Financial Market: Main news from October and November
Please confirm you are human to start the audio.
Financial market 26/10 to 30/10
Last Friday (23), the Central Bank of Brazil (BCB) issued BCB Resolutions Nos. 601, 602 and 603, introducing new measures concerning transparency in credit transactions, proactive offers of financial products and services, and credit offers during the initiation of Pix transactions. BCB Resolution No. 601 establishes the “Consolidated Debt Dashboard”, an electronic platform designed to consolidate information on customers’ financial obligations, debt repayment capacity, credit simulations and risk alerts. BCB Resolution No. 602 establishes requirements for selective authorization to receive advertisements and individualized proactive offers, including specific rules applicable to customers in circumstances requiring enhanced attention and minimum criteria for identifying such customers. BCB Resolution No. 603, in turn, amends the Pix Rulebook to regulate credit offers during transaction initiation, providing, among other requirements, for prior user authorization, a minimum 24-hour period before such authorization becomes effective, the availability of a credit simulator and an interface for reviewing contracted credit transactions, as well as restrictions on certain types of transactions. The new rules will enter into force between March and July 2027.
BCB Resolution No. 601 of 10/23/2026
On Tuesday (27), the President of the Central Bank of Brazil, Gabriel Galípolo, announced that the authority intends to introduce additional measures to address over-indebtedness before the end of 2026. The statement coincided with the release of the Financial Stability Report (REF) for the first half of 2026, according to which borrowers classified as at-risk totaled 20.3 million individuals in June 2026, representing 17% of all borrowers in the Brazilian National Financial System. On that occasion, Galípolo emphasized that BCB Resolutions Nos. 601, 602 and 603, issued on October 23, constitute an initial set of measures aimed at mitigating risks associated with excessive indebtedness, particularly through the regulation of proactive credit offers targeting customers experiencing heightened financial vulnerability, recurring use of revolving credit or persistent payment defaults. According to the President, these initiatives are aligned with international practices for the treatment of consumers facing greater exposure to over-indebtedness risks and form part of a regulatory agenda expected to be complemented by further measures throughout the year.
New measures against over-indebtedness should be announced sometime in 2026, says Galípolo
On Wednesday (28), the possibility of revising the tax treatment applicable to certain currently tax-exempt fixed-income securities resurfaced in financial market discussions. According to press reports, the government is reportedly considering alternatives involving the application of the Tax on Financial Transactions (IOF) to securities, a discussion that could encompass instruments such as LCIs, LCAs, CRIs, CRAs and tax-incentivized debentures. In parallel, market participants and industry associations have been discussing the potential impacts of such changes on competition among investment products and on financing mechanisms for the real estate, agricultural and infrastructure sectors. The issue follows previous discussions concerning the taxation of tax-incentivized securities, and, to date, no draft regulation has been published or official announcement made detailing any potential changes. On October 29, however, the Secretary of the National Treasury clarified that there is currently no proposal under consideration to impose the IOF on these securities, although the government continues to assess alternatives to reduce tax distortions among investment products.
Treasury denies plan to tax tax-exempt investments with IOF at this time
On Friday (23), the President of the Brazilian Securities and Exchange Commission (CVM), Otto Lobo, stated that the supervisory infrastructure of the Brazilian capital market should evolve toward models based on asset tokenization and artificial intelligence-powered monitoring. During the 4th Investment Funds Law Congress, the President emphasized that the growth of the investment fund industry, comprising more than 34,000 structures and aggregate net assets exceeding BRL 11 trillion, requires new supervisory mechanisms capable of keeping pace with the scale and speed of market transactions. According to Lobo, the infrastructure currently operated by exchanges and central securities depositories will continue to coexist with an environment based on distributed ledger technology (DLT), which may incorporate features such as automated settlement, continuous audit trails, digital identification of asset holders and compliance mechanisms embedded directly into digital assets. The President also reported that the CVM's Tokenization Working Group is conducting tests involving different DLT networks for the issuance of native digital assets and the assessment of institutional use cases, emphasizing that market integrity remains a central consideration in the development of these initiatives.
On Friday (23), the Central Bank of Brazil launched a public consultation on a draft joint resolution with the National Monetary Council (CMN), establishing criteria for the distribution of funding products by financial institutions and other institutions authorized to operate by the Central Bank. Among other measures, the proposal provides for mandatory assessments of product suitability for customers' profiles, the implementation of customer best-interest and distribution policies, rules for identifying and mitigating conflicts of interest, transparency requirements concerning remuneration and economic incentives, and enhanced governance and supervisory mechanisms. The draft also establishes obligations to disclose information on risks, costs, remuneration and product recommendation criteria, as well as prohibitions on practices considered unfair or potentially restrictive of competition between issuers and distributors. If approved, the regulation will enter into force on January 1, 2028, with a transition period until June 30, 2028, for existing contracts. Comments on Public Consultation No. 131/2026 may be submitted until January 24, 2027.
