🇧🇷 Payments in Brazil

The SPB: who runs what, and under which license

The Sistema de Pagamentos Brasileiro (SPB) is the set of infrastructures that execute, clear, and settle payments in Brazil. What sets it apart is the role of the central bank, which is regulator, supervisor, and operator of the main retail rail, a rare setup among national payment systems. Since 2002, the Banco Central do Brasil (BCB) has run the STR (Sistema de Transferência de Reservas), the RTGS system where transactions settle in central bank money. It also runs the SPI (Sistema de Pagamentos Instantâneos), the real-time infrastructure that has processed Pix payments since 2020. Between the two, a single private operator, Nuclea (formerly CIP, Câmara Interbancária de Pagamentos), runs the retail clearing houses: SILOC for deferred clearing (boletos, debits) and SITRAF for continuous settlement.

The legal framework rests on one founding law, Lei nº 12.865 of October 9, 2013. It creates two separate regulatory concepts that are often confused. The arranjo de pagamento (payment arrangement) is the rulebook, the equivalent of a scheme. The instituição de pagamento (IP) is the institution that takes part in it, as an e-money issuer, a post-paid instrument issuer (credit cards), or a credenciador (acquirer). Brazil has no generic payment service provider (PSP) license. A foreign company therefore qualifies as an IP in one of these categories, or operates under the umbrella of an IP that is already authorized.

Pix: the anatomy of the rail, not the legend

Pix is the consumer-facing brand. The rail is called the SPI, and the directory is called the DICT (Diretório de Identificadores de Contas Transacionais). The three names refer to different things: a brand, a settlement infrastructure, and an addressing directory. Institutions join the SPI, which provides gross settlement in central bank money 24 hours a day, 365 days a year. Addressing lookups go to the DICT. End customers see the name Pix. A participant is direct if it settles in the SPI itself from its account at the BCB, and indirect if it goes through a direct participant. That status determines cost, latency, and exposure to counterparty risk.

Access to the rail, its pricing, and its time limits are set by regulation, not by the market. Resolução BCB nº 1 of August 12, 2020 (art. 3) makes participation mandatory for any licensed institution with more than 500,000 active customer accounts. Resolução BCB nº 19 of October 1, 2020, prohibits charging individuals and sole proprietors to send or receive a Pix. Free Pix for these users is a regulatory requirement, not a commercial choice left to institutions. The Manual de Tempos do Pix sets a limit of 40 seconds between receipt of the order and settlement. Past that, the SPI itself rejects the transaction. The quality target for the payer experience is 6.0 seconds at the median and 10.0 seconds at the 99th percentile; the secondary channel (scheduled Pix) has 45 minutes.

The Pix ecosystem: what exists, what didn't catch on, and what's coming

The agenda evolutiva is the BCB's public roadmap for Pix. Each feature is specified, given a date, and then made mandatory for every participant. A new Pix feature is therefore an implementation requirement with a deadline, not a commercial option each institution can take or leave. To that extent, a Brazilian PSP's product roadmap is set by the central bank's calendar.

Cards and parcelado: the Brazilian exception that won't die

Parcelado splits a card purchase into several monthly installments: Brazilians take on credit at the moment of purchase, not through a separate loan. That is why cards have held their ground despite the forecasts of decline made since 2021. Card volume reached R$4.5 trillion in 2025, up 10.1% (ABECS, February 2026). The most common form, parcelado sem juros, is billed with no interest shown to the customer. The merchant absorbs the cost through a longer settlement period and a discount. 42.6% of card purchases in 2025 were split into interest-free installments, vs. 57.1% paid in full. And 64.2% of installment transactions had six installments or fewer.

Two kinds of installment plans coexist, distinguished by who carries the credit, and they must never be confused in an acquiring contract. With parcelado emissor (or com juros, “with interest”), the issuer extends the credit. The merchant is paid as for a single-payment sale, and the buyer pays interest. Parcelado lojista (or sem juros, “interest-free”) is carried by the merchant. The merchant is paid one installment at a time, month by month, and bears the carrying cost. The distinction therefore shapes the merchant's cash flow: the same sale is paid either all at once or over as many months as there are installments. This mechanism also explains antecipação de recebíveis, the discounting of future receivables, which accounts for a large share of Brazilian acquirers' actual revenue.

Since 2025, only one domestic scheme of any size remains. Elo (Elo Serviços S.A., a 2011 joint venture of Banco do Brasil, Bradesco, and Caixa Econômica Federal) is still the only large domestic scheme in South America, with 8.7% of cards issued in Q1 2025 (BCB). Its card base is heavily concentrated in social programs and Caixa cards. Its international acceptance, based on agreements with Discover/Diners, remains limited. Hipercard, historically the second domestic scheme and heavily concentrated in Brazil's Northeast (Nordeste), has been shut down. The BCB authorized the shutdown in June 2025, no transaction has been approved since July 1, 2025, and its cards have moved to Mastercard. Any acceptance contract signed before that date should therefore be reviewed, since it may name a scheme that no longer approves any transactions.

