to the Pix

Institution's electronic address (e-mail) for matters related to the Pix

Note: Preferably provide an institutional e-mail accessible to more than one user

VII

Identification of the director responsible for responding to demands from the Central Bank of Brazil related to issues concerning the SPI

Name:

CPF:

VIII

Institution's telephone number for matters related to the SPI

Institution's electronic address (e-mail) for matters related to the SPI

We acknowledge that:

(i) to complete the Pix adhesion process, the Central Bank of Brazil reserves the right to request additional information and documents at any time; and
(ii) completion of the Pix adhesion process implies adherence to the rules, conditions and procedures established in the Pix Regulation.

______________________________________________________ Name and Title

(Annex II as amended, as of 1/3/2023, by BCB Normative Instruction No. 352, of 2/15/2023.)

Annex II - Pix onboarding and registration update form for institutions authorized to operate by the Central Bank of Brazil and that intend to act exclusively as special settlement participant

Reason for submission

( ) Onboarding request

( ) Registration update of a participant in operation, under the terms set forth in art. 7

( ) Registration update of an institution onboarding to Pix, under the terms set forth in art. 7

CNPJ registration

III

If a direct participant in the SPI, state the connection method to the RSFN (direct or through a PSTI)

If through a PSTI, indicate the name and CNPJ of the PSTI:

PSTI name:
PSTI CNPJ:

Number of active customer accounts at the time of the onboarding request, in the following categories:

IV (a)

Demand deposit accounts

IV (b)

Savings deposit accounts

IV (c)

Prepaid payment accounts

Identification of the director responsible for handling demands from the Central Bank of Brazil related to matters concerning Pix

Name:

CPF:

Institutional telephone number for matters related to Pix

VII

Institutional email address for matters related to Pix

Note: Preferably provide an institutional email accessible to more than one user

VIII

Identification of the director responsible for handling demands from the Central Bank of Brazil related to matters concerning the SPI

Name:

CPF:

Institutional telephone number for matters related to the SPI

Institutional email address for matters related to the SPI

We declare that we are aware that:

(i) to complete the Pix onboarding process, the Central Bank of Brazil reserves the right to require additional information and documents at any time; and
(ii) completion of the Pix onboarding process implies adherence to the rules, conditions and procedures established in the Pix Regulation.

_______________________________________________ Name and Position

Annex III - Pix onboarding and registration update form for institutions not authorized to operate by the Central Bank of Brazil

CNPJ Registration

Corporate name

III

Trade name

ISPB code of the responsible participant

Number of active prepaid payment accounts of clients at the time of the adhesion request

Offers transactional accounts to end users:

( ) legal entities

( ) natural persons

VII

Identification of the director responsible for handling the demands of the Central Bank of Brazil related to issues concerning Pix

Name:

CPF:

VIII

Institution's telephone for matters related to Pix

Institution's electronic address (e-mail) for matters related to Pix

Note: Preferably provide an institutional e-mail accessible to more than one user

We declare that we are aware that:

(i) to complete the Pix adhesion process, the Central Bank of Brazil reserves the right to require complementary information and documents at any time; and
(ii) the completion of the Pix adhesion process implies adherence to the rules, conditions and procedures established in the Pix Regulation.

______________________________________________________ Name and Position

(Annex III with wording given, as of 1/3/2023, by Normative Instruction BCB No. 352, of 15/2/2023.)

Annex III - Pix adhesion and registration update form for institutions that do not have authorization to operate from the Central Bank of Brazil

Reason for submission

( ) Adhesion request

( ) Registration update of a participant in operation, under the terms set forth in art. 7

( ) Registration update of an institution in adhesion to Pix, under the terms set forth in art. 7

Institution eligible for the transition regime referred to in Section IX of Chapter XXII of the Pix Regulation (Yes/No)

III

CNPJ Registration

Corporate name

Trade name

ISPB code of the responsible participant

VII

Number of active prepaid payment accounts of clients at the time of the adhesion request

VIII

Offers transactional accounts to end users:

( ) legal entities

( ) natural persons

Identification of the director responsible for handling the demands of the Central Bank of Brazil related to issues concerning Pix

Name:

CPF:

Institution's telephone for matters related to Pix

Institution's electronic address (e-mail) for matters related to Pix

Note: Preferably provide an institutional e-mail accessible to more than one user

We declare that we are aware that:

(i) to complete the Pix membership process, the Central Bank of Brazil reserves the right to require additional information and documents at any time; and
(ii) the completion of the Pix membership process implies adherence to the rules, conditions and procedures established in the Pix Regulation.

_______________________________________________ Name and Position

Annex IV - Pix membership and registration update form for institutions that intend to operate exclusively as initiator

CNPJ Registration

Type of access to DICT (direct, indirect or does not access)

III

ISPB Code of the direct participant with access to DICT (in case of indirect access to DICT)

Identification of the director responsible for handling the demands of the Central Bank of Brazil related to matters concerning Pix

Name:

CPF:

Initiator's telephone for matters related to Pix

Institution's electronic address (e-mail) for matters related to Pix

Note: Preferably provide an institutional e-mail accessible to more than one user

We declare that we are aware that:

(i) to complete the Pix membership process, the Central Bank of Brazil reserves the right to require additional information and documents at any time; and

(ii) the completion of the Pix membership process implies adherence to the rules, conditions and procedures established in the Pix Regulation.

________________________________________________________ Name and Position

(Annex IV as amended, as of 1/3/2023, by BCB Normative Instruction No. 352, of 15/2/2023.)

