Open Finance in Brazil: how data sharing works

Your bank knows a lot about you: how much comes into your account, how much goes out, which cards and loans you have. Until recently, that information stayed locked inside each institution. If another bank wanted to assess your credit application, you had to bring statements on paper or as PDFs.

Open Finance changes that logic. According to the Central Bank of Brazil, it lets you take your financial information from one institution to another and move money in your accounts through different platforms (Central Bank, Open Finance: Quero entender mais). This article explains the architecture, the consent rules and the precautions that remain your responsibility.

What Open Finance is, in practical terms

The rule that created the system defines Open Finance as the “standardized sharing of data and services through the opening and integration of systems” (Joint Resolution No. 1/2020). There are two things in that:

• Data sharing: you authorize one institution to send your data to another. Besides statements, card bills and credit operations, the Central Bank lists investment and foreign exchange data (Central Bank, Sou cliente).
• Service sharing: you use one institution’s app to move money held at another. The most common example is payment initiation, in which an app triggers a Pix (Brazil’s instant payment system) from your account at another bank.

The original name was Open Banking. Joint Resolution No. 4, of March 2022, renamed the system Open Finance, reflecting a scope that already went beyond bank accounts (Joint Resolution No. 4/2022).

The goals stated in the rule are to encourage innovation, promote competition, increase the efficiency of the financial and payment system and promote financial citizenship. In the newsroom’s reading, the central point is competition: if another institution can see your history, it is in a position to make a concrete offer instead of starting from scratch.

A short timeline

The Central Bank organizes the rollout in stages (Central Bank, Quero entender mais):

• 2020: publication of the Open Finance rules (and those for Pix).
• 2021: creation of the infrastructure and start of sharing of public product data and, later, customer data.
• 2022: sharing of payment services with Pix.
• 2023: investment data and monitoring rules.
• 2024: foreign exchange data, new payment services and rules for the new governance structure.
• 2025: contactless Pix, Pix Automático (recurring payments) and the entry of new participants.

On November 28, 2025, Joint Resolution No. 15 added a new service to the scope: credit portability, meaning moving a loan from one institution to another through the Open Finance infrastructure. The same rule removed the old credit proposal forwarding service from the scope (Joint Resolution No. 15/2025).

The architecture: who is who

The institutions’ roles

The rule names each role (Joint Resolution No. 1/2020):

• Transmitting institution: the one that holds your data and sends it.
• Receiving institution: the one that requests and receives the data, with your authorization.
• Account-holding institution: the one that holds the account the money will leave from.
• Payment initiation service provider: the one that triggers the payment from another institution “without at any time holding the transferred funds.”

The same institution can play different roles at different times. The bank that receives your data today may be the one transmitting it tomorrow.

Who takes part

Under the rule, participation in data sharing is mandatory for institutions in segments S1 and S2, the country’s largest conglomerates, and voluntary for the others authorized by the Central Bank (Joint Resolution No. 1/2020). The Central Bank reports more than 700 participating institutions, including banks, credit unions, brokerages and payment institutions (Central Bank, Quero entender mais).

Who sets the rules

• Central Bank: defines the principles, objectives and main rules and supervises participants.
• Open Finance Association: a governance structure formed and funded by the participating institutions. It develops the technical standards and maintains the support infrastructure, overseen by the Central Bank (Central Bank, Quero entender mais; Open Finance Brasil).

A decentralized model

This is the most important architectural point. The Central Bank describes the Brazilian model as decentralized: sharing happens through direct communication between the two institutions involved. There is no central database with customer information, and the data does not travel through the Central Bank (Central Bank, Quero entender mais).

Communication happens through APIs (application programming interfaces), standardized “doors” through which one system requests information from another in an agreed format. Joint Resolution No. 1/2020 requires institutions to sign a convention on these standards, including interface design, protocols, data format and security certificates. To give a sense of scale, the Central Bank reports, with May 2026 data, 116 million data-sharing authorizations and 6 billion API calls per week (Central Bank, Quero entender mais).

On the technical security side, the profile published by the Association is an implementation of FAPI (Financial-grade API), a set of authentication and authorization requirements designed for financial APIs (Open Finance Association, Security Profile v2.1.0). The document has newer versions listed on the portal itself; the technical details matter more to developers than to customers.

Consent, authentication and confirmation

Every request to share registration data, transaction data or services goes through three mandatory steps, which the rule requires to be carried out only through electronic channels, in sequence and without interruption (Joint Resolution No. 1/2020).

1. Consent, at the receiving institution

You start in the app of the institution that wants to receive your data (or that will initiate the payment). There, you look for an option such as “Open Finance” or “Bring my data” and choose where the data will come from (Central Bank, Sou cliente).

The rule defines consent as the “free, informed, prior and unequivocal expression of will,” made electronically, for specific purposes. The request must be in clear language, have a defined purpose and a validity period compatible with that purpose, indicate the source institution, itemize the data or services and identify you.

Three practices are prohibited: obtaining consent through a standard-form contract, through a form with acceptance already ticked, or presumptively, without active action on your part.

