BCB Resolution No. 403 — Amends Resolution BCB No. 1 of August 12, 2020, which establishes the Pix payment arrangement and approves its regulations

RESOLUTION
BCB NO. 403, OF JULY 22, 2024

Amends Resolution BCB No. 1, of August 12, 2020, which establishes the Pix payment arrangement and approves its regulations, and the regulation attached to Resolution BCB No. 1, of August 12, 2020, which governs the operation of the Pix payment arrangement.

The Collegiate Board of the Central Bank of Brazil, in a session held on July 17, 2024, based on art. 10, caput, item IV, of Law No. 4.595, of December 31 1964, in art. 10 of Law No. 10.214, of March 27, 2001, in arts. 6, 7, 9, 10, 14 and 15 of Law No. 12.865, of October 9, 2013, in Resolution No. 4.282, of November 4, 2013, in Communication No. 32.927, of December 21, 2018, and in Communication No. 34.085, of August 28, 2019,

R E S O L V E:

Art. 1
Resolution BCB No. 1, of August 12, 2020, published in the Official Gazette of the Union on August 13, 2020, shall enter into force with the following changes:

“Art. 3
.....................................................................................................................

..................................................................................................................................

§ 3 ...........................................................................................................................

I - from other financial institutions and payment institutions; and

II - from the National Treasury Secretariat, as a government entity.

..................................................................................................................................

§ 5
...........................................................................................................................

I -
...............................................................................................................................

a) operational and liquidity risk management structure, as provided for in current regulation;

b) cybersecurity policy, action plan and incident response plan, contracting of services for data processing and storage and cloud computing, as provided for in current regulation;

..................................................................................................................................

d) procedures for the execution of the measures determined by Law No. 13.810, of March 8, 2019, which provides for the compliance with sanctions imposed by resolutions of the United Nations Security Council, including the unavailability of assets of natural and legal persons and entities, and the national designation of persons investigated or accused of terrorism, its financing or acts related to it, as provided for in current regulation; and

.........................................................................................................................”
(NR)

Art. 2
The regulation attached to Resolution BCB No. 1, of August 12, 2020, published in the Official Gazette of the Union on August 13, 2020, shall enter into force with the following changes:

“Art. 3 .....................................................................................................................

..................................................................................................................................

XXVII -
........................................................................................................................

..................................................................................................................................

c) correspondent in the country, under the terms of the specific regulation issued by the National Monetary Council in the exercise of its legal powers;

XXVIII - access device:
an electronic device used by the end user to access the Pix functionalities, which may be a mobile phone, computer, laptop or any other personal device accepted by the participant;

.........................................................................................................................”
(NR)

“Art. 6
Participants in Pix who offer transactional accounts to end-user natural persons must make available the initiation of a Pix transaction through the participant's main application, in terms of number of users, which is offered to natural persons and is accessible via mobile phone.

§ 1 ...........................................................................................................................

..................................................................................................................................

§ 2
The initiation of a Pix transaction for end-user natural persons may be made available through another application provided by the participant, in which case the participant is not obliged to offer the initiation of a Pix transaction through its main application for these end users.

§ 3
The number of users who can access the initiation of a Pix transaction through an application other than the main application, as referred to in § 2, must be lower than the number of users who have access to the initiation of a Pix transaction through the main application.” (NR)

“Art. 11-C. The offer of Pix Cobrança by Pix participants is optional, except for the obligation referred to in art. 6, § 1, item II.

.........................................................................................................................”
(NR)

“Art. 15-C.
................................................................................................................

..................................................................................................................................

§ 3
...........................................................................................................................

..................................................................................................................................

II - the participant who can provide a payment transaction initiation service, in accordance with Resolution BCB No. 80, of March 25, 2021.” (NR)

“Art. 23.
....................................................................................................................

..................................................................................................................................

III - special liquidator;

IV - initiator; and

V - user institution.

..................................................................................................................................

§ 3
...........................................................................................................................

I - within the scope of Pix, have the exclusive objective of providing settlement services for other participants, not offering sending or receiving of a Pix to end users, except as provided in § 5;

..................................................................................................................................

§ 5
The special liquidator participant may provide a payment transaction initiation service, provided it meets the requirements established in Resolution BCB No. 80, of March 25, 2021.

§ 6
A financial institution or a payment institution authorized to operate by the Central Bank of Brazil may act as a user institution, provided its exclusive objective, within the scope of Pix, is to carry out transactions for payments or receipts resulting, exclusively, from its own obligations and rights.” (NR)

“Art. 30.
....................................................................................................................

..................................................................................................................................