Annex IV - Pix membership and registration update form for institutions that intend to operate exclusively as initiator

Reason for submission

( ) Membership request

( ) Registration update of a participant in operation, under the terms set forth in art. 7

( ) Registration update of an institution in the process of joining Pix, under the terms set forth in art. 7

CNPJ Registration

III

Type of access to DICT (direct, indirect or does not access)

ISPB Code of the direct participant with access to DICT (in case of indirect access to DICT)

Identification of the director responsible for handling the demands of the Central Bank of Brazil related to matters concerning Pix

Name:

CPF:

Initiator's telephone for matters related to Pix

VII

Institution's electronic address (e-mail) for matters related to Pix

Note: Preferably provide an institutional e-mail accessible to more than one user

We declare that we are aware that:

(i) to complete the Pix membership process, the Central Bank of Brazil reserves the right to require additional information and documents at any time; and

(ii) the completion of the Pix membership process implies adherence to the rules, conditions and procedures established in the Pix Regulation.

_______________________________________________ Name and Position

Annex V - Procedures for processing instruction by means of the Digital Protocol and for obtaining the Sisbacen code

Art. 1 The sending of information and documents to the Central Bank of Brazil, within the scope of Pix, must be done by means of the Digital Protocol, observing the following procedures:

I - access the Digital Protocol by means of an institutional user account at the electronic address https://protocolodigital.bcb.gov.br/protocolo/acesso/;
II - adopt the following procedures on the screen of the system referred to in item I:
- a) fill in the “Description” field, using the following components, in the format “xx.xxx.xxx - Institution - stage”, where the component:
  - 1. “xx.xxx.xxx” must correspond to the registration number (first eight digits) of the institution in the National Register of Legal Entities (CNPJ);
  - 2. “Institution” must correspond to the corporate name of the institution submitting the information; and
  - 3. “etapa” must be filled with “Pix – processo de adesão – etapa cadastral”, “Pix – processo de adesão – etapa homologatória”, “Pix – processo de adesão – etapa de operação restrita” or “Pix – participante em operação plena” according to the stage in which the institution finds itself and the documents to be submitted; and
- b) select “Pix”, in the field “Selecione um assunto”; and
III - send each file in PDF/A format.

§ 1º In the event of sending more than one document, the field “Protocolar documento complementar” must be selected so that all documents of the same institution are linked.

§ 2º In the event that a file exceeds the maximum size allowed by the system, the file must be partitioned, and in this case, the field “Descrição” must be filled in using the format “xx.xxx.xxx - Instituição – etapa - Parte 1”, “xx.xxx.xxx - Instituição - etapa - Parte 2”, and so on.

Art. 2º If the institution does not yet have an institutional user account in the Digital Protocol, instead of the provisions of art. 1º of this Annex, the sending of information and documents may alternatively follow the following procedures:

I - access to the Digital Protocol must be carried out through an individual user account (citizen profile) at the electronic address https://protocolodigital.bcb.gov.br/protocolo/acesso/;
II - adopt the following procedures on the system screen referred to in item I:
- a) the field “Descrição” must be filled in using the following components, in the format “xxx.xxx.xxx-xx - Instituição - etapa”, where the component:
  - 1. “xxx.xxx.xxx-xx” must correspond to the complete registration number in the Cadastro de Pessoa Física (CPF) of the institution's representative;
  - 2. “Instituição” must correspond to the corporate name of the institution submitting the information; and
  - 3. “etapa” must be filled with “Pix – processo de adesão – etapa cadastral”, “Pix – processo de adesão – etapa homologatória”, “Pix – processo de adesão – etapa de operação restrita” or “Pix – participante em operação plena” according to the stage in which the institution finds itself and the documents to be submitted; and
- b) select “Pix”, in the field “Selecione um assunto”; and
III - send each file in PDF/A format.

§ 1º In the event of sending more than one document, the field “Protocolar documento complementar” must be selected so that all documents of the same institution are linked.

§ 2º In the event that a file exceeds the maximum size allowed by the system, the file must be partitioned, and in this case, the field “Descrição” must be filled in using the format “xxx.xxx.xxx-xx - Instituição - etapa - Parte 1”, “xxx.xxx.xxx-xx - Instituição – etapa - Parte 2”, and so on.

Art. 3º The institution in the process of joining must obtain the Sisbacen code according to the following guidelines:

I - observe the instructions on the Sisbacen page on the Banco Central do Brasil website, specifically with regard to the user profile “Usuário Especial, para uso do STA – Sistema de Transferência de Arquivos”; and
II - at the time of filling out the form, the institution must indicate as motivation the “Solicitação de cadastro inicial” and as justification for using the STA “Instituição de pagamento participante do PIX não sujeita à autorização pelo BCB.

(Annex VI included, as of 2/5/2023, by BCB Normative Instruction No. 373, of 4/25/2023.)

Annex VI - Self-assessment questionnaire on security - Institutions that intend to operate in the transactional account provider modality, directly access the DICT and be a direct participant in the SPI

The questionnaire addresses security aspects related to Pix.

Compliance with these aspects is mandatory for all participants. Thus, failure to meet all of these aspects, as well as failure to effectively implement the provided security mechanisms, from the beginning of the restricted operation stage, subjects the applicant to rejection of the membership application.

The participant must store evidence supporting its adherence to the aspects listed in this questionnaire at the time of submission to the Banco Central do Brasil. This evidence may be requested by the Banco Central do Brasil and may include, at the participant's discretion, diagrams, topologies, flowcharts, screenshots, queries with their respective returns, or other documents it deems pertinent.

It is important to emphasize that the eventual provision, to the Banco Central do Brasil, of incorrect documents, data, or information, or in disagreement with the deadlines and conditions established in legal or regulatory norms, constitutes an infraction punishable under current legislation.

Secure communication

Section 2 of the Pix Security Manual sets out rules for secure communication purposes

I (a)

Does the proposed solution consider compliance, from the institution's first moment in the restricted operation phase, with the requirements set out in section 2 of the Pix Security Manual? (Yes/No)

Digital Signature

Section 3 of the Pix Security Manual sets out the digital signature of messages transmitted in the Instant Payment System (SPI) and in the Transactional Account Identifier Directory (DICT).

II (a)

Does the proposed solution consider compliance, from the institution's first moment of operation in the restricted operation phase, with the requirements set out in section 3 of the Pix Security Manual?

