Normative Instruction BCB No. 511 — Procedures for Pix Adhesion, Participation Changes, and DICT Access

Resolution No. 222

NORMATIVE INSTRUCTION BCB No. 511, OF AUGUST 30, 2024

Within the scope of Pix, it establishes the procedures necessary to request: adhesion to Pix; alteration of the participation modality in Pix; alteration of the access method to the Directory of Transactional Account Identifiers (DICT) and participation in the Instant Payment System (SPI); alteration of the responsible participant, clearing house, or service provider in the DICT; offering of additional or optional products and services; and updating of other pertinent registration information.

The Head of the Department of Competition and Financial Market Structure (Decem), in the exercise of the powers conferred by art. 23, item I, letter “a”, and art. 94, item IX, of the Internal Regulations of the Central Bank of Brazil, annexed to Resolution BCB No. 340, of September 21, 2023, and taking into account the provisions of § 3º of art. 25 of the Pix Regulations annexed to Resolution BCB No. 1, of August 12, 2020,

R E S O L V E:

Art. 1º This Normative Instruction establishes the procedures necessary to request:

I - adhesion to Pix;

II - alteration of the participation modality in Pix;

III - alteration of the access method to the Directory of Transactional Account Identifiers (DICT) and participation in the Instant Payment System (SPI);

IV - alteration of the responsible participant, clearing house, or service provider in the DICT;

V - offering of additional or optional products and services, within the scope of Pix; and

VI - registration update for participation in Pix.

Art. 2º The provisions of this Normative Instruction apply to:

I - all institutions requesting adhesion to Pix; and

II - all Pix participants.

CHAPTER I

OF THE PIX ADHESION PROCESS

Section I

Of the Procedure

Art. 3º Unless otherwise specifically provided, any issues pertinent to the Pix adhesion process will be handled exclusively by Decem, through the corporate mailbox pix-operacional@bcb.gov.br.

§ 1º For the purpose of communication with requesting institutions, Decem will use the electronic address(es) for Pix-related matters informed in the Pix adhesion form or the registration update form submitted.

§ 2º The electronic address(es) referred to in § 1º must, preferably, be accessible to more than one user of the requesting institution and be designated for resolving issues with the Central Bank of Brazil, within the scope of Pix, at the institutional level.

§ 3º It is the exclusive responsibility of the requesting institution to keep updated with the Central Bank of Brazil the contact(s) referred to in § 2º, as well as to ensure the timely receipt and handling of communications referred to in § 1º.

Art. 4º The Pix adhesion process consists of the following stages:

I - pre-registration stage;

II - registration stage;

III - homologation stage; and

IV - restricted operation stage, directed at the institution intending to act in the transactional account provider modality, except for the case of exemption provided for in art. 44.

Sole paragraph. Entering full operation in Pix requires successful approval in each successive stage, except for the case of exemption provided for in item IV.

Art. 5º The submission of a Pix adhesion request to the Central Bank of Brazil comprises sending, to Decem, the documents that make up the registration stage of the Pix adhesion process, through the Central Bank of Brazil Digital Protocol (Digital Protocol), observing the guidelines contained in Annex V.

§ 1º The pre-registration stage of the Pix adhesion process will begin on the date of submission of the request referred to in the caput.

§ 2º During the pre-registration stage of the Pix adhesion process, the adhesion request will await analysis in a service queue, organized according to the following priorities, in order:

I - institutions whose participation is mandatory;

II - institutions authorized to operate by the Central Bank of Brazil; and

III - date of authorization request.

§ 3º The Central Bank of Brazil, considering the circumstances of each concrete case and in the face of public interest involved, including for the achievement of policies prioritized by the Agency's action agenda, may, in a reasoned manner, alter the priority order referred to in § 2º.

§ 4º Requesting institutions are assured the possibility of sending additional or substitute documents without prejudice to the position they occupied in the queue at the time of the initial document.

Art. 6º The registration stage begins upon the review of the documents submitted in the pre-registration stage, at which time the requesting institution will be notified of the analysis result, which will consist of:

I - in the absence of pending issues, a communication of successful completion of the registration stage, which will also contain guidelines for executing the homologation stage of the Pix adhesion process;

II - a communication regarding curable pending issues to be resolved by the requesting institution within 30 days from the notice; or

III - a communication regarding the denial of the Pix adhesion request in case of pending issues considered non-curable.

§ 1º The requesting institution that presents curable pending issues, as provided in item II, and resolves them within the regulatory deadline, through the Digital Protocol, observing the guidelines contained in Annex V, will be notified of the successful completion of the registration stage of the Pix adhesion process, as provided in item I.

§ 2º Failure to observe the deadline set forth in item II implies the loss of validity of the request and the archiving of the Pix adhesion process.

§ 3º The forms submitted by the requesting institution during the registration stage must be signed by a director responsible for the institution. (Added by Normative Instruction BCB No. 679, of 10/30/2025.)

§ 4º Pending issues in the registration stage identified after its conclusion subject the requesting institution to denial. (Added by Normative Instruction BCB No. 679, of 10/30/2025.)

Art. 7º Once notified of the successful completion of the registration stage of the Pix adhesion process, the institution will be automatically enabled for the homologation stage of the Pix adhesion process.

§ 1º The requesting institution will have a period of five months, counted from the communication referred to in the caput, to obtain approval in the homologation stage of the Pix adhesion process.

§ 2º The period referred to in § 1º may be extended for up to two months, upon request submitted by the requesting institution to Decem, through the Digital Protocol and in free text, observing the guidelines contained in Annex V.

§ 3º The extension request referred to in § 2º must be submitted within the period referred to in § 1º. Failure to comply with this provision subjects the extension request to denial for late submission.

§ 4º If the extension request referred to in § 2º does not quantify the desired additional period, it will be tacitly considered to be two months.

§ 5º Decem will notify the requesting institution of the approval or denial of the extension request referred to in § 2º.

§ 6º For requesting institutions participating directly in the SPI, the extension of the deadline for concluding the formal homologation tests in the SPI automatically implies the extension of the period referred to in § 2º.

Art. 8º The requirements for approval in the homologation stage of the Pix adhesion process will be adapted for each requesting institution, depending on:

I - whether the institution is authorized or not to operate by the Central Bank of Brazil;

II - the Pix participation modality sought (transactional account provider, special clearing house, initiator, or user institution);

III - the intended method of access to the DICT and participation in the SPI (direct or indirect);

IV - the public for which transactional accounts are offered (natural or legal persons); and

V - the products and services the institution is obliged or intends, optionally, to offer within the scope of Pix.

Art. 9º The requesting institution will be notified of the result of the homologation stage of the Pix adhesion process, which will consist of:

I - a communication of successful completion of the homologation stage of the Pix adhesion process, which will also contain guidelines regarding the submission of a suggested date for entering production and a schedule for fulfilling the restricted operation stage, if it is an institution subject to participation in this stage of the Pix adhesion process;

II - a communication of successful completion of the homologation stage of the Pix adhesion process, which will also contain guidelines regarding the submission of a suggested date for entering directly into production and full operation, if it is an institution exempt from participation in the restricted operation stage of the Pix adhesion process; or

III - a communication of failure in the homologation stage of the Pix adhesion process, with consequent denial of the Pix adhesion request and closure of the process.

§ 1º The institution failing the homologation stage of the Pix adhesion process may only submit a new adhesion request after:

I - 90 days counted from the expiration date of the deadline for concluding the homologation stage of the last Pix adhesion request, in cases where the denial occurred due to the expiration of the regulatory deadline for concluding homologation tests and other requirements to which it was subject;

II - 90 days counted from the date of submission of the request for withdrawal of the last Pix adhesion request, if the withdrawal request is approved by Decem; or

III - 90 days counted from the date of the communication of failure in the homologation stage of the Pix adhesion process, in other cases of denial.

§ 2º The suggested date for entering production, as well as the schedule for fulfilling the restricted operation stage, if it is an institution subject to participation in this stage of the Pix adhesion process, must be submitted by the requesting institution to Decem, through the Digital Protocol and in free text, observing the guidelines contained in Annex V.

Art. 10. Decem will notify the requesting institution of the date of entry into the Pix production environment, as well as the schedule for fulfilling the restricted operation stage, if it is an institution subject to participation in this stage of the Pix adhesion process.

Sole paragraph. For requesting institutions participating directly in the SPI, the communication referred to in the caput will also inform the date and time for the effective entry into the SPI production environment.

Art. 11. Unless otherwise provided, institutions in the restricted operation stage of the Pix adhesion process will tacitly enter full operation on the day following that scheduled for the end of the restricted operation, regardless of communication from Decem on this matter.

Art. 12. It is prohibited to submit a new Pix adhesion request while the previous request has not been denied or successfully concluded.

Art. 13. In case of denial of the Pix adhesion request and submission of a new request, observing, when applicable, the 90-day period referred to in art. 9º, § 1º, there will be no credit for tests executed nor for documents submitted in previous requests.

Sole paragraph. The provisions of the caput apply to institutions that were previously Pix participants and that, excluded for any reason, submit a new Pix adhesion request after the expiration of the exclusion period.

Section II

Of the Registration Stage

Art. 14. Only adhesion requests to Pix filed with a head office CNPJ will be admitted. Requests filed with a branch CNPJ will be denied.

Art. 14-A. Institutions intending to act in the transactional account provider modality, except credit cooperatives, that do not observe the minimum limits of paid-up share capital and net worth referred to in art. 3º-A of Resolution BCB No. 1, of August 12, 2020, will have their request denied in the registration stage. (Added by Normative Instruction BCB No. 703, of 1/28/2026.)

Sole paragraph. Proof of compliance with the limits referred to in the caput will be made by sending information to the Central Bank of Brazil regarding paid-up share capital and net worth, in accordance with current regulation. (Added by Normative Instruction BCB No. 703, of 1/28/2026.)

Art. 15. Institutions that meet the criteria for mandatory participation or that, optionally, wish to participate in the SPI directly may, at their discretion, indicate the same director for matters related to Pix and for matters related to SPI.

Art. 16. For institutions that have an authorization to operate issued by the Central Bank of Brazil and intend to act in the transactional account provider modality, the registration stage of the Pix adhesion process comprises the sending and subsequent approval, by Decem, of the following documents, duly submitted through the Digital Protocol, observing the guidelines contained in Annex V:

I - Pix adhesion form, according to the model available in Annex I-A;

II - Intent form for offering products and services, according to the model available in Annex I-B; and

II - Intent form for offering products and services, according to the model available in Annex I-B; (Wording given, from 1/1/2025, by Normative Instruction BCB No. 581, of 12/30/2024.)

III - cybersecurity self-assessment questionnaire, duly signed by a director responsible for cybersecurity policy:

a) according to the model available in Annex I-C, if intending to access the DICT directly and be a direct SPI participant;

b) according to the model available in Annex I-C if intending to access the DICT directly and be an indirect SPI participant; or

c) according to the model available in Annex I-F, if intending to access the DICT indirectly and be an indirect SPI participant.

c) according to the model available in Annex I-F, if intending to access the DICT indirectly and be an indirect SPI participant; and (Wording given, from 1/1/2025, by Normative Instruction BCB No. 581, of 12/30/2024.)

IV - Pix Automatic – Receipt schedules form, according to the model available in Annex I-G, if intending to offer Pix Automatic – Receipt. (Added, from 1/1/2025, by Normative Instruction BCB No. 581, of 12/30/2024.)

§ 1º Institutions exclusively offering pre-paid payment accounts must have prior authorization from the Central Bank of Brazil for the issuance of electronic money, or be exempt from doing so, as provided in specific regulation.

§ 2º The entity of the organized cooperative system of two or three levels that intends to act as a clearing house in the SPI of, at least, one singular credit cooperative affiliated with a central credit cooperative, in addition to the information referred to in the caput, must provide, for each singular credit cooperative, the following information:

I - CNPJ registration; and

II - number of active customer accounts, at the time of the adhesion request, in the following modalities:

a) demand deposit accounts;

b) savings deposit accounts; and

c) pre-paid payment accounts.

§ 3º Singular credit cooperatives affiliated with a central credit cooperative whose registration was carried out in accordance with § 2º are exempt from sending the registration information referred to in the caput.

Art. 17. For institutions that have an authorization to operate issued by the Central Bank of Brazil and intend to act exclusively in the special clearing house modality, the registration stage of the Pix adhesion process comprises the sending, and subsequent approval, by Decem, of the following documents, duly submitted through the Digital Protocol, observing the guidelines contained in Annex V:

I - Pix adhesion form, according to the model available in Annex II-A; and

II - cybersecurity self-assessment questionnaire, according to the model available in Annex II-B, duly signed by a director responsible for cybersecurity policy.

§ 1º Participation in the special clearing house modality is prohibited to institutions that have an authorization to operate issued by the Central Bank of Brazil that have reached the amount of active transactional accounts characterizing mandatory participation in Pix in the transactional account provider modality, in accordance with the Pix Regulations.

§ 2º The institution that incurs in the situation referred to in § 1º must necessarily submit a Pix adhesion request in the transactional account provider modality.

Art. 18. For institutions that do not have an authorization to operate issued by the Central Bank of Brazil, the registration stage of the Pix adhesion process comprises the sending, and subsequent approval, by Decem, of the following documents, duly submitted through the Digital Protocol, observing the guidelines contained in Annex V:

I - Pix adhesion form, according to the model available in Annex I-D;

II - Intent form for offering products and services, according to the model available in Annex I-E;

III - cybersecurity self-assessment questionnaire, according to the model available in Annex I-F, duly signed by a director responsible for cybersecurity policy;

IV - contract signed with the responsible participant, in accordance with the Pix Regulations; and

V - declaration signed by the responsible participant stating that the contracting institution has paid the minimum required capital amount, in accordance with the Pix Regulations and in the manner set forth in Normative Instruction BCB No. 16, of September 18, 2020.

§ 1º The institutions referred to in the caput must be in regular operation and not subject to authorization from the Central Bank of Brazil for the provision of payment services in the modality of electronic money issuer, as provided in specific regulation.

§ 2º The provisions of the caput apply to payment institutions in regular operation regarding the exercise of the activity of payment service provider in the modality of electronic money issuer, as provided in specific regulation, and with a pending request for operating authorization to be issued by the Central Bank of Brazil.

Art. 19. For institutions that have an authorization to operate issued by the Central Bank of Brazil and intend to act exclusively in the initiator modality, the registration stage of the Pix adhesion process comprises the sending, and subsequent approval, by Decem, of the following documents, duly submitted through the Digital Protocol, observing the guidelines contained in Annex V:

I - Pix adhesion form, according to the model available in Annex III-A;

II - Intent form for offering products and services, according to the model available in Annex III-B; and

II - Intent form for offering products and services, according to the model available in Annex III-B; (Wording given, from 1/1/2025, by Normative Instruction BCB No. 581, of 12/30/2024.)

III - cybersecurity self-assessment questionnaire, duly signed by a director responsible for cybersecurity policy:

a) according to the model available in Annex III-C, if intending to access the DICT directly;

b) according to the model available in Annex III-D, if intending to access the DICT indirectly; or

c) according to the model available in Annex III-E, if intending not to access the DICT.

c) according to the model available in Annex III-E, if intending not to access the DICT; and (Wording given, from 1/1/2025, by Normative Instruction BCB No. 581, of 12/30/2024.)

IV - Pix Automatic – Receipt schedules form, according to the model available in Annex I-G, if intending to offer Pix Automatic – Receipt. (Added, from 1/1/2025, by Normative Instruction BCB No. 581, of 12/30/2024.)

Sole paragraph. Institutions intending to offer the payment transaction initiation service must have prior authorization from the Central Bank of Brazil or be exempt from doing so, as provided in specific regulation.

Art. 20. For institutions that have an authorization to operate issued by the Central Bank of Brazil and intend to act in the user institution modality, the registration stage of the Pix adhesion process comprises the sending and subsequent approval, by Decem, of the following documents, duly submitted through the Digital Protocol, observing the guidelines contained in Annex V:

I - Pix adhesion form, according to the model available in Annex IV-A;

II - Intent form for consuming products and services, according to the model available in Annex IV-B; and

II - Intent form for consuming products and services, according to the model available in Annex IV-B; (Wording given, from 1/1/2025, by Normative Instruction BCB No. 581, of 12/30/2024.)

III - cybersecurity self-assessment questionnaire, according to the model available in Annex IV-C, duly signed by a director responsible for cybersecurity policy.

III - cybersecurity self-assessment questionnaire, according to the model available in Annex IV-C, duly signed by a director responsible for cybersecurity policy; and (Wording given, from 1/1/2025, by Normative Instruction BCB No. 581, of 12/30/2024.)

IV - Pix Automatic – Receipt schedule form, according to the model available in Annex III-B, if intending to offer the payment transaction initiation service via Pix Automatic – Receipt. (Included, effective 1/1/2025, by Instruction Normative BCB No. 581, of 12/30/2024.)

Sole paragraph. The submission of the document referred to in item II is waived for institutions that do not intend to consume functionalities related to QR Codes or Pix Automatic.

Section III

Of the Homologation Stage

Subsection I

General Provisions

Art. 20-A. The homologation stage of the adhesion process to Pix comprises:

I - formal homologation tests in the SPI, directed at institutions that meet the mandatory criteria or that, optionally, wish to participate in the SPI directly;

II - homologation tests, between the indirect participant in the SPI and its clearing institution, directed at institutions that meet the mandatory criteria for indirect participation in the SPI or that, optionally, wish to participate in the SPI indirectly;

III - formal homologation tests for direct access to the DICT, directed at institutions that meet the mandatory criteria for direct access to the DICT or that, optionally, wish to access directly;

IV - formal homologation tests in the DICT, directed at institutions applying to act in the special clearing modality and at participating or applying institutions to act in the transactional account provider modality, which access or will access the DICT directly and wish to provide services in the DICT to institutions with indirect access;

V - homologation tests in the DICT, between the institution with indirect access and the institution providing services in the DICT to it, directed at institutions that meet the mandatory criteria for indirect access or that, optionally, wish to access indirectly;

VI - verification of adherence of solutions developed for end users, directed at institutions offering transactional accounts to natural person users, that wish to act in the transactional account provider modality;

VII - formal validation tests for QR Codes, directed at institutions that:

a) optionally, intend to consume functionalities related to QR Codes;

b) meet the mandatory criteria; or

c) optionally, wish to enable their users to receive Pix by generating QR Codes or send Pix by reading QR Codes;

VIII - formal validation tests of the payment transaction initiation service, within the scope of Pix and focused on the institution holding accounts, as provided in specific Open Finance regulation, directed at institutions authorized to operate by the Central Bank of Brazil, mandatory participants in Pix or that intend to act in the transactional account provider modality and optionally participate in Open Finance as account holders;

IX - formal validation tests of the provision of payment transaction initiation service, within the scope of Pix and focused on the payment transaction initiating institution, as provided in specific Open Finance regulation, directed at institutions that intend to act in the initiator modality and at institutions authorized to operate by the Central Bank of Brazil that intend to act in the transactional account provider or special clearing modality and, optionally, offer the payment transaction initiation service;

X - formal homologation tests for publishing information related to the withdrawal service, directed at institutions authorized to operate by the Central Bank of Brazil that intend to act in the transactional account provider modality and, optionally, as a withdrawal service facilitator;

XI - formal validation tests for Pix Automatic, directed at institutions that:

a) optionally, intend to consume functionalities related to Pix Automatic;

b) meet the mandatory criteria; or

c) optionally, wish to enable their users to receive or send Pix Automatic;

XII - obtaining of Sisbacen code from the Central Bank of Brazil, observing the guidelines in Annex V, directed at institutions that do not yet possess it;

XIII - sending to Decem, via Digital Protocol and in free text, observing the guidelines in Annex V, of a declaration signed by the participant responsible for the applying institution not authorized to operate by the Central Bank of Brazil, stating that the contracting institution has the technical and operational capacity to comply with the duties and obligations provided in the Pix Regulation; and

XIV - registration, in the System of Information on Entities of Interest of the Central Bank (Unicad), if not yet done, of:

a) director responsible for issues related to participation in Pix;

b) director responsible for cybersecurity policy; and

c) director responsible for the RDR system.

c) director responsible for the RDR system; (Wording given by Instruction Normative BCB No. 679, of 10/30/2025.)

XV - formal validation tests of messaging related to the sending of Pix transactions settled in the participants' own systems, directed to all institutions adhering in the transactional account provider modality; and (Included by Instruction Normative BCB No. 679, of 10/30/2025.)

XVI - formal validation tests of the DICT value recovery functionality, directed to all adhering institutions that wish to access the DICT directly. (Included by Instruction Normative BCB No. 679, of 10/30/2025.)

Art. 21. The applying institution will be considered rejected in the homologation stage of the adhesion process to Pix:

I - that has not concluded, within the regulatory deadline, including any extension, the homologation tests and other requirements to which it is subject;

II - rejected in the formal homologation tests for direct access to the DICT;

III - rejected in the stage of verification of adherence of solutions to end users;

IV - withdrawing from the Pix adhesion process;

V - that intends to access the DICT indirectly and that, until the end of the regulatory deadline for the successful completion of the homologation stage of the Pix adhesion process, except for any extension, has not indicated a Pix participant duly qualified to provide services in the DICT to institutions with indirect access;

VI - that intends to be an indirect participant in the SPI and that, until the end of the regulatory deadline for the successful completion of the homologation stage of the Pix adhesion process, except for any extension, has not indicated a clearing participant duly approved in the formal homologation tests in the SPI, as provided in specific regulation;

VII - that, at the end of the regulatory deadline for the successful completion of the homologation stage of the Pix adhesion process, except for any extension, does not have, in Unicad, directors with active registrations, as provided in Art. 20, item XIV, letters “a”, “b” and “c”; and

VIII - that, at the end of the regulatory deadline for the successful completion of the homologation stage of the Pix adhesion process, except for any extension, has registered in Unicad a director responsible for cybersecurity policy divergent from the signatory of the latest version of the self-assessment questionnaire in security presented.

Subsection II

Of the Formal Homologation Tests in the SPI

Art. 22. Institutions that meet the mandatory criteria or that, optionally, wish to participate in the SPI in the direct modality must perform the formal homologation tests, as provided in specific regulation.

Subsection III

Of the Homologation Tests between the Indirect Participant in the SPI and its Clearing Institution

Art. 23. Institutions that meet the mandatory criteria for indirect participation in the SPI or that, optionally, wish to participate in the SPI in the indirect modality must perform homologation tests with their clearing institution.

§ 1º The homologation tests referred to in the caput must be defined by the clearing institution in the SPI, in a manner that allows it to declare the operational aptitude of the indirect participant.

§ 2º The direct participant must keep the documentation and evidence of the performance of the homologation tests available to the Central Bank of Brazil.

Subsection IV

Of the Formal Homologation Tests for Direct Access to the DICT

Art. 24. Institutions that meet the mandatory criteria for direct access to the DICT or that, optionally, wish to access the DICT directly must perform formal homologation tests.

Sole paragraph. The requirements for compliance with the tests referred to in the caput are set forth in Instruction Normative BCB No. 508, of August 30, 2024.

