BCB Resolution No. 584 — Amends BCB Resolution No. 142 of September 23, 2021, Regarding Procedures and Controls for Fraud Prevention in Payment Services

The Collegiate Board of the Central Bank of Brazil, in a session held on August 6, 2026, based on arts. 9, caput, items II, IX and X, of Law No. 12,865, of October 9, 2013, arts. 4 to 6 and 9 of Law No. 14,478, of December 21, 2022, and arts. 1 and 2 of Decree No. 11,563, of June 13, 2023,

R E S O L V E:

Art. 1 The summary of BCB Resolution No. 142, of September 23, 2021, published in the Official Gazette of the Union on September 24, 2021, shall be effective with the following changes:

"Provides for procedures and controls for the prevention of fraud in the provision of payment services and in the provision of virtual asset services."

Art. 2 BCB Resolution No. 142, of September 23, 2021, published in the Official Gazette of the Union on September 24, 2021, shall be effective with the following changes:

"Art. 1 This Resolution provides for procedures and controls for the prevention of fraud in the provision of payment services and in the provision of virtual asset services to be adopted by financial institutions and other institutions authorized to operate by the Central Bank of Brazil, virtual asset service providers and payment institutions that are part of the Brazilian Payments System – SPB.

Sole Paragraph. The provisions of this Resolution also apply to virtual asset service providers in the process of compliance, as per art. 88, § 2, of BCB Resolution No. 520, of November 10, 2025."

"Art. 2-A ................................................

............................................................

§ 5 The assessment referred to in § 2 must be compatible with the regulation or instrument that governs the operation of the payment arrangement related to the payment transaction."

"Art. 2-B The institutions referred to in art. 1, when providing virtual asset services or executing payment transactions related to the provision of these services, may only execute transfer orders for these assets twenty-four hours after receiving the respective contribution resources in the wallet, in Brazilian reais or in the form of virtual assets, when the transfer is destined to:

I - an entity constituted abroad that carries out activities in the virtual asset market; or

II - a self-custody wallet, as defined in specific regulatory terms.

§ 1 The retention referred to in the caput:

I - is exclusively precautionary in nature and is intended for the risk analysis of the respective operation;

II - does not imply the definitive unavailability of assets; and

III - must be applied in operations that:

a) exceed the value equivalent to US$10,000.00 (ten thousand United States dollars) or its equivalent in other currencies per operation or for the total value of operations carried out on the same day in the client's name; or

b) characterize, in accordance with the institution's policies, strategies and structures for risk management, the need for retention to carry out risk analysis of the respective operation, observing the provisions of § 2.

§ 2 The institutions referred to in art. 1 must ensure that their policies, strategies and structures for risk management provided for in the regulation include criteria for triggering the retention in the case provided for in item III, letter 'b', of § 1, observing criteria compatible, at a minimum, with the risk profiles:

I - of the client;

II - of the operation or service provided;

III - of the counterparty; and

IV - of the jurisdiction where the entity is headquartered.

§ 3 The institution must notify the client of the implementation of the retention referred to in the caput, indicating, clearly and adequately:

I - the precautionary nature of the measure referred to in item I of § 1; and

II - the applicable deadline, cited in the caput.

§ 4 Once the risk analysis referred to in item I of § 1 is concluded, the institution must, after the period referred to in the caput:

I - immediately cease the retention referred to in the caput; or

II - reject the operations.

§ 5 It is optional for the institution to cease the retention of operations before the period referred to in the caput based on a reasoned decision, including, at a minimum, the criteria set out in § 2.

§ 6 The decision, its reasoning and the criteria referred to in § 5 must be documented.

§ 7 If, in a subsequent analysis, the improper exercise of the option referred to in § 5 is found, the documentation referred to in § 6 must be accompanied by an additional document, containing the measures effectively adopted to correct the institution's internal control systems.

§ 8 The documentation referred to in §§ 6 and 7 must be available for submission to the Central Bank of Brazil, as defined in art. 6-A, caput, item II.

§ 9 For the purposes of this Resolution, the retention referred to in the caput applies to the virtual asset services provided for in art. 5, caput, items I to V, of Law No. 14,478, of December 21, 2022, including virtual assets referenced in fiat currency (stablecoins).

§ 10. The provisions of this article do not preclude the application of the provisions of this Resolution and other norms relating to the prevention of fraud, the prevention of money laundering and terrorist financing, and the compliance with other measures established in legislation and regulation."

"Art. 4 The institutions mentioned in art. 1 must maintain daily records detailing occurrences of fraud or attempts at fraud in the provision of payment services and virtual asset services, including the corrective measures adopted.

......................................................"

"Art. 6-A The Central Bank of Brazil may, among other measures, in the performance of its legal duties:

I - define the frequency, minimum content and operational procedures for the submission of the documentation referred to in art. 2-B, §§ 6 and 7; and

II - at any time, regarding a specific institution or a group of institutions, provided that non-compliance with the provisions of this Resolution is found, impose:

a) compliance with a period longer than the twenty-four hours provided for in art. 2-B, caput;

b) compliance with the procedure referred to in art. 2-B in operations with values lower than those provided for in § 1, item III, letter 'a', of that article; and

c) restrictions on the exercise of the option referred to in art. 2-B, § 5."

Art. 3 This Resolution enters into force on January 1, 2027.

GILNEU FRANCISCO ASTOLFI VIVAN

Director of Regulation