(Yes/No)

III

Security of dynamic QR Codes

Section 4 of the Pix Security Manual sets out the security specifications for dynamic QR Codes generated by the receiver.

III (a)

Does the proposed solution consider compliance, from the institution's first moment of operation in the restricted operation phase, with the requirements set out in items 4.1 and 4.2 of the Pix Security Manual?

(Yes/No/Dynamic QR Code generation will not be offered)

III (b)

Does the proposed solution consider compliance, from the very first moment of the institution's operation in the restricted operation phase, with the requirements set out in item 4.3 of the Pix Security Manual?

(Yes/No/Dynamic QR Code generation will not be offered)

Digital certificates

Section 5 of the Pix Security Manual provides for the types of certificate to be used within the scope of Pix, as well as the processes for activation, deactivation and revocation verification of these certificates.

IV (a)

Does the proposed solution consider compliance, from the very first moment of the institution's operation in the restricted operation phase, with the requirements set out in section 5 of the Pix Security Manual?

(Yes/No)

Secure implementation of applications, APIs and other systems

Section 6 of the Pix Security Manual provides for mandatory security aspects in the implementation of systems related to Pix.

V (a)

Does the proposed solution contemplate the use, from the very first moment of the institution's operation in the restricted operation phase, of encryption mechanisms in the communication between the systems and APIs related to Pix and their respective client applications or software?

(Yes/No)

V (b)

Does the proposed solution contemplate the implementation, from the very first moment of the institution's operation in the restricted operation phase, of strong authentication mechanisms for the client software in the APIs and systems related to Pix?

(Yes/No)

V (c)

Does the proposed solution contemplate the implementation, from the very first moment of the institution's operation in the restricted operation phase, of security mechanisms capable of ensuring that the APIs and other systems used are accessed only by the participant's legitimate client software, in order to prevent man-in-the-middle attacks?

(Yes/No)

V (d)

Does the proposed solution contemplate the implementation, from the very first moment of the institution's operation in the restricted operation phase, of security mechanisms capable of ensuring that the client software communicates only with the desired APIs and systems, in order to prevent man-in-the-middle attacks and manipulation of its communication?

(Yes/No)

V (e)

Does the proposed solution contemplate the implementation, from the very first moment of the institution's operation in the restricted operation phase, of security mechanisms that prevent reverse engineering, decompilation, code manipulation, modification of credentials or security parameters, among other techniques that result in the adulteration of applications or client software?

(Yes/No)

V (f)

Does the proposed solution contemplate the implementation of the security of the APIs and other systems related to Pix mostly on the server side, from the very first moment of the institution's operation in the restricted operation phase, in order to prevent security from being restricted only to the client software or application?

(Yes/No)

V (g)

Does the proposed solution contemplate the provision, from the very first moment of the institution's operation in the restricted operation phase, of only the information strictly necessary for the correct functioning of the applications?

(Yes/No)

V (h)

Does the proposed solution contemplate the implementation of controls, from the first moment of the institution's operation in the restricted operation phase, to ensure that information such as full CPF (without mask), branch and account data of Pix payment recipients, as well as security-related information linked to Pix keys, are for the exclusive use of the participant's internal systems and are not exposed to its client applications and software?

(Yes/No)

V (i)

Does the proposed solution contemplate the processing and masking of data obtained from the query of Pix keys and transactions using QR Code directly in the system or API, instead of using filters in the client software, from the first moment of the institution's operation in the restricted operation phase?

(Yes/No)

V (j)

Does the proposed solution contemplate the implementation on its website, from the first moment of the institution's operation in the restricted operation phase, of mechanisms to prevent the use of robots and the automation of queries of Pix keys and transactions?

(Yes/No/There will be no use of the website for initiating a Pix)

Audit Logs

Section 7 of the Pix Security Manual provides for the audit logs that must be maintained by all Pix participants.

VI (a)

Does the proposed solution take into account, from the first moment of the institution's operation in the restricted operation phase, the requirements set forth in section 7 of the Pix Security Manual?

(Yes/No)

VII

Mechanisms for preventing scraping attacks

Section V of Chapter XIII of the Regulation Annexed to Resolution BCB No. 1 (Pix Regulation), dated August 12, 2020, and section 13 of the DICT Operational Manual provide for mechanisms for preventing scraping attacks.

VII (a)

Does the proposed solution contemplate the implementation of mechanisms to prevent scraping attacks on the institution's internal Pix key database from the first moment of the institution's operation in the restricted operation phase?

(Yes/No)

VII (b)

Are the planned mechanisms to prevent scraping attacks on the institution's internal Pix key database at least equal to the scraping attack prevention mechanisms existing in the DICT and detailed in the DICT Operational Manual?

(Yes/No)

VII (c)

Does the proposed solution contemplate the implementation of mechanisms to prevent scraping attacks on the DICT from the first moment of the institution's operation in the restricted operation phase?

(Yes/No)

VII (d)

Are the planned mechanisms to prevent scraping attacks on the DICT at least equal to the scraping attack prevention mechanisms existing in the DICT and detailed in the DICT Operational Manual?

(Yes/No)

VII (e)

Does the proposed solution contemplate the implementation, from the first moment of the institution's operation in the restricted operation phase, of a mechanism to verify the authenticity of the user requesting the query?

(Yes/No)

VII (f)

Does the proposed solution contemplate the implementation, from the first moment of the institution's operation in the restricted operation phase, of an internal policy mechanism for limiting queries?

(Yes/No)

VII (g)

Does the proposed solution contemplate the implementation, from the first moment of the institution's operation in the restricted operation phase, of mechanisms for identifying and handling cases of excessive queries of Pix keys that do not result in the sending of a payment order?

(Yes/No)

VII (h)

(Yes/No)

VII (i)

Will the institution establish, from the first moment of the institution's operation in the restricted operation phase, an action plan for handling suspected scraping attack cases?

