Published
9 MIN READ
Brazil's SAC decree: what changes in your fintech app
The SAC decree (SAC is Brazil's mandatory customer service channel), Decree No. 13,135/2026, takes effect on November 2, 2026 and explicitly covers fintechs that serve consumers through an app. The app's chat needs human service from 8 a.m. to 8 p.m., every day, with options to cancel and to talk to a person on every screen of the service flow.
This article reads Decree No. 13,135 from the point of view of whoever builds the product, with the text checked on the Planalto (Brazil's presidency) website on October 16, 2026. Determining how your operation fits stays with your legal team.
In 2025, Wama designed and developed the app for Cappta, a payment institution that offers payment acquiring and a white-label digital account. It's the kind of app the decree now names, and one that already carries what the Central Bank and the app stores require of the app.
What does the SAC decree change in a fintech app?
The decree replaces Decree No. 11,034/2022 and takes effect twenty days after its publication in the Official Gazette on October 13 (Arts. 24 and 25). The 2022 rule gave 180 days to adapt; this one gives twenty. In the product, the change lands in six places:
App chat: a real-time person from 8 a.m. to 8 p.m., seven days a week (Art. 12, § 1).
Customer service AI: allowed for triage and resolution, with a way out to a person (Art. 3, § 3).
Menus: five levels at most, with cancellation and human service on all of them (Art. 13).
Cancellation: through the channel used to sign up, effective immediately, with an electronic receipt (Art. 20).
Records: ticket number, history and message retention for 90 days (Arts. 18 and 19).
Improper charges: suspension within 48 hours (Art. 21, § 3).
The mandatory phone line, free service and a response within seven calendar days still apply. The website keeps the obligations of the website as a fintech compliance piece; the decree affects the app, the chat and operations.
Is your fintech covered by the SAC decree?
It is, if it serves consumers digitally and is regulated or supervised by the Central Bank. Art. 1, sole paragraph, item II, includes providers of financial, payment or credit services through a digital platform. The 2022 decree wasn't explicit.
Whether it applies depends on there being a consumer relationship. In the reading of a lawyer specializing in financial regulation, interviewed by a legal news site on October 14, it covers banks with individual account holders, card issuers, payment institutions with digital accounts and personal-loan finance companies. As a rule, business relationships stay out, such as an acquirer with a merchant, which Brazil's Superior Court of Justice (STJ) has already treated as not being a consumer relationship.
SAC isn't the ombudsman. The ombudsman is the second level under BCB Resolution 28, with the channels a payment institution's website publishes. SAC is the front door, and that's what the decree rebuilds.
Does the app chat need people from 8 a.m. to 8 p.m.?
Yes. The decree defines an electronic channel as any voice, text or video service with real-time interaction with a person, including website and app chats and instant messaging (Art. 3, § 2). In-app support chat is SAC.
Art. 12 adds up three rules. At least one electronic channel runs 24 hours a day, seven days a week. On it, from 8 a.m. to 8 p.m., the customer talks to a person in real time. The Ministry of Justice, in a note dated October 13, 2026, sums it up this way: AI can be used, but it can't prevent human service.
In the product, that calls for a human queue integrated into the chat, a business-hours rule and the estimated wait time, which Art. 13, § 2 requires showing when the customer asks for a person. Anyone who has designed the part of the screen Pix already regulates knows a waiting state is a screen too.
What can and can't customer service AI do?
AI can handle triage, internal routing and resolving the request, as long as the customer has the option of talking to a person in real time during the hours the decree sets (Art. 3, § 3). The decree doesn't ban chatbots. It bans the chatbot that becomes a wall.
Rule | Article | What it becomes in the product |
|---|---|---|
A person when the customer asks | 4, VIII | A transfer option visible from the first message |
No data required before service | 8, sole paragraph | No CPF (Brazil's taxpayer ID) or login required to start or to call a person |
No repeating the request | 6, II, and 7 | The whole conversation with the AI goes to the agent |
No advertising | 6, I | No credit or card offers in support, not even while waiting |
At Wama, AI comes in during the build, with Claude Code and Framer's agents, and every result goes through human review before reaching the client. The decree asks for the same split in customer service: automation handles the volume, and a person responds when called, already with the context.
What happens to menus and cancellation in the app?
The chat can use five levels at most to resolve the request and can't send the customer to another channel, except in person when essential (Art. 13). On every level, including the first, two options stay visible: cancel the contract or service right away, and talk to a person.
