Normative Instruction BCB No. 491 — Establishes guidelines for registering access devices for initiating Pix transactions and managing Pix keys, and defines the maximum value allowed for initiating Pix transactions on unregistered access devices

Resolution No. 222

NORMATIVE INSTRUCTION BCB No. 491, OF JULY 23, 2024

Establishes the guidelines for registering access devices for initiating Pix transactions and for managing Pix keys, and defines the maximum value allowed for initiating Pix transactions on unregistered access devices.

The Head of the Department of Competition and Financial Market Structure (Decem) and the Head of the Information Technology Department (Deinf), in the exercise of the powers conferred upon them by art. 23, item I, letter “a”, and respectively, art. 94, item IX, and art. 70, item VII, of the Internal Regulations of the Central Bank of Brazil, annexed to Resolution BCB No. 340, of September 21, 2023, and in view of the provisions of art. 89, §§ 7 and 9, of the Regulation annexed to Resolution BCB No. 1, of August 12, 2020,

RESOLVE:

Art. 1 This Normative Instruction establishes:

I - the guidelines for registering access devices for:

a) initiation of Pix transactions; and

b) request for registration, deletion, alteration, portability, and claim of possession of Pix keys; and

II - the maximum value allowed for initiating Pix transactions on unregistered access devices.

Sole Paragraph. The provisions of this normative instruction do not apply to the Pix Automatic product, as provided for in Subsection IV, Section II, Chapter V, of the Regulation Annexed to Resolution BCB No. 1, of August 12, 2020. (Included by Normative Instruction BCB No. 594, of 3/19/2025.)

Art. 2 This Normative Instruction applies to Pix participants in the modalities:

I - transactional account provider; and

II - initiator.

Art. 2 This Normative Instruction applies to Pix participants in the transactional account provider modality. (Wording given by Normative Instruction BCB No. 594, of 3/19/2025.)

Sole Paragraph. The Pix participants referred to in the caput must observe the guidelines for registering access devices, including for Pix transactions initiated through a payment transaction initiation service, whenever there are stages in which the user is redirected to the environment of the institution holding the account. (Included by Normative Instruction BCB No. 594, of 3/19/2025.)

Art. 3 The guidelines for registering access devices have the following objectives:

I - to ensure the integrity, security, and efficiency of Pix; and

II - to guarantee transparency and the protection of the rights of Pix end users.

Art. 4 In the process of registering access devices, the Pix participant must, at a minimum:

I - confirm the following personal information of the user:

I - confirm the identity of the user who is the account holder; and (Wording given by Normative Instruction BCB No. 594, of 3/19/2025.)

a) name;

a) (Revoked by Normative Instruction BCB No. 594, of 3/19/2025.)

b) CPF;

b) (Revoked by Normative Instruction BCB No. 594, of 3/19/2025.)

c) phone number;

c) (Revoked by Normative Instruction BCB No. 594, of 3/19/2025.)

d) email address (e-mail);

d) (Revoked by Normative Instruction BCB No. 594, of 3/19/2025.)

e) transactional account number; and

e) (Revoked by Normative Instruction BCB No. 594, of 3/19/2025.)

f) branch number linked to the transactional account; and

f) (Revoked by Normative Instruction BCB No. 594, of 3/19/2025.)

II - use verification codes or two-factor authentication.

§ 1 For the purpose of complying with item I of the caput, the Pix participant must: (Included by Normative Instruction BCB No. 594, of 3/19/2025.)

I - confirm the following personal information of the user: (Included by Normative Instruction BCB No. 594, of 3/19/2025.)

a) name; (Included by Normative Instruction BCB No. 594, of 3/19/2025.)

b) CPF; (Included by Normative Instruction BCB No. 594, of 3/19/2025.)

c) phone number; (Included by Normative Instruction BCB No. 594, of 3/19/2025.)

d) email; (Included by Normative Instruction BCB No. 594, of 3/19/2025.)

e) transactional account number; and (Included by Normative Instruction BCB No. 594, of 3/19/2025.)

f) branch number linked to the transactional account; or (Included by Normative Instruction BCB No. 594, of 3/19/2025.)

II - use secure mechanisms such as: (Included by Normative Instruction BCB No. 594, of 3/19/2025.)

a) smartcards; (Included by Normative Instruction BCB No. 594, of 3/19/2025.)

b) cryptographic tokens; (Included by Normative Instruction BCB No. 594, of 3/19/2025.)

c) one-time password tokens, or OTP; or (Included by Normative Instruction BCB No. 594, of 3/19/2025.)

d) biometric access. (Included by Normative Instruction BCB No. 594, of 3/19/2025.)