(Yes/No)

We acknowledge that:

(i) to conclude the Pix adhesion process, the Central Bank of Brazil reserves the right to request additional information and documents at any time; and

(ii) the conclusion of the Pix adhesion process implies adherence to the rules, conditions and procedures established in the Pix Regulation.

______________________________________________________ Name (director responsible for the cybersecurity policy)

(Annex VII included, as of 2/5/2023, by BCB Normative Instruction No. 373, dated 25/4/2023.)

Annex VII - Self-assessment questionnaire on security - Institutions intending to operate as a transactional account provider, access the DICT indirectly and be an indirect participant of the SPI

The questionnaire addresses security aspects related to Pix.

Compliance with these aspects is mandatory for all participants. Therefore, failure to meet the entirety of these aspects, as well as the failure to effectively implement the security mechanisms provided for, from the beginning of the restricted operation stage, subjects the applicant to the rejection of the adhesion request.

The participant shall store evidence supporting its adherence to the aspects listed in this questionnaire at the time of submission to the Central Bank of Brazil. These evidences may be requested by the Central Bank of Brazil and may include, at the participant's discretion, diagrams, topologies, flowcharts, screenshots, queries with their respective returns or other documents deemed relevant.

It is important to emphasize that the eventual provision, to the Central Bank of Brazil, of incorrect documents, data or information, or information in disagreement with the deadlines and conditions established in legal or regulatory norms, constitutes an infraction punishable under the terms of the current legislation.

Security of dynamic QR Codes

Section 4 of the Pix Security Manual sets out the security specifications for dynamic QR Codes generated by the payee.

I (a)

Does the envisaged solution provide for compliance, from the institution's first moment of operation in the restricted operation phase, with the requirements set out in items 4.1 and 4.2 of the Pix Security Manual?

(Yes/No/Dynamic QR Code generation will not be offered)

I (b)

Does the envisaged solution provide for compliance, from the institution's first moment of operation in the restricted operation phase, with the requirements set out in item 4.3 of the Pix Security Manual?

(Yes/No/Dynamic QR Code generation will not be offered)

Secure implementation of applications, APIs and other systems

Section 6 of the Pix Security Manual sets out mandatory security aspects in the implementation of systems related to Pix.

II (a)

Does the envisaged solution contemplate the use, from the institution's first moment of operation in the restricted operation phase, of encryption mechanisms in the communication between Pix-related systems and APIs and their respective client applications or software?

(Yes/No)

II (b)

Does the envisaged solution contemplate the implementation, from the institution's first moment of operation in the restricted operation phase, of strong authentication mechanisms for the client software in the APIs and systems related to Pix?

(Yes/No)

II (c)

Does the envisaged solution contemplate the implementation, from the institution's first moment of operation in the restricted operation phase, of security mechanisms capable of ensuring that the APIs and other systems used are accessed only by the participant's legitimate client software, in order to prevent man-in-the-middle attacks?

(Yes/No)

II (d)

Does the envisaged solution contemplate the implementation, from the institution's first moment of operation in the restricted operation phase, of security mechanisms capable of ensuring that the client software communicates only with the desired APIs and systems, in order to prevent man-in-the-middle attacks and manipulation of its communication?

(Yes/No)

II (e)

Does the envisaged solution contemplate the implementation, from the institution's first moment of operation in the restricted operation phase, of security mechanisms that prevent reverse engineering, decompilation, code manipulation, modification of credentials or security parameters, among other techniques that result in the tampering of applications or client software?

(Yes/No)

II (f)

Does the envisaged solution contemplate the implementation of security for the APIs and other systems related to Pix predominantly on the server side, from the institution's first moment of operation in the restricted operation phase, so as to prevent security from being restricted solely to the client software or application?

(Yes/No)

II (g)

Does the envisaged solution contemplate the provision, from the institution's first moment of operation in the restricted operation phase, of only the information strictly necessary for the correct functioning of the applications?

(Yes/No)

II (h)

Does the planned solution contemplate the implementation of controls, from the first moment of the institution's operation in the restricted operation phase, to ensure that information such as the full CPF (without mask), agency and account data of recipients of payments via Pix, as well as information for security purposes linked to Pix keys, are for the exclusive use of the participant's internal systems and are not exposed to its applications and client software?

(Yes/No)

II (i)

Does the planned solution contemplate the processing and masking of data obtained in the query of Pix keys and transactions using QR Code directly in the system or API, instead of using filters in the client software, from the first moment of the institution's operation in the restricted operation phase?

(Yes/No)

II (j)

Does the planned solution contemplate the implementation on its website, from the first moment of the institution's operation in the restricted operation phase, of mechanisms to prevent the use of robots and automation of queries of Pix keys and transactions?

(Yes/No/There will be no use of the website for initiating a Pix)

III

Audit Logs

Section 7 of the Pix Security Manual provides for the audit logs that must be maintained by all Pix participants.

III (a)

Does the planned solution consider compliance, from the first moment of the institution's operation in the restricted operation phase, with the requirements set forth in section 7 of the Pix Security Manual?

(Yes/No)

Mechanisms for preventing reading attacks

Section V of chapter XIII of the Regulation Annex to BCB Resolution No. 1 (Pix Regulation), of 12 August 2020, and section 13 of the DICT Operational Manual provide for mechanisms for preventing reading attacks.

IV (a)

Does the planned solution contemplate the implementation of mechanisms for preventing reading attacks on the institution's internal Pix key database from the first moment of the institution's operation in the restricted operation phase?

(Yes/No)

IV (b)

Are the planned mechanisms for preventing reading attacks on the institution's internal Pix key database at least equal to the mechanisms for preventing reading attacks existing in the DICT and detailed in the DICT Operational Manual?

(Yes/No)

IV (c)

Does the planned solution contemplate the implementation of mechanisms for preventing reading attacks on the DICT from the first moment of the institution's operation in the restricted operation phase?

(Yes/No)

IV (d)

Are the planned mechanisms for preventing reading attacks on the DICT at least equal to the mechanisms for preventing reading attacks existing in the DICT and detailed in the DICT Operational Manual?

