Pix: how Brazil's instant payment system works

For users, Pix, Brazil’s instant payment system, is simple: you type a key, check the name and the money arrives in seconds. To deliver that experience, however, the Central Bank of Brazil built its own infrastructure, with rules for more than 900 institutions and systems that run every day of the year.

This article explains the pieces of that architecture, the path of a transaction and the newest features, always based on the Central Bank’s rules and official pages. Scams and the Special Return Mechanism (MED) have their own article, on digital financial scams.

What Pix is, technically speaking

For the Central Bank, Pix is an instant payment system that lets people transfer money between accounts in seconds, at any time and on any day, from checking, savings or prepaid payment accounts (Central Bank, Pix). It was launched on November 16, 2020.

Legally, Pix is a payment arrangement: a set of rules governing how a payment service is provided to the public. It was established by BCB Resolution No. 1, of August 12, 2020, which approves the Pix Regulation (BCB Resolution No. 1/2020). That resolution is still in force and has been amended dozens of times; there are changes published in 2026, including some with effects scheduled for 2027. Operational details may therefore change, and the reference is always the version in force on the Central Bank’s website.

The Central Bank has two roles in Pix: it is the regulator, which sets the rules, and the manager of the operational platforms, which builds and operates the infrastructure (Central Bank, Sobre o Pix).

The two core components: DICT and SPI

DICT: the phone book of keys

The DICT (Directory of Transactional Account Identifiers) is the database that links each Pix key to the account details: name, CPF or CNPJ (Brazil’s individual and corporate taxpayer IDs), institution, branch, account number and type, key creation date, among others. It is managed and operated by the Central Bank (Central Bank, DICT).

Under the Regulation, there are five types of key: mobile number, email, CPF, CNPJ and a random key generated by the DICT itself (BCB Resolution No. 1/2020). The key works as an alias for the account. You do not need a key to send or receive a Pix: you can use the full account details, as in a regular transfer (Central Bank, Sobre o Pix).

The DICT also has a security function. It stores infraction reports and fraud flags associated with keys, CPFs and CNPJs, information that institutions check before authorizing a payment (Central Bank, Segurança no Pix).

SPI: where the money actually moves

The SPI (Instant Payment System) is, in the words of the rule, “the centralized real-time gross settlement infrastructure” for instant payments (BCB Resolution No. 195/2022). Two terms help explain it:

• Settlement is the moment when the obligation between institutions is extinguished, with the final transfer of the money.
• Gross means that each transaction is settled individually, without waiting to net several of them at the end of the day.

Settlement takes place in accounts that institutions hold at the Central Bank itself, called PI Accounts (Instant Payment Accounts). The same rule defines an instant payment as one in which the transmission of funds and their availability to the payee occur in real time, with the service available 24 hours a day, every day of the year.

There are two ways to participate in the SPI (BCB Resolution No. 195/2022):

• Direct: the institution has its own PI Account and connects directly to the SPI.
• Indirect: the institution has no PI Account and settles through a direct participant, which registers it and acts as its settlement agent. Commercial banks, multiple banks with a commercial portfolio and savings banks may not participate indirectly.

All communication takes place on the RSFN (National Financial System Network), separate from the internet, with encrypted information and digital certificates required of institutions (Central Bank, Segurança no Pix).

Who takes part in Pix

Participation is mandatory for financial and payment institutions authorized by the Central Bank with more than 500,000 active customer accounts. Others may join voluntarily (BCB Resolution No. 1/2020). The Regulation provides for five types:

• Transactional account provider: the institution that offers the account to the customer. It is your bank, fintech or credit union.
• Government entity: the National Treasury Secretariat, for typical collections and payments.
• Special settlement agent: an institution that provides settlement services to other participants, without offering Pix directly to individuals and businesses.
• Initiator: an institution whose role in Pix is to initiate payments from accounts at other institutions, using the Open Finance infrastructure.
• User institution: an institution that uses Pix only for its own payments and receipts.

The Central Bank reports more than 900 participating institutions (Central Bank, Sobre o Pix).

The path of a Pix, step by step

In the description below, the newsroom simplifies the flow for teaching purposes; the technical details are in the manuals listed on the Central Bank’s rules page.

1. You enter the destination. You type the key, scan a QR code or fill in the account details.
2. Your bank queries the DICT. Using the key, the DICT returns the payee’s account details and security information associated with it.
3. You check and confirm. The app shows the details of who will receive the money, such as the name, which the Central Bank recommends always checking. You authenticate with a password, biometrics or token. By rule, every transaction requires authentication (Central Bank, Segurança no Pix).
4. Your bank sends the order to the SPI. The SPI debits the paying institution’s PI Account and credits the receiving institution’s PI Account (or that of each one’s settlement agent).
5. The payee’s bank credits the account and both sides are notified of completion.