§ 3
The Central Bank of Brazil may, at its discretion, authorize the effective disconnection of the participant within a period shorter than that provided for in the caput.” (NR)

“Art. 31. In addition to the exclusion of a participant resulting from the application of a penalty, as provided for in Chapter XIX, the participant who:

..................................................................................................................................

III - has its contract with the responsible participant terminated, without having been replaced within the notification period provided for in art. 29; or

IV - has its authorization request for operation denied by the Central Bank of Brazil, when no further appeal is available.

Sole paragraph. The Central Bank of Brazil will exclude the participant as soon as the period for cessation of payment services provided for in art. 17 of Resolution BCB No. 81, of March 25, 2021, has ended, in the cases set forth in item IV of the caput.” (NR)

“Art. 41-B. ................................................................................................................

..................................................................................................................................

§ 3
Operational failures are not considered, for the purpose of return, the cases in which the Pix transaction was duly initiated by the payer user and the amount indicated in the initiation of the transaction was correctly credited to the transactional account of the receiving user.” (NR)

“Art. 41-D.
................................................................................................................

..................................................................................................................................

§ 1
The block referred to in item II of the caput must be maintained observing the deadlines provided for in the DICT Operational Manual.

§ 2
If the transactional account of the receiving user of the Pix transaction with a well-founded suspicion of fraud has not been closed, the participant must carry out multiple blocks or partial returns of the amount corresponding to the balance available in it, whenever resources are credited to it and:

I - the return request has been rejected due to lack of balance in the transactional account; or

II - the return occurs in an amount lower than that of the original transaction.

§ 3
The multiple blocks or partial returns referred to in § 2 must be carried out until:

I - the total amount of the transaction subject to the return request is reached; or

II - ninety days, counted from the date of the original transaction.” (NR)

“Art. 48.
....................................................................................................................

..................................................................................................................................

§ 2
Indirect access to the DICT by the account-providing participant or user institution must be carried out through a Pix participant with direct access to the DICT, and must include, at a minimum, the execution of registration, deletion, portability, ownership claim, synchronization verification and inquiry orders.

.........................................................................................................................”
(NR)

“Art. 54-A. Initiator participants with direct access to the DICT have access only to the functionalities provided for in art. 54, caput, items VII, IX and XI.” (NR)

“Art. 56.
....................................................................................................................

§ 1 ...........................................................................................................................

§ 2
The Pix participant may reject a request to register a Pix key in case of a key or user with any infraction notification stored in the DICT, in accordance with art. 78-G, and must communicate the reason for the rejection to the user.” (NR)

“Art. 59. ....................................................................................................................

..................................................................................................................................

VI - full name of the end-user natural person, which, at the discretion of the end user, may be the civil name, as registered in the CPF, or the social name, if registered in the CPF;

.........................................................................................................................”
(NR)

“Art. 60.
....................................................................................................................

§ 1 ...........................................................................................................................

..................................................................................................................................

II - suspicion, attempt or actual use of the Pix key fraudulently;

III - identification of the need for adjustment after a key synchronization verification process, as provided for in Subsection VI of this Section;

..................................................................................................................................

V - lack of correspondence between the data linked to the Pix key and the information contained in the CPF, in the case of a key linked to a natural person, or in the CNPJ, in the case of a key linked to a legal entity, as registered with the Federal Revenue Service; or

VI - inactivity, as recorded by the Federal Revenue Service, of the CPF or CNPJ linked to the key.

§ 2
The provision of item V of § 1 does not apply to cases in which the full name of the end-user natural person linked to the Pix key is a social name, if registered in the CPF.” (NR)

“Art. 89.
....................................................................................................................

..................................................................................................................................

II - Pix initiation procedures;

III - the account opening process;

IV - the processes of registration, deletion, alteration, portability and ownership claim of Pix keys; and

V - the inflow and outflow of resources in transactional accounts through Pix transactions.

§ 1
Participants must adopt, at a minimum, the following mechanisms to ensure the security of the inflow and outflow of resources in transactional accounts through Pix transactions:

I - use a fraud risk management solution that includes at least the security information stored in the DICT and is capable of identifying atypical Pix transactions or those not compatible with the client's profile to:

a) use the maximum differentiated time limit to authorize a transaction with suspected fraud, as provided for in the Pix Times Manual;

b) reject a transaction due to well-founded suspicion of fraud, as provided for in arts. 38 and 39 of this regulation; and

c) provisionally block resources originating from a Pix transaction, as provided for in art. 39-B of this regulation; and

II - make available, in an electronic channel through which a Pix transaction can be initiated, with broad access to clients, information about the precautions clients must take to avoid fraud.