§ 2 Participants are responsible for failures in the implementation of mechanisms for identifying the user who is the account holder. (Included by Normative Instruction BCB No. 594, of 3/19/2025.)

Art. 5 The Pix participant must establish, at its discretion, the number of devices that may be enabled for its clients.

Art. 6 The Pix participant must make available to its clients the possibility of managing registered devices.

§ 1 The participant must make available, at a minimum, the following functionalities:

I - device inclusion;

I - device inclusion; and (Wording given by Normative Instruction BCB No. 594, of 3/19/2025.)

II - device exclusion; and

II - device exclusion. (Wording given by Normative Instruction BCB No. 594, of 3/19/2025.)

III - device blocking.

III - (Revoked by Normative Instruction BCB No. 594, of 3/19/2025.)

§ 2 The management of devices must be made available, at least, in the application used by the client to initiate Pix transactions.

§ 3 The Pix participant may make available the functionalities: (Included by Normative Instruction BCB No. 594, of 3/19/2025.)

I - device blocking; and (Included by Normative Instruction BCB No. 594, of 3/19/2025.)

II - device unblocking. (Included by Normative Instruction BCB No. 594, of 3/19/2025.)

Art. 7 The Pix participant must delete a previously registered device, without the client's consent, if the device:

I - has been stolen or lost;

II - has been damaged and cannot be repaired;

III - is outdated and no longer compatible;

IV - has its security compromised;

V - is being used for illegal activities; or

VI - has not been used to initiate a Pix transaction for twelve months.

VI - has not been used to access the Pix participant's application for twelve months. (Wording given by Normative Instruction BCB No. 594, of 3/19/2025.)

Sole Paragraph. A device deleted for the reasons listed in the caput cannot perform any of the functionalities provided for in art. 1, caput, item I, nor even within the limits provided for in art. 9, until the device is re-registered. (Included, effective 7/1/2025, by Normative Instruction BCB No. 594, of 3/19/2025.)

Art. 8 If the client attempts to perform one of the actions provided for in art. 1, item I, letters “a” and “b”, on a device that is not registered, the Pix participant must:

I - inform the need to register the device prior to executing the action; and

II - make available instructions for registering the device.

Sole Paragraph. The Pix participant may, additionally, allow the user to perform the actions cited in the caput on an unregistered device, provided that each action is validated individually through another device that is registered for the same user and for the same account. (Included by Normative Instruction BCB No. 594, of 3/19/2025.)

Art. 9 The maximum value allowed for Pix transactions to be initiated on an access device that is not registered is:

Art. 9 The maximum value allowed for Pix transactions to be initiated on unregistered access devices, excluding transactions validated in the manner of art. 8, sole paragraph, is: (Wording given by Normative Instruction BCB No. 594, of 3/19/2025.)

I - R$200.00 (two hundred reais), per transaction; and

II - R$1,000.00 (one thousand reais), on a given day.

§ 1 The limit referred to in item II of the caput applies to the set of transactions initiated from unregistered devices. (Included by Normative Instruction BCB No. 594, of 3/19/2025.)

§ 2 The limits set forth in the caput do not apply to transactions initiated through a payment transaction initiation service without redirection to other environments or electronic systems, as provided for in art. 9, sole paragraph, of Joint Resolution No. 1, of May 4, 2020, when the account linking stage, as provided for in art. 2, caput, item I, of Resolution BCB No. 406, of August 2, 2024, has been performed from a device registered with the Pix participant holding the account. (Included, effective 7/1/2025, by Normative Instruction BCB No. 594, of 3/19/2025.)

Art. 10. This Normative Instruction enters into force on the date of its publication, producing effects from November 1, 2024.

RICARDO PEREIRA DE ARAÚJO HAROLDO JAYME MARTINS FROES CRUZ Substitute Head of Decem Head of Deinf

NOTE

Decree No. 10,411, of June 30, 2020, provides for the mandatory conduct of a regulatory impact analysis (AIR) for the issuance of normative acts of general interest produced by the bodies and entities of the direct and indirect federal public administration.

However, as defined in paragraph 8 of Vote 280/2021–BCB, of November 10, 2021, the Pix Regulation, including the other documents that integrate, detail, and complement it, do not constitute a regulatory act of coercive force, but rather have an eminently contractual nature. Thus, modifications made to the aforementioned regulation and to the other documents that integrate, detail, and complement it are not subject to the prior production of an AIR.

RICARDO PEREIRA DE ARAÚJO HAROLDO JAYME MARTINS FROES CRUZ Substitute Head of Decem Head of Deinf