Published
9 MIN READ
Journey without redirection (JSR) in the fintech app
The journey without redirection is the way to pay with Pix, Brazil's instant payment system, without leaving the app or website where the purchase started. The customer links the account once, at the institution where it is held, and then confirms each payment with biometrics in the initiator. Since April 22, 2026, every mandatory Pix participant must offer it.
For whoever offers the account, it creates new screens: the link confirmation, the management of linked devices, and the response to a payment that arrives from outside the app.
At Wama, financial products are delivered projects: in 2025 the studio designed and developed the app for Cappta, a payment institution that offers payment acquiring and a digital account in white label, with the interfaces designed in Figma. This text is a product slice of the guide on what the regulation requires of a fintech's website and app.
What is the journey without redirection, and what changed in 2026?
The journey without redirection (JSR, from the Portuguese "jornada sem redirecionamento") is the Open Finance payment initiation service in which the customer authorizes the Pix inside the initiator's environment, without opening the bank app for each purchase. BCB Resolution No. 406, of August 2024, splits the service into two stages: account linking and payment transaction.
The calendar closed this year. BCB Resolution No. 541, of December 18, 2025, extended the obligation to all account holders that are mandatory Pix participants: production testing starting February 6, 2026, and offering to the general public starting April 22.
Version 2.2, tested between February and April, brought the journey to business accounts, to desktop, and to Pix Automático (recurring Pix). Contactless Pix in digital wallets also runs on the JSR, and today's change to it is covered in the text on the end of the US$ 100 cap on contactless Pix.
Who does what in the journey without redirection?
Three actors share the journey: the customer, the account-holding institution, and the payment initiation service provider (ITP, from the Portuguese "iniciadora de transação de pagamento"), which can be a digital wallet, an online store, or a management system. The central rule is in Resolution 406: authentication and link confirmation happen in the account holder's environment, and the confirmation of each payment, in the initiator's environment.
Stage | Account holder | Initiator (ITP) |
|---|---|---|
Link | Authenticates the customer, checks that the request is theirs, and shows the authorization screen | Collects consent, receives the customer back, and generates the credential on the device |
Credential | Receives and stores the credential component to authenticate later | Requests the customer's action and the authorization to send the component to the account holder |
Payment | Authenticates with the linked credential and runs its own security checks | Collects biometrics, sends risk signals, and confirms the transaction on its own screen |
Management | Offers an area to view and revoke links | Also offers an area to view and revoke links |
Liability | For its own environments and records | For its own environments and records, including a failure that prevents the account holder from authenticating |
The last row comes from Article 5 and weighs on the contract. If your fintech offers accounts under another institution's license, the account holder before Open Finance is usually the licensed one, and the split of screens between the two needs to be in writing, as in every operation of those who operate under a partner institution's license. The same care applies to the digital account offered under another company's brand.
What does the link screen need in the account holder's app?
Linking is the only moment with a redirect: the customer leaves the initiator, enters the account holder's app, authenticates, and confirms. The documentation of a banking infrastructure provider describes the sequence the account holder runs:
Show the authentication screen with the access the customer already uses in the app.
Check that the authenticated CPF (individual taxpayer ID) or CNPJ is the same as in the link request. A mismatch blocks the link, so that someone else cannot approve it.
Build the authorization screen with the consent data received from the initiator.
Confirm success and send the customer back to the initiator, where they create the credential with biometrics.
This screen decides whether the journey takes off. An Open Finance infrastructure company, in a May 2026 text, notes that the gain only appears when the link works on the first try. The authorization text needs to say, without jargon, that a third party will start initiating Pix from that account, and it falls under the same bar as the experience requirements Pix already imposes on the screen.
At Wama, a flow like this stays with a single person, from brief to deploy, with no account-management layer between who decides and who executes. AI speeds up building the screens; the decision about what the authorization shows remains human.
What does the link management area need to allow?
The official device link FAQ from Open Finance Brasil is direct: account holder and initiator must offer a link management environment, because both must allow revocation. In the version 2.2 pilot, the management area with limit editing appeared as a minimum requirement of the account holder's journey.