(Yes/No)

IV (e)

Does the planned solution contemplate the implementation, from the first moment of the institution's operation in the restricted operation phase, of a mechanism for verifying the authenticity of the user requesting the query?

(Yes/No)

IV (f)

Does the planned solution contemplate the implementation, from the first moment of the institution's operation in the restricted operation phase, of an internal policy mechanism for limiting queries?

(Yes/No)

IV (g)

Does the planned solution contemplate the implementation, from the first moment of the institution's operation in the restricted operation phase, of mechanisms for identifying and handling cases of excessive queries of Pix keys that do not result in the sending of a payment order?

(Yes/No)

IV (h)

(Yes/No)

IV (i)

Will the institution establish, from the first moment of the institution's operation in the restricted operation phase, an action plan for handling suspected cases of reading attacks?

(Yes/No)

We declare that we are aware that:

(i) to complete the Pix adherence process, the Central Bank of Brazil reserves the right to require additional information and documents at any time; and

(ii) the completion of the Pix adherence process implies adherence to the rules, conditions and procedures established in the Pix Regulation.

______________________________________________________ Name (director responsible for the cybersecurity policy)

(Annex VIII included, as of 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)

Annex VIII - Security self-assessment questionnaire - Institutions intending to operate in the special settlement modality

The questionnaire addresses security aspects related to Pix.

Compliance with these aspects is mandatory for all participants. Accordingly, failure to meet all of these aspects, as well as failure to effectively implement the provided security mechanisms, from the beginning of the restricted operation stage, subjects the applicant to rejection of the membership application.

The participant must store evidence supporting its adherence to the aspects listed in this questionnaire at the time of submission to the Central Bank of Brazil. Such evidence may be requested by the Central Bank of Brazil and may include, at the participant's discretion, diagrams, topologies, flowcharts, screenshots, queries with their respective returns, or other documents it deems pertinent.

It is important to emphasize that any provision to the Central Bank of Brazil of incorrect documents, data, or information, or in disagreement with the deadlines and conditions established in legal or regulatory rules, constitutes an infraction punishable under current legislation.

Secure communication

Section 2 of the Pix Security Manual sets forth rules for secure communication purposes

I (a)

Does the proposed solution consider compliance, from the very first moment of the institution in full operation, with the requirements set forth in section 2 of the Pix Security Manual? (Yes/No)

Digital Signature

Section 3 of the Pix Security Manual sets forth the digital signature of messages transmitted in the Instant Payment System (SPI) and in the Transactional Account Identifier Directory (DICT).

II (a)

Does the proposed solution consider compliance, from the very first moment of the institution in full operation, with the requirements set forth in section 3 of the Pix Security Manual?

(Yes/No)

III

Digital certificates

Section 5 of the Pix Security Manual sets forth the types of certificate to be used within the scope of Pix, as well as the processes for activation, deactivation, and revocation verification of these certificates.

III (a)

Does the proposed solution consider compliance, from the very first moment of the institution in full operation, with the requirements set forth in section 5 of the Pix Security Manual?

(Yes/No)

Secure implementation of applications, APIs, and other systems

Section 6 of the Pix Security Manual sets forth mandatory security aspects in the implementation of systems related to Pix.

IV (a)

Does the proposed solution contemplate the use, from the very first moment of the institution in full operation, of encryption mechanisms in communication between the systems and APIs related to Pix and their respective client applications or software?

(Yes/No)

IV (b)

Does the proposed solution contemplate the implementation, from the very first moment of the institution in full operation, of strong authentication mechanisms for the client software in the APIs and systems related to Pix?

(Yes/No)

IV (c)

Does the proposed solution contemplate the implementation, from the very first moment of the institution in full operation, of security mechanisms capable of ensuring that the APIs and other systems used are accessed only by the participant's legitimate client software, so as to prevent man-in-the-middle attacks?

(Yes/No)

IV (d)

Does the proposed solution contemplate the implementation, from the very first moment of the institution in full operation, of security mechanisms capable of ensuring that the client software communicates only with the desired APIs and systems, so as to prevent man-in-the-middle attacks and manipulation of its communication?

(Yes/No)

IV (e)

Does the proposed solution contemplate the implementation, from the very first moment of the institution in full operation, of security mechanisms that prevent reverse engineering, decompilation, code manipulation, modification of credentials or security parameters, among other techniques that result in the adulteration of the applications or client software?

(Yes/No)

IV (f)

Does the proposed solution contemplate the implementation of the security of the APIs and other systems related to Pix mostly on the server side, from the very first moment of the institution in full operation, so as to prevent security from being restricted only to the client software or application?

(Yes/No)

IV (g)

Does the proposed solution contemplate the provision, from the very first moment of the institution in full operation, of only the information strictly necessary for the correct functioning of the applications?

(Yes/No)

Audit Logs

Section 7 of the Pix Security Manual sets forth the audit logs that must be maintained by all Pix participants.

V (a)

Does the proposed solution consider compliance, from the very first moment of the institution in full operation, with the requirements set forth in section 7 of the Pix Security Manual?

(Yes/No)

Mechanisms for preventing reading attacks

Section V of chapter XIII of the Regulation Annex to BCB Resolution No. 1 (Pix Regulation), of 12 August 2020, and section 13 of the DICT Operations Manual set forth mechanisms for preventing reading attacks.

VI (a)

Does the proposed solution contemplate the implementation of mechanisms for preventing reading attacks on the institution's internal Pix key database from the very first moment of the institution in full operation?

(Yes/No)

VI (b)

Are the planned mechanisms for preventing read attacks on the institution's internal Pix key base at least equal to the mechanisms for preventing read attacks existing in the DICT and detailed in the DICT Operational Manual?

(Yes/No)

VI (c)

Does the proposed solution provide for the implementation of mechanisms for preventing read attacks on the DICT from the institution's first moment in full operation?

