PIX

Brazil's leading instant payment network, used by more than 170 million people, is now a checkout option for small businesses on PayPal's merchant platform, deepening the U.S. company's ties to the country's real-time payment infrastructure.

BCB has scheduled three major PIX compliance mandates within a 20-day window starting April 22. The deadlines cover NFC public availability, payment institution accreditation, and fraud prevention system migration.

PIX has more than 170 million users, representing over 90 percent of Brazil's adult population. The system accounts for approximately one-third of Brazil's online sales value.

Transaction volumes grew 24.3 percent year-over-year. The average PIX transaction reached R$ 456, a 7 percent annual increase.

Brazil's central bank rejected US criticism of Pix this week as the USTR maintains a formal investigation into the instant payment system. Colombian President Petro separately requested that Brazil extend Pix cross-border.

The NTE report, released March 31, stated that BCB 'created, owns, operates, and regulates' PIX, characterizing the central bank's dual role as giving the system preferential treatment over competing payment methods.

The POS figure marks a new threshold for real-time payment systems at physical retail. PIX's share has been built through QR code payments at merchant terminals rather than contactless NFC, which processed 1.

Resolution BCB No. 554, effective March 30, requires all direct participants in Brazil's instant payment system to configure minimum balance thresholds and optional automatic account blocking for their Conta PI settlement accounts at the central bank. The regulation follows a cyberattack on BTG Pactual that diverted approximately R$100 million from the bank's settlement account on March 22.

Three attacks on PIX participant settlement infrastructure diverted R$1.6 billion in 12 months through forged pacs.008 payment orders. Axur Research Team's analysis of the Plump Spider threat group documents the technical methodology from vishing-based initial access to digital certificate exploitation. BCB Resolutions 538 and 554 address the structural gap between PIX's resilient central systems and vulnerable institutional endpoints, with enforcement deadlines in March and May 2026.

Brazil's central bank created a regulatory working group with a June 30 deadline to propose rules addressing the exploitation of PIX transaction descriptions for harassment. The initiative, launched at the 28th PIX Forum Plenary on March 26, establishes six guiding principles balancing platform safety with payment system efficiency.

After R$6.5 billion in PIX fraud losses during 2025 and a 7 percent fund recovery rate, Brazil's central bank is enforcing MED 2.0, an upgraded refund mechanism that traces stolen money across multiple account hops with automatic blocks at each node. Supervisory penalties for non-compliant institutions begin in May 2026, completing a phased rollout that started with optional adoption in November 2025.

Resolution 554 gives PIX settlement participants three tools to prevent unauthorized fund withdrawals from their central bank accounts: a configurable floor balance that automatically rejects payment orders, a self-triggered account freeze requiring manual SPB-Web unblocking, and a backup channel for monitoring account statements independent of the RSFN network. The measures follow 76 critical incidents reported across the SPI in 2025, up 29 percent from the prior year.

The third major institutional fund diversion targeting Brazil's PIX ecosystem in under twelve months exposed R$100 million in BTG Pactual's central bank reserves to hackers on March 22, 2026. The bank recovered R$73 million and restored services within 24 hours while Federal Police investigate the attack that dispersed stolen funds across seven banks and into cryptocurrency.

Since going live in June 2025, PIX's automatic billing capability has maintained strong uptake, with EBANX reporting 34 percent monthly subscription growth and total volume increases of 41 percent per month. The system is projected to handle USD 30 billion in yearly throughput by mid-2027, creating a new channel for tens of millions of Brazilians without credit card access to participate in the subscription economy.

A six-month security gap at Brazilian payment institution Pefisa exposed registration data tied to more than 28,000 PIX keys, extending a pattern of recurring incidents that now numbers 23 since the instant payment system launched in November 2020 and raising questions about participant-level security enforcement across the ecosystem.

The upgraded fraud recovery mechanism introduces multi-layered account tracing and automated preventive blocks across up to five intermediate accounts, addressing the structural weakness that allowed 91 percent of disputed PIX funds to vanish before victims could act under the original system.

Brazil's contactless PIX feature completed its first year of operation with modest adoption figures. Despite processing over R$46 million in January 2026, tap-to-pay PIX remains a marginal feature within the broader PIX ecosystem, accounting for fewer than one in every 6,600 PIX transactions.

Security researchers have identified a new Android banking trojan that uses a live human operator to intercept and redirect Pix transfers at the moment of confirmation, exploiting the irreversible nature of instant payments to steal funds before victims detect the alteration.

Brazil's instant payment system is becoming a leading force in corporate treasury as B2B transfers now claim 46 percent of all PIX value despite representing just 3 percent of transaction volume, revealing a structural transformation in how Brazilian companies settle inter-business obligations.

Apple has been given until March 30, 2026 to respond to CADE's demands. The investigation centers on Apple's refusal to enable PIX por Aproximacao, the contactless tap-to-pay function of Brazil's instant payment system PIX, on iPhones. While the BCB rolled out the contactless PIX protocol and made it mandatory for