The world's most competitive acquiring market

For years, Brazilian acquiring was a duopoly: Cielo (1995, Banco do Brasil and Bradesco) on one side, Rede (1996, controlled by Itaú Unibanco since 2012) on the other. Regulatory liberalization, mandatory terminal interoperability, and the end of card brand (bandeira) exclusivity opened the market to new entrants. It now has five large players. On top of these comes a long tail of sub-acquirers and wallets. Market share analysis therefore has to cover all of them, not just the acquirers backed by the legacy banks.

A Brazilian acquirer's revenue comes from two pools: acceptance fees, and financial income from credit and receivables discounting. In 2025, Rede reported R$2.058 billion in service revenue and R$3.770 billion in financial intermediation revenue, with net income of R$1.888 billion. Credit and prepayment bring in nearly twice as much as acquiring itself. PagBank reported R$20.4 billion in revenue and R$2.12 billion in net income for 2025, with its loan book up 33% to R$4.6 billion. Negotiating a Brazilian acquiring contract is therefore first about financing terms, the source of most of the acquirer's revenue, and only then about the MDR.

The registry of recebíveis de cartão (card receivables) is the central system that records the receivables a merchant holds on its acquirers from card payments. Resolução CMN nº 4.734 and Circular BCB nº 3.952, both dated June 27, 2019, created a new type of entity, the registradora, which keeps the schedule of each merchant's future receivables. The regime took effect after two delays: first from November 3, 2020, to February 17, 2021, then to June 7, 2021, because one of the three registries was not ready. Since then, a merchant's receivables are visible to the whole market, not just to the acquirer that originated them, so they can be discounted or pledged with a third party. The trava bancária, the lock through which acquirers effectively captured their merchants' financing, lost its effect. The prepayment spread fell to a low of 0.15 percentage point in August 2023 (CERC, based on Banco Central do Brasil data).

• Authorized registradoras: CERC, Nuclea, TAG, B3, and CRDC. A merchant can register its receivables schedule with any of them and have its acquirers compete on the discount rate.
• Concentration is falling: the combined share of the top four acquirers fell from about 84.8% in Q1 2019 to 72.7% in Q3 2023 (Banco Central do Brasil data reported by the trade press). Brazil is one of the few markets in the world where acquiring is becoming less concentrated.
• Sub-acquiring and split payments: platforms and marketplaces widely operate as sub-acquirers under a licensed IP, with built-in settlement splitting; this is the standard setup for a SaaS vendor or a foreign marketplace.
• Neobanks as acquirers: Nubank (more than 115 million customers in Brazil in Q1 2026), Mercado Pago (71.3 million), and PicPay (about 68 million) win the merchant relationship through the account, not the terminal.

Boleto: declining, never dead, and legally irreplaceable

The boleto bancário is a barcoded payment slip issued by the payee through its bank and payable in cash at a branch, at a self-service kiosk, at a lotérica (lottery outlet), or by debit in a banking app. It was the rail for the unbanked and is still the rail for B2B, utilities, and anything paid on a due date. Pix has cut its relative share without stopping its growth in value. It still accounted for 7.6% of transactions in H2 2025, with value up 3.7% (Banco Central do Brasil, April 2026). More than 8.2 billion slips were processed in 2025, up about 3% year over year (Nuclea).

The boleto survives because of three properties Pix lacks. The first is legal standing. A boleto can be protested and enforced in court, which a transfer cannot, and that makes it a collection tool in B2B trade. The second is the decoupling of issuance and payment. A bill issued today can be paid in 30 days without tying up the debtor's cash, so the slip works as a form of trade credit. The third is cash acceptance, which still matters for part of the population and for in-person collection.

Open Finance, Drex, and digital assets: what's real and what's still a project

Open Finance Brasil is Brazil's framework for sharing financial data and services between institutions with the customer's consent. It is based on Resolução Conjunta nº 1 of May 4, 2020, issued jointly by the Banco Central do Brasil and the Conselho Monetário Nacional (National Monetary Council). It was rolled out in phases (open data, account data, payment initiation, investment and insurance data) and has its own governance body. Since January 1, 2025, data sharing has been mandatory for institutions in the S1 and S2 segments and for any conglomerate with more than five million customers. Offering the payment transaction initiation (ITP) service is mandatory for every mandatory Pix participant and every licensed initiator.

ITP lets a merchant trigger a Pix payment from its own checkout flow, without a clunky redirect to the banking app, and with consent stored on the initiator's side. This mechanism underpins “Pix by Open Finance,” which lets a PSP keep control of the payment flow instead of handing it over to the payer's banking app. Growth from R$3.2 billion to R$15.3 billion in one year takes the channel past the pilot stage. Volume is still small compared with the R$35 trillion in annual Pix payments.