Subsection V

Of the Formal Homologation Tests in the DICT for Providing Services to Participants with Indirect Access

Art. 25. Institutions that access or will access the DICT directly and that wish to provide services in the DICT to institutions with indirect access must be approved in the formal homologation tests with at least one institution with indirect access.

Sole paragraph. The requirements for compliance with the tests referred to in the caput are set forth in Instruction Normative BCB No. 508, of August 30, 2024.

Subsection VI

Of the Homologation Tests between the Participant with Indirect Access to the DICT and the Contracted Participant with Direct Access

Art. 26. Institutions that meet the mandatory criteria for indirect access to the DICT or that, optionally, wish to access the DICT indirectly must perform homologation tests with the contracted participant with direct access.

§ 1º The homologation tests referred to in the caput must be defined by the contracted participant with direct access, in a manner that allows it to declare the operational aptitude of the participant with indirect access.

§ 2º The contracted participant with direct access must keep the documentation and evidence of the performance of the homologation tests available to the Central Bank of Brazil.

Subsection VII

Of the Process of Verification of Adherence of Solutions to End Users

Art. 27. Institutions applying to act in the transactional account provider modality, when offering transactional accounts to natural person users, must comply with the process of verification of adherence of solutions developed for end users, which comprises the approval of a mobile phone application project intended for natural person users.

§ 1º Only the main mobile phone application made available to natural person users will be evaluated.

§ 2º For the purposes of the provision in § 1º, the main mobile phone application is considered the application that has the largest number of users, among the applications made available by the institution.

§ 3º The mobile phone applications intended exclusively for legal person users are not subject to analysis by Decem.

§ 4º The project, in a single file, must be submitted to the evaluation of Decem, via Digital Protocol, observing the guidelines in Annex V, at least thirty days in advance of the deadline for the homologation stage.

§ 5º Non-compliance with the provision in § 4º subjects the project to rejection in the process of verification of adherence of solutions to end users due to late submission.

§ 6º The project must contain illustrative screens of the mobile phone application, demonstrating only the items detailed in the section “Items to be evaluated in the process of verification of adherence of solutions to end users” contained in Annex I of the “Minimum Requirements for User Experience”, available on the Pix page on the website of the Central Bank of Brazil on the internet.

§ 7º Each illustrative screen of the project must make explicit reference to the item detailed in the section “Items to be evaluated in the process of verification of adherence of solutions to end users” contained in Annex I of the “Minimum Requirements for User Experience”, available on the Pix page on the website of the Central Bank of Brazil on the internet.

§ 8º The project must be organized in the order of the items detailed in the section “Items to be evaluated in the process of verification of adherence of solutions to end users” contained in Annex I of the “Minimum Requirements for User Experience”, available on the Pix page on the website of the Central Bank of Brazil on the internet.

Art. 28. The submitted project will be received by Decem and will await analysis in the service queue, observing the regulatory deadline to obtain approval in the homologation stage of the Pix adhesion process, except for any extension.

Art. 29. Once the project has been reviewed, the applying institution will be notified of the result of the analysis, which will consist of:

I - in case of no pending issues, a communication of approval of the project; or

II - in a communication regarding pending issues in the project to be resolved by the applying institution within the regulatory deadline to obtain approval in the homologation stage of the Pix adhesion process, except for any extension.

Sole paragraph. The applying institution that presents pending issues, under item II, may present a second version of the project.

Art. 30. To proceed with the presentation of the second version of the project, the applying institution must observe the same sending and organization procedure provided for the initial version.

Sole paragraph. The second version referred to in the caput must contain only the pages and items for which adjustments were requested in the initial version.

Art. 31. Once the second version of the project has been reviewed, the applying institution will be notified of the result of the analysis, which will consist of:

I - in case of no pending issues, a communication of approval of the project; or

II - in a communication regarding pending issues in the project to be resolved by the applying institution within the regulatory deadline to obtain approval in the homologation stage of the Pix adhesion process, except for any extension.

Sole paragraph. The applying institution that presents pending issues, under item II, may present a third and final version of the project.

Art. 32. To proceed with the presentation of the third and final version of the project, the applying institution must observe the same sending and organization procedure provided for the first two versions.

Sole paragraph. The third and final version referred to in the caput must contain only the pages and items for which adjustments were requested in the second version.

Art. 33. Once the third and final version of the project has been reviewed, the applying institution will be notified of the result of the analysis, which will consist of:

I - in case of no pending issues, a communication of approval of the project; or

II - in case of pending issues, a communication of rejection in the process of verification of adherence of solutions to end users.

Art. 34. The applying institution will be rejected in the process of verification of adherence of solutions to end users, with consequent denial of the adhesion process, if:

I - it has not submitted the project within the regulatory deadline; or

II - it has not obtained approval by the third version of the project.

Art. 35. Applying institutions must develop and implement the application in adherence to the final version of the project presented.

§ 1º All obligations contained in the “Minimum Requirements for User Experience”, including those not listed in the section “Items to be evaluated in the process of verification of adherence of solutions to end users” contained in Annex I of the “Minimum Requirements for User Experience”, available on the Pix page on the website of the Central Bank of Brazil on the internet, must be present in the application made available to users.

§ 2º Subsequent changes to the application must comply with the Pix Regulation, which includes the “Minimum Requirements for User Experience”, available on the Pix page on the website of the Central Bank of Brazil on the internet.

§ 3º Subsequent changes to an implemented application, referred to in § 2º, will not be submitted to the evaluation of Decem.

Art. 36. The process of verification of adherence of solutions to end users is waived for:

I - the applying institution to act in the transactional account provider modality that uses a mobile phone application provided by another institution already participating in Pix; and

II - the applying institution to act in the transactional account provider modality that does not offer transactional accounts to natural person users, except for the eventual registration update referred to in Art. 89.

§ 1º For the purposes of the waiver referred to in item I, the already participating Pix institution that provides the mobile phone application must issue a waiver request to be sent to Decem, via Digital Protocol and in free text, observing the guidelines in Annex V.

§ 2º Decem will notify the applying institution of the approval or denial of the waiver request referred to in § 1º.

Subsection VIII

Of the Formal Validation Tests for QR Codes

Art. 37. Institutions that are approved in the formal validation tests for QR Codes are those that:

I - optionally, intend to consume functionalities related to QR Codes;

II - meet the mandatory criteria; or

III - optionally, wish to enable, for their users, the receipt of Pix by generating QR Codes or the sending of Pix by reading QR Codes.

Sole paragraph. The requirements for compliance with the tests referred to in the caput are set forth in Instruction Normative BCB No. 508, of August 30, 2024.

Art. 38. The following are waived from compliance with the QR Codes validation tests:

I - the applying institution to act in the transactional account provider modality that uses a mobile phone application provided by another institution already participating in Pix; and

II - the applying institution to act in the transactional account provider modality that offers transactional accounts exclusively to legal person users and will not offer, to this audience, the receipt of Pix by generating QR Codes, nor the sending of Pix by reading QR Codes.

§ 1º For the purposes of the waiver referred to in item I, the already participating Pix institution that provides the mobile phone application must issue a waiver request to be sent to Decem, via Digital Protocol and in free text, observing the guidelines in Annex V.

§ 2º Decem will notify the applying institution of the approval or denial of the waiver request referred to in § 1º.

Subsection IX

Of the Formal Validation Tests for the Provision of Payment Transaction Initiation Service

Art. 39. The following must be approved in the formal validation tests for the provision of payment transaction initiation service:

I - the applying institution to act in the initiator modality and, therefore, to offer, within the scope of Pix, exclusively the payment transaction initiation service in the figure of payment transaction initiator, in accordance with specific Open Finance regulation;

II - the institution authorized to operate by the Central Bank of Brazil, mandatory participant in Pix or that, optionally, intends to appear, within the scope of Pix, exclusively as an account-holding institution, as provided in specific Open Finance regulation;

III - the institution authorized to operate by the Central Bank of Brazil, applying to act in the transactional account provider modality and that, optionally, wishes to appear, within the scope of Pix, as an account-holding institution and as a payment transaction initiating institution, simultaneously, as provided in specific Open Finance regulation; and

IV - the institution authorized to operate by the Central Bank of Brazil, applying to act in the special clearing modality and that, optionally, wishes to offer, within the scope of Pix, the payment transaction initiation service in the figure of payment transaction initiator, in accordance with specific Open Finance regulation.

Sole paragraph. The requirements for compliance with the tests referred to in the caput are set forth in Instruction Normative BCB No. 508, of August 30, 2024.

Art. 40. The following are waived from compliance with the formal validation tests for the provision of payment transaction initiation service:

I - the institution authorized to operate by the Central Bank of Brazil, applying to participate in Pix, optionally, in the transactional account provider modality, that does not wish to be a participant in Open Finance as an account-holding institution, as provided in specific regulation; and

II - the singular credit cooperative, affiliated to the credit central cooperative and that has as its clearing institution in the SPI an entity of the cooperative system organized in two or three levels.

Subsection X

Of the Formal Tests for Publishing Information Related to the Withdrawal Service

Art. 41. Institutions authorized to operate by the Central Bank of Brazil, applying to act in the transactional account provider modality and that, optionally, wish to facilitate the withdrawal service, must be approved in the formal tests for publishing information related to the withdrawal service.

§ 1º The requirements for compliance with the tests referred to in the caput are set forth in Instruction Normative BCB No. 508, of August 30, 2024.

§ 2º The entity of the cooperative system organized in two or three levels that acts or intends to act as a clearing institution in the SPI, of at least one singular credit cooperative affiliated to a credit central cooperative, and that has concluded the tests referred to in the caput, must notify Decem, via Digital Protocol and in free text, observing the guidelines in Annex V, of its eventual intention to extend to its affiliated singular cooperatives the authorization to act in the facilitation of the withdrawal service.

§ 3º The extension referred to in § 2º will apply to:

I - all singular cooperatives affiliated to the credit central cooperative authorized to act as a withdrawal service facilitator; and

---

II - tacitly, to all affiliated single cooperatives that become Pix participants under the condition of being affiliated single cooperatives to a central credit cooperative authorized to act as a facilitator of withdrawal services.

§ 4º The affiliated single cooperative, upon its disaffiliation from the granting central credit cooperative, is unauthorized to continue acting as a facilitator of withdrawal services, since the authorization to exercise the activity was given due to the extension provided for in § 2º.

§ 5º The provisions of § 4º do not apply to cases where the single cooperative becomes affiliated with another central credit cooperative that is also opted for the extension provided for in § 1º.

Subsection XI

Of the Formal Validation Tests for Automatic Pix

Art. 42. The following institutions must be approved in the formal validation tests for Automatic Pix:

I - in the process of adhesion to Pix in the transactional account provider mode, if offering transactional accounts to individual end-users;

II - in the process of adhesion to Pix in the transactional account provider mode, if exclusively offering transactional accounts to corporate users and opted for offering the service to this public;

III - in the process of adhesion to Pix in the user institution mode, if wishing to consume functionalities related to Automatic Pix; or

IV - in the process of adhesion to Pix in the transactional account provider mode, if exclusively offering transactional accounts to corporate users and not opted for offering the service to this public as paying users, exclusively regarding tests for handling improper messages.

Sole paragraph. The requirements for compliance with the tests referred to in the caput are set forth in Instruction Normative BCB No. 508, of August 30, 2024.

Art. 43. The following are exempt from complying with the formal validation tests for Automatic Pix:

I - the applying institution to act in the transactional account provider mode that offers transactional accounts exclusively to corporate users, as well as does not manifest intention to offer Automatic Pix to this public, except regarding the tests referred to in item IV of Article 42; and

II - the single credit cooperative, affiliated to the central credit cooperative and that has as its clearing entity in the SPI an entity of the cooperative system organized in two or three levels.

§ 1º Participants in the transactional account provider mode that offer accounts to corporations may request exemption from offering payments via Automatic Pix only for this public.

§ 2º The exemption mentioned in § 1º exempts the participant from the specific tests for payments via Automatic Pix if the participant offers transactional accounts exclusively to corporate users.

§ 3º To request the exemption mentioned in § 1º, it is necessary to send, through the Digital Protocol, a request, in free text, of exemption signed by the Director responsible for addressing demands from the Central Bank of Brazil related to issues concerning Pix.

§ 3º To request the exemption mentioned in § 1º, it is necessary to send a form for updating the intention to offer products and services, through the Digital Protocol, observing the guidelines contained in Annex V. (Wording given, from 1/1/2025, by Instruction Normative BCB No. 581, of 12/30/2024.)

Subsection XII

Of the Formal Validation Tests for the Value Recovery Functionality

(Subsection XII included by Instruction Normative BCB No. 679, of 10/30/2025.)

Art. 43-A. The following institutions must be approved in the messaging tests related to the sending of settled Pix transactions in the systems of their own participants: (Included by Instruction Normative BCB No. 679, of 10/30/2025.)

I - direct; and (Included by Instruction Normative BCB No. 679, of 10/30/2025.)

II - indirect. (Included by Instruction Normative BCB No. 679, of 10/30/2025.)

§ 1º The single credit cooperative institution affiliated to a central credit cooperative that has this central as its clearing entity in the SPI is exempt from carrying out the tests referred to in the caput. (Included by Instruction Normative BCB No. 679, of 10/30/2025.)

§ 2º Institutions with indirect participation in the SPI must organize the carrying out of the test with their clearing participant. (Included by Instruction Normative BCB No. 679, of 10/30/2025.)

Art. 43-B. The following institutions must be approved in the validation tests for the value recovery functionality: (Included by Instruction Normative BCB No. 679, of 10/30/2025.)

I - participants with direct access to the DICT, in the transactional account provider mode; (Included by Instruction Normative BCB No. 679, of 10/30/2025.)

II - participants with direct access to the DICT, in the special clearing mode; and (Included by Instruction Normative BCB No. 679, of 10/30/2025.)

III - participants with direct access to the DICT, in the user institution mode. (Included by Instruction Normative BCB No. 679, of 10/30/2025.)

§ 1º Institutions in the process of adhesion to Pix must successfully conclude the formal homologation tests referred to in the caput during the homologation stage, if they do not conclude their adhesion by January 23, 2026. (Included by Instruction Normative BCB No. 679, of 10/30/2025.)

§ 1º Institutions in the process of adhesion to Pix must successfully conclude the formal homologation tests referred to in the caput during the homologation stage, if they do not conclude this stage by January 29, 2026. (Wording given by Instruction Normative BCB No. 703, of 1/28/2026.)

§ 2º Pix participants and institutions in the process of adhesion to Pix that conclude their adhesion by January 23, 2026 are permitted to carry out the tests referred to in the caput. (Included by Instruction Normative BCB No. 679, of 10/30/2025.)

§ 2º Pix participants and institutions in the process of adhesion to Pix that conclude the homologation stage by January 29, 2026 are permitted to carry out the tests referred to in the caput. (Wording given by Instruction Normative BCB No. 703, of 1/28/2026.)

Section IV

Of the Restricted Operation Stage

Art. 44. The restricted operation stage of the Pix adhesion process corresponds to the offering of Pix to a limited number of clients.

Art. 45.
The institution must begin the restricted operation stage within a maximum period of three months, counted from the communication of successful completion of the homologation stage of the Pix adhesion process, except for the period provided for in § 2º.

§ 1º Prior to the beginning of the restricted operation stage, Decem may determine that applying institutions carry out complementary homologation tests.

§ 2º Decem will communicate the applying institutions in the situation referred to in § 1º and establish a deadline for compliance with the tests.

§ 3º Failure to carry out the tests referred to in § 1º within the regulatory deadline implies the loss of validity of the Pix adhesion request, with consequent archiving of the process.

§ 4º It is prohibited for the applying institution to enter production if it intends to access the DICT indirectly and has not indicated a duly qualified participant institution to provide services in the DICT to institutions with indirect access.

§ 5º It is prohibited for the applying institution to enter production if it intends to participate in the SPI indirectly and whose indicated clearing participant has not previously entered the SPI production environment.

Art. 46.
The following are exempt from complying with the restricted operation stage of the Pix adhesion process: single credit cooperatives, affiliated to the central credit cooperative, that are requesting Pix adhesion and that have as their clearing entity in the SPI an entity of the cooperative system organized in two or three levels that is a Pix participant.

Sole paragraph. For the exemption referred to in the caput, the entity of the cooperative system organized in two or three levels that will act as the clearing entity in the SPI of the single credit cooperative affiliated to the central credit cooperative must send to Decem, through the Digital Protocol and in free text, observing the guidelines contained in Annex V, the request for exemption from the restricted operation stage of the Pix adhesion process, declaring the full aptitude of the single cooperative to provide services to its members without the need to comply with the stage referred to in the request.

Art. 47. The restricted operation stage of the Pix adhesion process does not apply to the applying institution to act in the special clearing mode, the initiator mode, or the user institution mode.

Art. 48. The restricted operation stage is composed of two phases:

I - phase 1: Pix must be offered to more than 1% and up to 30% of the transactional account users of the institution; and

II - phase 2: Pix must be offered to more than 30% and up to 70% of the transactional account users of the institution.

§ 1º The total period of the restricted operation stage must last between 14 and 56 days.

§ 2º Phase 1 and phase 2 must have the same duration, that is, at least 7 days, and at most 28 days, for each stage individually.

§ 3º The duration of each phase must be defined at the discretion of each participant, respecting the deadlines defined in §§ 1º and 2º.

§ 4º In each phase, the institution may gradually increase the number of transactional account users with access to Pix, up to the maximum limit defined in items I and II of the caput.

§ 5º Phase 2 will begin on the day immediately following the final day of phase 1.

§ 6º It is permitted to request a change in the schedule of the restricted operation stage of the Pix adhesion process, provided that phase 2 has not started and without prejudice to the other provisions regarding the duration of each phase.

§ 7º To proceed with the request referred to in § 6º, the applying institution must observe the same procedure and the same provisions provided for the initial version of the schedule presented.

§ 8º Under no circumstances will a change in the schedule of the restricted operation stage of the Pix adhesion process be admitted once phase 2 has started.

Art. 49. The transactional account users selected to participate in the restricted operation stage of the Pix adhesion process must reflect the profile of the total base of users of this service in the applying institution, by legal nature, by age, and by geographic distribution.

Art. 50.
Institutions in the restricted operation stage of the Pix adhesion process will be active in the Pix production environment and, therefore, subject to the same obligations reserved for institutions in full operation, except for the availability of Pix to a limited number of transactional account users.

CHAPTER II

OF THE CHANGE IN PARTICIPATION MODE IN PIX

Art. 51.
Institutions authorized to operate by the Central Bank of Brazil that are already Pix participants may request a change in their participation mode in Pix.

§ 1º The change referred to in the caput is prohibited:

I - to the institution that is a mandatory Pix participant;

II - to the Pix participant institution not authorized to operate by the Central Bank of Brazil; and

III - to the institution in the process of adhesion to Pix.

§ 2º The institution referred to in item III, if it intends to change the participation mode in Pix initially requested, must present a request for withdrawal of the ongoing Pix adhesion process and present a new Pix adhesion request, observing, when applicable, the 90-day period provided for in Article 9, § 1º, item II.

Art. 52.
The process of changing the participation mode in Pix is composed of the following stages:

I - pre-registration stage;

II - registration stage;

III - homologation stage; and

IV - restricted operation stage, directed at the institution that intends to start acting in the transactional account provider mode, except for the case of exemption provided for in Article 46.

Sole paragraph. The effective change to the new participation mode in Pix requires successful approval in each successive stage, except for the case of exemption provided for in item IV.

Art. 53. The submission of a request for change in participation mode in Pix to the Central Bank of Brazil comprises the sending, to Decem, of the documents that make up the relevant registration stage, through the Digital Protocol, observing the guidelines contained in Annex V:

I - if intending to start acting in the transactional account provider mode:

a) form for updating registration, according to the model available in Annex I-A;

b) form for updating the intention to offer products and services, according to the model available in Annex I-B; and

b) form for updating the intention to offer products and services, according to the model available in Annex I-B; (Wording given, from 1/1/2025, by Instruction Normative BCB No. 581, of 12/30/2024.)

c) cybersecurity self-assessment questionnaire, duly signed by the director responsible for cybersecurity policy, according to the model available in Annex I-C, if wishing to access the DICT directly and be a direct SPI participant, or if wishing to access the DICT directly and be an indirect SPI participant; or according to the model available in Annex I-F, if wishing to access the DICT indirectly and be an indirect SPI participant;

c) cybersecurity self-assessment questionnaire, duly signed by the director responsible for cybersecurity policy, according to the model available in Annex I-C, if wishing to access the DICT directly and be a direct SPI participant, or if wishing to access the DICT directly and be an indirect SPI participant; or according to the model available in Annex I-F, if wishing to access the DICT indirectly and be an indirect SPI participant; and (Wording given, from 1/1/2025, by Instruction Normative BCB No. 581, of 12/30/2024.)

d) form for Automatic Pix Journeys – Receipt, according to the model available in Annex I-G, if intending to offer Automatic Pix – Receipt. (Included, from 1/1/2025, by Instruction Normative BCB No. 581, of 12/30/2024.)

II - if intending to start acting in the special clearing mode:

a) form for updating registration, according to the model available in Annex II-A; and

b) cybersecurity self-assessment questionnaire, according to the model available in Annex II-B, duly signed by the director responsible for cybersecurity policy;

III - if intending to start acting in the initiator mode:

a) form for updating registration, according to the model available in Annex III-A;

b) form for updating the intention to offer products and services, according to the model available in Annex III-B; and

c) cybersecurity self-assessment questionnaire, duly signed by the director responsible for cybersecurity policy, according to the model available in Annex III-C, if wishing to access the DICT directly; according to the model available in Annex III-D, if wishing to access the DICT indirectly; or according to the model available in Annex III-E, if wishing not to access the DICT;

IV - if intending to start acting in the user institution mode:

a) form for updating registration, according to the model available in Annex IV-A;

b) form for updating the intention to consume products and services, according to the model available in Annex IV-B; and

c) cybersecurity self-assessment questionnaire, according to the model available in Annex IV-C, duly signed by the director responsible for cybersecurity policy.

§ 1º The sending of the document referred to in item “a” of item II is exempted for the institution that does not intend to consume functionalities related to QR Codes or Automatic Pix.

§ 2º The pre-registration stage of the process for changing the participation mode in Pix will begin on the date of submission of the request referred to in the caput.

§ 3º During the pre-registration stage of the process for changing the participation mode in Pix, the change request will await analysis in a service queue, organized according to the priority order of requests, as provided for in Article 5, §§ 2º and 3º.

§ 4º Applying institutions are assured the possibility of sending additional or substitute documents without prejudice to the position they occupied in the queue at the time of the initial document.

Art. 54. Once the documents presented during the pre-registration stage of the process for changing the participation mode in Pix have been reviewed, the registration stage will begin, at which time the applying institution will be communicated regarding the result of the analysis, which will consist of:

I - if there are no pending issues, a communication of successful completion of the registration stage of the process for changing the participation mode in Pix, which will also contain guidelines for carrying out the relevant homologation stage;

II - a communication regarding solvable pending issues to be resolved by the applying institution; or

III - a communication regarding the denial of the request for change in participation mode in Pix in case of pending issues considered unsolvable.

