BCB Resolution No. 457 — Amending the Pix Payment Arrangement Regulation to Enhance Security Mechanisms

Resolution No. 457

RESOLUTION
BCB NO. 457, OF MARCH 6, 2025

Amends the regulation annexed to BCB Resolution No. 1, of August 12, 2020, which establishes the Pix payment arrangement and approves its regulation, to enhance Pix security mechanisms.

The Collegiate Board of the Central Bank of Brazil, in a session held on February 25, 2025, based on art. 10, caput, item IV, of Law No. 4.595, of December 31, 1964, art. 10 of Law No. 10.214, of March 27, 2001, arts. 6, 7, 9, 10, 14 and 15 of Law No. 12.865, of October 9, 2013, Resolution No. 4.282, of November 4, 2013, Communication No. 32.927, of December 21, 2018, and Communication No. 34.085, of August 28, 2019,

R E S O L V E:

Art. 1 The regulation annexed to BCB Resolution No. 1, of August 12, 2020, published in the Official Gazette of the Union on August 13, 2020, shall enter into force with the following alterations:

“Art. 57.
....................................................................................................................

I - validate possession of the key with the end user, as defined in the DICT Operational Manual;

II - obtain the end user's consent; and

III - validate the name of the user to be linked to the Pix key as registered in the CPF, in the case of a natural person, or as registered in the CNPJ, in the case of a legal entity, observing the provisions of art. 59, caput.

..................................................................................................................................

§ 4 The Pix participant may only request the registration of a Pix key:

I - after the completion of the transactional account opening process, which includes verification of the account holder's identification, in accordance with current regulations; and

II - of a user whose CPF or CNPJ registration number is in a regular situation, as defined in the DICT Operational Manual.” (NR)

“Art. 59.
....................................................................................................................

..................................................................................................................................

IX - title of the establishment (trade name) of the end user, only if registered in the CNPJ, and as registered therein.

..................................................................................................................................

§ 3 The DICT Operational Manual shall provide for the parameters for compliance with items VI, VII and IX of the caput.” (NR)

“Art. 60.
....................................................................................................................

§ 1 ...........................................................................................................................

..................................................................................................................................

V - absence of correspondence between the data linked to the Pix key and the information contained in the CPF, in the case of a key linked to a natural person, or in the CNPJ, in the case of a key linked to a legal entity, according to the record maintained by the Federal Revenue Service, when there are indications of fraudulent use of the key; or

VI - irregular situation of the CPF or CNPJ registration number linked to the Pix key, as the case may be, as defined in the DICT Operational Manual.

.........................................................................................................................”
(NR)

“Art. 64.
....................................................................................................................

§ 1 Prior to the request for alteration referred to in the caput, the Pix participant must ensure that the information listed in art. 59 corresponds to that registered in the CPF, in the case of a natural person, or in the CNPJ, in the case of a legal entity.

§ 2 The alteration of information linked to the Pix key must be requested by the Pix participant, without the need for the end user's consent, in order to correct inconsistencies between the data linked to it and the information contained in the CPF, in the case of a key linked to a natural person, or in the CNPJ, in the case of a key linked to a legal entity, according to the record maintained by the Federal Revenue Service, as well as any other inconsistencies, whenever they are identified and do not constitute fraudulent use of the Pix key.” (NR)

“Art. 66.
....................................................................................................................

....................................................................................................................

III - CPF registration number; and

IV - CNPJ registration number.

.........................................................................................................................”
(NR)

“Art. 67.
....................................................................................................................

....................................................................................................................

II - regardless of request by the end user, in the cases:

a) where there is an alteration of the agency or agency and account identifiers, with the same participant, maintaining its ownership by the end user; or

b) where there is a need to correct the information linked to the Pix keys.

.........................................................................................................................”
(NR)

“Art. 68.
....................................................................................................................

....................................................................................................................

Sole Paragraph. The requirements provided for in art. 57 shall apply to the portability of Pix keys, to the extent and in the manner determined by the DICT Operational Manual.” (NR)

“Art. 70.
....................................................................................................................

....................................................................................................................

Sole Paragraph. The requirements provided for in art. 57 shall apply to the claim of possession of Pix keys, to the extent and in the manner determined by the DICT Operational Manual.” (NR)

“Art. 71. The claim of possession may be requested only for Pix phone number keys.

.........................................................................................................................”
(NR)

“Art. 89.
....................................................................................................................

....................................................................................................................

§ 6 Participants must ensure that the processes set forth in item IV of the caput and the initiation of a Pix transaction, excluding the reversals referred to in Chapter XI, are requested by their natural person clients only through an access device previously registered by the respective client, except as provided in §§ 7 and 8.

§ 7 Participants may allow the initiation of Pix transactions through an unregistered access device, in value and under conditions to be defined in a specific document published by the Central Bank of Brazil.

..................................................................................................................................

§ 9 The guidelines for registration and management of access devices, including specific procedures for Pix products and for the sharing of payment transaction initiation service, shall be set forth in a specific document published by the Central Bank of Brazil.

.........................................................................................................................”
(NR)

Art. 2 The following provisions of the regulation annexed to BCB Resolution No. 1, of August 12, 2020, published in the Official Gazette of the Union on August 13, 2020, are hereby revoked:

I - art. 60, § 2;

II - art. 66, caput, item V;

III - art. 67, sole paragraph; and

IV - art. 71, caput, items I and II.

Art. 3 This Resolution enters into force on the date of its publication, producing effects:

I - from April 1, 2025, for the provisions that alter or revoke the following provisions of the Pix Regulation:

a) art. 66;

b) art. 67, sole paragraph; and

c) art. 71;

II - from July 1, 2025, for the provisions that alter the following provisions of the Pix Regulation:

a) art.
57, caput;

b) art. 57, § 4, item II; and

c) art. 64, § 1;

III - from October 1, 2025, for the provisions that alter the following provisions of the Pix Regulation:

a) art. 68; and

b) art. 70; and

IV - immediate, for the remaining provisions.

RENATO
DIAS DE BRITO GOMES

Director of Organization of the Financial System and Resolution