Compliance Guide: Eastern Companies Offering Payments in Brazil

September 13, 2026

Summary: The regulatory path for an Asian company to operate payments in Brazil, from the constitution of a local legal entity to authorization as a Payment Institution, mapped without surprises.

Introduction

First point: before processing the first real, your company needs to exist legally in Brazil and, depending on the business model, obtain authorization from the Central Bank of Brazil. There is no shortcut to this requirement, and ignoring it can make the operation unviable after it has already gained scale.

Brazil is one of the most attractive payment markets in the world, and also one of the most regulated. The system is mature, with clear rules on who can accredit merchants, issue electronic money, or initiate transactions. For an Eastern company accustomed to other regulatory frameworks, understanding this architecture before investing is what separates a successful entry from a project stalled by licensing issues.

This guide is informative and does not constitute legal advice. Values, limits, and deadlines mentioned should always be confirmed in the current text of the regulations, which are periodically reviewed by the Central Bank. Hire local legal and regulatory counsel before making decisions.

Context: the Brazilian legal framework

The foundation is Law No. 12,865/2013, which brought payment arrangements and payment institutions into the Brazilian Payment System. It defined concepts such as payment arrangement, payment institution, electronic money, and payment account.

On top of this law, the Central Bank built operational regulation. BCB Resolution No. 80/2021 governs the constitution, authorization, and functioning of payment institutions, while BCB Resolution No. 81/2021 deals with prudential requirements, such as capital and risk management. BCB Resolution No. 150/2021 consolidates rules on payment arrangements.

To gauge the opportunity: the Brazilian card sector surpassed R$ 4.1 trillion in 2024, up 10.9% from 2023, according to ABECS. It is a market large enough to justify the compliance effort, provided it is done in the right order.

Constitution, modality, and authorization

There is no “remote” payment operation in Brazil. The first requirement is to constitute a Brazilian legal entity. BCB Resolution No. 80/2021 determines that the payment institution must be constituted as a limited liability company or corporation, adopt the expression “Instituição de Pagamento” in its name when applicable, and maintain a governance policy compatible with the activity. In practice, this involves registration with the Commercial Registry, enrollment in the CNPJ, definition of partners and administrators, and often the appointment of resident representatives in the country. Foreign capital is allowed, but the operating vehicle is local.

The same resolution defines four modalities of payment institutions, and correctly framing your model is decisive, because each has distinct requirements: electronic money issuer, which manages prepaid payment accounts; post-paid payment instrument issuer, the traditional card model; acquirer, which enables merchants to accept payment instruments; and payment transaction initiator, which initiates the transaction without managing the user's account, a typical role in Open Finance. According to the regulation, the minimum share capital is R$ 1 million for the initiator and R$ 2 million for the other modalities, values that must be confirmed in the current text of the resolution.

Not every payment institution needs prior authorization from day one, but there are volume triggers that make authorization mandatory. For an acquirer or post-paid instrument issuer, authorization is required when exceeding approximately R$ 500 million moved in 12 months. For electronic money issuers, the limits are staggered and decreasing over the years. The payment transaction initiator always requires prior authorization, regardless of volume. Upon reaching the limit, the institution has a deadline, referenced as 90 days in the regulation, to submit the request. All these numbers must be confirmed in the updated text of the resolution, because the schedule is expected to change.

Sub-acquiring: the lower-barrier entry point

For a company that wants to test the market without immediately facing the full authorization process as an acquirer, sub-acquiring is often the fastest path. The sub-acquirer enables the merchant to accept payment instruments but does not participate in settlement as a creditor to the issuer. It operates within an existing arrangement, supported by an authorized acquirer.

This model, now consolidated in BCB Resolution No. 150/2021, reduces the initial entry barrier. The flip side: when the sub-acquirer exceeds volume limits or starts managing third-party funds, it needs to seek authorization as a payment institution in the acquirer modality. In other words, sub-acquiring is excellent to start, but requires a clear migration plan as the operation grows.

Security, Open Finance, and points of attention

Regardless of the modality, anyone who processes, stores, or transmits card data must adhere to PCI DSS, the industry security standard. The current version is v4.0.1, published in June 2024. An important milestone: the “future-dated” requirements of v4.0 became mandatory after March 31, 2025. Treat certification as part of the project from the start; reworking architecture to meet PCI after launching costs much more.

Open Finance Brazil, structured from Joint Resolution No. 1/2020, organizes data sharing and payment initiation with customer consent. For those intending to act as payment transaction initiators, adhering to the ecosystem is the core of the business.

Three additional fronts are often underestimated by foreign companies. Foreign exchange and foreign capital: Law No. 14,286/2021, in force since 12/31/2022, modernizes exchange and foreign capital rules in Brazil. Anti-money laundering: BCB Circular No. 3,978/2020 requires policy, procedures, and internal controls with a risk-based approach and designation of a responsible director; it is not optional. LGPD: Law No. 13,709/2018 governs the processing of personal data, and payments inherently deal with sensitive data.

Practical application: entry checklist

Regulatory diagnosis: define the payment institution modality that corresponds to your model, or start via sub-acquiring.
Constitution: open the local legal entity, with CNPJ and governance.
Volume assessment: project when authorization triggers will be reached and plan the submission to the Central Bank in advance.
Capital: allocate the minimum share capital for the chosen modality.
Security: start the PCI DSS v4.0.1 certification project from the beginning.
AML/CTF and LGPD: implement the anti-money laundering policy and data protection program.
Foreign exchange: structure the entry of foreign capital under Law 14,286/2021.
Local counsel: hire Brazilian legal and regulatory support before each step.

Next steps

Compliance is the entry condition, not the strategy. After mapping the regulatory path, the challenge becomes winning customers in a highly competitive market. That is exactly the topic of the next article: Go-to-Market for Asian Companies, where we detail entry strategies that have already worked in Brazil and a realistic timeline.

Conclusion

Operating payments in Brazil requires method: local legal entity, correct modality, attention to authorization triggers, and a solid foundation of security and compliance. A local white-label infrastructure partner can drastically shorten this journey, taking care of the technical and regulatory layer while you focus on the product. Talk to Plutech to understand how to accelerate your entry into the Brazilian market.