§ 1º The applying institution that presents solvable pending issues, as provided for in item II, and resolves them, through the Digital Protocol, observing the guidelines contained in Annex V, will be communicated regarding the successful completion of the registration stage of the process for changing the participation mode in Pix, as per item I.

§ 2º If there are no pending tests or requirements regarding the eventual homologation stage of the process for changing the participation mode in Pix, the communication referred to in item I will inform regarding the exemption from participation in this stage and will observe the provisions contained in Article 57.

Art. 55. Once communicated regarding the successful completion of the registration stage of the process for changing the participation mode in Pix, the institution will be automatically enabled for the relevant homologation stage.

Art. 56. The requirements for approval in the homologation stage of the process for changing the participation mode in Pix will be customized for each applying institution, namely:

I - for the institution that intends to start acting in the transactional account provider mode:

a) formal tests, referred to in Article 22, regarding homologation in the SPI, directed at the institution that, optionally, wishes to start participating in the SPI directly;

b) homologation tests, referred to in Article 23, between the indirect SPI participant and its clearing entity, directed at the institution that, optionally, wishes to start participating in the SPI indirectly;

c) formal tests, referred to in Article 24, regarding homologation in the DICT, directed at the institution that, optionally, wishes to start accessing the DICT directly;

d) homologation tests, referred to in Article 26, between the participant with indirect access to the DICT and the contracted participant with direct access, directed at the institution that, optionally, wishes to start accessing the DICT indirectly;

e) Verification, referred to in Article 27, of the adherence of solutions developed for end-users, directed at the institution that offers transactional accounts to individual users, except for the exemption possibilities provided for in Article 36;

f) formal tests, referred to in Article 37, regarding QR Code validation, directed at the institution that falls under the mandatory criteria or that, optionally, intends to enable receiving Pix through the generation of QR Codes or sending Pix through the reading of QR Codes, except for the exemption possibilities provided for in Article 38;

g) formal tests, referred to in Article 39, caput and item II, regarding the validation of the payment transaction initiation service, to be executed within the scope of Pix and focused on the account-holding institution, by institutions that, optionally, intend to participate in Open Finance solely in the figure of the account holder, as provided for in specific Open Finance regulation, except for the cases of exemption provided for in Article 40;

h) formal tests, referred to in Article 39, caput and item III, regarding the validation of the payment transaction initiation service provision, to be executed within the scope of Pix by the institution that intends to act, simultaneously, as account holder and as payment transaction initiator, as provided for in specific Open Finance regulation;

i) formal tests, referred to in Article 41, regarding homologation for publishing information related to the withdrawal service, directed at the institution that, optionally, intends to also act as a facilitator of withdrawal services;

---

j) formal tests referred to in Art. 42, regarding the validation of functionalities related to Automatic Pix, directed at the institution that falls under the mandatory criteria or that, optionally, intends to enable the receipt or sending of Automatic Pix, except for the dispensation possibilities referred to in Art. 43; and

k) closure of PI Account, as set forth in specific SPI regulation, in cases where the holder will participate in the SPI indirectly.

II - for the institution intending to act as a special liquidator:

a) formal tests referred to in Art. 22, regarding homologation in the SPI, directed at the institution that does not yet participate in the SPI directly;

b) formal tests, referred to in Art. 24, regarding homologation in the DICT, directed at the institution that does not yet access the DICT directly;

c) after approval in the tests referred to in item "b", formal tests, referred to in Art. 25, directed at the institution without prior qualification to provide services in the DICT to institutions with indirect access;

III - for the institution intending to act as an initiator:

a) formal tests, referred to in Art. 24, regarding homologation in the DICT, directed at the institution that, optionally, wishes to start accessing the DICT directly;

b) formal tests, referred to in Art. 39, caput and item I, regarding the validation of the payment transaction initiation service provision, within the scope of Pix and focused on the payment transaction initiating institution, as set forth in specific Open Finance regulation, directed at the institution without prior qualification to act as a payment transaction initiating institution within the scope of Pix; and

c) closure of PI Account, as set forth in specific SPI regulation, in cases where the requesting institution is the holder of a PI Account; and

IV - for the institution intending to start acting as a user institution:

a) formal tests, referred to in Art. 22, regarding homologation in the SPI, directed at the institution that, optionally, wishes to start participating in the SPI directly;

b) homologation tests, referred to in Art. 23, between the indirect participant in the SPI and its liquidator, directed at the institution that, optionally, wishes to start participating in the SPI indirectly;

c) formal tests, referred to in Art. 24, regarding homologation in the DICT, directed at the institution that, optionally, wishes to start accessing the DICT directly;

d) homologation tests, referred to in Art. 26, between the participant with indirect access to the DICT and the contracted participant with direct access, directed at the institution that, optionally, wishes to start accessing the DICT indirectly;

e) formal tests, referred to in Art. 37, regarding the validation of QR Codes, directed at the institution that, optionally, intends to consume functionalities related to QR Codes;

f) formal tests referred to in Art. 42, regarding the validation of functionalities related to Automatic Pix, directed at the institution that, optionally, intends to consume the receipt or sending of Automatic Pix; and

g) closure of PI Account, as set forth in specific SPI regulation, in cases where the requesting institution is the holder of a PI Account and wishes to start participating in the SPI indirectly.

Sole Paragraph. The institution that will start participating directly in the SPI will observe the deadline determined for the conclusion of the tests in the SPI, as set forth in specific SPI regulation.

Art. 57. The requesting institution will be notified regarding the result of the homologation stage of the participation mode change process in Pix, which will also contain:

I - for the institution intending to start acting in the transactional account provider mode, guidelines regarding the sending of a suggested date for the effective change of participation mode in Pix in the production environment and a schedule for complying with the relevant restricted operation stage, except for the case of dispensation referred to in Art. 46, in which case the provisions of item II will be observed;

II - for the institution intending to start acting in the special liquidator, initiator, or user institution mode, guidelines regarding the sending of a suggested date for the effective change of participation mode in Pix in the production environment.

Sole Paragraph. The suggested date for the effective change of participation mode in Pix, as well as the schedule for complying with the relevant restricted operation stage, if it concerns an institution that will start acting in the transactional account provider mode, except for the case of dispensation referred to in Art. 44, must be presented by the requesting institution to Decem, via the Digital Protocol and in free text, observing the guidelines contained in Annex V.

Art. 58. Decem will define and notify the requesting institution regarding the date of the effective change of participation mode in Pix in the production environment, as well as the definitive schedule for complying with the relevant restricted operation stage, if it concerns an institution that will start acting in the transactional account provider mode, except for the case of dispensation referred to in Art. 44.

§ 1º For the requesting institution to participate directly in the SPI, the notification referred to in the caput will also inform the date and time for the effective entry into the SPI production environment.

§ 2º The institution that will participate in the restricted operation stage of the participation mode change process in Pix will observe the specific provisions set forth in Chapter I, Section IV - "Of the Restricted Operation Stage" of this Instruction Normative.

CHAPTER III

OF THE APPLICATION FOR CHANGE IN THE FORM OF ACCESS TO THE DICT AND PARTICIPATION IN THE SPI

Art. 59. Institutions authorized to operate by the Central Bank of Brazil that are already Pix participants may apply for a change in the form of access to the DICT and participation in the SPI.

§ 1º If the application referred to in the caput is presented within the scope of an application for change in the participation mode in Pix, the relevant provisions contained in Chapter II of this Instruction Normative will be observed.

§ 2º The change referred to in the caput is prohibited:

I - to the institution that, as set forth in specific SPI regulation, is obliged to participate directly;

II - to the Pix participant institution not authorized to operate by the Central Bank of Brazil;

III - to the institution in the process of adhesion to Pix; and

IV - to the participant institution in the special liquidator mode.

§ 3º The institution referred to in item III, if it intends to change the form of access to the DICT and participation in the SPI, must present an application for withdrawal from the ongoing Pix adhesion process and present a new Pix adhesion application, observing, when applicable, the 90-day deadline referred to in Art. 9º, § 1º, item II.

§ 4º The institution referred to in § 2º, item IV, if it intends to change the form of access to the DICT and participation in the SPI, must present an application for change of participation mode in Pix, as set forth in Chapter II of this Instruction Normative.

Art. 60. The process of change in the form of access to the DICT and participation in the SPI is composed of the following stages:

I - pre-registration stage;

I - registration stage; and

III - homologation stage.

Sole Paragraph. The effective change in the form of access to the DICT and participation in the SPI requires approval, with success, in each stage successively.

Art. 61. The presentation of an application for change in the form of access to the DICT and participation in the SPI, before the Central Bank of Brazil, comprises the sending, to Decem, of the documents that make up the relevant registration stage, via the Digital Protocol, observing the guidelines contained in Annex V:

I - if it is a Pix participant institution in the transactional account provider mode:

a) registration update form, according to the model available in Annex I-A, in which, in an appropriate field, the option for the form of access to the DICT and participation in the SPI is stated; and

b) cybersecurity self-assessment questionnaire, duly signed by the director responsible for cybersecurity policy according to the model available in Annex I-C, if it wishes to access the DICT directly and be a direct participant in the SPI or if it wishes to access the DICT directly and be an indirect participant in the SPI; or according to the model available in Annex I-F, if it wishes to access the DICT indirectly and be an indirect participant in the SPI;

II - if it is a Pix participant institution in the initiator mode:

a) registration update form, according to the model available in Annex III-A in which, in an appropriate field, the option for the form of access to the DICT is stated; and

b) cybersecurity self-assessment questionnaire, duly signed by the director responsible for cybersecurity policy, according to the model available in Annex III-C, if it wishes to access the DICT directly; according to the model available in Annex III-D, if it wishes to access the DICT indirectly; or according to the model available in Annex III-E, if it does not wish to access the DICT; and

III - if it is a Pix participant institution in the user institution mode:

a) registration update form, according to the model available in Annex IV-A, in which, in an appropriate field, the option for the form of access to the DICT and participation in the SPI is stated; and

b) cybersecurity self-assessment questionnaire, duly signed by the director responsible for cybersecurity policy according to the model available in Annex IV-C.

§ 1º The pre-registration stage of the process of change in the form of access to the DICT and participation in the SPI will begin on the date of presentation of the application referred to in the caput.

§ 2º During the pre-registration stage of the process of change in the form of access to the DICT and participation in the SPI, the application for change will await analysis in a service queue, organized according to the priority order of the applications, as set forth in Art. 5º, §§ 2º and 3º.

§ 3º The requesting institutions are assured the possibility of sending additional or substitute documents without prejudice to the position they occupied in the queue at the time of the inaugural document.

§ 4º The requesting institution to access the DICT indirectly and to indirect participation in the SPI must indicate, in an appropriate field of the registration update form, the ISPB of the contracted liquidating participant.

Art. 62. Once the documents presented during the pre-registration stage of the process of change in the form of access to the DICT and participation in the SPI have been reviewed, the registration stage will begin, at which time the requesting institution will be notified regarding the result of the analysis, which will consist of:

I - in case there are no pending issues, a notification of successful completion of the registration stage of the process of change in the form of access to the DICT and participation in the SPI, which will also contain guidelines for executing the relevant homologation stage;

II - in a notification regarding solvable pending issues to be resolved by the requesting institution; or

III - in a notification regarding the denial of the application for change in the form of access to the DICT and participation in the SPI in case of pending issues considered unsolvable.

Sole Paragraph. The requesting institution that presents solvable pending issues, as set forth in item II, and resolves them, via the Digital Protocol, observing the guidelines contained in Annex V, will be notified regarding the successful completion of the registration stage of the process of change in the form of access to the DICT and participation in the SPI, as per item I.

Art. 63. The requirements for approval in the homologation stage of the process of change in the form of access to the DICT and participation in the SPI will be customized for each requesting institution, namely:

I - for the Pix participant institution in the transactional account provider mode that wishes to start accessing the DICT directly and participate directly in the SPI:

a) formal homologation tests in the SPI, referred to in Art. 22; and

b) formal homologation tests in the DICT, referred to in Art. 24;

II - for the Pix participant institution in the transactional account provider mode that wishes to start accessing the DICT directly and participate indirectly in the SPI:

a) homologation tests, referred to in Art. 23, between the indirect participant in the SPI and its liquidator;

b) formal homologation tests in the DICT, referred to in Art. 24; and

c) closure of PI Account, as set forth in specific SPI regulation;

III - for the Pix participant institution in the transactional account provider mode that wishes to start accessing the DICT indirectly and participate indirectly in the SPI:

a) homologation tests, referred to in Art. 23, between the indirect participant in the SPI and its liquidator;

b) homologation tests, referred to in Art. 26, between the participant with indirect access to the DICT and the contracted participant with direct access; and

c) closure of PI Account, as set forth in specific SPI regulation;

IV - for the Pix participant institution in the initiator mode:

a) formal tests, referred to in Art. 24, regarding homologation in the DICT, if it wishes to start accessing the DICT directly;

b) homologation tests, referred to in Art. 26, between the institution with indirect access to the DICT and the contracted participant with direct access, if it wishes to start accessing the DICT indirectly, or

c) guidelines regarding the closure of activities in the DICT for the Pix participant institution in the initiator mode that wishes to no longer access the DICT; and

V - for the Pix participant institution in the user institution mode:

a) formal homologation tests in the SPI, referred to in Art. 22, if it wishes to start participating directly in the SPI;

b) formal homologation tests in the DICT, referred to in Art. 24, if it wishes to start accessing the DICT directly;

c) homologation tests, referred to in Art. 23, between the indirect participant in the SPI and its liquidator, if it wishes to start participating indirectly in the SPI;

d) homologation tests, referred to in Art. 26, between the participant with indirect access to the DICT and the contracted participant with direct access, if it wishes to start accessing the DICT indirectly; and

e) closure of PI Account, as set forth in specific SPI regulation, in cases where the requesting institution is the holder of a PI Account and wishes to start participating in the SPI indirectly.

Sole Paragraph. The requesting institution for direct participation in the SPI will observe the deadline determined for the conclusion of the tests in the SPI, as set forth in specific SPI regulation.

Art. 64. The requesting institution will be notified regarding the result of the homologation stage of the process of change in the form of access to the DICT and participation in the SPI, which will also contain:

I - for the institution acting in the transactional account provider mode or user institution mode, guidelines regarding the sending of a suggested date for the effective change in the form of access to the DICT and participation in the SPI in the DICT and SPI production environments;

II - for the institution acting in the initiator mode, guidelines regarding the sending of a suggested date for the effective change in the form of access to the DICT in the DICT production environment.

Sole Paragraph. The suggested date for the effective migration in the production environment of the DICT and SPI must be presented by the requesting institution to Decem, via the Digital Protocol and in free text, observing the guidelines contained in Annex V.

Art. 65. Decem will define and notify the requesting institution regarding the date of the effective migration in the production environment of the DICT and SPI.

Sole Paragraph. For the requesting institution to participate directly in the SPI, the notification referred to in the caput will also inform the time for the effective entry into the SPI production environment.

CHAPTER IV

OF THE APPLICATION FOR CHANGE OF RESPONSIBLE PARTICIPANT AND LIQUIDATING PARTICIPANT

Section I

Of the Change of Responsible Participant

Art. 66. Institutions not authorized to operate by the Central Bank of Brazil, already Pix participants in the transactional account provider mode or in the process of adhesion in this mode, may optionally present an application for change of responsible participant.

§ 1º The Change referred to in the caput is prohibited to the institution in the process of adhesion to Pix that has already completed the homologation stage of said process.

§ 2º The institution referred to in § 1º, if it intends to change the originally indicated responsible participant, must wait for full entry into operation or present an application for withdrawal from the ongoing Pix adhesion process.

§ 3º The institution that incurs in the withdrawal application referred to in §2º may only present a new Pix adhesion application after 90 days have elapsed from the presentation of said application.

Art. 67. The change of responsible participant by the contracting institution necessarily implies the change of the service provider of access to the DICT, as well as the change of the participant indicated as liquidator in the SPI, functions that will be exercised by the new responsible party.

Art. 68. The presentation of an application for change of responsible participant, before the Central Bank of Brazil, comprises the sending, to Decem, via the Digital Protocol, observing the guidelines contained in Annex V, of:

I - registration update form, according to the model available in Annex I-D, in which, in an appropriate field, the ISPB of the new responsible participant is stated;

II - contract signed with the new responsible participant, as per the Pix Regulation; and

III - declaration, signed by the new responsible participant, that the contracting institution has integrated the minimum capital amount required, as per the Pix Regulation and in the mold set forth in Instruction Normative BCB No. 16, of 2020.

Art. 69. Once the documents regarding the application for change of responsible participant have been reviewed, the requesting institution will be notified regarding the result of the analysis, which will consist of:

I - in case there are no pending issues, a notification containing guidelines for the change of responsible participant in the homologation environment, as well as regarding the relevant homologation tests; or

II - in a notification regarding solvable pending issues to be resolved by the requesting institution.

Sole Paragraph. The requesting institution that presents solvable pending issues, as set forth in item II, and resolves them, via the Digital Protocol, observing the guidelines contained in Annex V, will be notified in the terms of item I.

Art. 70. The homologation tests to be executed between the contracting institution and the new responsible participant will consist of:

I - homologation tests, referred to in Art. 23, between the indirect participant in the SPI and its liquidator; and

II - homologation tests, referred to in Art. 26, between the participant with indirect access to the DICT and the contracted participant with direct access.

Art. 71. Once the homologation tests regarding the process of change of responsible participant are concluded, it must be arranged to send to Decem, via the Digital Protocol and in free text, observing the guidelines contained in Annex V, a declaration, signed by the new responsible participant, that the contracting institution has the technical and operational capacity to comply with the duties and obligations provided for in the Pix Regulation.

Sole Paragraph. For the institution in the process of adhesion to Pix, the approval of the document referred to in the caput must occur within the regulatory deadline for the conclusion of the homologation stage of the Pix adhesion process, except for any extension.

Art. 72. The requesting institution already participating in Pix will be notified regarding the result of the application for change of responsible participant, which will also contain guidelines regarding the sending of the suggested date and time for the effective change in the production environment of the DICT and SPI.

Section II

Of the Change of Exclusively Liquidating Participant in the SPI and Service Provider in the DICT

Art. 73. Institutions authorized to operate by the Central Bank of Brazil, already Pix participants in the transactional account provider mode or in the process of adhesion in this mode, may change the liquidating participant, as set forth in specific SPI regulation.

§ 1º The new liquidating participant will also automatically assume the function of service provider of access to the DICT to the indirect participant.

§ 2º The new DICT access provider must be previously qualified to provide services in the DICT to institutions with indirect access.

§ 3º It is the exclusive responsibility of the institution with indirect access to the DICT to hire a participant in accordance with the provisions of § 2º.

CHAPTER V

OF THE OFFERING OF OPTIONAL PRODUCTS AND SERVICES WITHIN THE SCOPE OF PIX

Section I

Of the Provision of Services in the DICT to Institutions with Indirect Access

Art. 74. Institutions authorized to operate by the Central Bank of Brazil, that access or will access the DICT directly, whether already Pix participants or in the process of adhesion to Pix, may optionally apply for qualification to provide services in the DICT to institutions with indirect access.

Sole Paragraph. The presentation of an application for the provision of services referred to in the caput is prohibited:

I - to institutions that access or will access the DICT indirectly;

II - to institutions not authorized to operate by the Central Bank of Brazil;

III - to institutions in the process of adhesion to Pix that have not yet entered the homologation stage of said process; and

IV - to institutions in the homologation stage of the Pix adhesion process that have not obtained prior approval in the formal homologation tests in the DICT, referred to in Art. 24.

Art. 75. Institutions that wish to provide services in the DICT to institutions with indirect access must manifest their intention to Decem, via the Digital Protocol and in free text, observing the guidelines contained in Annex V.

Art. 76. Once the application has been reviewed, the requesting institution will be notified regarding the result of the analysis, which will consist of:

I - in case there are no restrictions on the provision of services in the DICT to institutions with indirect access, guidelines regarding formal homologation tests with, at least, one institution with indirect access, as set forth in Instruction Normative BCB No. 508, of August 30, 2024; or

II - in case there are restrictions on the provision of services in the DICT to institutions with indirect access, a notification regarding the denial of the application.

Art. 77. Even if the institution in the homologation stage of the Pix adhesion process successfully concludes the formal tests for providing services in the DICT to institutions with indirect access, its effective authorization to provide these services in the DICT production environment will be conditioned on its full operational entry.

Art. 78. The Pix participant institution successfully approved in the formal homologation tests in the DICT for providing services to institutions with indirect access will be authorized to provide these services in the DICT production environment.

Section II

On the Option to Start Offering Payment Transaction Initiation Service or New Forms of Initiation

Art. 79. The institution authorized to operate by the Central Bank of Brazil, already a participant in Pix in the transactional account provider modality, in the special liquidator modality, or in the adhesion process in any of these modalities, may request, at any time and optionally, authorization to offer, within the scope of Pix, the payment transaction initiation service, acting as a payment transaction initiating institution, as provided for in the specific regulation of Open Finance.

§ 1º To request the authorization referred to in the caput, the requesting institution must have prior authorization from the Central Bank of Brazil to specifically provide the payment initiation service or be exempt from doing so, as provided in specific regulation.

§ 2º The institution wishing to offer the service referred to in the caput must submit to Decem, through the Digital Protocol, observing the guidelines in Annex V:

I - if it is a Pix participant institution in the transactional account provider modality or in the adhesion process in this modality, a form for updating the intention to offer products and services, according to the model available in Annex I-B, indicating, in a specific section of the mentioned form, the intention to offer the service, as well as the forms of initiation it intends to offer; or

II - if it is a Pix participant institution in the special liquidator modality or in the adhesion process in this modality, a form for updating registration data, according to the model available in Annex II-A, indicating, in a specific section of the mentioned form, the intention to offer the service, as well as the forms of initiation it intends to offer.

Art. 80. Once the document containing the option to offer the payment transaction initiation service, as well as the forms of initiation to be offered within the scope of Pix, is reviewed, the requesting institution will be notified of the result of the analysis, which will consist of:

I - if there are no pending issues, in a notification of receipt of the request to offer the payment transaction initiation service, within the scope of Pix, which will also contain guidelines for executing the relevant homologation tests, which will correspond to:

a) for the institution already participating in the transactional account provider modality, or in the adhesion process to Pix in this modality, those referred to in Art. 39, item I, if it has already successfully concluded, within the scope of Pix, the tests related to the account holder figure, as provided in specific regulation of Open Finance;

b) for the institution already participating in the transactional account provider modality, or in the adhesion process to Pix in this modality, those referred to in Art. 39, item III, if it has not yet successfully concluded, within the scope of Pix, the tests related to the account holder figure, as provided in specific regulation of Open Finance; or

c) for the institution already participating in the special liquidator modality, or in the adhesion process to Pix in this modality, those referred to in Art. 39, item IV; and

II - in a notification regarding the denial of the request for authorization to offer the payment transaction initiation service within the scope of Pix.