(Yes/No)

VI (d)

Are the planned mechanisms for preventing read attacks on the DICT at least equal to the mechanisms for preventing read attacks existing in the DICT and detailed in the DICT Operational Manual?

(Yes/No)

VII (e)

Does the proposed solution provide for the implementation, from the institution's first moment in full operation, of an internal policy mechanism for limiting queries?

(Yes/No)

VII (f)

Does the proposed solution provide for the implementation, from the institution's first moment in full operation, of mechanisms for identifying and handling cases of excessive queries of Pix keys that do not result in the sending of a payment order?

(Yes/No)

VII (g)

(Yes/No)

VII (h)

Will the institution establish, from the institution's first moment in full operation, an action plan for handling suspected cases of read attack?

(Yes/No)

We declare that we are aware that:

(i) to complete the Pix membership process, the Central Bank of Brazil reserves the right to require additional information and documents at any time; and
(ii) completion of the Pix membership process implies adherence to the rules, conditions and procedures established in the Pix Regulation.

______________________________________________________ Name (director responsible for the cybersecurity policy)

(Annex IX included, as of 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)

Annex IX - Security self-assessment questionnaire - Institutions intending to operate as initiator and directly access the DICT

The questionnaire addresses security aspects related to Pix.

It is important to emphasize that the eventual provision, to the Central Bank of Brazil, of incorrect documents, data or information, or in disagreement with the deadlines and conditions established in legal or regulatory norms, constitutes an infraction punishable under current legislation.

Secure communication

Section 2 of the Pix Security Manual provides rules for secure communication purposes

I (a)

Does the proposed solution consider compliance, from the institution's first moment in full operation, with the requirements set forth in section 2 of the Pix Security Manual? (Yes/No)

Digital Signature

Section 3 of the Pix Security Manual provides for the digital signature of messages transmitted in the Instant Payment System (SPI) and in the Transactional Account Identifier Directory (DICT).

II (a)

Does the proposed solution consider compliance, from the institution's first moment in full operation, with the requirements set forth in section 3 of the Pix Security Manual?

(Yes/No)

III

Security of dynamic QR Codes

Section 4 of the Pix Security Manual provides the security specifications for dynamic QR Codes generated by the payee.

III (a)

Does the proposed solution consider compliance, from the institution's first moment in full operation, with the requirements set forth in item 4.3 of the Pix Security Manual?

(Yes/No/Generation of dynamic QR Codes will not be offered)

Digital certificates

IV (a)

Does the proposed solution consider compliance, from the institution's first moment in full operation, with the requirements set forth in section 5 of the Pix Security Manual?

(Yes/No)

Secure implementation of applications, APIs and other systems

Section 6 of the Pix Security Manual provides for mandatory security aspects in the implementation of systems related to Pix.

V (a)

Does the proposed solution contemplate the use, from the very first moment of the institution in full operation, of encryption mechanisms in the communication between the systems and APIs related to Pix and their respective client applications or software?

(Yes/No)

V (b)

(Yes/No)

V (c)

(Yes/No)

V (d)

Does the proposed solution contemplate the implementation, from the very first moment of the institution in full operation, of security mechanisms capable of ensuring that the client software communicates only with the desired APIs and systems, in order to prevent man-in-the-middle attacks and manipulation of its communication?

(Yes/No)

V (e)

(Yes/No)

V (f)

Does the proposed solution contemplate the implementation of the security of the APIs and other systems related to Pix mostly on the server side, from the very first moment of the institution in full operation, in order to prevent security from being restricted only to the client software or application?

(Yes/No)

V (g)

Does the proposed solution contemplate providing, from the very first moment of the institution in full operation, only the information strictly necessary for the correct functioning of the applications?

(Yes/No)

V (h)

Does the proposed solution contemplate the implementation of controls, from the very first moment of the institution in full operation, to ensure that information such as the full CPF (without mask), branch and account data of recipients of payments via Pix, as well as information for security purposes linked to Pix keys, are for the exclusive use of the participant's internal systems and are not exposed to its applications and client software?

(Yes/No)

V (i)

Does the proposed solution contemplate the processing and masking of data obtained in the query of Pix keys and transactions using QR Code directly in the system or API, instead of using filters in the client software, from the very first moment of the institution in full operation?

(Yes/No)

V (j)

Does the proposed solution contemplate the implementation on its website, from the very first moment of the institution in full operation, of mechanisms to prevent the use of robots and automation of queries of Pix keys and transactions?

(Yes/No/There will be no use of the website for initiating a Pix)

Audit Logs

Section 7 of the Pix Security Manual provides for the audit logs that must be maintained by all Pix participants.

VI (a)

Does the proposed solution consider compliance, from the very first moment of the institution in full operation, with the requirements set forth in section 7 of the Pix Security Manual?

(Yes/No)

VII

Mechanisms to prevent reading attacks

Section V of chapter XIII of the Regulation Annex to BCB Resolution No. 1 (Pix Regulation), of 12 August 2020, and section 13 of the DICT Operational Manual provide for mechanisms to prevent reading attacks.

VII (a)

Does the proposed solution contemplate the implementation of mechanisms to prevent reading attacks on the DICT from the very first moment of the institution in full operation?

(Yes/No)

VII (b)

Are the planned mechanisms to prevent reading attacks on the DICT at least equal to the mechanisms to prevent reading attacks existing in the DICT and detailed in the DICT Operational Manual?

(Yes/No)

VII (c)

Does the proposed solution contemplate the implementation, from the very first moment of the institution in full operation, of a mechanism to verify the authenticity of the user requesting the query?

(Yes/No)

VII (d)

Does the proposed solution contemplate the implementation, from the very first moment of the institution in full operation, of an internal policy mechanism to limit queries?

(Yes/No)

VII (e)

Does the proposed solution contemplate the implementation, from the very first moment of the institution in full operation, of mechanisms to identify and handle cases of excessive queries of Pix keys that do not result in the sending of a payment order?