Financial market 02/11 to 06/11
Last Wednesday (4), the Central Bank of Brazil (BCB) published on its blog a survey conducted in June 2026 showing that the Brazilian BaaS market comprises 79 providers and 5,533 contracting entities, most of which are not regulated by the BCB. Most providers operate as payment institutions, followed by direct credit companies (SCDs), banks and finance companies. The analysis, based on a sample of 68 providers, found that 97.1% use or provide services through APIs, and that 77.9% of those providing APIs have adopted specific security controls for these interfaces. The study also indicates that only 47.5% keep an inventory of third-party software components. On fraud prevention, 86.4% monitor atypical behavior and 84.8% apply preventive blocking of suspicious transactions. Supervised institutions also reported 99 significant cyberattacks to the BCB through September 2026, compared with 76 in all of 2025. The article notes that the increase in reports also reflects institutions’ greater detection and reporting capacity, not necessarily an equivalent rise in the number of incidents. According to the authors of the survey, the interconnection between participants and the speed of automated transactions call for specific attention to operational resilience, and controls over authentication, authorization, operational limits, certificate management, component inventories, environment segregation, audit trails, reconciliation and continuous monitoring should be treated as core elements of ecosystem protection, rather than merely ancillary technology requirements.
Last Thursday (5), the Brazilian Credit Guarantee Fund (FGC) announced that it had identified unauthorized access to investors’ personal information within its environment. The data accessed include names, taxpayer identification numbers (CPF), dates of birth and email addresses, as well as information on the guarantee payment, taxes withheld and the distribution channel through which the guaranteed investment was made at the liquidated institution. The suspected incident was identified on October 26, and since then the FGC has restricted access to the affected environments, blocked unauthorized accounts, preserved evidence and reviewed its permissions and security controls. According to the FGC, there is so far no evidence that the data has been disclosed or misused, nor of any financial loss, but the investigation is continuing with specialists to determine the extent of the access and whether the information was copied, disclosed or misused. The Brazilian National Data Protection Authority (ANPD) has been notified and will receive further information as the investigation progresses. The FGC warned that the data could be used to make fraudulent contacts more convincing, including in attempts at identity misuse or to obtain payments. It therefore advised investors to be especially cautious with messages, calls and emails that mention personal information or the guarantee payment, particularly from anyone claiming to represent the FGC or other institutions, and to confirm information on the payment process only through official channels, such as the email address [email protected].
Last Tuesday (3), Binance published a preliminary report on the hack that took place on October 29, which resulted in the theft of USD 6.3 billion in crypto-assets and is considered the largest attack in the industry’s history. According to the company, the breach began in June, when a member of the wallet development team downloaded a tampered artificial intelligence tool. In September, a second engineer downloaded a malicious code repository after taking part in a fake job interview. In October, the attacker used the compromised computer and an internal AI tool to take control of wallet developers’ machines and, using stolen credentials, ran a malicious script to carry out the attack. Right after the incident, Binance temporarily suspended crypto withdrawals and deposits, including in its Brazilian operations. The company stated that it has set aside more than USD 6.34 billion to cover the losses, that it will reimburse affected customers, and that in Brazil customer funds remain segregated from the exchange’s own assets, as required by BCB rules. Binance also announced increased investment in AI-based detection and the creation of a security research fund.
Binance case raises concerns about the security of cryptocurrency exchanges
Hackers used a fake job interview before stealing $6.3 billion from Binance
Last Tuesday (3), the National Council of Justice (CNJ), the Central Bank of Brazil (BCB), the Brazilian Notarial College and the registrars B3, Cerc and Núclea signed technical cooperation agreements to strengthen oversight of the ownership and transfer of court-ordered government debts (precatórios). Aiming to improve the management, traceability and transfer mechanisms for these transactions and to strengthen coordination among the participating institutions, the initiative provides for the development of an infrastructure linking court records to the registries used by the financial system. The measure is intended to make it possible to track the chain of transfers, identify the holder of each credit and expand regulators’ supervisory capacity. Registrars will contribute on a complementary basis to the integrity of records, the prevention of duplicate transactions and the preservation of transaction histories. According to CNJ President Justice Edson Fachin, the initiative also advances the standardization of the processing and monitoring of precatórios and small-value payment requests (RPVs). The structure is also expected to improve the information available for valuing these assets, whose price depends on both the legal status of the credit and the expected payment timeline, meaning that disputes over the amount owed or the validity of a precatório can substantially change that calculation.
CNJ and BC sign agreement to expand traceability of court-ordered payment transactions
With the end of the transition period under the new virtual asset regulatory framework and authorization requests filed in October, Virtual Asset Service Providers (VASPs) must demonstrate to the Central Bank of Brazil (BCB) that their infrastructure complies with the regulations, particularly the asset segregation requirements. BCB Resolution No. 520/2025 now requires segregation of customer funds, together with governance and controls, and BCB Resolution No. 521/2021 requires traceability of fiat currency transactions. The rules provide that such segregation must be achieved either through transactional accounts offered by the VASP itself or through partnerships with regulated institutions authorized to offer transactional accounts, under the BaaS model. Given the operational and regulatory costs involved in offering transactional accounts to customers directly, VASPs are expected to drive demand for BaaS services as a means of ensuring full compliance with the applicable regulations.
Cryptocurrency regulation opens up market for BaaS companies