§ 1º For institutions in the Pix adhesion process that have expressed interest in offering the service referred to in the caput, the result of the relevant homologation tests will condition their approval in the homologation stage of the Pix adhesion process, unless withdrawal of the offer of the service referred to in the caput is expressed prior to the end of the deadline for obtaining approval in the mentioned stage.

§ 2º The withdrawal referred to in § 1º consists of the re-submission, through the Digital Protocol and observing the guidelines in Annex V, of:

I - a form for updating the intention to offer products and services, according to the model available in Annex I-B, in which the institution already participating in the transactional account provider modality, or in the adhesion process to Pix in this modality, indicates its intention in an appropriate field; or

II - a form for updating registration data, according to the model available in Annex II-A, in which the institution already participating in the special liquidator modality, or in the adhesion process to Pix in this modality, indicates its intention in an appropriate field.

§ 3º The authorization to offer the payment transaction initiation service, in the Pix production environment, will only be executed after the completion of the relevant homologation tests, regardless of whether it is an institution already participating or in the adhesion process to Pix.

Art. 81. The procedure and provisions of this section apply to cases where the institution already participating or in the adhesion process to Pix in the transactional account provider, special liquidator, or initiator modalities wishes to offer new forms of payment transaction initiation, within the scope of Pix, for which it has not obtained authorization in a previous request.

Section III

On the Option to Start Acting as a Withdrawal Service Facilitator

Art. 82. The institution authorized to operate by the Central Bank of Brazil, already a participant in Pix in the transactional account provider modality or in the adhesion process in this modality, may submit, at any time and optionally, a request to act as a withdrawal service facilitator.

§ 1º The institution wishing to act as a withdrawal service facilitator must indicate its intention in an appropriate field of the form for updating the intention to offer products and services, according to the model available in Annex I-B.

§ 2º The document referred to in § 1º must be submitted to Decem, through the Digital Protocol, observing the guidelines in Annex V.

Art. 83. Once the document containing the option to act as a withdrawal service facilitator is reviewed, the requesting institution will be notified of the result of the analysis, which will consist of:

I - if there are no pending issues, in a notification of receipt of the request to act as a withdrawal service facilitator, which will also contain guidelines for executing the relevant homologation tests, which will correspond to those referred to in Art. 41; or

II - in a notification regarding the denial of the request for authorization to act as a withdrawal service facilitator.

§ 1º For institutions in the Pix adhesion process that have expressed interest in acting as a withdrawal service facilitator, the result of the tests referred to in item I will condition their approval in the homologation stage of the Pix adhesion process, unless withdrawal of the act as a withdrawal service facilitator is expressed prior to the end of the deadline for obtaining approval in the mentioned stage.

§ 2º The withdrawal referred to in § 1º consists of the re-submission, through the Digital Protocol and observing the guidelines in Annex V, of a form for updating the intention to offer products and services, according to the model available in Annex I-B, in which the institution indicates its intention in an appropriate field.

§ 3º The institution already participating in Pix in the transactional account provider modality may also decline the request to act, optionally, as a withdrawal service facilitator, in which case it will observe the provisions of § 2º.

§ 4º The authorization to act as a withdrawal service facilitator, in the Pix production environment, will only be executed after the completion of the homologation tests referred to in item I, regardless of whether it is an institution already participating or in the adhesion process to Pix.

Section IV

On the Option to Offer New QR Code Related Functionalities

Art. 84. The institution already participating in Pix in the transactional account provider modality, in the user institution modality, or in the adhesion process in any of these modalities, may submit, at any time, a request to offer new functionalities, of an optional nature, related to QR Codes.

§ 1º The institution wishing to offer the functionalities referred to in the caput must submit, to Decem, through the Digital Protocol, observing the guidelines in Annex V:

I - if it is an institution authorized to operate by the Central Bank of Brazil, already a participant in Pix in the transactional account provider modality, or in the adhesion process in this modality, a form for updating the intention to offer products and services, according to the model available in Annex I-B, indicating in a specific section of the mentioned form, the intended functionalities;

II - if it is an institution not authorized to operate by the Central Bank of Brazil, already a participant in Pix or in the adhesion process, a form for updating the intention to offer products and services, according to the model available in Annex I-E, indicating in a specific section of the mentioned form, the intended functionalities; or

III - if it is a user institution, or in the adhesion process to Pix in this modality, a form for updating the intention to consume products and services, according to the model available in Annex IV-B.

§ 2º The document referred to in § 1º must be submitted to Decem, through the Digital Protocol, observing the guidelines in Annex V.

Art. 85. Once the document containing the option to offer new functionalities of an optional nature related to QR Codes is reviewed, the requesting institution will be notified of the result of the analysis, which will consist of:

I - if there are no pending issues, in a notification of receipt of the request to offer the functionalities referred to in the caput, which will also contain guidelines for executing the relevant homologation tests, which will correspond to those referred to in Art. 37; or

II - in a notification regarding the denial of the request to offer new functionalities related to QR Codes.

§ 1º For institutions in the Pix adhesion process that have expressed interest in offering new functionalities, of an optional nature, related to QR Codes, the result of the tests referred to in item I will condition their approval in the homologation stage of the Pix adhesion process, unless withdrawal of the offer of the functionalities in question is expressed prior to the end of the deadline for obtaining approval in the mentioned stage.

§ 2º The withdrawal referred to in § 1º consists of the re-submission, through the Digital Protocol and observing the guidelines in Annex V, of:

I - a form for updating the intention to offer products and services, according to the model available in Annex I-B, dealing with an institution authorized to operate by the Central Bank of Brazil, already participating in the transactional account provider modality or in the adhesion process to Pix in this modality, in which the institution indicates its intention in an appropriate field;

II - a form for updating the intention to offer products and services, according to the model available in Annex I-E, dealing with an institution not authorized to operate by the Central Bank of Brazil, already a participant in Pix or in the adhesion process, in which the institution indicates its intention in an appropriate field; or

III - a form for updating the intention to consume products and services, according to the model available in Annex IV-B, dealing with an institution already participating in Pix in the user institution modality, or in the adhesion process to Pix in this modality, in which the institution indicates its intention in an appropriate field.

§ 3º The permission to offer the new functionalities, of an optional nature, related to QR Codes, will only be granted after the completion of the relevant homologation tests, regardless of whether it is an institution already participating or in the adhesion process to Pix.

Section V

On the Option to Offer Automatic Pix

Art. 86. The institution already participating in Pix, or in the adhesion process, may submit, at any time, a request to offer or consume functionalities, of an optional nature, related to Automatic Pix, subject to the deadlines referred to in Art. 97.

Sole Paragraph. The institution wishing to offer the functionalities referred to in the caput must submit, to Decem, through the Digital Protocol, observing the guidelines in Annex V:

I - if it is an institution authorized to operate by the Central Bank of Brazil, already a participant in Pix in the transactional account provider modality, or in the adhesion process in this modality, a form for updating the intention to offer products and services, according to the model available in Annex I-B, indicating in a specific section of the mentioned form, the intended functionalities;

II - if it is an institution not authorized to operate by the Central Bank of Brazil, already a participant in Pix or in the adhesion process, a form for updating the intention to offer products and services, according to the model available in Annex I-E, indicating in a specific section of the mentioned form, the intended functionalities; or

III - if it is a participant institution in Pix in the user institution modality, or in the adhesion process in this modality, a form for updating the intention to consume products and services, according to the model available in Annex IV-B, indicating in a specific section of the mentioned form, the intended functionalities.

Art. 87. Once the document containing the option to offer or consume new functionalities related to Automatic Pix is reviewed, the requesting institution will be notified of the result of the analysis, which will consist of:

I - if there are no pending issues, in a notification of receipt of the request to offer the functionalities referred to in the caput, which will also contain guidelines for executing the relevant homologation tests, which will correspond to those referred to in Art. 42; or

II - in a notification regarding the denial of the request to offer new functionalities related to Automatic Pix.

§ 1º For institutions in the Pix adhesion process that have expressed interest in offering new functionalities, of an optional nature, related to Automatic Pix, subject to the deadlines referred to in Art. 97, the result of the tests referred to in item I will condition their approval in the homologation stage of the Pix adhesion process, unless withdrawal of the offer of the functionalities in question is expressed prior to the end of the deadline for obtaining approval in the mentioned stage.

§ 2º The withdrawal referred to in § 1º consists of the re-submission, through the Digital Protocol and observing the guidelines in Annex V, of:

I - a form for updating the intention to offer products and services, according to the model available in Annex I-B, dealing with an institution authorized to operate by the Central Bank of Brazil, already participating in the transactional account provider modality, or in the adhesion process to Pix in this modality, in which the institution indicates its intention in an appropriate field;

II - a form for updating the intention to offer products and services, according to the model available in Annex I-E, dealing with an institution not authorized to operate by the Central Bank of Brazil already participating, or in the adhesion process to Pix, in which the institution indicates its intention in an appropriate field; or

III - a form for updating the intention to consume products and services, according to the model available in Annex IV-B, dealing with an institution already participating in Pix in the user institution modality, or in the adhesion process in this modality, in which the institution indicates its intention in an appropriate field.

§ 3º The permission to offer the new functionalities, of an optional nature, related to Automatic Pix, will only be granted after the completion of the relevant homologation tests, regardless of whether it is an institution already participating or in the adhesion process to Pix.

CHAPTER VI

ON REGISTRATION UPDATES

Section I

On general aspects of registration changes

Art. 88. Except for information related to the amount and modality of active transactional accounts of users, as well as the evidence demonstrating compliance with the items in the self-assessment questionnaire on security, the other information and documents presented within the scope of Pix must be kept updated with the Central Bank of Brazil during the Pix adhesion process and while the institution is a participant in Pix.

§ 1º The information and documents referred to in the caput must be sent to Decem, unless specific provision to the contrary, exclusively through the Digital Protocol, and, when applicable, by presenting an appropriate form, observing the guidelines in Annex V.

§ 2º The registration update that aims exclusively to communicate the change in the amount of active accounts should only be performed if the volume characterizing or decharacterizing mandatory participation in Pix is reached, in the terms of the Pix Regulation, by the institution that is already a participant in Pix or by that which is in the adhesion process.

§ 3º Pix participants must store the evidence demonstrating compliance with the items in the self-assessment questionnaire on security for a minimum period of 5 (five) years and, when requested, send them to the Central Bank of Brazil according to the format and deadlines defined.

§ 4º The minimum period referred to in § 3º will be counted from the sending, to the Central Bank of Brazil, of the information contained in the self-assessment questionnaire on security.

Art. 89. The insertion or alteration of data related to directors responsible for areas of activity must be carried out, directly in Unicad, under the responsibility of the Pix participant institution or the institution in the adhesion process to Pix that already has a Sisbacen code.

Art. 90. The insertion or alteration of data related to the director responsible for the SPI, as well as the alteration of telephone and email contact data for matters related to the SPI, will observe the provisions of specific SPI regulation.

Art. 91. The registration update aiming to change contacts for matters related to Pix must be requested by email sent to the corporate mailbox pix-operacional@bcb.gov.br from a previously informed and registered contact for this same purpose.

Art. 92. The registration update regarding the change of Corporate Name or Reduced Name of institutions authorized to operate by the Central Bank of Brazil or with a pending request, in course, to obtain authorization, will observe the provisions contained in specific regulation.

Section II

On the process of verifying the adherence of solutions to end users

Art. 93. The institution already participating in Pix in the transactional account provider modality, or in the adhesion process to Pix in this modality, which previously offered transactional accounts solely to corporate users, is obliged, upon the registration update in which it informs that it now offers transactional accounts also to natural person users, to submit to the process of verifying the adherence of solutions to end users referred to in Art. 27.

§ 1º If the institution referred to in the caput is in the Pix adhesion process, it must obtain approval in the process of verifying the adherence of solutions to end users within the regulatory deadline for successfully concluding the relevant homologation stage, subject to any extension.

§ 2º The offer of Pix to natural person users is prohibited without prior approval in the process of verifying the adherence of solutions to end users.

Section III

On formal tests for QR Code validation

Art. 94. The institution already participating in Pix in the transactional account provider modality, or in the adhesion process to Pix in this modality, which previously offered transactional accounts exclusively to corporate users, is obliged, upon the registration update in which it informs that it now offers transactional accounts also to natural person users, to submit to the formal tests for QR Code validation referred to in Art. 37, if it has not yet successfully executed them.

Section IV

On Formal Tests for Validation of Payment Transaction Initiation Service Provision

Art. 95. The transactional account provider that is not a participant in Open Finance as an account-holding institution, as provided in specific regulation of Open Finance, must be approved in the validation of the provision of payment transaction initiation service, referred to in Art. 39, item II, if it becomes a participant in Open Finance as an account-holding institution.

Sole Paragraph. The provisions of the caput apply to the institution participating in Pix in the transactional account provider modality that entered Pix in the condition of an institution not subject to authorization by the Central Bank of Brazil and that, during its operation as a participant, obtained operating authorization, subject to the exemption cases referred to in Art. 40.

Section V

On Formal Tests for Validation of Automatic Pix

Art. 96. The institution already participating in Pix in the transactional account provider modality, or in the adhesion process to Pix in this modality, which previously offered transactional accounts exclusively to corporate users, is obliged, upon the registration update in which it informs that it now offers transactional accounts also to natural person users, to submit to the formal tests for validation of Automatic Pix referred to in Art. 42, if it has not yet successfully executed them.

CHAPTER VII

TRANSITIONAL PROVISIONS

Art. 97. Regarding the formal homologation tests for Automatic Pix, referred to in Art. 42, the following deadlines must be observed:

I - institutions that concluded the homologation stage of the Pix adhesion process before April 28, 2025, including operating participants, must successfully complete the tests between April 28, 2025, and June 6, 2025;

---

II - institutions that completed the homologation stage of the Pix adhesion process between April 28, 2025, and June 6, 2025, must successfully complete tests within a period of eight weeks counted from the successful conclusion of the relevant homologation stage;

III - institutions that do not complete the homologation stage of the Pix adhesion process by June 6, 2025, must complete the Pix Automatic tests within the period established for the successful conclusion of that stage; and

IV - during the period from March 10, 2025, to June 6, 2025, operating participant institutions that offer transactional accounts only to legal entity users and opt not to offer payments via Pix Automatic must send, to Decem, via the Digital Protocol, observing the guidelines contained in Annex V, a form for updating the intention to offer products and services, indicating, in the appropriate field, the waiver of the offer of Pix Automatic. (Amended by Normative Instruction BCB No. 613, of April 30, 2025.)

Art. 98. Pix participant institutions that, optionally, wish to offer Pix Automatic from its launch must send, by April 4, 2025, to Decem, via the Digital Protocol, observing the guidelines contained in Annex V: (Amended, effective January 1, 2025, by Normative Instruction BCB No. 581, of December 30, 2024.)

I - (Revoked by Normative Instruction BCB No. 613, of April 30, 2025.)

II - in the case of offering Pix Automatic – Receipt, a form for Pix Automatic – Receipt shifts, indicating those it intends to offer. (Included, effective January 1, 2025, by Normative Instruction BCB No. 581, of December 30, 2024.)

§1º The institutions referred to in the caput must comply with the tests referred to in Art. 42 between April 28, 2025, and June 6, 2025. (Transformed into § 1º by Normative Instruction BCB No. 613, of April 30, 2025.)

§ 2º The institutions referred to in the caput may, until June 6, 2025, request withdrawal of the offer of Pix Automatic – Receipt, by sending, duly formalized in the Digital Protocol, a form for updating the intention to offer products and services. (Included by Normative Instruction BCB No. 613, of April 30, 2025.)

Art. 98-A. The following deadlines must be observed regarding the formal homologation tests referred to in Art. 43-A: (Included by Normative Instruction BCB No. 679, of October 30, 2025.)

I - successful completion of tests between November 10, 2025, and November 20, 2025, for Pix participant institutions; (Included by Normative Instruction BCB No. 679, of October 30, 2025.)

II - successful completion of tests between November 10, 2025, and November 20, 2025, for institutions in Pix adhesion that conclude the homologation stage before the end of that period; and (Included by Normative Instruction BCB No. 679, of October 30, 2025.)

III - successful completion of tests during the homologation stage for institutions in Pix adhesion that do not complete that stage by November 20, 2025. (Included by Normative Instruction BCB No. 679, of October 30, 2025.)

Art. 98-B. Institutions in the adhesion process that have already been approved in the registration stage must comply with the provisions of Art. 14-A until the end of the restricted operation stage. (Included by Normative Instruction BCB No. 703, of January 28, 2026.)

CHAPTER VIII

GENERAL PROVISIONS

Art. 99. Unless otherwise specifically provided, any issues related to the monitoring of demands concerning the topics addressed in this Normative Instruction will be handled by Decem through the corporate mailbox pix-operacional@bcb.gov.br.

Sole Paragraph. It is the exclusive responsibility of the requesting institution to keep updated, with the Central Bank of Brazil, the contacts for matters related to Pix, as well as to ensure the timely reception and handling of pertinent communications.

Art. 100. The Central Bank of Brazil may request additional information and documents at any time.

Sole Paragraph. In the situation referred to in the caput, if the additional information eventually required is not provided or if the Central Bank of Brazil deems them incorrect, incomplete, or inconsistent, the request is subject to denial, regardless of the stage in which the process is located.

Art. 101. Regardless of compliance with the other conditions of the Pix adhesion process, a request from an institution whose authorization for operation was denied by the Central Bank of Brazil will be denied.

Art. 102. For the purposes of the provisions of Art. 16, § 3º, Art. 40, item II, Art. 43, item II, and Art. 46, caput, single credit cooperatives affiliated with a central credit cooperative are equated with single credit cooperatives that operate through deposit accounts with specific purposes, in accordance with Resolution BCB No. 314, of April 26, 2023, and that have as the clearing agent in the SPI the institution that operates these accounts.

Art. 103. Pix participant institutions that have obtained approval for a request for orderly withdrawal from Pix, as referred to in Art. 30 of the Pix Regulation, are exempt from carrying out specific homologation tests for new Pix functionalities or new Pix products whose implementation date is subsequent to the notification of disconnection to the Central Bank of Brazil.

Art. 104. In addition to compliance with the provisions of this Normative Instruction, the successful conclusion of the Pix adhesion processes; changes in the modality of participation in Pix; changes in the form of access to the DICT and participation in the SPI; changes in the responsible participant and clearing participant; and the offer of optional products and services, within the scope of Pix, implies adherence to the rules, conditions, and procedures established in the Pix Regulation.

Art. 105. At the discretion of the Central Bank of Brazil, the existence of merely formal errors in procedural acts may allow for the utilization of the act, provided that it does not present risk to the objectives of the processes referred to in Art. 104.

Art. 106. In the sending of documents to meet the requirements of the processes referred to in Art. 104, any editing in the annexes of this Normative Instruction, not related to the marking of fields available for completion, except when expressly authorized, will subject the request to denial.

Art. 106-A. An appeal may be filed against decisions emanating within the scope of the processes: (Included, effective January 1, 2025, by Normative Instruction BCB No. 581, of December 30, 2024.)

I - of adhesion to Pix; (Included, effective January 1, 2025, by Normative Instruction BCB No. 581, of December 30, 2024.)

II - of changes in the modality of participation in Pix; (Included, effective January 1, 2025, by Normative Instruction BCB No. 581, of December 30, 2024.)

III - of changes in the form of access to the DICT and participation in the SPI; (Included, effective January 1, 2025, by Normative Instruction BCB No. 581, of December 30, 2024.)

IV - of changes in the responsible participant and clearing participant; and (Included, effective January 1, 2025, by Normative Instruction BCB No. 581, of December 30, 2024.)

V - of changes in the offer of optional products and services. (Included, effective January 1, 2025, by Normative Instruction BCB No. 581, of December 30, 2024.)

§ 1º The appeal referred to in the caput must be presented no later than 15 days, counted from the day following the communication of the decision to which it is directed. (Included, effective January 1, 2025, by Normative Instruction BCB No. 581, of December 30, 2024.)

§ 2º The appeal filed out of time will be considered null and will not be reviewed. (Included, effective January 1, 2025, by Normative Instruction BCB No. 581, of December 30, 2024.)

Art. 107. Normative Instruction BCB No. 291, published in the Official Gazette of the Union on August 1, 2022, is revoked.

Art. 108. This Normative Instruction enters into force on the date of its publication.

RICARDO TEIXEIRA LEITE MOURÃO

Annex I - Documents for institutions that participate or intend to participate in Pix in the transactional account provider modality

Annex I-A

• Adhesion form for institutions, authorized to operate by the Central Bank of Brazil, that intend to participate in Pix in the transactional account provider modality; and

• Update form for institutions, authorized to operate by the Central Bank of Brazil, already participants in Pix in the transactional account provider modality.

I	Reason for presentation	( ) ( ) ( )	Adhesion Request Update of participant in operation in Pix, as provided in Art. 88 Update of institution in adhesion to Pix, as provided in Art. 88
II	If the reason for presenting the form is an update, indicate next to it the item(s) to be changed. If it is an adhesion request, do not mark and skip to item III	( ) ( ) ( ) ( )	V1 – Change in form of access to DICT. VI2 – Change in form of participation in SPI. VII – Change in form of access to RSFN. IX3 – Amount and types of accounts offered.
III	CNPJ Registration
IV	Corporate Name4
V	Type of access to DICT Obs: Direct access to DICT is mandatory for the direct participant in SPI.	( ) ( )	Direct Indirect
VI	Type of participation in SPI Obs: If indirect, inform the ISPB code of the clearing participant in SPI:	( ) ( )	Direct Indirect, with clearing agent ISPB __________
VII	If direct participant in SPI, indicate form of connection to RSFN (direct or via PSTI). If indirect participant in SPI (NA).	( ) ( ) ( )	Direct Via the following PSTI: Name of PSTI: _____________ CNPJ of PSTI: ______________ NA
VIII	Offers or will offer transactional accounts:	( ) ( )	Yes No
IX	If already offering transactional accounts, inform in the sub-items below, the number of active client accounts at the time of the adhesion request or update, in the following modalities:
IX (a)	Demand deposit accounts
IX (b)	Savings deposit accounts
IX (c)	Prepaid payment accounts
X	Identification of the director responsible for handling demands from the Central Bank of Brazil related to issues concerning Pix5	Name: CPF:
XI	Institution's telephone number for matters related to Pix6 (Obs1: Inform at least one telephone) (Obs2: At least one of the telephones informed must be shareable with other Pix participants) (Obs3: Call center telephones or similar will not be accepted)
XI (a)	Telephone 1: Name7:	( )	authorizes sharing with other Pix participants
XI (b)	Telephone 2: Name7:	( )	authorizes sharing with other Pix participants
XI (c)	Telephone 3: Name7:	( )	authorizes sharing with other Pix participants
...	...	...
XII	Institution's electronic address (e-mail) for matters related to Pix8 (Obs1: Inform at least one e-mail) (Obs2: Inform at least one e-mail corresponding to a corporate mailbox accessible to more than one user) (Obs3: At least one of the e-mails informed must be shareable with other Pix participants) (Obs4: Consumer service e-mails or similar will not be accepted)
XII (a)	E-mail 1: Name9:	( ) ( )	authorizes sharing with other Pix participants corporate mailbox accessible to more than one user
XII (b)	E-mail 2: Name9:	( ) ( )	authorizes sharing with other Pix participants corporate mailbox accessible to more than one user
XII (c)	E-mail 3: Name9:	( ) ( )	authorizes sharing with other Pix participants corporate mailbox accessible to more than one user
...	....	....
XIII	If participating or intending to participate directly in SPI, identification of the director responsible for handling demands from the Central Bank of Brazil related to issues concerning SPI10	Name: CPF:
XIV	If participating or intending to participate directly in SPI, institution's telephone number for matters related to SPI10
XV	If participating or intending to participate directly in SPI, institution's electronic address (e-mail) for matters related to SPI10

1 The request for change in the form of access to DICT is prohibited to institutions in the process of adhesion to Pix, as provided in Art. 59, § 2º, item III.