2. Authentication, at the source institution

Next, you are taken to the app or website of the institution that holds the data (or the money) and identify yourself in the usual way: password, biometrics, token. The Central Bank stresses that the institution that started the process sees none of this authentication information (Central Bank, Segurança no Open Finance).

3. Confirmation

Still within the source institution’s environment, you see a summary: which data, to whom and for how long. For a payment, who initiated it, who receives it, the timing and other details. Only after this validation is the process completed and you return to the first app.

The consent term changed in 2023

In the original 2020 text, the validity of consent was “limited to twelve months.” Joint Resolution No. 7, of October 26, 2023, removed that cap: the term now has to be compatible with the purpose, with no fixed limit in the rule (Joint Resolution No. 7/2023). The same rule allowed the receiving institution to change the purpose, term or shared data with your specific and active agreement, without redoing authentication at the source bank. Changing the source institution still requires new consent.

In practice, this means authorizations can stay active for quite a long time. Periodically reviewing what you have authorized is a useful habit.

Revoking is your right

The rule requires the institutions involved to allow consent to be revoked at any time, at least through the same channel in which it was given (Joint Resolution No. 1/2020). The deadlines are:

• immediate for data sharing;
• up to one day for the payment initiation service.

The Central Bank adds that you can revoke through the app or website of any of the institutions involved (Central Bank, Sou cliente). There is also a rule against commercial pressure: the source institution may not suggest that you revoke consent, except when there is a justified suspicion of fraud.

For each valid consent, institutions must show who is involved, which data or services, the validity period, the date of the request and the purpose. The Open Finance Association states that use is free for consumers (Open Finance Brasil).

Where the LGPD comes in

Open Finance does not replace the LGPD (Brazil’s General Data Protection Law); the two sets of rules coexist. The LGPD’s definition of consent is very similar to the Central Bank rule’s: a “free, informed and unequivocal expression by which the data subject agrees to the processing of their personal data for a specific purpose” (Law No. 13,709/2018).

The LGPD also guarantees that consent can be revoked at any time, through a free and easy procedure, and includes data portability to another provider among the data subject’s rights. In the newsroom’s assessment, Open Finance can be seen as a standardized, supervised way of exercising, within the financial system, this idea of taking your data wherever you want.

The Open Finance rule adds its own requirements. The receiving institution must ensure that the data received is relevant to the stated purpose. Each participant is responsible for the reliability, integrity, availability, security and confidentiality of the sharing, and must have a director responsible for the subject (Joint Resolution No. 1/2020).

Open Finance and Pix: where the two meet

Many of Pix’s recent features depend on the Open Finance infrastructure:

• Payment initiation: an app triggers a Pix from your account at another bank. The Central Bank reports about R$ 4 billion a month in Pix transactions through Open Finance, with May 2026 data (Central Bank, Quero entender mais).
• Contactless Pix in a digital wallet: to use it, you link your account to the wallet once, through Open Finance’s sharing and initiation mechanisms. The wallet must be a payment initiator authorized by the Central Bank (Central Bank, Pix por aproximação).
• Smart transfers: automatic transfers between accounts held by the same person, based on rules you authorized in advance, such as covering a negative balance in one account with money from another (Central Bank, Pix Management Report 2023-2025).

The Pix architecture, with SPI, DICT and QR codes, is explained in the article on how Pix works.

Risks and precautions

In the newsroom’s assessment, Open Finance’s technical design is careful, but three practical risks deserve attention.

Scams that use the legitimate journey. The process is safe when you are the one deciding. If a scammer convinces you to authorize a data share or a payment, the consent and authentication steps can be completed by your own hands. The golden rule is the same as for other scams: only start the process in an app you opened on your own initiative. The most common fraud patterns and what to do afterwards are in the article on digital financial scams.

Payments through initiators and the MED. The Central Bank acknowledges, in its Pix management report, that institutions providing payment initiation services were not yet integrated into the MED (Special Return Mechanism, Pix’s refund mechanism for fraud cases), which makes it harder to trigger a refund on these transactions, and says it will develop a solution to include them (Pix Management Report 2023-2025). If you use payment initiators, it is worth asking your bank how disputes work in that case.

Forgotten consents. Since the term no longer has a fixed cap, old authorizations may remain active. Review the Open Finance section of your apps and revoke what you no longer use.

Sharing data is also a commercial choice: the institution that receives your data will use it to offer products. An offer based on your history is not, in itself, a recommendation that you sign up for anything. Compare the total effective cost, terms and conditions as you would with any other offer.

Key takeaways

• Open Finance is the standardized sharing of financial data and services among authorized institutions, under Central Bank rules and technical standards set by the Open Finance Association. Data goes from one institution to the other without passing through a central database.
• Nothing is shared without your consent, which requires a purpose, a term, authentication at the source bank and confirmation. You can revoke it whenever you want, immediately in the case of data.
• Open Finance underpins services such as payment initiation and contactless Pix in digital wallets. Use it only on your own initiative and review from time to time what is authorized.