If one of the institutions is an indirect participant, step 4 goes through the direct participant that represents it. If the transaction raises suspicion of fraud, institutions may apply a longer review time before authorizing it, or hold the amount received for up to 72 hours in the so-called precautionary block (Central Bank, Segurança no Pix).

Key, static QR code and dynamic QR code

The Regulation lists three mechanisms for sending or making available in advance the information for a Pix: key, dynamic QR code and static QR code (BCB Resolution No. 1/2020). The difference between the two QR codes lies in where the data is stored:

• Static QR code: the transaction information is inside the code itself. It has few configuration options. It is what a small shop prints and leaves on the counter.
• Dynamic QR code: the information is outside the code, which points to it. It allows many configurations and is usually generated for each charge, as in e-commerce. The Central Bank requires specific digital certificates to generate it (Central Bank, Segurança no Pix).

Many payment requests include, next to the QR code, a text code to copy and paste into the app, known as “Pix Copia e Cola” (Pix copy and paste), useful when scanning is not possible.

According to the Pix management report, in 2025 keys and dynamic QR codes each accounted for about 40% of transactions; manual entry of data, 12%; and static QR codes, 8%. Dynamic QR codes accounted for 5% in 2021, growth the Central Bank associates with the use of Pix in retail (Central Bank, Pix Management Report 2023-2025).

The newest features

Pix Automático

Pix Automático lets you pay recurring bills, such as electricity, school, gym or subscriptions, with a single prior authorization. It went live on June 16, 2025 (Pix Management Report 2023-2025).

The flow described by the Central Bank is this: the company offers the option; you authorize it and set rules, such as the maximum amount of each charge; in the days before the due date, the company sends the charge to your bank, which schedules the payment and notifies you; on the day, the bank pays according to the authorized rules. You can cancel scheduled charges and the authorization itself through the app (Central Bank, Pix Automático). There is no fee for the payer.

Contactless Pix

Contactless Pix uses NFC (near field communication), the proximity communication technology, to pay by tapping a phone or watch on the card machine (Central Bank, Pix por aproximação). According to the management report, the Central Bank published the rules in August 2024 and formally incorporated this form of initiation into the Pix Regulation in June 2025.

There are two models. Through the bank’s app, you open the app, authenticate and tap. Through a digital wallet, you link your account once, via Open Finance mechanisms, and the wallet must be a payment initiator authorized by the Central Bank. The initial maximum amount is R$ 500 per transaction, and you can lower it. Offering it is optional for banks, wallets and card machines.

Other features

The Central Bank also lists Scheduled Pix (Pix Agendado), whose recurring version became mandatory in October 2024, as well as Pix Saque and Pix Troco, for withdrawing cash at merchants (Central Bank, Pix; Pix Management Report).

The security layers

The Central Bank states that its systems have never been the target of successful attacks, but acknowledges that fraud, scams and attacks on participating institutions increasingly use Pix as a means of distributing the funds (Pix Management Report 2023-2025). The main layers, according to the Central Bank’s security page (Segurança no Pix):

• Authentication on every transaction and on key operations.
• Traceability of all transactions, which helps police and courts identify accounts involved in fraud.
• Registered device: for individuals, registering or changing keys and initiating transactions requires a previously registered device; on an unregistered device, the limit is R$ 200 per transaction and R$ 1,000 per day.
• Nighttime limit: after 8 p.m., the default limit for individuals is R$ 1,000, adjustable on request. Requests to lower a limit take effect immediately; requests to raise it may take 24 to 48 hours (Central Bank, Sobre o Pix).
• Check against the Federal Revenue Service: the name linked to the key must match the CPF or CNPJ record.
• Fraud flags in the DICT and the precautionary block, mentioned above.
• MED, to try to return funds in case of fraud. How it works, its deadlines and what it does not cover are in the article on digital financial scams.

In the newsroom’s assessment, none of these layers replaces the check that only you can make: the name of the payee, before you confirm.

Pix in numbers

The figures below are those published by the Central Bank on the Pix page, accessed on October 8, 2026 (Central Bank, Pix):

• more than 170 million individuals have already used Pix, about 80% of the population;
• more than 7 billion transactions in May 2026, totaling more than R$ 3 trillion in the month;
• a record 313.3 million transactions in a single day, on December 5, 2025.

These figures are updated frequently; the Central Bank’s statistics page has the full series.

Key takeaways

• Pix is a payment arrangement regulated and operated by the Central Bank. The DICT links keys to accounts and stores anti-fraud information; the SPI settles each transaction, one by one, in real time, all year round.
• Keys, static QR codes, dynamic QR codes and account details are different entry points to the same payment. Pix Automático and contactless Pix expanded its uses from 2025, relying partly on Open Finance.
• Security combines system rules, such as authentication, limits, registered devices and the precautionary block, with a habit of yours: checking who is receiving before you confirm.