2 The request for change in the form of participation in SPI is prohibited to institutions that, as provided in specific SPI regulation, are obliged to participate directly, as provided in Art. 59, § 2º, item I.

3 The submission of an update form is waived in cases where the change consists exclusively in the amount and modalities of active transactional accounts, except if the volume reached characterizes or decharacterizes mandatory participation in Pix, as provided in Art. 88, caput and § 2º.

4 The update regarding the change of corporate name of institutions authorized to operate by the Central Bank of Brazil will observe the provisions contained in specific regulation, as provided in Art. 92.

5 For purposes of update, the change of data related to the director responsible for issues related to participation in Pix must be carried out, directly in Unicad, by the participant institution or institution in adhesion to Pix that already has a Sisbacen code, as provided in Art. 89.

6 For purposes of update, the change of contacts for matters related to Pix must be requested by e-mail sent to the corporate mailbox pix-operacional@bcb.gov.br from a previously informed and registered contact for this same purpose, as provided in Art. 91.

7 Fill in with the name of the person responsible for the indicated telephone. If it is not from a specific person, fill the "Name" field with the term "Institutional". If the institution wishes to inform more than three telephones, it is exceptionally permitted to insert more lines, named "XI (d)", "XI (e)" and so on.

8 For purposes of update, the change of contacts for matters related to Pix must be requested by e-mail sent to the corporate mailbox pix-operacional@bcb.gov.br from a previously informed and registered contact for this same purpose, as provided in Art. 91.

9 Fill in with the name of the person responsible for the indicated e-mail. If it is not from a specific person, fill the "Name" field with the term "Institutional". If the institution wishes to inform more than three e-mails, it is exceptionally permitted to insert more lines, named "XII (d)", "XII (e)" and so on.

10 For purposes of update, the change of data related to the director responsible for SPI and Conta PI must be carried out as provided in specific SPI regulation, as determined in Art. 90.

We declare that we are aware that:

(i) the Central Bank of Brazil reserves the right to request additional information and documents at any time; and

(ii) adhesion and subsequent participation in Pix implies acceptance of the rules, conditions, and procedures established in the Pix Regulation.

---

Name and Position

Annex I-B

· Form of intention to offer products and services to be offered by institutions, authorized to operate by the Central Bank of Brazil, that intend to participate in Pix in the transactional account provider modality; and

· Form of update of intention to offer products and services by institutions, authorized to operate by the Central Bank of Brazil, already participants in Pix in the transactional account provider modality.

I	Reason for submission	( ) ( ) ( )	Adhesion request Update of products and services offered by a Pix participant in operation, as set forth in Art. 88 Update of products and services to be offered by an institution adhering to Pix, as set forth in Art. 88
II	CNPJ Registration
III	Corporate Name
IV	Offers or will offer transactional accounts to end users:	( ) ( )	legal entities natural persons
V	Participates or will participate in Open Finance, optionally, as a holding institution?	( ) ( )	Yes No, the institution is exempt
VI	Offers or will offer payment transaction initiation service within the scope of Open Finance, acting as a payment transaction initiator?	( ) ( )	Yes. In this case, select the initiation methods in item XIV No
VII	Acts or will act as a Facilitator for withdrawal service (Pix Withdrawal and Pix Change)?	( ) ( )	Yes No
VIII	Offers or will offer Pix API1?	( ) ( )	Yes No
IX	Mandatory products and services offered to natural persons (editing or selection prohibited)		• Pix Automatic – Payment • Pix Scheduled; • Pix Key; • Static QR Code reading; • Dynamic QR Code reading; and • Pix Billing for immediate payments - generation of static QR Code
X	Optional products and services offered to natural persons	( ) ( )	Pix Billing for immediate payments - generation of dynamic QR Code Pix Billing for payments with maturity - generation of dynamic QR Code
XI	Mandatory products and services offered to legal entities (editing or selection prohibited)		• Pix Scheduled
XI (a)	If offering or intending to offer transactional accounts to end-user legal entities, do you request exemption from offering “Pix Automatic – Payment” for this audience?	( ) ( )	Yes No
XII	Mandatory products and services offered to legal entities by participants offering Pix API (editing or selection prohibited)		• Pix Billing for immediate payments - generation of dynamic QR Code • Pix Withdrawal - generation of dynamic QR Code; and • Pix Change - generation of dynamic QR Code
XIII	Optional products and services offered to legal entities	( ) ( ) ( ) ( ) ( ) ( )	Pix Key2 Static QR Code reading2 Dynamic QR Code reading2 Generation of static QR Code of Pix Billing for immediate payments and Generation of static QR Code of Pix Withdrawal3 Pix Billing for payments with maturity – generation of dynamic QR Code Pix Automatic – Receipt
XIV	Optional products offered through payment transaction initiation service by Open Finance4 participants	( ) ( ) ( ) ( ) ( ) ( )	Pix Initiation – Manual entry of transactional account data of the receiving user Pix Initiation – Pix Key Pix Initiation – INIC5 Pix Initiation – QR Code reading Pix Scheduled Initiation Pix Automatic Initiation – Receipt

1 The generation of any type of dynamic QR Code, when offered to legal entity users in an automated manner, must only be performed via the Pix API.
2 The institution that makes transactional accounts available to legal entity users must make available, at minimum, one of the three modalities for performing a Pix (Pix Key, Static QR Code reading, Dynamic QR Code reading).
3 If opting to offer the generation of static QR Code to legal entities, the participant is obliged to offer, through this initiation method, both the functionalities related to the Pix Billing for immediate payments products and the functionalities related to Pix Withdrawal. 4 The provision of payment transaction initiation service is optional for transactional account provider participants and available only with prior authorization to exercise the activity, granted by the Central Bank of Brazil, except for cases of exemption provided for in specific regulations. If opting to offer this service, the participant must indicate, at least, one of the Pix initiation modalities. 5 Corresponds to cases where the transactional account provider rendering the initiation service holds the information of the receiving user.

We declare that we are aware that:

(i) the Central Bank of Brazil reserves the right to request additional information and documents at any time; and

(ii) adhesion and subsequent participation in Pix implies acceptance of the rules, conditions, and procedures established in the Pix Regulation.

---

Name and Position

Annex I-B

(Annex I-B with wording given, from 1/1/2025, by Instruction Normative BCB No. 581, of 12/30/2024.)

• Intention form for offering products and services to be offered by institutions, authorized to operate by the Central Bank of Brazil, that intend to participate in Pix in the transactional account provider modality; and
• Intention update form for offering products and services by institutions, authorized to operate by the Central Bank of Brazil, already participants in Pix in the transactional account provider modality.

I	Reason for submission	( ) ( ) ( )	Adhesion request Update of products and services offered by a Pix participant in operation, as set forth in Art. 88 Update of products and services to be offered by an institution adhering to Pix, as set forth in Art. 88
II	CNPJ Registration
III	Corporate Name
IV	Offers or will offer transactional accounts to end users:	( ) ( )	legal entities natural persons
V	Participates or will participate in Open Finance, optionally, as a holding institution?	( ) ( )	Yes No, the institution is exempt
VI	Offers or will offer payment transaction initiation service within the scope of Open Finance, acting as a payment transaction initiator?	( ) ( )	Yes. In this case, select the initiation methods in item XIV No
VII	Acts or will act as a Facilitator for withdrawal service (Pix Withdrawal and Pix Change)?	( ) ( )	Yes No
VIII	Offers or will offer Pix API1?	( ) ( )	Yes No
IX	Mandatory products and services offered to natural persons (editing or selection prohibited)		• Pix Automatic – Payment • Pix Scheduled; • Pix Key; • Static QR Code reading; • Dynamic QR Code reading; and • Pix Billing for immediate payments - generation of static QR Code
X	Optional products and services offered to natural persons	( ) ( )	Pix Billing for immediate payments - generation of dynamic QR Code Pix Billing for payments with maturity - generation of dynamic QR Code
XI	Mandatory products and services offered to legal entities (editing or selection prohibited)		• Pix Scheduled
XI (a)	If offering or intending to offer transactional accounts to end-user legal entities, do you request exemption from offering “Pix Automatic – Payment” for this audience?	( ) ( )	Yes No
XII	Mandatory products and services offered to legal entities by participants offering Pix API (editing or selection prohibited)		• Pix Billing for immediate payments - generation of dynamic QR Code • Pix Withdrawal - generation of dynamic QR Code; and • Pix Change - generation of dynamic QR Code
XIII	Optional products and services offered to legal entities	( ) ( ) ( ) ( ) ( ) ( )	Pix Key2 Static QR Code reading2 Dynamic QR Code reading2 Generation of static QR Code of Pix Billing for immediate payments and Generation of static QR Code of Pix Withdrawal3 Pix Billing for payments with maturity – generation of dynamic QR Code Pix Automatic – Receipt
XIV	Optional products offered through payment transaction initiation service by Open Finance4 participants	( ) ( ) ( ) ( ) ( ) ( )	Pix Initiation – Manual entry of transactional account data of the receiving user Pix Initiation – Pix Key Pix Initiation – INIC5 Pix Initiation – QR Code reading Pix Scheduled Initiation Pix Automatic Initiation – Receipt

1 The generation of any type of dynamic QR Code, when offered to legal entity users in an automated manner, must only be performed via the Pix API.
2 The institution that makes transactional accounts available to legal entity users must make available, at minimum, one of the three modalities for performing a Pix (Pix Key, Static QR Code reading, Dynamic QR Code reading).
3 If opting to offer the generation of static QR Code to legal entities, the participant is obliged to offer, through this initiation method, both the functionalities related to the Pix Billing for immediate payments products and the functionalities related to Pix Withdrawal. 4 The provision of payment transaction initiation service is optional for transactional account provider participants and available only with prior authorization to exercise the activity, granted by the Central Bank of Brazil, except for cases of exemption provided for in specific regulations. If opting to offer this service, the participant must indicate, at least, one of the Pix initiation modalities. 5 Corresponds to cases where the transactional account provider rendering the initiation service holds the information of the receiving user.

We declare that we are aware that:

(i) the Central Bank of Brazil reserves the right to request additional information and documents at any time; and

(ii) adhesion and subsequent participation in Pix implies acceptance of the rules, conditions, and procedures established in the Pix Regulation.

---

Name and Position

Annex I-C

• Security self-assessment questionnaire - Institutions authorized to operate by the Central Bank of Brazil that intend to participate in Pix in the transactional account provider modality, access the DICT directly, and be a direct participant of the SPI; and
• Security self-assessment questionnaire - Institutions authorized to operate by the Central Bank of Brazil that intend to participate in Pix in the transactional account provider modality, access the DICT directly, and be an indirect participant of the SPI.

The questionnaire addresses security aspects related to Pix.

Observance of these aspects is mandatory for all participants. Thus, non-compliance with all these aspects, as well as the ineffective implementation of the security mechanisms provided for, from the beginning of the restricted operation stage, subjects the applicant to the denial of the adhesion request.

The participant must store evidence supporting their adherence to the aspects listed in this questionnaire upon submission to the Central Bank of Brazil. These evidences may be requested by the Central Bank of Brazil and may include, at the participant's discretion, diagrams, topologies, flowcharts, screen captures, queries with respective returns, or other documents deemed pertinent.

It is important to note that the eventual provision to the Central Bank of Brazil of documents, data, or information that are incorrect or out of compliance with the deadlines and conditions established in legal or regulatory norms constitutes an infraction punishable under current legislation.

CNPJ Registration
Corporate Name

I	Secure Communication
	Section 2 of the Pix Security Manual sets forth rules for secure communication purposes
I (a)	Does the proposed solution consider the observation, from the first moment of the institution in the restricted operation phase, of the requirements set forth in Section 2 of the Pix Security Manual? (Yes/No)
II	Digital Signature
	Section 3 of the Pix Security Manual sets forth the digital signature of messages transmitted in the SPI and DICT.
II (a)	Does the proposed solution consider the observation, from the first moment of the institution's operation in the restricted operation phase, of the requirements set forth in Section 3 of the Pix Security Manual? (Yes/No)
III	Security of Dynamic QR Codes
	Section 4 of the Pix Security Manual sets forth the security specifications of dynamic QR Codes generated by the receiver.
III (a)	Does the proposed solution consider the observation, from the first moment of the institution's operation in the restricted operation phase, of the requirements set forth in items 4.1 and 4.2 of the Pix Security Manual? (Yes/No/Generation of dynamic QR Codes will not be offered)
III (b)	Does the proposed solution consider the observation, from the first moment of the institution's operation in the restricted operation phase, of the requirements set forth in item 4.3 of the Pix Security Manual? (Yes/No/Generation and reading of dynamic QR Codes will not be offered)
IV	Digital Certificates
	Section 5 of the Pix Security Manual sets forth the types of certificates to be used within the scope of Pix, as well as the processes for activation, deactivation, and revocation verification of these certificates.
IV (a)	Does the proposed solution consider the observation, from the first moment of the institution's operation in the restricted operation phase, of the requirements set forth in Section 5 of the Pix Security Manual? (Yes/No)
V	Secure Implementation of Applications, APIs, and Other Systems
	Section 6 of the Pix Security Manual sets forth mandatory security aspects in the implementation of systems related to Pix.
V (a)	Does the proposed solution contemplate the use, from the first moment of the institution's operation in the restricted operation phase, of encryption mechanisms in communication between systems and APIs related to Pix and their respective client applications or software? (Yes/No)
V (b)	Does the proposed solution contemplate the implementation, from the first moment of the institution's operation in the restricted operation phase, of strong authentication mechanisms for client software on APIs and systems related to Pix? (Yes/No)
V (c)	Does the proposed solution contemplate the implementation, from the first moment of the institution's operation in the restricted operation phase, of security mechanisms capable of ensuring that APIs and other systems used are accessed only by legitimate client software of the participant, thereby preventing man-in-the-middle attacks? (Yes/No)
V (d)	Does the proposed solution contemplate the implementation, from the first moment of the institution's operation in the restricted operation phase, of security mechanisms capable of ensuring that client software communicates only with desired APIs and systems, thereby preventing man-in-the-middle attacks and manipulation of its communication? (Yes/No)
V (e)	Does the proposed solution contemplate the implementation, from the first moment of the institution's operation in the restricted operation phase, of security mechanisms that prevent reverse engineering, decompilation, code manipulation, modification of credentials or security parameters, among other techniques that result in the adulteration of client applications or software? (Yes/No)
V (f)	Does the proposed solution contemplate the implementation of security of APIs and other systems related to Pix predominantly on the server side, from the first moment of the institution's operation in the restricted operation phase, so as to avoid that security is restricted only to client software or application? (Yes/No)
V (g)	Does the proposed solution contemplate the provision, from the first moment of the institution's operation in the restricted operation phase, only of the information strictly necessary for the correct functioning of applications? (Yes/No)
V (h)	Does the proposed solution contemplate the implementation of controls, from the first moment of the institution's operation in the restricted operation phase, to ensure that information such as full CPF (unmasked), agency and account data of recipients of Pix payments, as well as information for security purposes linked to Pix keys, are for exclusive use of the participant's internal systems and are not exposed to its applications and client software? (Yes/No)
V (i)	Does the proposed solution contemplate the treatment and masking of data obtained in Pix key and QR Code transaction queries directly in the system or API, instead of using filters in client software, from the first moment of the institution's operation in the restricted operation phase? (Yes/No)
V (j)	Does the proposed solution contemplate the implementation on its website, from the first moment of the institution's operation in the restricted operation phase, of mechanisms to prevent the use of robots and automation of key and Pix transaction queries? (Yes/No/Website will not be used for Pix initiation)
VI	Audit Logs
	Section 7 of the Pix Security Manual sets forth the audit logs that must be maintained by all Pix participants.
VI (a)	Does the proposed solution consider the observation, from the first moment of the institution's operation in the restricted operation phase, of the requirements set forth in Section 7 of the Pix Security Manual? (Yes/No)
VII	Mechanisms for Prevention of Reading Attacks
	Section V of Chapter XIII of the Regulation Annex to Resolution BCB No. 1 (Pix Regulation), of August 12, 2020, and Section 13 of the DICT Operational Manual set forth mechanisms for prevention of reading attacks.
VII (a)	Does the proposed solution contemplate the implementation of mechanisms for prevention of reading attacks to the institution's internal Pix key database from the first moment of the institution's operation in the restricted operation phase? (Yes/No)
VII (b)	Are the planned mechanisms for prevention of reading attacks to the institution's internal Pix key database, at minimum, equal to the mechanisms for prevention of reading attacks existing in the DICT and detailed in the DICT Operational Manual? (Yes/No)
VII (c)	Does the proposed solution contemplate the implementation of mechanisms for prevention of reading attacks to the DICT from the first moment of the institution's operation in the restricted operation phase? (Yes/No)
VII (d)	Are the planned mechanisms for prevention of reading attacks to the DICT, at minimum, equal to the mechanisms for prevention of reading attacks existing in the DICT and detailed in the DICT Operational Manual? (Yes/No)
VII (e)	Does the proposed solution contemplate the implementation, from the first moment of the institution's operation in the restricted operation phase, of a mechanism for verification of the authenticity of the user requesting the query? (Yes/No)
VII (f)	Does the proposed solution contemplate the implementation, from the first moment of the institution's operation in the restricted operation phase, of an internal policy mechanism for limiting queries? (Yes/No)
VII (g)	Does the proposed solution contemplate the implementation, from the first moment of the institution's operation in the restricted operation phase, of mechanisms for identification and treatment of cases of excessive queries of Pix keys that do not result in the sending of a payment order? (Yes/No)
VII (h)	Does the proposed solution contemplate the implementation, from the first moment of the institution's operation in the restricted operation phase, of mechanisms for identification and treatment of cases of excessive queries of keys not registered in the DICT? (Yes/No)
VII (i)	Will the institution establish, from the first moment of the institution's operation in the restricted operation phase, an action plan for the treatment of suspected reading attack cases? (Yes/No)

We declare that we are aware that:

(i) the Central Bank of Brazil reserves the right to request additional information and documents at any time; and

(ii) adhesion and subsequent participation in Pix implies acceptance of the rules, conditions, and procedures established in the Pix Regulation.

---

Name

(responsible director for cybersecurity policy)

Annex I-D

• Adhesion form for institutions, not authorized to operate by the Central Bank of Brazil, that intend to participate in Pix; and
• Registration update form for institutions, not authorized to operate by the Central Bank of Brazil, already participants in Pix.

I	Reason for submission	( ) ( ) ( )	Adhesion request Update of participant's registration in operation, as set forth in art. 88 Update of institution's registration in adhesion to Pix, as set forth in art. 88
II	If the reason for submitting the form is a registration update, indicate next to it the item(s) to be changed. If it is an adhesion request, do not check and skip to item III	( ) ( ) ( )	IV – Corporate name V – Trade name VI – Responsible participant
III	CNPJ Registration Number
IV	Corporate name
V	Trade name
VI	ISPB Code of the responsible participant
VII	Number of active prepaid payment accounts for clients at the time of the adhesion or update request1
VIII	Identification of the director responsible for attending to demands from the Central Bank of Brazil related to issues concerning Pix2	Name: CPF:
IX	Institution’s phone number for matters related to Pix3 (Obs1: Provide at least one phone number) (Obs2: At least one of the provided phone numbers must be shareable with other Pix participants) (Obs3: Customer service center phone numbers or similar will not be accepted)
IX (a)	Phone 1: Name4:	( )	authorizes sharing with other Pix participants
IX (b)	Phone 2: Name4:	( )	authorizes sharing with other Pix participants
IX (c)	Phone 3: Name4:	( )	authorizes sharing with other Pix participants
...	...	...
X	Electronic address (e-mail) of the institution for matters related to Pix5 (Obs1: Provide at least one e-mail) (Obs2: Provide at least one e-mail corresponding to a corporate mailbox accessible by more than one user) (Obs3: At least one of the provided e-mails must be shareable with other Pix participants) (Obs4: E-mails from customer service centers or similar will not be accepted)
X (a)	E-mail 1: Name6:	( ) ( )	authorizes sharing with other Pix participants corporate mailbox accessible by more than one user
X (b)	E-mail 2: Name6:	( ) ( )	authorizes sharing with other Pix participants corporate mailbox accessible by more than one user
X (c)	E-mail 3: Name6:	( ) ( )	authorizes sharing with other Pix participants corporate mailbox accessible by more than one user
...	....	....

1 The submission of a registration update form is waived in cases where the change consists exclusively of the amount of active transactional accounts, as set forth in art. 88, caput and § 2º.

2 For purposes of registration update, changes to data related to the director responsible for issues regarding participation in Pix must be carried out directly in Unicad, by the participating institution or the institution in the process of adhesion to Pix that already possesses a Sisbacen code, as set forth in art. 89.

3 For purposes of registration update, changes to contacts for matters related to Pix must be requested via e-mail sent to the corporate mailbox pix-operacional@bcb.gov.br from a previously informed and registered contact for this same purpose, as set forth in art. 91.

4 Fill in with the name of the person responsible for the indicated phone number. If it is not a specific person, fill the “Name” field with the term “Institutional”. If the institution wishes to provide more than three phone numbers, the insertion of additional lines, designated “X (d)”, “X (e)” and so on, is exceptionally permitted.

5~~~~For purposes of registration update, changes to contacts for matters related to Pix must be requested via e-mail sent to the corporate mailbox pix-operacional@bcb.gov.br from a previously informed and registered contact for this same purpose, as set forth in art. 91.

6 Fill in with the name of the person responsible for the indicated e-mail. If it is not a specific person, fill the “Name” field with the term “Institutional”. If the institution wishes to provide more than three e-mails, the insertion of additional lines, designated “XI (d)”, “XI (e)” and so on, is exceptionally permitted.

We declare that we are aware that:

(i) the Central Bank of Brazil reserves the right to request complementary information and documents at any time; and

(ii) adhesion and subsequent participation in Pix implies acceptance of the rules, conditions, and procedures established in the Pix Regulation.

______________________________________________________

Name and Position

Anexo I-D

(Annex I-D with wording given, from 1/1/2025, by Instruction Normative BCB No. 581, of 12/30/2024.)

Registration update form for institutions, not authorized to operate by the Central Bank of Brazil, in the process of adhesion or already participants in Pix.

