— with Laura Arantes
Brazil is home to a vibrant and attractive ecosystem for payment fintechs, consolidated over recent years. This growth process has been marked by major advances, including the Central Bank’s launch of the Pix instant payment system and the strengthening of regulations for the Brazilian Payments System.
The sector’s dynamism has boosted financial inclusion, service efficiency and the user experience. But as often happens under more flexible regulatory frameworks, reduced oversight created openings that some criminal groups exploited for money laundering and asset concealment.
In late August, a joint operation by the Federal Revenue Service, the Public Prosecutor’s Office and the Federal Police revealed how some fintechs had been used as “parallel banks” by organized crime. This laid bare the connection between the financial market and organized crime, exposing a money laundering network that also involved legitimate businesses such as gas stations, ethanol plants and investment funds. As an immediate response, the Federal Revenue Service issued rules expanding mandatory reporting obligations for fintechs.
The operation focused on the Primeiro Comando da Capital (First Command of the Capital, or PCC), Brazil’s most powerful criminal organization. Investigators uncovered a scheme structured from the base of the production chain, with sugarcane farms, ethanol plants and gas stations under PCC control. Authorities found illicit practices including fuel adulteration, coercion to force sales and manipulation of financial transactions through convenience stores. These operations created a continuous flow of dirty money funneled into Brazil’s formal payment system, undermining oversight.
The fuel sector, investigators noted, had become a powerful money-laundering machine. Fuel adulteration — using inputs such as methanol and solvents — inflated sales volumes and generated profits beyond what legally operating gas stations could achieve. At the same time, systematic tax evasion slashed costs, making it easier to disguise illicit funds and legitimate revenue. Gas stations thus became ideal vehicles for laundering money by reporting dirty inflows as routine sales.
The scheme’s next step was to channel these resources into fintechs, which were targeted precisely because they operate under lighter transparency rules than traditional banks. One key mechanism exploited was the use of contas-bolsão — umbrella accounts at regulated financial institutions that allow fintechs to manage multiple sub-accounts for clients.
Originally designed to lower costs for foreign trade operations, these contas-bolsão were misused to obscure ownership links. Through this system, a fintech customer could hold a sub-account at a financial institution without a direct relationship to it, making oversight difficult.
To close this loophole, the Federal Revenue Service’s new normative instruction requires fintech to submit e-Financeira reports, a set of documents periodically sent to oversight authorities containing information on clients’ balances, transactions and financial investments. In practice, these institutions are now treated like banks, allowing authorities to expand monitoring and cross-checking of financial data for individuals and companies, and strengthen enforcement against tax evasion, capital flight and money laundering.
Earlier this year, the federal government had already attempted to tighten fintech oversight. The Federal Revenue Service required fintechs, digital banks and payment institutions to report monthly transactions above BRL 5,000 (USD 930) for individuals and BRL 15,000 for companies, whether via Pix or other methods. But the rule was derailed amid a wave of opposition-led disinformation that made the wild claim that the government sought to implement a “Pix tax.”
Meanwhile, the Central Bank is preparing new regulations for Banking-as-a-Service (BaaS) providers, expected later this year. Authorities are particularly concerned about fintechs operating under the BaaS model, which does not currently require disclosure of end clients or the structure of contas-bolsão.
The new regulation seeks to impose standards on governance, risk management, security, conduct and internal controls — aligning them with those already in place for regulated institutions. It will also establish clear accountability rules and procedures for contract termination or resolution, helping to safeguard transparency and systemic stability.
It is worth noting that these changes coincide with the complex process of legalizing online sports bookmakers in Brazil. Betting companies often rely on BaaS providers to process deposits and payments, and they will be directly affected by the new rules.
By tightening fintech oversight, the Central Bank aims to reduce opportunities for betting companies to operate in regulatory gray areas. In practice, stricter rules should enhance transparency in financial flows and reduce the risks of money laundering and systemic evasion.
