BCB Resolution 587: What Changes in Your Fintech App

BCB Resolution 587, of September 18, 2026, changes the Pix regulation (Pix is Brazil's instant payment system) on three dates. Flagging a well-founded suspicion of fraud applies from the date of publication. Notifying the customer about it, hybrid billing and new communication duties take effect on February 1, 2027. Salary accounts get Pix Automático in July 2027.

The news and legal alerts from the week the rule came out explain what changed for users and institutions. This article reads BCB Resolution No. 587 from the perspective of those who build the product: what becomes a screen, what becomes a back-office routine and what becomes a rule in the billing system. It's a follow-up to what Brazil's Central Bank already requires from those who build the app.

In 2025, Wama designed and developed the app for Cappta, a payment institution that offers payment acquiring and white-label digital accounts. In an app from a regulated institution, every adjustment to the Pix regulation reaches the backlog with a set date.

What does BCB Resolution 587 change in a fintech app?

The resolution touches four main fronts of the product, and all of them call for a screen, a system state or a routine with a deadline. It adds to the map of limits and time windows the app already needs to display, which changed on October 1.

• Flagging a well-founded suspicion of fraud: blocking of keys and transactions since 09/18/2026; customer notice from 02/01/2027.

• Hybrid billing: boleto (Brazil's bank payment slip) and Pix Cobrança in the same charge, from 02/01/2027.

• Notices and monitoring: data incidents, the Special Refund Mechanism (MED) and Pix Automático controls, from 02/01/2027.

• Pix Automático in salary accounts: from 07/01/2027.

What does fraud flagging require from the screen and the back office?

A Pix participant can create an infraction notice to flag the CPF or CNPJ (Brazil's individual and company tax IDs) of a customer involved in a transaction with a well-founded suspicion of fraud (art. 78-HA). The flag is recorded in DICT, the Pix key directory, for five years (art. 78-HD).

The effect is immediate and harsh. Whoever created or accepted the notice rejects all Pix transactions of the user and account involved, as payer and as payee, except refunds (art. 89, § 2). It also rejects registration, portability and claims of that user's keys, and must communicate the reason a registration was refused (arts. 56, 68 and 70).

What the back office needs to have

1. Owner of the flag: whoever creates or accepts the notice is accountable for it and for its cancellation (arts. 78-HB and 78-HC).

2. Cancellation request: the flagged customer must be able to request a review.

3. Seven-day deadline: the institution decides whether to keep or cancel the flag within seven days of the request.

4. Record of the grounds: the reason for the decision is kept on file, in both cases.

From February 1, 2027, the customer receives a notice of the flag with, at a minimum, the date, the possibility of review and the channel to request clarification and cancellation. The message shown when a Pix is refused is a separate piece, the fraud-suspicion refusal message in version 7.4 of the user experience manual, which applies from March 2027.

At Milhas Pix, an airline miles marketplace with Pix payments, Wama built everything from the acquisition page to the offer management and transaction tracking screens. In a product like that, the transaction status screen is where the refusal needs to make sense to the person who tried to pay.

How does hybrid billing change the billing system?

Hybrid billing is a Pix Cobrança with a due date, presented so it can also be paid by boleto (art. 11-AA). It applies to regular billing boletos and to dynamic boletos not tied to a financial asset. Offering it is optional for the payee's institution, which must be the same one that issues the boleto.

The institution ensures consistency between the two schemes to prevent undue or duplicate payment. Once the boleto is paid, the corresponding Pix Cobrança is canceled, and any Pix that arrives later is rejected (art. 39, V). The operational steps are in the Pix Flows Manual, whose version 2.2 was released by BCB Normative Instruction No. 777, of September 18, 2026, also effective from February 1, 2027.

If the Pix still settles with the obligation already paid by boleto, the payee's institution refunds the full amount to the payer within 24 hours, using its own funds (art. 41-A, § 3). In practice, the charge now has a single state that both channels check before accepting money.

For a company that issues boletos through its bank, the decision starts with the product's billing model: offering the hybrid invoice only makes sense if its institution adopts it, and reconciliation needs to recognize which of the two channels settled the invoice.