(Yes/No)

VII (f)

(Yes/No)

VII (g)

Will the institution establish, from the very first moment of the institution in full operation, an action plan to handle suspected cases of reading attacks?

(Yes/No)

We declare that we are aware that:

(i) to complete the Pix membership process, the Central Bank of Brazil reserves the right to require additional information and documents at any time; and
(ii) completion of the Pix membership process implies adherence to the rules, conditions and procedures established in the Pix Regulation.

______________________________________________________ Name (director responsible for the cybersecurity policy)

(Annex X included, as of 2/5/2023, by BCB Normative Instruction No. 373, of 4/25/2023.)

Annex X - Security self-assessment questionnaire - Institutions that intend to operate in the initiator modality and access the DICT indirectly

The questionnaire addresses security aspects related to Pix.

The participant must store evidence supporting its adherence to the aspects listed in this questionnaire at the time of submission to the Central Bank of Brazil. This evidence may be requested by the Central Bank of Brazil and may include, at the participant's discretion, diagrams, topologies, flowcharts, screenshots, queries with their respective responses, or other documents it deems pertinent.

It is important to emphasize that the eventual provision, to the Central Bank of Brazil, of incorrect documents, data or information, or in disagreement with the deadlines and conditions established in legal or regulatory rules, constitutes an infraction punishable under current legislation.

Security of dynamic QR Codes

Section 4 of the Pix Security Manual provides for the security specifications of dynamic QR Codes generated by the receiver.

I (a)

Does the proposed solution consider compliance, from the first moment of the institution in full operation, with the requirements set out in item 4.3 of the Pix Security Manual?

(Yes/No/Generation of dynamic QR Codes will not be offered)

Secure implementation of applications, APIs and other systems

Section 6 of the Pix Security Manual provides for mandatory security aspects in the implementation of systems related to Pix.

II (a)

Does the proposed solution contemplate the use, from the first moment of the institution in full operation, of encryption mechanisms in communication between the systems and APIs related to Pix and their respective client applications or software?

(Yes/No)

II (b)

Does the proposed solution contemplate the implementation, from the first moment of the institution in full operation, of strong authentication mechanisms for the client software in the APIs and systems related to Pix?

(Yes/No)

II (c)

Does the proposed solution contemplate the implementation, from the first moment of the institution in full operation, of security mechanisms capable of ensuring that the APIs and other systems used are accessed only by the participant's legitimate client software, in order to prevent man-in-the-middle attacks?

(Yes/No)

II (d)

Does the proposed solution contemplate the implementation, from the first moment of the institution in full operation, of security mechanisms capable of ensuring that the client software communicates only with the desired APIs and systems, in order to prevent man-in-the-middle attacks and manipulation of its communication?

(Yes/No)

II (e)

Does the proposed solution contemplate the implementation, from the first moment of the institution in full operation, of security mechanisms that prevent reverse engineering, decompilation, code manipulation, modification of credentials or security parameters, among other techniques that result in the adulteration of the applications or client software?

(Yes/No)

II (f)

Does the proposed solution contemplate the implementation of the security of the APIs and other systems related to Pix mostly on the server side, from the first moment of the institution in full operation, in order to prevent security from being restricted only to the client software or application?

(Yes/No)

II (g)

Does the proposed solution contemplate the provision, from the first moment of the institution in full operation, of only the information strictly necessary for the correct functioning of the applications?

(Yes/No)

II (h)

Does the proposed solution contemplate the implementation of controls, from the first moment of the institution in full operation, to ensure that information such as the full CPF (without mask), agency and account data of recipients of payments via Pix, as well as information for security purposes linked to Pix keys, are for the exclusive use of the participant's internal systems and are not exposed to its applications and client software?

(Yes/No)

II (i)

(Yes/No)

II (j)

Does the proposed solution contemplate the implementation on its website, from the first moment of the institution in full operation, of mechanisms to prevent the use of robots and automation of queries of Pix keys and transactions?

(Yes/No/The website will not be used to initiate a Pix)

III

Audit Logs

Section 7 of the Pix Security Manual provides for the audit logs that must be maintained by all Pix participants.

III (a)

Does the proposed solution consider compliance, from the first moment of the institution in full operation, with the requirements set out in section 7 of the Pix Security Manual?

(Yes/No)

Mechanisms for preventing reading attacks

IV (a)

Does the proposed solution provide for the implementation of mechanisms for preventing reading attacks on the DICT from the first moment the institution is in full operation?

(Yes/No)

IV (b)

Are the planned mechanisms for preventing reading attacks on the DICT at least equal to the mechanisms for preventing reading attacks existing in the DICT and detailed in the DICT Operational Manual?

(Yes/No)

IV (c)

Does the proposed solution provide for the implementation, from the first moment the institution is in full operation, of a mechanism for verifying the authenticity of the user requesting the query?

(Yes/No)

IV (d)

Does the proposed solution provide for the implementation, from the first moment the institution is in full operation, of an internal policy mechanism for limiting queries?

(Yes/No)

IV (e)

Does the proposed solution provide for the implementation, from the first moment the institution is in full operation, of mechanisms for identifying and handling cases of excessive queries of Pix keys that do not result in the sending of a payment order?

(Yes/No)

IV (f)

(Yes/No)

IV (g)

Will the institution establish, from the first moment the institution is in full operation, an action plan for handling suspected cases of reading attacks?

(Yes/No)

We declare that we are aware that:

(i) to complete the Pix adherence process, the Central Bank of Brazil reserves the right to require complementary information and documents at any time; and
(ii) completion of the Pix adherence process implies adherence to the rules, conditions and procedures established in the Pix Regulation.

______________________________________________________ Name (director responsible for the cybersecurity policy)

(Annex XI included, as of 2/5/2023, by BCB Normative Instruction No. 373, of 25/4/2023.)

Annex XI - Security self-assessment questionnaire - Institutions intending to operate in the initiator modality and without access to the DICT

The questionnaire addresses security aspects related to Pix.