I	Reason for submission	( ) ( )	Update of participant's registration in operation, as set forth in art. 88 Update of institution's registration in adhesion to Pix, as set forth in art. 88
II	If the reason for submitting the form is a registration update, indicate next to it the item(s) to be changed. If it is an adhesion request, do not check and skip to item III	( ) ( ) ( )	IV - Corporate name V - Trade name VI - Responsible participant
III	CNPJ Registration Number
IV	Corporate name
V	Trade name
VI	ISPB Code of the responsible participant
VII	Number of active prepaid payment accounts for clients at the time of the adhesion or update request1
VIII	Identification of the director responsible for attending to demands from the Central Bank of Brazil related to issues concerning Pix2	Name: CPF:
IX	Institution’s phone number for matters related to Pix3 (Obs1: Provide at least one phone number) (Obs2: At least one of the provided phone numbers must be shareable with other Pix participants) (Obs3: Customer service center phone numbers or similar will not be accepted)
IX (a)	Phone 1: Name4:	( )	authorizes sharing with other Pix participants
IX (b)	Phone 2: Name4:	( )	authorizes sharing with other Pix participants
IX (c)	Phone 3: Name4:	( )	authorizes sharing with other Pix participants
...	...	...
X	Electronic address (e-mail) of the institution for matters related to Pix5 (Obs1: Provide at least one e-mail) (Obs2: Provide at least one e-mail corresponding to a corporate mailbox accessible by more than one user) (Obs3: At least one of the provided e-mails must be shareable with other Pix participants) (Obs4: E-mails from customer service centers or similar will not be accepted)
X (a)	E-mail 1: Name6:	( ) ( )	authorizes sharing with other Pix participants corporate mailbox accessible by more than one user
X (b)	E-mail 2: Name6:	( ) ( )	authorizes sharing with other Pix participants corporate mailbox accessible by more than one user
X (c)	E-mail 3: Name6:	( ) ( )	authorizes sharing with other Pix participants corporate mailbox accessible by more than one user
...	....	....

1 The submission of a registration update form is waived in cases where the change consists exclusively of the amount of active transactional accounts, as set forth in art. 88*, caput* and § 2º.

2 For purposes of registration update, changes to data related to the director responsible for issues regarding participation in Pix must be carried out directly in Unicad, by the participating institution or the institution in the process of adhesion to Pix that already possesses a Sisbacen code, as set forth in art. 89.

3 For purposes of registration update, changes to contacts for matters related to Pix must be requested via e-mail sent to the corporate mailbox pix-operacional@bcb.gov.br from a previously informed and registered contact for this same purpose, as set forth in art. 91.

4 Fill in with the name of the person responsible for the indicated phone number. If it is not a specific person, fill the “Name” field with the term “Institutional”. If the institution wishes to provide more than three phone numbers, the insertion of additional lines, designated “X (d)”, “X (e)” and so on, is exceptionally permitted.

5 For purposes of registration update, changes to contacts for matters related to Pix must be requested via e-mail sent to the corporate mailbox pix-operacional@bcb.gov.br from a previously informed and registered contact for this same purpose, as set forth in art. 91.

6 Fill in with the name of the person responsible for the indicated e-mail. If it is not a specific person, fill the “Name” field with the term “Institutional”. If the institution wishes to provide more than three e-mails, the insertion of additional lines, designated “XI (d)”, “XI (e)” and so on, is exceptionally permitted.

We declare that we are aware that:

(i) the Central Bank of Brazil reserves the right to request complementary information and documents at any time; and

(ii) adhesion and subsequent participation in Pix implies acceptance of the rules, conditions, and procedures established in the Pix Regulation.

---

Name and Position

Anexo I-E

·~~~~Form of intent to offer products and services to be offered by institutions, not authorized to operate by the Central Bank of Brazil, that intend to participate in Pix; and

· Form for updating the intent to offer products and services by institutions, not authorized to operate by the Central Bank of Brazil, already participants in Pix.

I	Reason for submission	( ) ( ) ( )	Adhesion request Update of products and services offered by Pix participant in operation, as set forth in art. 88 Update of products and services to be offered by institution in adhesion to Pix, as set forth in art. 88
II	CNPJ Registration Number
III	Corporate Name
IV	Offers or will offer transactional accounts to end users:	( ) ( )	legal entities natural persons
V	Offers or will offer Pix API1	( ) ( )	Yes No
VI	Mandatory products and services offered to natural persons (editing or selection is prohibited)		· Scheduled Pix; · Pix Key; · Static QR Code Reading; · Dynamic QR Code Reading; and · Pix Collection for immediate payments - generation of static QR Code · Automatic Pix - Payment
VII	Optional products and services offered to natural persons	( ) ( )	Pix Collection for immediate payments - generation of dynamic QR Code Pix Collection for payments with due date - generation of dynamic QR Code
VIII	Mandatory products and services offered to legal entities (editing or selection is prohibited)		· Scheduled Pix · Automatic Pix – Payment
VIII (a)	If offering or intending to offer transactional accounts to end-user legal entities, do you request exemption from offering “Automatic Pix – Payment” for this audience?	( ) ( )	Yes No
IX	Mandatory products and services offered to legal entities by participants that offer Pix API (editing or selection is prohibited)		· Pix Collection for immediate payments - generation of dynamic QR Code · Pix Withdrawal - generation of dynamic QR Code; and · Pix Change - generation of dynamic QR Code
X	Optional products and services offered to legal entities	( ) ( ) ( ) ( ) ( ) ( )	Pix Key2 Static QR Code Reading2 Dynamic QR Code Reading2 Generation of Static QR Code of Pix Collection for immediate payments and Generation of Static QR Code of Pix Withdrawal3 Pix Collection for payments with due date - generation of dynamic QR Code Automatic Pix – Receipt

1 The generation of any type of Dynamic QR Code, when offered to legal entity users in an automated manner, must only be carried out through the Pix API.

2 The institution that makes transactional accounts available to legal entity users must make available, at minimum, one of the three modalities for carrying out a Pix (Pix Key, Static QR Code Reading, Dynamic QR Code Reading).

3 If opting to offer the generation of Static QR Code to legal entities, the participant is obliged to offer, through this initiation method, both the functionalities related to the Pix Collection for immediate payments product, as well as the functionalities related to Pix Withdrawal.

Anexo I-E

(Annex I-E with wording given, from 1/1/2025, by Instruction Normative BCB No. 581, of 12/30/2024.)

Form for updating the intent to offer products and services by institutions, not authorized to operate by the Central Bank of Brazil, in the process of adhesion or already participants in Pix.

I	Reason for submission	( ) ( )	Update of products and services offered by Pix participant in operation, as set forth in art. 88 Update of products and services to be offered by institution in adhesion to Pix, as set forth in art. 88
II	CNPJ Registration Number
III	Corporate Name
IV	Offers or will offer transactional accounts to end users:	( ) ( )	legal entities natural persons
V	Offers or will offer Pix API1	( ) ( )	Yes No
VI	Mandatory products and services offered to natural persons (editing or selection is prohibited)		• Scheduled Pix; • Pix Key; • Static QR Code Reading; • Dynamic QR Code Reading; and • Pix Collection for immediate payments - generation of static QR Code • Automatic Pix - Payment
VII	Optional products and services offered to natural persons	( ) ( )	Pix Collection for immediate payments - generation of dynamic QR Code Pix Collection for payments with due date - generation of dynamic QR Code
VIII	Mandatory products and services offered to legal entities (editing or selection is prohibited)		• Scheduled Pix
VIII (a)	If offering or intending to offer transactional accounts to end-user legal entities, do you request exemption from offering “Automatic Pix – Payment” for this audience?	( ) ( )	Yes No
IX	Mandatory products and services offered to legal entities by participants that offer Pix API (editing or selection is prohibited)		• Pix Collection for immediate payments - generation of dynamic QR Code • Pix Withdrawal - generation of dynamic QR Code; and • Pix Change - generation of dynamic QR Code
X	Optional products and services offered to legal entities	( ) ( ) ( ) ( ) ( ) ( )	Pix Key2 Static QR Code Reading2 Dynamic QR Code Reading2 Generation of Static QR Code of Pix Collection for immediate payments and Generation of Static QR Code of Pix Withdrawal3 Pix Collection for payments with due date - generation of dynamic QR Code Automatic Pix – Receipt

1 The generation of any type of Dynamic QR Code, when offered to legal entity users in an automated manner, must only be carried out through the Pix API.

2 The institution that makes transactional accounts available to legal entity users must make available, at minimum, one of the three modalities for carrying out a Pix (Pix Key, Static QR Code Reading, Dynamic QR Code Reading).

3 If opting to offer the generation of Static QR Code to legal entities, the participant is obliged to offer, through this initiation method, both the functionalities related to the Pix Collection for immediate payments product, as well as the functionalities related to Pix Withdrawal.

Anexo I-F

Security self-assessment questionnaire – institutions, authorized or not to operate by the Central Bank of Brazil, that intend to act in the transational account provider modality, access the DICT indirectly and be an indirect participant of the SPI.

The questionnaire addresses security aspects related to Pix.

Observance of these aspects is mandatory for all participants. Thus, non-compliance with all these aspects, as well as the ineffective implementation of the security mechanisms provided for, from the beginning of the restricted operation stage, subjects the applicant to the denial of the adhesion request.

The participant must store evidence supporting their adherence to the aspects listed in this questionnaire upon sending it to the Central Bank of Brazil. These evidences may be requested by the Central Bank of Brazil and may include, at the participant's discretion, diagrams, topologies, flowcharts, screenshots, queries with respective returns or other documents deemed pertinent.

It is important to note that the eventual provision to the Central Bank of Brazil of incorrect documents, data or information or inconsistent with the deadlines and conditions established in legal or regulatory norms constitutes an offense punishable under current legislation.

CNPJ Registration Number
Corporate name

---

I	Security of Dynamic QR Codes
	Section 4 of the Pix Security Manual sets forth the security specifications for dynamic QR Codes generated by the payee.
I (a)	Does the proposed solution consider, from the first moment of the institution's operation in the restricted operation phase, the requirements set forth in items 4.1 and 4.2 of the Pix Security Manual? (Yes/No/Dynamic QR Code generation will not be offered)
I (b)	Does the proposed solution consider, from the first moment of the institution's operation in the restricted operation phase, the requirements set forth in item 4.3 of the Pix Security Manual? (Yes/No/Dynamic QR Code generation and reading will not be offered)
II	Secure Implementation of Applications, APIs, and Other Systems
	Section 6 of the Pix Security Manual sets forth mandatory security aspects in the implementation of systems related to Pix.
II (a)	Does the proposed solution contemplate, from the first moment of the institution's operation in the restricted operation phase, the use of encryption mechanisms in communication between systems and APIs related to Pix and their respective client applications or software? (Yes/No)
II (b)	Does the proposed solution contemplate, from the first moment of the institution's operation in the restricted operation phase, the implementation of strong authentication mechanisms for client software in the APIs and systems related to Pix? (Yes/No)
II (c)	Does the proposed solution contemplate, from the first moment of the institution's operation in the restricted operation phase, the implementation of security mechanisms capable of ensuring that the APIs and other systems used are accessed only by the legitimate client software of the participant, thereby preventing man-in-the-middle attacks? (Yes/No)
II (d)	Does the proposed solution contemplate, from the first moment of the institution's operation in the restricted operation phase, the implementation of security mechanisms capable of ensuring that the client software communicates only with desired APIs and systems, thereby preventing man-in-the-middle attacks and manipulation of its communication? (Yes/No)
II (e)	Does the proposed solution contemplate, from the first moment of the institution's operation in the restricted operation phase, the implementation of security mechanisms that prevent reverse engineering, decompilation, code manipulation, modification of credentials or security parameters, among other techniques that result in the adulteration of client applications or software? (Yes/No)
II (f)	Does the proposed solution contemplate, from the first moment of the institution's operation in the restricted operation phase, the implementation of the security of the APIs and other systems related to Pix predominantly on the server side, so as to avoid that security is restricted only to the client software or application? (Yes/No)
II (g)	Does the proposed solution contemplate, from the first moment of the institution's operation in the restricted operation phase, the provision of only the information strictly necessary for the correct functioning of the applications? (Yes/No)
II (h)	Does the proposed solution contemplate, from the first moment of the institution's operation in the restricted operation phase, the implementation of controls to ensure that information such as full CPF (unmasked), agency and account data of payees of payments via Pix, as well as information for security purposes linked to Pix keys, are exclusively used by the participant's internal systems and are not exposed to its applications and client software? (Yes/No)
II (i)	Does the proposed solution contemplate, from the first moment of the institution's operation in the restricted operation phase, the processing and masking of data obtained in the consultation of Pix keys and transactions using QR Code directly in the system or API, instead of the use of filters in the client software? (Yes/No)
II (j)	Does the proposed solution contemplate, from the first moment of the institution's operation in the restricted operation phase, the implementation on its website of mechanisms to prevent the use of robots and automation of Pix key and transaction queries? (Yes/No/There will be no use of the site to initiate a Pix)
III	Audit Logs
	Section 7 of the Pix Security Manual sets forth the audit logs that must be maintained by all Pix participants.
III (a)	Does the proposed solution consider, from the first moment of the institution's operation in the restricted operation phase, the requirements set forth in section 7 of the Pix Security Manual? (Yes/No)
IV	Mechanisms for Prevention of Reading Attacks
	Section V of Chapter XIII of the Regulation Annex to BCB Resolution No. 1 (Pix Regulation), of August 12, 2020, and Section 13 of the DICT Operational Manual set forth mechanisms for prevention of reading attacks.
IV (a)	Does the proposed solution contemplate, from the first moment of the institution's operation in the restricted operation phase, the implementation of mechanisms to prevent reading attacks on the institution's internal Pix key database? (Yes/No)
IV (b)	Are the planned mechanisms for prevention of reading attacks on the institution's internal Pix key database, at a minimum, equal to the mechanisms for prevention of reading attacks existing in the DICT and detailed in the DICT Operational Manual? (Yes/No)
IV (c)	Does the proposed solution contemplate, from the first moment of the institution's operation in the restricted operation phase, the implementation of mechanisms to prevent reading attacks on the DICT? (Yes/No)
IV (d)	Are the planned mechanisms for prevention of reading attacks on the DICT, at a minimum, equal to the mechanisms for prevention of reading attacks existing in the DICT and detailed in the DICT Operational Manual? (Yes/No)
IV (e)	Does the proposed solution contemplate, from the first moment of the institution's operation in the restricted operation phase, the implementation of a mechanism for verification of the authenticity of the user requesting the query? (Yes/No)
IV (f)	Does the proposed solution contemplate, from the first moment of the institution's operation in the restricted operation phase, the implementation of an internal policy mechanism for limiting queries? (Yes/No)
IV (g)	Does the proposed solution contemplate, from the first moment of the institution's operation in the restricted operation phase, the implementation of mechanisms for identification and treatment of cases of excessive queries of Pix keys that do not result in the sending of a payment order? (Yes/No)
IV (h)	Does the proposed solution contemplate, from the first moment of the institution's operation in the restricted operation phase, the implementation of mechanisms for identification and treatment of cases of excessive queries of keys not registered in the DICT? (Yes/No)
IV (i)	Will the institution establish, from the first moment of the institution's operation in the restricted operation phase, an action plan for the treatment of cases suspected of reading attacks? (Yes/No)

We declare that we are aware that:

(i) the Central Bank of Brazil reserves the right to request additional information and documents at any time; and

(ii) adherence and subsequent participation in Pix implies acceptance of the rules, conditions, and procedures established in the Pix Regulation.

---

Name

(Manager responsible for cybersecurity policy)

Annex I-G

(Annex I-G included, effective from 1/1/2025, by Instruction Normative BCB No. 581, of December 30, 2024.)

Pix Automatic Schedule Form – All institutions that opted for the offer of the "Pix Automatic – Receipt" product

I	CNPJ Registration
II	Corporate Name
III	Schedules offered for the Pix Automatic – Receipt product1	( ) ( ) ( ) ( ) ( )	Schedule 1 (Article 11-Q, § 1º, a) Schedule 2 (Article 11-Q, § 1º, b) Schedule 3 (Article 11-Q, § 1º, c) Schedule 4 – Static QR (Article 11-Q, § 1º, d) Schedule 4 – Dynamic QR (Article 11-Q, § 1º, d)

1 In accordance with Article 11-Q of the regulation annexed to BCB Resolution No. 1, of August 12, 2020.

Annex II - Documents for institutions that participate or intend to
participate in Pix exclusively in the special liquidating modality

Annex II-A

• Adhesion form for institutions, authorized
  to operate by the Central Bank of Brazil, that intend to participate in Pix exclusively in the special liquidating modality; and

• Update form for institutions, authorized
  to operate by the Central Bank of Brazil, already participants in Pix in the modality special liquidating

I	Reason for presentation	( ) ( ) ( )	Adhesion Request Update of participant's registration in operation, as set forth in art. 88 Update of institution's registration in adhesion to Pix, as set forth in art. 88
II	If the reason for presenting the form is an update, indicate next to it the item(s) to be changed. If it is an adhesion request, do not mark and skip to item III	( ) ( ) ( ) ( )	V – Change in access method to RSFN. VII1 – Amount and types of accounts offered VIII – Offer of the payment transaction initiation service within the scope of Open Finance, acting as a payment transaction initiator IX – Payment transaction initiation methods
III	CNPJ Registration
IV	Corporate Name2
V	Connection method to RSFN (direct or via PSTI).	( ) ( )	Direct Via the following PSTI: Name of PSTI: _____________ CNPJ of PSTI: ______________
VI	Offer or will offer transactional accounts:	( ) ( )	Yes No
VII	If transactional accounts are already offered, inform in the sub-items below, the number of active client accounts at the time of the adhesion request or update, in the following modalities:
VII (a)	Demand deposit accounts
VII (b)	Savings deposit accounts
VII (c)	Prepaid payment accounts
VIII	Offer or will offer payment transaction initiation service within the scope of Open Finance, acting as a payment transaction initiator?	( ) ( )	Yes. In this case, select the initiation methods in item IX No
IX	If the answer to item VIII is "yes", inform optional products offered through payment transaction initiation service by Open Finance participants3	( ) ( ) ( ) ( ) ( )	Pix Initiation - Manual insertion of payee's transactional account data Pix Initiation - Pix Key Pix Initiation – INIC8 Pix Initiation - QR Code reading Scheduled Pix
X	If the answer to item VIII is yes (editing or selection prohibited), inform offer or not of Pix Automatic	( )	Pix Automatic - Payment
XI	Identification of director responsible for responding to Central Bank of Brazil demands related to issues concerning Pix4	Name: CPF:
XII	Institution's phone number for Pix-related matters5 (Obs1: Inform at least one phone number) (Obs2: At least one of the phone numbers provided must be shareable with other Pix participants) (Obs3: Call center or similar phone numbers will not be accepted)
XII (a)	Phone 1: Name6:	( )	authorizes sharing with other Pix participants
XII (b)	Phone 2: Name6:	( )	authorizes sharing with other Pix participants
XII (c)	Phone 3: Name6:	( )	authorizes sharing with other Pix participants
...	...	...
XIII	Institution's electronic address (e-mail) for Pix-related matters7 (Obs1: Inform at least one e-mail) (Obs2: Inform at least one e-mail corresponding to a corporate mailbox accessible to more than one user) (Obs3: At least one of the e-mails provided must be shareable with other Pix participants) (Obs4: E-mails for consumer service or similar will not be accepted)
XIII (a)	E-mail 1: Name8:	( ) ( )	authorizes sharing with other Pix participants corporate mailbox accessible to more than one user
XIII (b)	E-mail 2: Name8:	( ) ( )	authorizes sharing with other Pix participants corporate mailbox accessible to more than one user
XIII (c)	E-mail 3: Name8:	( ) ( )	authorizes sharing with other Pix participants corporate mailbox accessible to more than one user
...	....	....
XIV	If participating or intending to participate directly in SPI, identification of director responsible for responding to Central Bank of Brazil demands related to issues concerning SPI9	Name: CPF:
XV	If participating or intending to participate directly in SPI, institution's phone number for SPI-related matters9
XVI	If participating or intending to participate directly in SPI, institution's electronic address (e-mail) for SPI-related matters9

1 The submission of an update form is waived in cases where the change consists exclusively in the amount and modalities of active transactional accounts, except if the volume reached characterizes or decharacterizes mandatory participation in Pix, as set forth in art. 88, caput and § 2º.

2 The update regarding the change of corporate name of institutions authorized to operate by the Central Bank of Brazil will observe the provisions contained in specific regulation, as set forth in art. 92.

3 The provision of payment transaction initiation service is optional for special liquidating participants and available only upon prior authorization for the exercise of the activity, granted by the Central Bank of Brazil, except for cases of waiver provided for in specific regulation. If opting for the offer of this service, it must indicate, at least, one of the Pix initiation modalities.

4 For the purpose of updating registration, the change of data related to the director responsible for issues related to participation in Pix must be carried out, directly in Unicad, by the participating institution or in the process of adhesion to Pix that already has a Sisbacen code, as set forth in art. 89.

5For the purpose of updating registration, the change of contacts for matters related to Pix must be requested by means of an e-mail sent to the corporate mailbox pix-operacional@bcb.gov.br from a previously informed and registered contact for this same purpose, as set forth in art. 91.

6 Fill in with the name of the person responsible for the indicated phone. If it is not someone specific, fill in the "Name" field with the term "Institutional". If the institution wishes to inform more than three phone numbers, it is exceptionally permitted to insert more lines, named "XII (d)", "XII (e)" and so on.

7 For the purpose of updating registration, the change of contacts for matters related to Pix must be requested by means of an e-mail sent to the corporate mailbox pix-operacional@bcb.gov.br from a previously informed and registered contact for this same purpose, as set forth in art. 91.

8 Fill in with the name of the person responsible for the indicated e-mail. If it is not someone specific, fill in the "Name" field with the term "Institutional". If the institution wishes to inform more than three e-mails, it is exceptionally permitted to insert more lines, named "XIII (d)", "XIII (e)" and so on.

9 For the purpose of updating registration, the change of data related to the director responsible for SPI and PI Account must be carried out as set forth in specific SPI regulation, as determined in art. 90.

We declare that we are aware that:

(i) the Central Bank of Brazil reserves the right to request additional information and documents at any time; and

(ii) adherence and subsequent participation in Pix implies acceptance of the rules, conditions, and procedures established in the Pix Regulation.

---

Name and Position

Annex II-B

Security self-assessment questionnaire - institutions authorized to operate by the Central Bank of Brazil that intend to act exclusively in the modality special liquidating

The questionnaire covers security aspects related to Pix.

Observance of these aspects is mandatory for all participants.
Thus, non-compliance with all these aspects, as well as the non-implementation effective of the security mechanisms provided for, from the beginning of the stage of restricted operation, subjects the applicant to the denial of the adhesion request.

The participant must store evidence that supports its adherence to the aspects listed in this questionnaire upon submission to the Central Bank of Brazil. These evidence may be requested by the Central Bank of Brazil and may include, at the participant's discretion, diagrams, topologies, flowcharts, screenshots, queries with respective returns or other documents deemed pertinent.

