Resolutions CMN 5.274/2025 and BCB 538/2025 (published Dec 18, 2025) impose 14 minimum mandatory cybersecurity controls on financial and payment institutions, including fintechs, brokers and distributors, effective and enforceable from March 1, 2026. They require an annual independent penetration test with documentation and action plans retained for five years, plus Pix-specific safeguards such as multifactor authentication for admin access, logical/physical system isolation, dedicated isolated cloud instances, and end-to-end integrity validation before digital signatures.
Home › Founders News › Regulations
New Central Bank cyber rules hit fintechs: 14 controls, annual pentest from Mar 2026
Why this matters for founders
Fintech and payments founders under Banco Central authorization must now be able to show concrete technical evidence of the 14 controls during supervision, so budget for an independent annual pentest and isolate any Pix infrastructure before an inspection asks for it.
Source: Grant Thornton Brasil
Related updates
More that helps you.
Tax reform: startups must fill CBS/IBS fields on e-invoices from Aug 3, 2026
Under Brazil's consumption tax reform transition, completing the new CBS and IBS fields on electronic invoices (NF-e, NFC-e and transport documents) became mandatory on August 3, 2…
Brazil Pix rule IN BCB 766: 80-day MED dispute window, layered fraud tracing
Instrucao Normativa BCB no 766 (published in the DOU on 29 July 2026) upgrades Pix fraud handling in phases. From 10 August 2026 a layered tracking system (a new transaction-depth…
New BCB Pix antifraud rules phase in Aug 10 and Sep 1, 2026; MED window jumps to 80 days
Via Instrução Normativa BCB nº 766, the Banco Central rolls out Pix security changes in two phases: layered fund tracing plus new infraction-notification and value-recovery procedu…
Brazil phases in higher minimum capital for Pix payment institutions from July 2026
Under Joint Resolution 14 (National Monetary Council and Banco Central, Nov 2025), prepaid payment institutions offering Pix must hold R$17.4m in minimum capital (R$12.4m without P…
Get briefs like this tuned to you.
In the app, Founder Briefs are personalized to your country, industry and stage, and you can save the ones that matter.
See plans →
Keep exploring
Related across the site
ToolDocuSignDocuSign lets you send documents for legally binding electronic signature and track their status. It handles contracts, NDAs, offer letters, and other agreements with an audit trail.ToolGustoGusto runs full-service payroll for US businesses, handling paychecks, tax filing, and direct deposit, plus benefits, onboarding, and contractor payments. It automates federal, state, and local payroll tax compliance.ToolLegalZoomLegalZoom helps you form an LLC or corporation and access legal documents, registered agent service, and attorney consultations. It walks non-lawyers through business formation filings.Term409A ValuationAn independent appraisal of a private company's common stock, used to set the strike price for employee stock options in the US.Case studyReginald F. LewisTLC Beatrice InternationalChecklistFind a small business lawyer you trustFigure out what legal help you actually need, vet and hire the right small business lawyer, and control costs with clear scope and smart preparation.