On August 28, 2025, the Brazilian Federal Revenue Service (“RFB”) issued Normative Instruction No 2,278 (“IN No. 2,278”), which introduces significant changes in the oversight of the financial sector, particularly payment institutions and payment arrangements, including fintechs.

The measure was published shortly after the unveiling of a police operation aimed at investigating the alleged use of fintechs (in addition to other vehicles) in potential money laundering schemes. The stated purpose of the regulation is to strengthen mechanisms for the prevention and repression of crimes against the tax system, money laundering and concealment, and structured fraud.

Main Provisions

The instruction establishes the obligation to immediately report to the competent authorities any indications of crimes, including those related to organized crime, notably money laundering, concealment of assets, and fraud.

As a result, payment institutions and payment arrangers are now subject to the same requirements already applicable to banks and other members of the Brazilian National Financial System (“SFN”) and the Brazilian Payment System (“SPB”). In practice, this means the obligation to:

• Mandatory submission of information to e-Financeira, system that centralizes data on financial transactions with the RFB, established by Normative Instruction RFB No. 1,571/2015. Among the information to be reported, it is noteworthy the obligation to disclose transactions above R$ 2,000.00 for individuals and R$ 6,000.00 for legal entities; and
• Application of the definitions set forth in Law No. 12,865/2013, which concern the concepts of payment arrangement, payment arrangement institutor, payment institution, payment account, payment instrument, and electronic money. These definitions now serve as the reference framework for classifying the operations covered by IN No 2,278.

It is worth noting that small-scale or limited-scope payment arrangement institutions that effectively process payments are also subject to the new legislation. Thus, any institution falling under the definitions of Law No 12,865/2013 and that effectively processes payments is subject to the new obligations introduced by IN No 2,278, even if the institution is exempt from registration control and authorization by the Central Bank of Brazil (“BCB”).

Impacts

IN No 2,278 equates, from an oversight perspective, payment institutions and payment arrangers, including fintechs, with banks, significantly reducing the room for transactions outside the reach of the RFB.

The Brazilian Federation of Banks (“Febraban”) classified the update as a “decisive milestone” for balancing innovation and security in the financial system. The Brazilian Association of Fintechs (“ABFintechs”), in turn, highlighted its role in regulatory modernization, emphasizing that the equal treatment is likely to strengthen confidence in the sector.

The measure has the potential to strengthen the actions of other bodies, such as the BCB, the Federal Police (“PF”), and the Federal Prosecutor’s Office (“MPF”), since the intensification of the RFB’s activities will provide support for investigations aimed at combating “white-collar” crimes.

To comply with the new legislation, it is essential that such institutions have a governance structure and internal controls in place to ensure the quality and monitoring of the information shared with the RFB.

Vella Pugliese Buosi e Guidoni Advogados offers specialized consulting services to support companies with matters related to Regulatory Law and Compliance. Our team is available to support your organization with the topics mentioned above.