§ 2
Pix transactions cannot be initiated or received by an account held by a user suspected of fraud, including third parties who receive resources from Pix transactions suspected of fraud.

§ 3
Participants must maintain a database containing security information about their clients, updated at least once every six months through consultation of the security information stored in the DICT.

§ 4
The documentation of the fraud risk management solution referred to in item I of § 1 must be made available to the Central Bank of Brazil.

§ 5
The identification of fraudulent users referred to in § 2 must include the security information stored in the DICT, and the participant must consider the existence of fraud flags against the user.

§ 6
Participants must ensure that the processes set forth in item IV of the caput and the initiation of a Pix transaction are requested by their natural person clients only through an access device previously registered by the respective client, except as provided for in §§ 7 and 8.

§ 7
Participants may allow the initiation of Pix transactions through an unregistered access device, in an amount to be defined in a specific document published by the Central Bank of Brazil.

§ 8
The provision of § 6 applies only to access devices that have never been used to initiate a Pix transaction.

§ 9
The guidelines for registering an access device will be set forth in a specific document published by the Central Bank of Brazil.” (NR)

“Art. 90-A. ................................................................................................................

I - to a third-party holder of a demand deposit account, a savings deposit account or a prepaid payment account, the initiation or receipt of Pix transactions through any of these accounts that is provided by the third party itself to the end user; or

II - to a third party not holding a demand deposit account, a savings deposit account or a prepaid payment account, the initiation of Pix transactions through the transactional account provided by the participant.” (NR)

“Art. 91-B. The Central Bank of Brazil may, at any time, notify Pix participants of occurrences of non-compliance with this regulation.

§ 1
The notification referred to in the caput will cover the occurrence characterizing non-compliance with the Pix Regulation and, whenever necessary, the determinations of the Central Bank of Brazil and the respective compliance deadlines, and may include the need to:

I - implement corrective measures to prevent recurrence of the non-compliance;

II - adopt emergency measures to mitigate the risk of damage to Pix or its users; and

III - adopt or cease a certain practice.

§ 2
In the case referred to in item I of § 1, the participant will have a period of up to five business days from receipt of the notification to submit to the Central Bank of Brazil an action plan with the list of proposed corrective measures and the respective completion deadlines.

..................................................................................................................................

§ 4
The Central Bank of Brazil may determine that the participant send documentary evidence attesting to full compliance with the notification referred to in § 1.

§ 5
The Central Bank of Brazil may, at its discretion, grant an extension of the deadlines determined in the notification, upon justified request sent by the participant before the respective deadlines expire.

§ 6
The participant notified of the occurrence of non-compliance with this regulation may submit to the Central Bank of Brazil, within a period of up to five business days from receipt of the respective notification, documentary evidence proving that:

I - there was no non-compliance with the Pix Regulation; or

II - the institution was not at fault for the occurrence subject to the notification.

§ 7
The participant will be informed whenever the exemption from the fine referred to in art. 93-A applies.” (NR)

“Art. 97. The provisions of:

I - Chapter V, Section III, Subsection III;

II - Chapter XIII, Section III, Subsections IV, V, VI, VIII and XI, Section V and Section VI;

III - Chapters XIV, XV,
XVI, XVII, XVIII and XIX; and

IV - art. 39-B.

………………………………………………………………………………………………………….…………” (NR)

“Art. 98. The provisions of Chapters V, XI and XIV do not apply to participants who act exclusively in the special liquidator modality, as referred to in art. 23, caput, item III, and who do not provide a payment transaction initiation service.

Sole paragraph. The provisions of Chapter XI do not apply to participants who act exclusively in the special liquidator modality and who provide a payment transaction initiation service.” (NR)

“Art. 98-B. The provisions of Chapters XIV and XV and art. 89 do not apply to participants that are user institutions, as referred to in art. 23, caput, item V.” (NR)

Art. 3
The following are repealed:

I - art. 3, § 3, items III and IV, of Resolution BCB No. 1, of August 12, 2020, published in the Official Gazette of the Union on August 13, 2020; and

II - art. 41-I, caput, item II, of the regulation attached to Resolution BCB No. 1, of August 12, 2020, published in the Official Gazette of the Union on August 13, 2020.

Art. 4
This Resolution enters into force on the date of its publication, producing effects:

I - from November 1, 2024, for the provisions that amend art. 89 of the regulation attached to Resolution BCB No. 1, of August 12, 2020; and

II - immediately, for the other provisions.

RENATO DIAS DE BRITO GOMES

Director of Organization of the Financial System and Resolution