Brazil Can Reject Pix Payments Before Mandatory Notice Begins

Brazilian financial institutions can already stop a customer with a fraud mark from sending or receiving Pix at that institution. Refunds are the exception.

Resolution BCB 587 now makes the institution behind the mark responsible for it, sets a five-year outer limit and gives the customer a seven-day internal review. Yet the resolution delays its new mark-specific notification duty until 1 February 2027.

That sequence leaves a due-process gap. The payment consequence can operate before the bank must tell the customer when it placed the mark, that review is available and which channel handles the request.

The rejection is automatic, but not system-wide

A Pix participant can create a mark for its own customer when a specific transaction produces a founded suspicion of fraud. It can also become responsible for a mark by accepting an infraction notification sent through the Pix process.

Once it creates or accepts that notification, the institution must reject every Pix transaction involving the marked user as payer or recipient, as well as the account involved in the notification. Only refund transactions remain available. The same institution must reject a new Pix-key registration and cannot request portability or a claim of ownership for a key linked to the customer.

The restriction is broad inside the responsible institution. It is not a nationwide declaration that the customer committed fraud. Other participants can see risk information in the Pix identifiers directory, or DICT, and use it in their own controls. The mandatory transaction bar in Article 89 falls on the participant that accepted or created the mark.

Nor is rejection new. The BCB's September 2025 rule change already required a participant that accepted or created a fraud notification to restrict Pix initiation and receipt across the customer's accounts at that institution. Resolution 587 preserves that consequence while clarifying responsibility, cancellation and duration.

That history matters. The notice gap is not a grace period before a new payment block. It is a gap of more than four months before a new, explicit notice about a block that can already operate.

Suspicion starts the process, not proof

The legal threshold is a "founded suspicion of transactional fraud" tied to a specific Pix transaction. The resolution does not convert that suspicion into a finding of guilt.

The consolidated Pix regulation says participants must apply minimum criteria indicated by the BCB in a separate document. Resolution 587 itself does not list those criteria or a minimum evidence packet. The DICT operating material instead describes the workflow: a customer's institution can create a mark after identifying founded suspicion, while acceptance of a notification from another participant can generate a mark through the infraction process.

That division puts the first factual decision with the financial institution. The BCB operates the rulebook and directory, but its consumer guidance says the central bank neither creates nor removes marks. Only the responsible institution can cancel one.

The five-year term is therefore a ceiling, not a prediction. Article 78-HD keeps a mark linked to the CPF or CNPJ, and to the Pix key when available, for five years from registration. Article 78-HC allows earlier cancellation and requires it when the basis for founded suspicion no longer remains.

Public data do not show how often that happens under normal operations. The BCB has not published the current mark population, median duration, current cancellation rate or a system-wide false-positive rate alongside the new resolution.

One older disclosure shows why those measures matter. A September 2025 BCB working-group presentation reported that 131,000 marks were cancelled in October and November 2024 during an initial data-cleaning exercise. It also reported an 80% reversal rate. The presentation did not identify the full population or selection method behind that rate, and it did not classify every reversal as a false positive.

Those figures cannot establish that most live marks are wrong. They do establish that correction is not a theoretical edge case.

Review begins now, notice comes later

Most of the new safeguards took effect when the resolution was published on 18 September 2026. A marked customer can ask the responsible institution to cancel the mark. The institution must decide within seven days, cancel when supporting elements no longer exist, and retain the reasons for maintaining or removing it.

The BCB's own release separates one provision from that immediate package. From 1 February 2027, the institution that creates a mark must notify the user of the registration date, the possibility of review and the channel for questions and a review request.

Interim notice is less complete. A rejected Pix-key registration must come with a reason. A customer may also discover a problem through a failed payment, then contact the institution about active marks. Neither route provides the mark-specific notice package that becomes mandatory in February.

The seven-day process is an internal first review, not an external appeal. The same institution that owns the mark decides whether to maintain it. Resolution 587's separate ten-day appeal provision applies to institutions challenging BCB decisions. It does not create a second-stage appeal for a marked customer.

The missing metric is time to correction

Fraud controls lose value if institutions hesitate before stopping a mule account. They also lose legitimacy if a legitimate customer cannot learn why ordinary payments fail.

For banks, the implementation target should be earlier than February. The data needed for notice already exist: registration time, responsible institution, transaction reference and review channel. Delaying communication while keeping rejection live creates avoidable complaints and makes the seven-day right harder to use.

For the BCB, the next disclosure should cover active marks, cancellation rates, review outcomes and median time to removal. A five-year ceiling sounds severe, but its practical effect depends on how many marks survive review and how quickly errors are corrected.

Resolution 587 improves accountability by naming the institution responsible for a mark and forcing a reasoned review. Its sequencing is weaker. A payment restriction should not become easier to impose than to explain.