Art. 20 settles cancellation. The request is accepted through SAC and through every channel where sign-up happens, without requiring another channel, effective immediately, except for justified technical processing, and with an electronic receipt. If the app sells the additional card in three taps, it cancels through the same app.
Ticket number, history and what the system needs to store
Every service interaction generates a ticket number, and the agent sees the history of active requests and those tied to the same issue (Art. 18). The customer gets that history within five business days on request, and it's kept for six months after resolution. Recordings and messages exchanged in SAC are kept for at least 90 days (Art. 19), which includes the conversation with the AI.
Everything follows the LGPD, Brazil's data protection law (Art. 5), and the contract with the chat vendor needs to say who is responsible for user data. The 48-hour deadline to suspend an improper charge (Art. 21, § 3) calls for integrating customer service with the billing engine, not just a ticket.
Phone, emergencies and Procon: what stays outside the app
The phone line is still mandatory. From 8 a.m. to 8 p.m., a person answers within 20 seconds in 80% of requests and within 300 seconds in the rest, and a dropped call is returned within 300 seconds with the same ticket number (Arts. 14 and 15). Urgent requests get immediate service at any hour (Art. 17), with the cases still to be defined by regulators.
The specialist quoted above gives card theft and account takeover as examples of emergencies, situations that connect with fraud flagging and MED in the app. The list is rounded out by publishing the channels on the website and in the app (Art. 9), accessibility on the channels (Art. 10), in line with what the law already requires for website accessibility, and a phone line for the Procons, Brazil's consumer protection agencies (Art. 22).
How to put the SAC decree into the app builder's scope
A backlog order that fits before November 2, leaving for later what the regulator still has to detail:
Map where the app provides service today: chat, help center, messaging and phone.
Put talk to a person and cancel on every level, with five levels at most.
Connect the human queue to the chat from 8 a.m. to 8 p.m., with estimated wait time.
Remove the upfront data requirement from the AI assistant and pass the context to the agent.
Accept cancellation through the sign-up channel, with a notice of any charges and a receipt.
Generate ticket numbers and history, with 90-day and six-month retention.
Connect the 48-hour improper-charge trigger to the billing engine.
At Wama, what isn't written in the proposal isn't in scope. That's why the decree goes into the project as a list of requirements with the article next to each one, not as an adjustment after launch. And a single person runs it from brief to deploy, so whoever reads the rule is whoever designs the screen.
Common mistakes
Turning off the chatbot out of fear of the decree. AI is still allowed; what changes is the way out to a person.
Requiring login before opening the chat. Art. 8 prohibits making service conditional on upfront data.
Sending people who want to cancel in the chat to the phone. Arts. 13 and 20 prohibit it.
Offering products while the customer waits. Advertising in SAC is prohibited (Art. 6, I).
Frequently asked questions
When does the new SAC decree take effect?
On November 2, 2026. Decree No. 13,135 was signed on October 9, published in the Official Gazette on October 13 and takes effect twenty days after publication (Art. 25). It revokes Decree No. 11,034 of 2022, which had given 180 days to adapt.
Does the SAC decree ban chatbots?
No. Art. 3, § 3, allows automated procedures, including artificial intelligence, for triage, routing and resolving requests. The condition is guaranteeing consumers the option of real-time service by a person, from 8 a.m. to 8 p.m., every day, accessible at any level of the service flow.
Does a fintech that only serves businesses have to follow the decree?
It depends on the relationship. The decree assumes a consumer relationship, and relationships such as an acquirer with a merchant are, as a rule, business relationships, according to STJ decisions cited by specialists. If the fintech also serves individuals as consumers, that part of the operation is covered. Confirming how it applies is up to legal.
Can human service be phone-only?
No. The decree requires human service from 8 a.m. to 8 p.m., seven days a week, both on the phone (Art. 14, § 1) and on electronic channels, such as the app chat (Art. 12, § 1). Outside those hours, at least one electronic channel keeps running and can be automated.
How long should SAC conversations be stored?
Call recordings and voice or text messages exchanged on SAC channels are kept for at least 90 days from the interaction (Art. 19). Each request's history stays available for at least six months after resolution and goes to the customer within five business days.
If your app needs to reach November 2 with chat, cancellation and history designed the way the decree requires, talk to Wama.