It is important to emphasize that the eventual provision, to the Central Bank of Brazil, of incorrect documents, data or information or in disagreement with the deadlines and conditions established in legal or regulatory norms constitutes an infraction punishable under current legislation.

Secure implementation of applications, APIs and other systems

Section 6 of the Pix Security Manual provides for mandatory security aspects in the implementation of systems related to Pix.

I (a)

Does the proposed solution provide for the use, from the first moment the institution is in full operation, of encryption mechanisms in communication between the systems and APIs related to Pix and their respective client applications or software?

(Yes/No)

I (b)

Does the proposed solution provide for the implementation, from the first moment the institution is in full operation, of strong authentication mechanisms for the client software in the APIs and systems related to Pix?

(Yes/No)

I (c)

Does the proposed solution provide for the implementation, from the first moment the institution is in full operation, of security mechanisms capable of ensuring that the APIs and other systems used are accessed only by the participant's legitimate client software, so as to prevent man-in-the-middle attacks?

(Yes/No)

I (d)

Does the proposed solution provide for the implementation, from the first moment the institution is in full operation, of security mechanisms capable of ensuring that the client software communicates only with the desired APIs and systems, so as to prevent man-in-the-middle attacks and manipulation of its communication?

(Yes/No)

I (e)

Does the proposed solution provide for the implementation, from the first moment the institution is in full operation, of security mechanisms that prevent reverse engineering, decompilation, code manipulation, modification of credentials or security parameters, among other techniques that result in the adulteration of applications or client software?

(Yes/No)

I (f)

Does the proposed solution provide for the implementation of the security of APIs and other systems related to Pix mostly on the server side, from the first moment the institution is in full operation, so as to prevent security from being restricted only to the client software or application?

(Yes/No)

I (g)

Does the solution provided contemplate the implementation on its website, from the very first moment of the institution in full operation, of mechanisms to prevent the use of robots and automation of key queries and Pix transactions?

(Yes/No/No use of the website for initiating a Pix)

Audit Logs

Section 7 of the Pix Security Manual provides for the audit logs that must be maintained by all Pix participants.

II (a)

Does the solution provided consider compliance, from the very first moment of the institution in full operation, with the requirements set forth in section 7 of the Pix Security Manual?

(Yes/No)

We declare that we are aware that:

(i) to complete the Pix membership process, the Central Bank of Brazil reserves the right to require additional information and documents at any time; and
(ii) completion of the Pix membership process implies adherence to the rules, conditions and procedures established in the Pix Regulation.

______________________________________________________ Name (director responsible for the cybersecurity policy)

NOTE

As defined in paragraph 8 of Voto 280/2021–BCB, of 10 November 2021, the Pix Regulation is not characterized as a regulatory act of binding force, having, in fact, an eminently contractual nature; therefore, modifications made to said regulation are not subject to the prior production of a regulatory impact analysis (RIA). As provided for in Decreto nº 10.411, of 30 June 2020, the RIA is mandatory only for the issuance of normative acts of general interest produced by the bodies and entities of the direct and indirect federal public administration.

Angelo José Mont Alverne Duarte Department of Competition and Financial Market Structure

BCB Normative Instruction No. 291 — Establishes the necessary procedures for joining Pix

BCB Normative Instruction No. 291

CHAPTER I OF THE REGISTRATION STAGE

CHAPTER II OF THE HOMOLOGATION STAGE

Section I On the Formal Homologation Tests in the SPI

Section II On the Homologation Tests between the Indirect Participant in the SPI and its Settling Agent

Section III On the Formal Homologation Tests in the DICT

Section IV On the Process of Verifying the Alignment of Solutions with End Users

Section V On the Formal Validation Tests of QR Codes

Section VI On the Formal Validation Tests for the Payment Transaction Initiation Service

Section VII On the Formal Tests for the Publication of Information Relating to the Withdrawal Service

CHAPTER III ON THE RESTRICTED OPERATION STAGE

CHAPTER III-A TRANSITIONAL PROVISIONS

CHAPTER IV GENERAL PROVISIONS

Annex I - Pix participation and registration update form for institutions that have authorization to operate from the Banco Central do Brasil and that intend to operate as a transaction account provider

Annex I - Pix Adherence Form and Registration Update for institutions that have authorization to operate from the Central Bank of Brazil and that intend to act in the transactional account provider modality

Annex I - Pix Adhesion Form and Registration Update for institutions holding authorization to operate from the Central Bank of Brazil that intend to act in the transactional account provider modality

Annex II - Pix adhesion and registration update form for institutions holding an operating authorization from the Central Bank of Brazil that intend to act exclusively in the special settler modality

Annex II - Pix onboarding and registration update form for institutions authorized to operate by the Central Bank of Brazil and that intend to act exclusively as special settlement participant

Annex III - Pix onboarding and registration update form for institutions not authorized to operate by the Central Bank of Brazil

Annex III - Pix adhesion and registration update form for institutions that do not have authorization to operate from the Central Bank of Brazil

Annex IV - Pix membership and registration update form for institutions that intend to operate exclusively as initiator

Annex IV - Pix membership and registration update form for institutions that intend to operate exclusively as initiator

Annex V - Procedures for processing instruction by means of the Digital Protocol and for obtaining the Sisbacen code

Annex VI - Self-assessment questionnaire on security - Institutions that intend to operate in the transactional account provider modality, directly access the DICT and be a direct participant in the SPI

Annex VII - Self-assessment questionnaire on security - Institutions intending to operate as a transactional account provider, access the DICT indirectly and be an indirect participant of the SPI

Annex VIII - Security self-assessment questionnaire - Institutions intending to operate in the special settlement modality

Annex IX - Security self-assessment questionnaire - Institutions intending to operate as initiator and directly access the DICT

Annex X - Security self-assessment questionnaire - Institutions that intend to operate in the initiator modality and access the DICT indirectly

Annex XI - Security self-assessment questionnaire - Institutions intending to operate in the initiator modality and without access to the DICT

NOTE

Lineage: No known changes