What changes with Pix Automático in salary accounts?

From July 1, 2027, salary accounts can initiate transactions, but only Pix Automático ones. They remain barred from receiving other Pix transfers, except those sent by the National Treasury Secretariat and refunds (art. 3, VI, f, of the regulation).

For the app, this is an account with one door open and the others closed. The authorization screen and recurring payment management exist; regular transfers and receiving by key don't. Article 11-S, § 3, requires the payer's institution to offer the authorization journeys to all payers, and Resolution 587 clarifies that those in items c and d don't apply to salary accounts.

For those who charge, a new base of payers appears. The Pix Automático rules for subscription billing still apply to this base: a single authorization, a fixed amount or a cap set by the payer, and limited retries.

The notices and monitoring that take effect in February 2027

Article 32 gains three duties, all with an impact on the product.

• Data incident: notify the individual data subject of a security incident involving personal data in a Pix-related database, even when the institution didn't cause the incident and even when there's no relevant risk.

• Pix Automático: monitor and act against payees who send undue payment instructions or excessive authorization requests.

• MED: publicize the Special Refund Mechanism with a focus on vulnerable audiences, in advertising and customer service channels, with clear and accessible information.

The incident notice calls for a ready-made message template and a channel that reaches the data subject. Publicizing MED calls for help text written for people who read little, in the same place where the app already explains the link management area of the no-redirect journey.

Timeline: what to deliver by February and July 2027

The review back office should already exist, because flagging has applied since September. February concentrates almost all the screen and communication work.

How to put Resolution 587 into the scope of whoever builds the app

The path is to turn each article into a scope item with a date.

1. List the items in the table that apply to your institution: hybrid billing is optional, and salary accounts only matter to those who offer them.

2. Separate screen, system and routine: the notice is design, boleto and Pix consistency is engineering, the seven-day decision is operations.

3. Define who is accountable when there's more than one company in the arrangement. In a fintech that runs on BaaS, the Pix participant is accountable for the flag, and the client company's app still displays the notice and the channel.

4. Write everything into the contract with whoever develops it, with the effective date next to each deliverable.

At Wama, a single person is accountable for the project from briefing to deploy, and anything not written in the proposal is new scope. That's why regulatory items go in writing from the start, not as last-week adjustments.

Common mistakes

• Waiting until February for the back office. The seven-day review has applied since September 18.

• Merging the notice and the refusal message. The flag notice comes from the resolution; the message at the moment of the Pix comes from the user experience manual.

• Offering hybrid billing without a single state. Without it, a double payment becomes a refund paid with the institution's money.

Frequently asked questions

When does BCB Resolution 587 take effect?

On three dates. Fraud flagging, rejection of keys and transactions, appeals and participation apply since September 18, 2026. The flag notice, hybrid billing and the duties in article 32 take effect on February 1, 2027. Pix Automático in salary accounts, on July 1, 2027.

How long does the institution have to review a fraud flag?

Seven days from the customer's request. The institution responsible for the flag decides whether to keep or cancel it, cancels it when no evidence remains to support the suspicion, and keeps the grounds for the decision on file. If kept, the flag stays linked to the CPF or CNPJ for five years.

Is hybrid billing mandatory?

No. Offering it is optional for the payee's institution. Whoever offers it must issue its own boleto, ensure consistency between boleto and Pix, cancel the Pix Cobrança when the boleto is paid, and refund a duplicate payment within 24 hours, using its own funds.

Will salary accounts be able to receive Pix?

No. From July 1, 2027, they can initiate Pix Automático transactions, and only those, to pay recurring bills authorized by the account holder. Receiving Pix remains prohibited, with two exceptions: transfers from the National Treasury Secretariat and refunds of previous transactions.

Does the app need to change anything before February 2027?

It needs a working review path. Since September, the institution that flags a customer rejects their transactions and has seven days to respond to the cancellation request. In practice, this calls for a back-office routine and a customer service channel right now, even before the notice in the app.

If your fintech is going to fit Resolution 587 into the app and wants to handle screens, systems and deadlines in the same scope, talk to Wama.