In practice, the customer needs to be able to:
see active links, with the initiator and device of each one;
revoke any link, at any time;
change the link's term, which is five years under IN BCB No. 509, according to the FAQ, with an option for an indefinite or shorter term;
edit the journey's limits.
One detail changes the screen copy. Link and consent are separate entities, so revoking a link does not cancel scheduled payments that were authorized through it. In Wama's reading, the revocation screen needs to spell this out and point to where the schedule is canceled, because the customer who revokes usually thinks they have ended everything.
If your fintech or SaaS wants to be the initiator
There are two paths. The first is a payment institution authorized as an initiator that provides the journey as a special activity, opened by BCB Resolution No. 407. It requires an additional US$ 400,000 of minimum share capital and net equity for this activity and notice to the Central Bank ninety days in advance. The second is integrating a partner initiator via API, the path of almost every SaaS.
In both cases, the product gains the link request, the credential creation, the payment confirmation, and its own management area. Version 2.2 also brought Pix Automático into the journey, which matters to anyone selling recurring billing for a subscription product.
For Milhas Pix, a marketplace for buying and selling airline miles with payment via Pix, Wama built the SaaS platform, management system, website, and landing pages, from the acquisition page to the offer management and transaction tracking screens.
On the account holder's side, the FAQ's list of certifications gives a measure of the work: JSR functional, payments functional, FAPI security by the OpenID Foundation, and a FIDO server certified by the FIDO Alliance, the latter waived for those who already use one.
Optimized Journey: what goes into the same flow
The Optimized Journey (Jornada Otimizada) brings together, in a single flow, payment initiation and data sharing. In the version tied to the JSR, the customer authorizes in the same step the link and the sending of balance and limits to the initiator.
The testing rules are in IN BCB No. 725, in force since April 22, 2026: offering it is optional for initiators and data recipients and mandatory for account holders and data transmitters. The Optimized Journey pilot ran from April 22 to June 22, also cites IN BCB No. 740, of May 29, and opened to the general public on June 22, 2026.
In the pilot, the journeys were checked by a questionnaire based on the Open Finance User Experience Guide, a review that adds to the approvals a financial app goes through before the store.
Common mistakes in the journey without redirection
Treating the link authorization as a login screen. The customer needs to understand they are giving a third party the power to initiate Pix, not just logging into the app.
Hiding link management in a security menu. It is mandatory on both sides and needs to be where the customer looks for what they authorized.
Canceling schedules along with the link. The specification separates the two; mixing them generates complaints on both sides.
Separating who designs from who knows the regulation. Whoever is going to hire product design for a fintech needs someone who reads the resolution before opening Figma.
Frequently asked questions
Is the journey without redirection mandatory for my fintech?
It is mandatory for every account-holding institution that is a mandatory Pix participant, with offering to the public since April 22, 2026, under BCB Resolution No. 541. Being an initiator is optional. Those who use another institution's license need to check in the contract who answers for each screen.
Does the customer ever need to open the bank app?
Yes, once, for the link. Authentication and link confirmation happen in the account holder's environment, as BCB Resolution No. 406 requires. After that, each payment is confirmed with biometrics in the initiator, with no new redirect while the link is valid.
Does revoking the link cancel a scheduled Pix?
No. According to Open Finance Brasil's official FAQ, link and consent are separate entities, so revoking the link does not cancel scheduled payments authorized through it. The customer cancels the schedule separately, and the revocation screen should say so.
How long does a device link last?
Five years, under IN BCB No. 509 cited in Open Finance Brasil's official FAQ. The account holder must let the customer change that term to indefinite or to less than five years, which calls for a term field in the link management area.
Is contactless Pix the same as the journey without redirection?
No. The journey without redirection is the Open Finance service that lets you pay without going to the bank app. Contactless Pix is one use of it: the digital wallet linked to the account pays by NFC at the card terminal. Since October 1, 2026, it follows the account's general limits.
If your fintech is going to review its link and management screens or design an app that is born inside the journey, talk to Wama and bring to the first meeting the list of screens in the Pix and Open Finance environment.
