Brazil’s Central Bank tightens capital rules for fintechs

The regulator introduced two key measures. The first increases minimum capital and net worth requirements for regulated institutions, now based on the type of financial activity performed rather than on the institutional classification, whether payment or financial institution. The second targets the termination of irregular “shadow accounts” (known in Portuguese as contas-bolsão).

The move comes after a wave of cyberattacks on Pix, Brazil’s instant payment system, and after police investigations revealed that some fintechs had been used by organized crime groups, including in the so-called Hidden Carbon operation.

Bank and fintech representatives largely welcomed the measures.

Ailton de Aquino, the Central Bank’s head of supervision, said the change “levels the playing field in the national financial system.” He called the move a “clear” signal that innovation and security must go hand in hand. He acknowledged that non-banking institutions would be the most affected.

Capital requirements for payment institutions will increase from the current range of R$1 million to R$9 million to between R$9.2 million and R$32.8 million. For banks, the range will rise from R$7 million–R$77 million to R$56 million–R$96 million, depending on the activities performed. Each additional activity requires additional capital.

The Central Bank estimates that about 500 institutions will need to bolster their capital. Mr. Aquino said these institutions currently face R$5.2 billion in capital requirements, a figure that could rise to R$9.1 billion by January 1, 2028, when the transition period ends.

“I don’t believe a payment institution with an initial capital of R$1 million can meet the demands of technology, auditing, and sound structure,” Mr. Aquino said. He attributed the changes both to the natural evolution of regulation and to recent events. “In recent months, we’ve witnessed unpleasant situations in the national financial system. This is part of an evolutionary process, but also a response.”

He also recalled a recent need to ban institutions from using coworking spaces as their official contact points with the Central Bank. “We had to pass a very curious rule recently: an institution can’t have a coworking space as its contact point with the Central Bank. We reached the absurd point of trying to supervise a payment institution headquartered in a coworking space.”

Mr. Aquino gave the press briefing alongside Gilneu Vivan, the Central Bank’s director of regulation, and Izabela Correa, director of consumer affairs and conduct supervision.

New methodology

The new methodology for calculating minimum capital includes an amount for initial operating costs and, for companies heavily reliant on technology infrastructure, an additional amount to reflect that. Requirements will vary depending on whether the institution performs operational, investment, or funding activities, including issuing credit, receiving deposits, or offering custody services.

An extra R$30 million in capital will be required for institutions that use the word “bank” or similar terms in their branding, in any language, including companies such as Nubank.

Mr. Vivan said the new rules increase investors’ “skin in the game,” encouraging stronger compliance with regulations and internal controls. Institutions will be able to either increase their capital or scale back their activities to reduce their capital requirements.

Those unable to comply, Mr. Aquino said, will need to undergo an “orderly exit,” corporate restructuring, or be absorbed by other firms. He stressed, however, that the rule’s goal is not to shrink the number of institutions under Central Bank supervision but to create fairer competition.

A transition period is in place for current operators and those with pending applications to launch or expand services. Until June 30, 2026, capital and net worth requirements will remain unchanged. After that, the minimums will rise gradually every six months, with full implementation by December 31, 2027.

Crackdown on shadow accounts

The Central Bank also introduced new rules targeting “shadow accounts” that mask financial transactions. Starting December 1, institutions must terminate these accounts if they are used to process payments, receipts, or offsets on behalf of third parties with the intent to obscure or substitute financial obligations. Institutions will be responsible for identifying such irregular use.

Shadow accounts consolidate operations from multiple clients into a single account, commonly used in marketplaces and currency exchange. But the model has been exploited by criminal organizations. In this setup, a fintech holds an account at a bank and creates sub-accounts for end users, making it difficult to trace the money’s origin and destination. This practice has appeared repeatedly in police investigations.

“Obviously lawful services, such as eFX [electronic foreign exchange transfers], are not being targeted,” Ms. Correa said.

In recent months, the Central Bank has rolled out several measures to close security loopholes. It limited TED and Pix transfers by unauthorized payment institutions and shortened the window for unregulated fintechs to operate without a license, from 2029 to May 2026. It is also drafting new rules for banking-as-a-service platforms.