• Lei nº 14.478/2022, Brazil's legal framework (marco legal) for virtual assets, in force since June 2023: it defines virtual asset services, requires prior authorization, and creates a specific crime of virtual asset fraud (art. 171-A of the Penal Code).
• Decreto nº 11.563/2023, which names the Banco Central do Brasil as regulator and supervisor of virtual asset service providers (PSAVs, Brazil's term for VASPs), without overriding the jurisdiction of the CVM, Brazil's securities regulator, when the asset is a security.
• BCB Resolutions nº 519, 520, and 521 of 2025: the authorization regime for providers, conduct rules, segregation of client assets, the travel rule, and the link with the foreign exchange market. Dollar stablecoins are treated as FX transactions, not as exotic assets.
• Practical consequence: in Brazil, an inbound stablecoin flow used to pay a local supplier is not a way around FX rules, because it falls under Lei nº 14.286/2021 and Resolução BCB nº 277/2022.

Accepting payments in Brazil: structures, FX, fraud, and incidents

A foreign merchant has three ways, and only three, to accept payments from Brazilian consumers. The choice determines the approval rate, cost, tax treatment, and how long it takes to repatriate funds. With pure cross-border, the merchant collects in foreign currency from abroad through an international acquirer. It is the simplest route, but approval rates collapse because Brazilian issuers decline cross-border transactions en masse, and parcelado is not available. Local acquiring through a Brazilian entity requires a CNPJ and a domestic acquiring contract. It unlocks parcelado, Pix, and boleto, at the cost of a local presence and local taxes. With a local merchant of record, a third party collects in its own name in Brazil and pays the merchant abroad. This last setup is the most common among international software companies and platforms.

Foreign exchange is governed by Lei nº 14.286 of December 29, 2021, which replaced a body of rules dating back to 1935. Resolução BCB nº 277 of December 31, 2022 implements it. Two provisions directly affect a foreign merchant. The purpose of the transaction must be declared up to a US$50,000 threshold, with reporting responsibility shifting to the authorized institution. The regime also explicitly recognizes eFX providers, a status that lets fintechs without an FX license operate through a contract with an institution that has one. This is the regulatory entry point for most cross-border players in Brazil.

The largest security incident in Brazil's payment system occurred in July 2025. An attack on C&M Software led to the diversion of about R$800 million from its clients' reserve accounts. C&M Software is a prestador de serviços de tecnologia da informação (PSTI, an IT service provider) that connects institutions without direct access to the SPB and the SPI. No larger loss has ever been recorded against Brazil's financial system. The attack targeted the technical intermediary layer and relied on social engineering against its staff; it did not exploit any flaw in Pix itself.

• Regulatory response: PSTIs are now governed by Resolução BCB nº 498/2025, overhauled in January 2026 and then tightened by Resolução BCB nº 547/2026, with a separate cybersecurity component; minimum capital of about R$15 million for PSTIs, and a cap of R$15,000 per Pix or TED transaction for unauthorized payment institutions that access the SPB through a PSTI (Finsiders Brasil, 2026).
• Market impact: the technical barrier to entry is rising, outsourcing chains are getting shorter, and the question “Who is my PSTI, and what license does it hold?” is now part of due diligence for every Brazilian integration.
• Pix fraud: the main vector is still social engineering aimed at the payer, handled through the MED; MED 2.0, live since May 2026, improves the tracing of funds along the chain of receiving accounts. Resolução BCB nº 587 of September 18, 2026, adds the flagging of tax IDs, for individuals and businesses alike, involved in suspicious transactions: related transactions are rejected (except refunds), a flag can stay in place for up to five years, and the flagged person must be notified and can request a review, which the institution must answer within seven days (effective February 1, 2027).
• Payee verification: built into the rail. The DICT lookup returns to the payer, before confirmation, the payee's name, masked CPF or CNPJ, and key, never the account details. There is no need to build a confirmation of payee layer on top.

The Brazilian model, exported and challenged

Pix has served as a model for several Latin American central banks. Colombia's adaptation is the most complete. Bre-B, run by the Banco de la República, adopts the model's four defining features: a public rail, key-based addressing (llave), an interoperable QR code, and mandatory participation for institutions. Full interoperability opened on September 23, 2025, and mass rollout began on October 6, 2025, after several delays.

Mexico shows what separates the two paths. CoDi, launched in 2019 by Banco de México, is free for merchants and consumers alike, interoperable, and runs on SPEI. Adoption has remained low. In November 2025, Banxico and the Mexican Bankers Association publicly acknowledged that the public knew little about CoDi and DiMo. Being free and interoperable is therefore not enough to drive adoption. Pix adoption, by contrast, came from mandatory participation for institutions, distribution inside existing banking apps, and the ban on charging individuals. It also had a key directory that did away with typing in bank details.