What regulated fintechs are and why they matter to the market

The fintech market (companies in the financial sector that offer technology-based products or services that simplify, speed up or reinvent the way customers pay and consume) is going through a delicate moment of credibility and maturation. That makes it necessary to understand why regulation is so important to keeping services reliable and secure.

Fintechs operate in segments of the financial market such as:

• Payments (digital wallets, acquirers, sub-acquirers);
• Credit (P2P loans, personal credit, receivables advances);
• Investments (trading platforms, robo-advisors);
• Insurance (insurtechs);
• Foreign exchange and international remittances (eFX);
• Financial infrastructure (banking as a service, open finance).

Not every financial technology company needs to be regulated by the Central Bank of Brazil (BCB), SUSEP (the insurance regulator) or CVM (the capital markets regulator); that depends on the type of service and the size of the operation.

When we talk about a fintech regulated and authorized by the Central Bank of Brazil, as is the case with Trio, we mean institutions that have gone through the formal authorization process and are subject to ongoing supervision. This authorization and supervision process considers several points, and what weighs most is financial soundness, responsible governance, robust risk controls and transparency with customers.

Here are some of the pillars the BCB monitors:

Governance and corporate structure

• Review of controlling shareholders and executives: unblemished reputation and relevant experience;
• Shareholder agreements and clarity on capital composition;
• A board of directors and executive team with well-defined roles.

Capital and prudential requirements

• Meeting minimum capital requirements (initial share capital, minimum equity);
• An adequate Basel ratio for fintechs classified as financial institutions;
• Compliance with Resolução CMN 4.656/2018, the National Monetary Council rule (for SCDs and SEPs, Brazil’s direct and peer-to-peer lending companies, for example).

Internal controls and compliance

• Clear internal policies: anti-money laundering (AML/CFT), fraud prevention, accounting controls;

• A Compliance Officer with the autonomy to report to the board and executive team.

Anti-money laundering and counter-terrorist financing AML/CFT

• Adherence to Lei nº 9.613/1998 (Brazil’s anti-money laundering law) and Resolução BCB nº 50/2020;
• Know Your Customer (KYC) policies, customer identification and due diligence;
• Monitoring of suspicious transactions and reporting to COAF (Brazil’s financial intelligence unit);
• Regular employee training.

Risk and security

• Risk management (credit, liquidity, operational, cyber, legal and reputational);
• Information security and LGPD (Brazil’s General Data Protection Law): protection of customers’ sensitive data;
• Business continuity: contingency plans for critical failures;
• Cybersecurity Policy (Resolução CMN nº 4.893/2021)
• Security incident management and immediate notification to the BCB;
• Regular vulnerability and technology continuity testing.

Relationship with the BCB

• Periodic reporting through BCB systems (SCR, Cosif, Cadoc, etc.);
• Compliance with specific circulars and official letters;
• Readiness for on-site or remote inspections.

Products and services

• Operate only within the authorized scope (an SCD cannot take deposits, only lend its own capital);
• Respect regulatory limits: leverage, fee charging, relationships with third parties (FIDCs, marketplaces).

Transparency with customers

• Compliance with the Consumer Protection Code and BCB rules on transparency and conduct;
• A structured customer service channel and an independent ombudsman (mandatory for larger institutions);
• Clear communication: rates, costs and risks must be properly disclosed;
• Compliance with financial education and consumer protection rules.

In this environment of payment institutions authorized and regulated by the Central Bank, something of the utmost importance is segregation of funds: customers’ money cannot be mixed with the institution’s own money. To ensure this, each customer must have a payment account opened and registered with the Central Bank through the CCS (Cadastro de Clientes do Sistema Financeiro Nacional, the National Financial System’s customer registry). This prevents the existence, within the National Financial System, of so-called “pooled accounts” (contas bolsão), bank accounts used to centralize several customers’ funds in a single place.

The whole framework regulated fintechs are subject to is different from the world of startups that call themselves fintechs without being authorized, where “pooled accounts” are still common.

This puts the system at risk because of the lack of controls and procedures found in a regulated environment.

New: the Pix cap

In a move to make the Pix system more secure, the Central Bank of Brazil (BCB) imposed a R$15,000 cap on Pix (Brazil’s instant payment system) and TED (wire transfer) transactions at payment institutions that are not authorized to operate directly in the financial system. The measure, which took effect on September 5, 2025, aims to protect the system against organized crime and cyberattacks, and mainly affects unregulated institutions that connect to the system through Information Technology Service Providers (PSTIs).

Trio, as a Payment Institution authorized, regulated and audited by the Central Bank of Brazil with proprietary technology, also operates in the Pix system, so the new rules (a R$15,000 cap per transaction) do not affect our services, since we don’t use a PSTI.

Our clients can keep making withdrawals and deposits as usual, securely and reliably.

To talk to a Pix specialist, get in touch.