It is worth noting that the eventual provision, to the Central Bank of Brazil, of incorrect documents, data or information or out of compliance with the deadlines and conditions established in legal or regulatory norms constitutes an offense punishable under the terms of the current legislation.

CNPJ Registration
Corporate Name

---

I	Secure Communication
	Section 2 of the Pix Security Manual sets out rules for secure communication
I (a)	Does the proposed solution consider compliance, from the first moment of the institution's full operation, with the requirements set out in Section 2 of the Pix Security Manual? (Yes/No)
II	Digital Signature
	Section 3 of the Pix Security Manual sets out rules for the digital signature of messages transmitted in the SPI and DICT.
II (a)	Does the proposed solution consider compliance, from the first moment of the institution's full operation, with the requirements set out in Section 3 of the Pix Security Manual? (Yes/No)
III	Digital Certificates
	Section 5 of the Pix Security Manual sets out the types of certificates to be used within the scope of Pix, as well as the processes for activation, deactivation, and revocation verification of these certificates.
III (a)	Does the proposed solution consider compliance, from the first moment of the institution's full operation, with the requirements set out in Section 5 of the Pix Security Manual? (Yes/No)
IV	Secure Implementation of Applications, APIs, and Other Systems
	Section 6 of the Pix Security Manual sets out mandatory security aspects in the implementation of systems related to Pix.
IV (a)	Does the proposed solution contemplate the use, from the first moment of the institution's full operation, of encryption mechanisms in communication between systems and APIs related to Pix and their respective client applications or software? (Yes/No)
IV (b)	Does the proposed solution contemplate the implementation, from the first moment of the institution's full operation, of strong authentication mechanisms for client software in the APIs and systems related to Pix? (Yes/No)
IV (c)	Does the proposed solution contemplate the implementation, from the first moment of the institution's full operation, of security mechanisms capable of guaranteeing that the APIs and other systems used are accessed only by legitimate client software of the participant, thereby preventing man-in-the-middle attacks? (Yes/No)
IV (d)	Does the proposed solution contemplate the implementation, from the first moment of the institution's full operation, of security mechanisms capable of guaranteeing that the client software communicates only with desired APIs and systems, thereby preventing man-in-the-middle attacks and manipulation of its communication? (Yes/No)
IV (e)	Does the proposed solution contemplate the implementation, from the first moment of the institution's full operation, of security mechanisms that prevent reverse engineering, decompilation, code manipulation, modification of credentials or security parameters, among other techniques that result in the adulteration of client applications or software? (Yes/No)
IV (f)	Does the proposed solution contemplate the implementation of the security of the APIs and other systems related to Pix primarily on the server side, from the first moment of the institution's full operation, so as to avoid that security is restricted only to the client software or application? (Yes/No)
IV (g)	Does the proposed solution contemplate the provision, from the first moment of the institution's full operation, only of the information strictly necessary for the correct functioning of the applications? (Yes/No)
V	Audit Logs
	Section 7 of the Pix Security Manual sets out the audit logs that must be maintained by all Pix participants.
V (a)	Does the proposed solution consider compliance, from the first moment of the institution's full operation, with the requirements set out in Section 7 of the Pix Security Manual? (Yes/No)
VI	Mechanisms for Prevention of Reading Attacks
	Section V of Chapter XIII of the Regulation Annex to BCB Resolution No. 1 (Pix Regulation), of August 12, 2020, and Section 13 of the DICT Operational Manual set out rules on mechanisms for prevention of reading attacks.
VI (a)	Does the proposed solution contemplate the implementation of mechanisms for prevention of reading attacks to the institution's internal Pix key database from the first moment of the institution's full operation? (Yes/No)
VI (b)	Are the planned mechanisms for prevention of reading attacks to the institution's internal Pix key database, at a minimum, equal to the mechanisms for prevention of reading attacks existing in the DICT and detailed in the DICT Operational Manual? (Yes/No)
VI (c)	Does the proposed solution contemplate the implementation of mechanisms for prevention of reading attacks to the DICT from the first moment of the institution's full operation? (Yes/No)
VI (d)	Are the planned mechanisms for prevention of reading attacks to the DICT, at a minimum, equal to the mechanisms for prevention of reading attacks existing in the DICT and detailed in the DICT Operational Manual? (Yes/No)
VII (e)	Does the proposed solution contemplate the implementation, from the first moment of the institution's full operation, of an internal policy mechanism for limiting queries? (Yes/No)
VII (f)	Does the proposed solution contemplate the implementation, from the first moment of the institution's full operation, of mechanisms for identifying and treating cases of excessive queries of Pix keys that do not result in the sending of a payment order? (Yes/No)
VII (g)	Does the proposed solution contemplate the implementation, from the first moment of the institution's full operation, of mechanisms for identifying and treating cases of excessive queries of keys not registered in the DICT? (Yes/No)
VII (h)	Will the institution establish, from the first moment of the institution's full operation, an action plan for treating cases suspected of reading attacks? (Yes/No)

We declare that we are aware that:

i) the Central Bank of Brazil reserves the right to request additional information and documents at any time; and

(ii) adhesion and subsequent participation in Pix implies acceptance of the rules, conditions, and procedures established in the Pix Regulation.

---

Name

(Responsible Director for cybersecurity policy)

Annex III - Documents for institutions that participate or intend to participate in Pix exclusively in the initiator modality

Annex III-A

• Adhesion form for institutions, authorized to operate by the Central Bank of Brazil, that intend to participate in Pix exclusively in the initiator modality; and

• Registration update form for institutions, authorized to operate by the Central Bank of Brazil, already participants in Pix in the initiator modality.

I	Reason for submission	( ) ( ) ( )	Adhesion Request Update of registration of Pix participant in operation, as set out in art. 88 Update of registration of institution in adhesion to Pix, as set out in art. 88
II	If the reason for submitting the form is a registration update, indicate next to it the item(s) to be changed. If it is an adhesion request, do not mark and skip to item III	( ) ( )	V – Change in access method to DICT. VI – Change of direct participant providing services in DICT
III	CNPJ Registration
IV	Corporate Name1
V	Type of access to DICT	( ) ( ) ( )	direct indirect. Fill in item VI. does not access
VI	ISPB Code of the direct participant with access to DICT that will provide services
VII	Identification of director responsible for responding to demands from the Central Bank of Brazil related to issues concerning Pix2	Name: CPF:
VIII	Initiator's phone number for matters related to Pix3 (Obs1: Inform at least one phone number) (Obs2: At least one of the phone numbers provided must be shareable with other Pix participants) (Obs3: Customer service center phone numbers or similar will not be accepted)
VIII (a)	Phone 1: Name4:	( )	authorizes sharing with other Pix participants
VIII (b)	Phone 2: Name4:	( )	authorizes sharing with other Pix participants
VIII (c)	Phone 3: Name4:	( )	authorizes sharing with other Pix participants
...	...	...
IX	Electronic address (e-mail) of the institution for matters related to Pix5 (Obs1: Inform at least one e-mail) (Obs2: Inform at least one e-mail corresponding to a corporate mailbox accessible to more than one user) (Obs3: At least one of the e-mails provided must be shareable with other Pix participants) (Obs4: E-mails for customer service or similar will not be accepted)
IX (a)	E-mail 1: Name6:	( ) ( )	authorizes sharing with other Pix participants corporate mailbox accessible to more than one user
IX (b)	E-mail 2: Name6:	( ) ( )	authorizes sharing with other Pix participants corporate mailbox accessible to more than one user
IX (c)	E-mail 3: Name6:	( ) ( )	authorizes sharing with other Pix participants corporate mailbox accessible to more than one user
...	....	....

1 The registration update regarding the change of corporate name of institutions authorized to operate by the Central Bank of Brazil will observe the provisions contained in specific regulation, as set out in art. 88.

2 For purposes of registration update, the change of data related to the director responsible for issues related to participation in Pix must be carried out, directly in Unicad, by the participating institution or in the process of adhesion to Pix that already has a Sisbacen code, as set out in art. 89.

3 For purposes of registration update, the change of contacts for matters related to Pix must be requested by means of an e-mail sent to the corporate mailbox pix-operacional@bcb.gov.br from a previously informed and registered contact for this same purpose, as set out in art. 91.

4 Fill in with the name of the person responsible for the indicated phone number. If it is not someone specific, fill in the "Name" field with the term "Institutional". If the institution wishes to inform more than three phone numbers, it is exceptionally permitted to insert more lines, named "VIII (d)", "VIII (e)" and so on.

5 For purposes of registration update, the change of contacts for matters related to Pix must be requested by means of an e-mail sent to the corporate mailbox pix-operacional@bcb.gov.br from a previously informed and registered contact for this same purpose, as set out in art. 91.

6 Fill in with the name of the person responsible for the indicated e-mail. If it is not someone specific, fill in the "Name" field with the term "Institutional". If the institution wishes to inform more than three e-mails, it is exceptionally permitted to insert more lines, named "IX (d)", "IX (e)" and so on.

We declare that we are aware that:

(i) the Central Bank of Brazil reserves the right to request additional information and documents at any time; and

(ii) adhesion and subsequent participation in Pix implies acceptance of the rules, conditions, and procedures established in the Pix Regulation.

         ________________________________________________________

Name and Position

Annex III-B

·~~~~Form for intention to offer products and services to be offered by institutions, authorized to operate by the Central Bank of Brazil, that intend to participate in Pix exclusively in the initiator modality; and

· Form for updating intention to offer products and services by institutions, authorized to operate by the Central Bank of Brazil, already participants in Pix in the initiator modality.

I	Reason for submission	( ) ( ) ( )	Adhesion Request Update of products and services, offered by Pix participants in operation, as set out in art. 88 Update of products and services to be offered by institution in adhesion to Pix, as set out in art. 88
II	CNPJ Registration
III	Corporate Name
IV	Optional products offered through initiation service1	( ) ( ) ( ) ( ) ( ) ( )	Pix Initiation – Manual insertion of receiver user's transactional account data Pix Initiation – Pix Key Pix Initiation – INIC2 Pix Initiation – QR Code reading Scheduled Pix Automatic Pix – Payment

1 The initiator must make available, at a minimum, one of the Pix initiation modalities.

2 Corresponds to cases where the initiator participant holds the receiver user's information.

Annex III-B

(Annex III-B with wording given, from 1/1/2025, by Instruction Normative BCB No. 581, of 12/30/2024.)

• Form for intention to offer products and services to be offered by institutions, authorized to operate by the Central Bank of Brazil, that intend to participate in Pix exclusively in the initiator modality; and

• Form for updating intention to offer products and services by institutions, authorized to operate by the Central Bank of Brazil, already participants in Pix in the initiator modality.

I	Reason for submission	( ) ( ) ( )	Adhesion Request Update of products and services, offered by Pix participants in operation, as set out in art. 88 Update of products and services to be offered by institution in adhesion to Pix, as set out in art. 88
II	CNPJ Registration
III	Corporate Name
IV	Optional products offered through initiation service1	( ) ( ) ( ) ( ) ( ) ( )	Pix Initiation – Manual insertion of receiver user's transactional account data Pix Initiation – Pix Key Pix Initiation – INIC2 Pix Initiation – QR Code reading Pix Initiation – Scheduled Pix Pix Initiation – Automatic Receiving3

1 The initiator must make available, at a minimum, one of the Pix initiation modalities.

2 Corresponds to cases where the initiator participant holds the receiver user's information.

3 As per article 11-Q of the regulation annexed to BCB Resolution No. 1, of August 12, 2020.

Annex III-C

Security self-assessment questionnaire - Institutions authorized to operate by the Central Bank of Brazil that intend to participate in Pix exclusively in the initiator modality and access the DICT directly

The questionnaire covers security aspects related to Pix.

Compliance with these aspects is mandatory for all participants. Thus, non-compliance with all of these aspects, as well as the non-effective implementation of the security mechanisms provided for, from the beginning of the restricted operation stage, subjects the applicant to the denial of the adhesion request.

The participant must store evidence supporting their adherence to the aspects listed in this questionnaire upon submission to the Central Bank of Brazil. These evidences may be requested by the Central Bank of Brazil and may include, at the participant's discretion, diagrams, topologies, flowcharts, screenshots, queries with respective returns, or other documents deemed pertinent.

It is worth noting that the eventual provision to the Central Bank of Brazil of incorrect documents, data, or information, or out of compliance with the deadlines and conditions established in legal or regulatory norms, constitutes an offense punishable under current legislation.

CNPJ Registration
Corporate Name

---

I	Secure Communication
	Section 2 of the Pix Security Manual sets forth rules for secure communication
I (a)	Does the proposed solution consider compliance, from the first moment the institution is in full operation, with the requirements set forth in Section 2 of the Pix Security Manual? (Yes/No)
II	Digital Signature
	Section 3 of the Pix Security Manual sets forth rules for the digital signature of messages transmitted in the SPI and DICT.
II (a)	Does the proposed solution consider compliance, from the first moment the institution is in full operation, with the requirements set forth in Section 3 of the Pix Security Manual? (Yes/No)
III	Security of Dynamic QR Codes
	Section 4 of the Pix Security Manual sets forth the security specifications for dynamic QR Codes generated by the payee.
III (a)	Does the proposed solution consider compliance, from the first moment the institution is in full operation, with the requirements set forth in item 4.3 of the Pix Security Manual? (Yes/No/Generation and reading of dynamic QR Codes will not be offered)
IV	Digital Certificates
	Section 5 of the Pix Security Manual sets forth the types of certificates to be used within the scope of Pix, as well as the processes for activation, deactivation, and verification of revocation of these certificates.
IV (a)	Does the proposed solution consider compliance, from the first moment the institution is in full operation, with the requirements set forth in Section 5 of the Pix Security Manual? (Yes/No)
V	Secure Implementation of Applications, APIs, and Other Systems
	Section 6 of the Pix Security Manual sets forth mandatory security aspects in the implementation of systems related to Pix.
V (a)	Does the proposed solution contemplate the use, from the first moment the institution is in full operation, of encryption mechanisms in communication between systems and APIs related to Pix and their respective applications or client software? (Yes/No)
V (b)	Does the proposed solution contemplate the implementation, from the first moment the institution is in full operation, of strong authentication mechanisms for client software on the APIs and systems related to Pix? (Yes/No)
V (c)	Does the proposed solution contemplate the implementation, from the first moment the institution is in full operation, of security mechanisms capable of ensuring that the APIs and other systems used are accessed only by the participant's legitimate client software, thereby preventing man-in-the-middle attacks? (Yes/No)
V (d)	Does the proposed solution contemplate the implementation, from the first moment the institution is in full operation, of security mechanisms capable of ensuring that the client software communicates only with desired APIs and systems, thereby preventing man-in-the-middle attacks and manipulation of its communication? (Yes/No)
V (e)	Does the proposed solution contemplate the implementation, from the first moment the institution is in full operation, of security mechanisms that prevent reverse engineering, decompilation, code manipulation, modification of credentials or security parameters, among other techniques that result in the adulteration of applications or client software? (Yes/No)
V (f)	Does the proposed solution contemplate the implementation of the security of the APIs and other systems related to Pix primarily on the server side, from the first moment the institution is in full operation, so as to avoid that security be restricted only to the client software or application? (Yes/No)
V (g)	Does the proposed solution contemplate the provision, from the first moment the institution is in full operation, of only the information strictly necessary for the correct functioning of the applications? (Yes/No)
V (h)	Does the proposed solution contemplate the implementation of controls, from the first moment the institution is in full operation, to ensure that information such as full CPF (unmasked), agency and account data of recipients of payments via Pix, as well as information for security purposes linked to Pix keys, are for the exclusive use of the participant's internal systems and are not exposed to its applications and client software? (Yes/No)
V (i)	Does the proposed solution contemplate the treatment and masking of data obtained in the consultation of Pix keys and transactions using QR Code directly in the system or API, instead of the use of filters in the client software, from the first moment the institution is in full operation? (Yes/No)
V (j)	Does the proposed solution contemplate the implementation on its website, from the first moment the institution is in full operation, of mechanisms to prevent the use of robots and automation of key and Pix transaction queries? (Yes/No/There will be no use of the website to initiate a Pix)
VI	Audit Logs
	Section 7 of the Pix Security Manual sets forth the audit logs that must be maintained by all Pix participants.
VI (a)	Does the proposed solution consider compliance, from the first moment the institution is in full operation, with the requirements set forth in Section 7 of the Pix Security Manual? (Yes/No)
VII	Mechanisms for Prevention of Reading Attacks
	Section V of Chapter XIII of the Regulation Annexed to BCB Resolution No. 1 (Pix Regulation), of August 12, 2020, and Section 13 of the DICT Operational Manual set forth rules on mechanisms for prevention of reading attacks.
VII (a)	Does the proposed solution contemplate the implementation of mechanisms for prevention of reading attacks on the DICT from the first moment the institution is in full operation? (Yes/No)
VII (b)	Are the planned mechanisms for prevention of reading attacks on the DICT, at a minimum, equal to the mechanisms for prevention of reading attacks existing in the DICT and detailed in the DICT Operational Manual? (Yes/No)
VII (c)	Does the proposed solution contemplate the implementation, from the first moment the institution is in full operation, of a mechanism for verification of the authenticity of the user requesting the query? (Yes/No)
VII (d)	Does the proposed solution contemplate the implementation, from the first moment the institution is in full operation, of an internal policy mechanism for limiting queries? (Yes/No)
VII (e)	Does the proposed solution contemplate the implementation, from the first moment the institution is in full operation, of mechanisms for identification and treatment of cases of excessive queries of Pix keys that do not result in the sending of a payment order? (Yes/No)
VII (f)	Does the proposed solution contemplate the implementation, from the first moment the institution is in full operation, of mechanisms for identification and treatment of cases of excessive queries of keys not registered in the DICT? (Yes/No)
VII (g)	Will the institution establish, from the first moment the institution is in full operation, an action plan for the treatment of cases suspected of reading attacks? (Yes/No)

We declare that we are aware that:

(i) the Central Bank of Brazil reserves the right to request additional information and documents at any time; and

(ii) adherence and subsequent participation in Pix implies acceptance of the rules, conditions, and procedures established in the Pix Regulation.

---

Name

(director responsible for cybersecurity policy)

Annex III-D

Security Self-Assessment Questionnaire - Institutions authorized to operate by the Central Bank of Brazil that intend to participate in Pix exclusively in the initiator mode and access the DICT indirectly

The questionnaire addresses security aspects related to Pix.

Compliance with these aspects is mandatory for all participants.
In this way, failure to meet all these aspects, as well as the non-implementation effective of the security mechanisms provided for, from the beginning of the restricted operation stage, subjects the applicant to the denial of the adherence request.

The participant must store evidence supporting its adherence to the aspects listed in this questionnaire at the time of sending to the Central Bank of Brazil. These evidences may be requested by the Central Bank of Brazil and may include, at the participant's discretion, diagrams, topologies, flowcharts, screenshots, queries with respective returns, or other documents deemed pertinent.

It is worth noting that the eventual provision, to the Central Bank of Brazil, of incorrect documents, data, or information or out of compliance with the deadlines and conditions established in legal or regulatory norms constitutes an offense punishable under current legislation.

CNPJ Registration
Corporate Name

I	Security of Dynamic QR Codes
	Section 4 of the Pix Security Manual sets forth the security specifications for dynamic QR Codes generated by the payee.
I (a)	Does the proposed solution consider compliance, from the first moment the institution is in full operation, with the requirements set forth in item 4.3 of the Pix Security Manual? (Yes/No/Generation and reading of dynamic QR Codes will not be offered)
II	Secure Implementation of Applications, APIs, and Other Systems
	Section 6 of the Pix Security Manual sets forth mandatory security aspects in the implementation of systems related to Pix.
II (a)	Does the proposed solution contemplate the use, from the first moment the institution is in full operation, of encryption mechanisms in communication between systems and APIs related to Pix and their respective applications or client software? (Yes/No)
II (b)	Does the proposed solution contemplate the implementation, from the first moment the institution is in full operation, of strong authentication mechanisms for client software on the APIs and systems related to Pix? (Yes/No)
II (c)	Does the proposed solution contemplate the implementation, from the first moment the institution is in full operation, of security mechanisms capable of ensuring that the APIs and other systems used are accessed only by the participant's legitimate client software, thereby preventing man-in-the-middle attacks? (Yes/No)
II (d)	Does the proposed solution contemplate the implementation, from the first moment the institution is in full operation, of security mechanisms capable of ensuring that the client software communicates only with desired APIs and systems, thereby preventing man-in-the-middle attacks and manipulation of its communication? (Yes/No)
II (e)	Does the proposed solution contemplate the implementation, from the first moment the institution is in full operation, of security mechanisms that prevent reverse engineering, decompilation, code manipulation, modification of credentials or security parameters, among other techniques that result in the adulteration of applications or client software? (Yes/No)
II (f)	Does the proposed solution contemplate the implementation of the security of the APIs and other systems related to Pix primarily on the server side, from the first moment the institution is in full operation, so as to avoid that security be restricted only to the client software or application? (Yes/No)
II (g)	Does the proposed solution contemplate the provision, from the first moment the institution is in full operation, of only the information strictly necessary for the correct functioning of the applications? (Yes/No)
II (h)	Does the proposed solution contemplate the implementation of controls, from the first moment the institution is in full operation, to ensure that information such as full CPF (unmasked), agency and account data of recipients of payments via Pix, as well as information for security purposes linked to Pix keys, are for the exclusive use of the participant's internal systems and are not exposed to its applications and client software? (Yes/No)
II (i)	Does the proposed solution contemplate the treatment and masking of data obtained in the consultation of Pix keys and transactions using QR Code directly in the system or API, instead of the use of filters in the client software, from the first moment the institution is in full operation? (Yes/No)
II (j)	Does the proposed solution contemplate the implementation on its website, from the first moment the institution is in full operation, of mechanisms to prevent the use of robots and automation of key and Pix transaction queries? (Yes/No/There will be no use of the website to initiate a Pix)
III	Audit Logs
	Section 7 of the Pix Security Manual sets forth the audit logs that must be maintained by all Pix participants.
III (a)	Does the proposed solution consider compliance, from the first moment the institution is in full operation, with the requirements set forth in Section 7 of the Pix Security Manual? (Yes/No)
IV	Mechanisms for Prevention of Reading Attacks
	Section V of Chapter XIII of the Regulation Annexed to BCB Resolution No. 1 (Pix Regulation), of August 12, 2020, and Section 13 of the DICT Operational Manual set forth rules on mechanisms for prevention of reading attacks.
IV (a)	Does the proposed solution contemplate the implementation of mechanisms for prevention of reading attacks on the DICT from the first moment the institution is in full operation? (Yes/No)
IV (b)	Are the planned mechanisms for prevention of reading attacks on the DICT, at a minimum, equal to the mechanisms for prevention of reading attacks existing in the DICT and detailed in the DICT Operational Manual? (Yes/No)
IV (c)	Does the proposed solution contemplate the implementation, from the first moment the institution is in full operation, of a mechanism for verification of the authenticity of the user requesting the query? (Yes/No)
IV (d)	Does the proposed solution contemplate the implementation, from the first moment the institution is in full operation, of an internal policy mechanism for limiting queries? (Yes/No)
IV (e)	Does the proposed solution contemplate the implementation, from the first moment the institution is in full operation, of mechanisms for identification and treatment of cases of excessive queries of Pix keys that do not result in the sending of a payment order? (Yes/No)
IV (f)	Does the proposed solution contemplate the implementation, from the first moment the institution is in full operation, of mechanisms for identification and treatment of cases of excessive queries of keys not registered in the DICT? (Yes/No)
IV (g)	Will the institution establish, from the first moment the institution is in full operation, an action plan for the treatment of cases suspected of reading attacks? (Yes/No)

We declare that we are aware that:

(i) the Central Bank of Brazil reserves the right to request additional information and documents at any time; and

(ii) adherence and subsequent participation in Pix implies acceptance of the rules, conditions, and procedures established in the Pix Regulation.

---

Name

(director responsible for cybersecurity policy)

Annex III-E

Security Self-Assessment Questionnaire - Institutions authorized to operate by the Central Bank of Brazil that intend to participate in Pix exclusively in the initiator mode and not access the DICT

The questionnaire addresses security aspects related to Pix.

Compliance with these aspects is mandatory for all participants.
In this way, failure to meet all these aspects, as well as the non-implementation effective of the security mechanisms provided for, from the beginning of the restricted operation stage, subjects the applicant to the denial of the adherence request.

The participant must store evidence supporting its adherence to the aspects listed in this questionnaire at the time of sending to the Central Bank of Brazil. These evidences may be requested by the Central Bank of Brazil and may include, at the participant's discretion, diagrams, topologies, flowcharts, screenshots, queries with respective returns, or other documents deemed pertinent.

It is worth noting that the eventual provision, to the Central Bank of Brazil, of incorrect documents, data, or information or out of compliance with the deadlines and conditions established in legal or regulatory norms constitutes an offense punishable under current legislation.

CNPJ Registration
Corporate Name

I	Secure Implementation of Applications, APIs, and Other Systems
	Section 6 of the Pix Security Manual sets forth mandatory security aspects in the implementation of systems related to Pix.
I (a)	Does the proposed solution contemplate the use, from the first moment the institution is in full operation, of encryption mechanisms in communication between systems and APIs related to Pix and their respective applications or client software? (Yes/No)
I (b)	Does the proposed solution contemplate the implementation, from the first moment the institution is in full operation, of strong authentication mechanisms for client software on the APIs and systems related to Pix? (Yes/No)
I (c)	Does the proposed solution contemplate the implementation, from the first moment the institution is in full operation, of security mechanisms capable of ensuring that the APIs and other systems used are accessed only by the participant's legitimate client software, thereby preventing man-in-the-middle attacks? (Yes/No)
I (d)	Does the proposed solution contemplate the implementation, from the first moment the institution is in full operation, of security mechanisms capable of ensuring that the client software communicates only with desired APIs and systems, thereby preventing man-in-the-middle attacks and manipulation of its communication? (Yes/No)
I (e)	Does the proposed solution contemplate the implementation, from the first moment the institution is in full operation, of security mechanisms that prevent reverse engineering, decompilation, code manipulation, modification of credentials or security parameters, among other techniques that result in the adulteration of applications or client software? (Yes/No)
I (f)	Does the proposed solution contemplate the implementation of the security of the APIs and other systems related to Pix primarily on the server side, from the first moment the institution is in full operation, so as to avoid that security be restricted only to the client software or application? (Yes/No)
I (g)	Does the proposed solution contemplate the implementation on its website, from the first moment the institution is in full operation, of mechanisms to prevent the use of robots and automation of key and Pix transaction queries? (Yes/No/There will be no use of the website to initiate a Pix)
II	Audit Logs
	Section 7 of the Pix Security Manual sets forth the audit logs that must be maintained by all Pix participants.
II (a)	Does the proposed solution consider compliance, from the first moment the institution is in full operation, with the requirements set forth in Section 7 of the Pix Security Manual? (Yes/No)

We declare that we are aware that:

(i) the Central Bank of Brazil reserves the right to request additional information and documents at any time; and

(ii) adherence and subsequent participation in Pix implies acceptance of the rules, conditions, and procedures established in the Pix Regulation.

---

Name

(director responsible for cybersecurity policy)

Annex IV - Documents for institutions that participate or intend to
participate in Pix in the user institution mode

Annex IV-A

• Adherence form for institutions, authorized
  to operate by the Central Bank of Brazil, that intend to participate in Pix exclusively in the user institution mode; and

• Form
  for updating registration for institutions, authorized to operate by the Central Bank of Brazil, already participants in Pix exclusively in the user institution mode.

I	Reason for submission	( ) ( ) ( )	Application for adhesion Update of registration data for a Pix participant in operation, as set forth in art. 88 Update of registration data for an institution adhering to Pix, as set forth in art. 88
II	If the reason for submitting the form is a registration update, indicate next to it the item(s) to be altered. If it is an application for adhesion, do not check and skip to item III	( ) ( ) ( )	V1 – Alteration in the method of access to the DICT. VI2 – Alteration in the method of participation in the SPI. VII – Alteration in the method of access to the RSFN
III	CNPJ Registration
IV	Corporate Name3
V	Type of access to the DICT Note: Direct access to the DICT is mandatory for direct participants of the SPI	( ) ( ) ( )	Direct Indirect Does not access
VI	Type of participation in the SPI Note: If indirect, inform the ISPB code of the clearing participant in the SPI:	( ) ( )	Direct Indirect, with the clearing participant being the ISPB: ___________
VII	If a direct participant in the SPI, indicate the method of connection to the RSFN (direct or via a PSTI). If an indirect participant in the SPI (N/A).	( ) ( ) ( )	Direct Via the following PSTI: Name of PSTI: _____________ CNPJ of PSTI: ______________ N/A
VIII	Does it consume or intend to start consuming functionalities related to QR Codes?	( ) ( )	Yes. In this case, also present the form available in Annex IV-B No
IX	Does it consume or intend to start consuming functionalities related to Pix Automatic?	( ) ( )	Yes. In this case, also present the form available in Annex IV-B No
X	Identification of the director responsible for attending to demands from the Central Bank of Brazil related to issues concerning Pix4	Name: CPF:
XI	Institution's telephone number for matters related to Pix5
XI (a)	Telephone 1: Name6:	( )	authorizes sharing with other Pix participants
XI (b)	Telephone 2: Name6:	( )	authorizes sharing with other Pix participants
XI (c)	Telephone 3: Name6:	( )	authorizes sharing with other Pix participants
...	...	...
XII	Institution's electronic address (e-mail) for matters related to Pix7 (Note 1: Inform at least one e-mail) (Note 2: Inform at least one e-mail corresponding to a corporate mailbox accessible to more than one user) (Note 3: At least one of the e-mails informed must be shareable with other Pix participants) (Note 4: Customer service e-mails or similar will not be accepted)
XII (a)	E-mail 1: Name8:	( ) ( )	authorizes sharing with other Pix participants corporate mailbox accessible to more than one user
XII (b)	E-mail 2: Name8:	( ) ( )	authorizes sharing with other Pix participants corporate mailbox accessible to more than one user
XII (c)	E-mail 3: Name8:	( ) ( )	authorizes sharing with other Pix participants corporate mailbox accessible to more than one user
...	....	....
XIII	If participating or intending to participate directly in the SPI, identification of the director responsible for attending to demands from the Central Bank of Brazil related to issues concerning SPI9	Name: CPF:
XIV	If participating or intending to participate directly in the SPI, institution's telephone number for matters related to SPI9
XV	If participating or intending to participate directly in the SPI, institution's electronic address (e-mail) for matters related to SPI9

1 The request to alter the method of access to the DICT is prohibited to institutions in the process of adhering to Pix, as set forth in art. 59, § 2º, item III.

2 The request to alter the method of participation in the SPI is prohibited to institutions that, as set forth in specific SPI regulation, are obliged to participate directly, as set forth in art. 59, § 2º, item I.

3 The registration update regarding the change of corporate name of institutions authorized to operate by the Central Bank of Brazil will observe the provisions contained in specific regulation, as set forth in art. 92.

4 For purposes of registration update, the alteration of data related to the director responsible for issues related to participation in Pix must be carried out, directly in Unicad, by the participating institution or the institution in the process of adhering to Pix that already possesses a Sisbacen code, as set forth in art. 89.

5 For purposes of registration update, the alteration of contacts for matters related to Pix must be requested via e-mail sent to the corporate mailbox pix-operacional@bcb.gov.br from a previously informed and registered contact for this same purpose, as set forth in art. 91.

6 Fill in with the name of the person responsible for the indicated telephone. If it is not for a specific person, fill in the "Name" field with the term "Institutional". If the institution wishes to inform more than three telephone numbers, it is exceptionally permitted to insert more lines, named "XI (d)", "XI (e)" and so on, successively.

7 For purposes of registration update, the alteration of contacts for matters related to Pix must be requested via e-mail sent to the corporate mailbox pix-operacional@bcb.gov.br from a previously informed and registered contact for this same purpose, as set forth in art. 91.

8 Fill in with the name of the person responsible for the indicated e-mail. If it is not for a specific person, fill in the "Name" field with the term "Institutional". If the institution wishes to inform more than three e-mails, it is exceptionally permitted to insert more lines, named "XII (d)", "XII (e)" and so on, successively.

9 For purposes of registration update, the alteration of data related to the director responsible for the SPI and PI Account must be carried out as set forth in specific SPI regulation, as determined in art. 90.

We declare that we are aware that:

(i) the Central Bank of Brazil reserves the right to request additional information and documents at any time; and

(ii) adhesion and subsequent participation in Pix implies acceptance of the rules, conditions, and procedures established in the Pix Regulation.

---

Name and Position

Annex IV-B

• Form for intention to consume products and services by institutions, authorized to operate by the Central Bank of Brazil, that intend to participate in Pix exclusively in the user institution modality; and

• Form for updating intention to consume products and services by institutions, authorized to operate by the Central Bank of Brazil, already participants in Pix exclusively in the user institution modality.

I	Reason for submission	( ) ( ) ( ) ( ) ( )	Application for adhesion Update of functionalities related to QR Codes consumed by a Pix participant in operation, as set forth in art. 88 Update of functionalities related to QR Codes consumed by an institution adhering to Pix, as set forth in art. 88 Update of functionalities related to Pix Automatic consumed by a Pix participant in operation, as set forth in art. 88 Update of functionalities related to Pix Automatic, consumed by an institution adhering to Pix, as set forth in art. 88
II	CNPJ Registration
III	Corporate Name
IV	Does it consume or intend to start consuming functionalities related to Pix Automatic?	( ) ( )	Yes No
V	Functionalities related to Pix Automatic (if the answer to item IV is "yes", select at least one option)	( ) ( )	Pix Automatic – Payment Pix Automatic – Receipt
VI	Does it consume or intend to start consuming functionalities related to QR Codes?	( ) ( )	Yes No
VII	Functionalities related to QR Codes (if the answer to item VI is "yes", select at least one option)	( ) ( ) ( ) ( )	Reading of QR Code Generation of static QR Code of Pix Cobrança for immediate payments Generation of dynamic QR Code of Pix Cobrança for immediate payments Generation of dynamic QR Code of Pix Cobrança for payments with due date Generation of QR Codes

We declare that we are aware that:

(i) the Central Bank of Brazil reserves the right to request additional information and documents at any time; and

(ii) adhesion and subsequent participation in Pix implies acceptance of the rules, conditions, and procedures established in the Pix Regulation.

---

Name and Position

Annex IV-C

Security self-assessment questionnaire - Institutions authorized to operate by the Central Bank of Brazil that intend to participate in Pix exclusively in the user institution modality

The questionnaire addresses security aspects related to Pix.

Observance of these aspects is mandatory for all participants. Thus, non-compliance with all these aspects, as well as the ineffective implementation of the security mechanisms provided for, from the beginning of the restricted operation stage, subjects the applicant to the denial of the adhesion request.

The participant must store evidence supporting its adherence to the aspects listed in this questionnaire upon sending to the Central Bank of Brazil. These evidences may be requested by the Central Bank of Brazil and may include, at the participant's discretion, diagrams, topologies, flowcharts, screenshots, queries with respective returns, or other documents deemed pertinent.

It is worth noting that the eventual provision to the Central Bank of Brazil of incorrect documents, data, or information or in disagreement with the deadlines and conditions established in legal or regulatory norms constitutes an offense punishable under current legislation.

I	Secure CommunicationInstruction for filling: Answer "Yes" or "No" if intending to access the DICT directly or participate in the SPI directly. Otherwise, answer with "N/A".
	Section 2 of the Pix Security Manual deals with rules for secure communication purposes
I (a)	Does the proposed solution consider the observation, from the first moment of the institution in the full operation phase, of the requirements set forth in section 2 of the Pix Security Manual? (Yes/No/N/A)
II	Digital SignatureInstruction for filling: Answer "Yes" or "No" if intending to access the DICT directly or participate in the SPI directly. Otherwise, answer with "N/A".
	Section 3 of the Pix Security Manual deals with the digital signature of messages transmitted in the SPI and DICT.
II (a)	Does the proposed solution consider the observation, from the first moment of the institution's operation in the full operation phase, of the requirements set forth in section 3 of the Pix Security Manual? (Yes/No/N/A)
III	Security of Dynamic QR CodesInstruction for filling: Answer according to the provision for the use of dynamic QR Codes.
	Section 4 of the Pix Security Manual deals with the security specifications of QR Codes dynamic.
III (a)	Does the proposed solution consider the observation, from the first moment of the institution's operation in the full operation phase, of the requirements set forth in items 4.1 and 4.2 of the Pix Security Manual? (Yes/No/Dynamic QR Codes will not be generated)
III (b)	Does the proposed solution consider the observation, from the first moment of the institution's operation in the full operation phase, of the requirements set forth in item 4.3 of the Pix Security Manual? (Yes/No/Nor dynamic QR Codes will be generated nor read)
IV	Digital CertificatesInstruction for filling: Answer "Yes" or "No" if intending to access the DICT directly or participate in the SPI directly. Otherwise, answer with "N/A".
	Section 5 of the Pix Security Manual deals with the types of certificates to be used within the scope of Pix, as well as the processes of activation, deactivation, and verification of revocation of these certificates.
IV (a)	Does the proposed solution consider the observation, from the first moment of the institution's operation in the full operation phase, of the requirements set forth in section 5 of the Pix Security Manual? (Yes/No/N/A)
V	Secure implementation of applications, APIs, and other systems
	Section 6 of the Pix Security Manual deals with mandatory security aspects in the implementation of systems related to Pix.
V (a)	Does the proposed solution contemplate the use, from the first moment of the institution's operation in the full operation phase, of encryption mechanisms in the communication between systems and APIs related to Pix and other legitimate applications or software of the participant? (Yes/No)
V (b)	Does the proposed solution contemplate the implementation, from the first moment of the institution's operation in the full operation phase, of strong authentication mechanisms between legitimate applications or software of the participant and the APIs and systems related to Pix? (Yes/No)
V (c)	Does the proposed solution contemplate the implementation, from the first moment of the institution's operation in the full operation phase, of security mechanisms capable of guaranteeing that systems and APIs related to Pix are accessed only by legitimate applications or software of the participant, in order to prevent man-in-the-middle attacks? (Yes/No)
V (d)	Does the proposed solution contemplate the implementation, from the first moment of the institution's operation in the full operation phase, of security mechanisms capable of guaranteeing that legitimate applications or software of the participants communicate only with desired APIs and systems, in order to prevent man-in-the-middle attacks and manipulation of their communication? (Yes/No)
V (e)	Does the proposed solution contemplate the implementation, from the first moment of the institution's operation in the full operation phase, of security mechanisms that prevent reverse engineering, decompilation, code manipulation, modification of credentials or security parameters, among other techniques that result in the adulteration of legitimate applications or software of the participant? (Yes/No)
V (f)	Does the proposed solution contemplate the implementation of the security of the APIs and other systems related to Pix predominantly on the server side, from the first moment of the institution's operation in the full operation phase, in order to avoid that security is restricted only to legitimate applications or software of the participant*?* (*Yes/No)
V (g)	Does the proposed solution contemplate the provision, from the first moment of the institution's operation in the full operation phase, only of the information strictly necessary for the correct functioning of legitimate applications or software of the participant? (Yes/No)
V (h)	Does the proposed solution contemplate the implementation of controls, from the first moment of the institution's operation in the full operation phase, to guarantee that information such as full CPF (without masking), agency and account data of recipients of Pix payments, as well as information for security purposes linked to Pix keys, are for exclusive use of the participant's internal systems and are not exposed to other applications or software? (Yes/No)
V (i)	Does the proposed solution contemplate the treatment and masking of data obtained in the query of Pix keys and transactions using QR Code directly in the systems or API related to Pix, instead of the use of filters in other applications or software, from the first moment of the institution's operation in the full operation phase? (Yes/No)
V (j)	Does the proposed solution contemplate the implementation on its web site, from the first moment of the institution's operation in the full operation phase, of mechanisms to prevent the use of robots and automation of queries of keys and Pix transactions? (Yes/No/There will be no use of the site to initiate a Pix)
VI	Audit Logs
	Section 7 of the Pix Security Manual deals with the audit logs that must be maintained by all Pix participants.
VI (a)	Does the proposed solution consider the observation, from the first moment of the institution's operation in the full operation phase, of the requirements set forth in section 7 of the Pix Security Manual? (Yes/No)
VII	Mechanisms to prevent reading attacksInstruction for filling: Answer "Yes" or "No". If applicable, answer "N/A" only in cases where the institution does not intend to access the DICT, either directly or indirectly.
	Section V of chapter XIII of the Regulation Annex to Resolution BCB No. 1 (Pix Regulation), of August 12, 2020, and section 13 of the DICT Operational Manual deal with mechanisms to prevent reading attacks.
VII (a)	Does the proposed solution contemplate the implementation of mechanisms to prevent reading attacks to the DICT from the first moment of the institution's operation in the full operation phase? (Yes/No/N/A)
VII (b)	Are the planned mechanisms to prevent reading attacks to the DICT, at minimum, equal to the mechanisms to prevent reading attacks existing in the DICT and detailed in the DICT Operational Manual? (Yes/No/N/A)
VII (c)	Does the proposed solution contemplate the implementation, from the first moment of the institution's operation in the full operation phase, of a mechanism for verifying the authenticity of the user requesting the query of Pix keys? (Yes/No/N/A)
VII (d)	Does the proposed solution contemplate the implementation, from the first moment of the institution's operation in the full operation phase, of an internal policy mechanism for limiting queries of Pix keys? (Yes/No/N/A)
VII (e)	Does the proposed solution contemplate the implementation, from the first moment of the institution's operation in the full operation phase, of mechanisms for identifying and treating cases of excessive queries of Pix keys that do not result in the sending of a payment order? (Yes/No/N/A)
VII f)	Does the proposed solution contemplate the implementation, from the first moment of the institution's operation in the full operation phase, of mechanisms for identifying and treating cases of excessive queries of keys not registered in the DICT? (Yes/No/N/A)
VII (g)	Will the institution establish, from the first moment of the institution's operation in the full operation phase, an action plan for treating cases suspected of reading attacks? (Yes/No)

We declare that we are aware that:

(i) the Central Bank of Brazil reserves the right to request additional information and documents at any time; and

(ii) adhesion and subsequent participation in Pix implies acceptance of the rules, conditions, and procedures established in the Pix Regulation.

---

Name

(director responsible for cybersecurity policy)

Annex V - Procedures for instructing the procedural process through the Digital Protocol and for obtaining the Sisbacen code

Art. 1º The sending of documents to the Central Bank of Brazil, within the scope of Pix, must be done through the Digital Protocol, observing the following procedures:

I - access the Digital Protocol at the following electronic address: https://www.bcb.gov.br/acessoinformacao/protocolodigital, through an institutional user account. If the requesting institution does not yet have an institutional user account in the Digital Protocol, access may be carried out through a physical person user account (citizen profile);

II - once logged in, on the Digital Protocol screen, fill in the "Description" field, using the following components, in the format "xx.xxx.xxx - Institution - stage - demand", wherein the component:

1. "xx.xxx.xxx" must correspond to the registration number (first eight digits) of the institution in the National Registry of Legal Entities (CNPJ);

2. "Institution" must correspond to the social denomination of the requesting institution. Reduction or abbreviation of terms of the social denomination is admitted, such as "Payment Institution" (IP), "Credit Cooperative" (CC), Credit, Financing and Investment Society ("SCFI), "Société Anonyme" (S.A.), "Limited" (Ltda.), etc;

3. "stage" must be filled with "Pix - registration stage", "Pix - homologation stage", "Pix - restricted operation stage" or "Pix - PSP in full operation" according to the stage in which the institution is and the documents to be sent; and

4. "demand" - must be inserted a brief description of the request presented, such as those listed in the following non-exhaustive list:

a) "application for adhesion to Pix";

b) "resolution of pending issues in adhesion application";

c) "solution project";

d) "request for exemption from presenting a project";

e) "request for exemption from QR Code tests";

f) "capacity declaration";

g) "proof of exemption from participation in Open Finance";

h) "request for deadline extension";

i) "request for exemption from participation in restricted operation";

j) "schedule for restricted operation";

k) "date for entry into production";

l) "registration update";

m) "alterations in QR Code functionalities";

n) "alteration in initiation methods";

o) "offer of initiation service";

p) "acting as FSS";

q) "alteration of participation modality";

r) "migration to direct";

s) "migration to indirect";

t) "alteration of responsible PSP"; etc.

III - select "Pix" in the "Select a subject" field and send each file in PDF/A format.

§ 1º In the event of sending more than one document, the "Register complementary document" field must be selected so that all documents from the same institution are linked.

§ 2º In the event that a file exceeds the maximum size allowed by the system, the file must be partitioned, in which case the "Description" field must be filled using the format "xx.xxx.xxx - Institution - stage - demand - Part 1", "xx.xxx.xxx - Institution - stage - Part 2", and so on, successively.

Art. 2º The institution not authorized to operate by the Central Bank of Brazil, once approved in the registration stage of the Pix adhesion process, must request the Sisbacen code according to the following guidelines:

I - observe the instructions contained on the Sisbacen page (https://www.bcb.gov.br/meubc/sisbacen) on the Central Bank of Brazil's website, specifically regarding the user profile "Other Institutions not subject to signing a contract"; and

---

II - at the time of filling out the relevant registration form, the institution must indicate as "justification for using Sisbacen" the item "Payment institution participating in Pix not subject to BCB authorization".

NOTE

Decree No. 10,411, of June 30, 2020, provides for the mandatory implementation of a regulatory impact analysis (AIR) for the issuance of normative acts of general interest produced by the bodies and entities of the direct and indirect federal public administration.

However, as defined in paragraph 8 of Vote 280/2021–BCB, of November 10, 2021, the Pix Regulation, including other documents that integrate, detail, or complement it, do not constitute regulatory acts of mandatory force, possessing, in truth, an eminently contractual nature. Thus, modifications made to the aforementioned regulation and to the other documents that integrate, detail, or complement it are not subject to the prior production of an AIR.

RICARDO TEIXEIRA LEITE
MOURÃO