On September 3rd the Central Bank did not issue a payments rule. It issued an interface specification. Normative Instruction BCB nº 774 publishes version 7.4 of the Minimum Requirements for User Experience — a document that forms part of the Pix Regulation — and determines what can appear on the receipt, how fraud disputes are presented and when the application needs to alert that a saved contact has changed account holder. Behind the specification sits a disciplinary regime that ends in exclusion from the arrangement for sixty months. That is what, in my reading, turns a screen manual into an instrument of weight.

A user interface manual within the regulation

IN 774 revokes IN BCB nº 689, from December 2025, retires version 7.3 and takes effect on March 1st, 2027. Eighteen months pass between publication and enforcement — time for participants to rewrite the transaction completion screen and the PDF or image file that the customer shares by message.

The cadence matters more than the content of any single version. Version 7.0 came out in August 2024, 7.1 in February 2025, 7.2 in October 2025, 7.3 in December 2025 with effect from February 2026, 7.4 now. Five revisions in just over two years of a document that specifies which error messages the application must display, what icon should top the receipt, which nomenclatures are mandatory and which screen the customer service shortcut needs to be on. The manual is not decorative appendix to the regulation: it is where the regulator exercises product control over the layer that the user actually sees.

The 7.4 package goes beyond the receipt. It requires display of the legal entity beneficiary's trade name. It standardizes the statement, including the use of symbols for credited and debited amounts and the nomenclature of payment and receipt. It obliges notification to the user when the transaction is blocked on reasonable suspicion of fraud, and to inform, in the message of unsuccessful key registration, when the rejection stems from a fraud flag created or accepted by the provider itself. It restricts claim of ownership to mobile phone number keys only. It gives prominence to the payment object field in Pix Automático. Each of these items is a design decision made in Brasília and implemented by each participant at their own cost.

The Receipt Was Never Free Space

The current reading is that the Central Bank closed an open loophole. I read version 7.3 in its entirety before writing this, and the more precise reading is different: it extended to the document a principle it was already applying to the message.

Version 7.3, in force since February 2026, already determines that the "Description" field — which corresponds to the informacoesEntreUsuarios field of pacs.008 — must not contain HTML tags, and that the payer's application must display its characters literally, without rendering links or any dynamic content. The clause appears repeated in five chapters of the manual: Pix with key, manual entry, reversal, scheduling, notification to beneficiary. In QR Codes, where the payer's description field is suppressed, version 7.3 allows HTML in the additional information field but forbids dynamic content, such as scripts. And it already prohibits displaying the Pix key and the beneficiary's banking data on the receipt when the transaction identifier is filled.

That is: the Central Bank has been regulating what the application renders within the payment flow for at least two versions. The novelty of 7.4 is declaring that the receipt has the sole purpose of recording and demonstrating the transaction, and that advertising, marketing, commercial offers, hyperlinks and any content unrelated to identification, execution or recording are forbidden — on screen, PDF, image and paper.

This changes my interpretation of what happened. If the rule were about monetization, it would be a policy novelty. As an extension of a preexisting anti-rendering clause, it is the coherent conclusion of a line the regulator had been drawing: the surface of payment cannot contain anything actionable that is not the payment itself. The mechanism is phishing. The fraudster does not need access to the bank application; they need the user to accept as normal the presence of a clickable button inside a receipt. While legitimate receipts carry links, the forged receipt with a link does not stand out. Once the document is standardized without actionable elements, any receipt with an external button becomes a visible anomaly — and the cost of detection shifts from the user to the format.

The Pair Nobody Put Together

Two changes in 7.4 were treated separately by all the coverage I read. To me, they only make sense together.

The first: institutions must now store the Pix key used, linked to the saved contacts functionality, and alert the user when a key already in their contacts comes to point to another account holder. The second: claim of ownership — the procedure by which someone requests a key registered by another user — now exists only for mobile phone number keys.

One restricts the vector. The other installs the alarm. The attack against which both are directed is the taking of an already-trusted key: the fraudster captures a key that the victim has already saved and verified, and the next transfer goes to the wrong account without any confirmation screen looking different. It is the point in the flow where human verification has already been done and will not be redone. Version 7.3 already obliged the donor provider to immediately communicate the beginning of claim to the key holder, with a seven-day period for revalidation — protection on the side of who loses the key. Version 7.4 adds protection on the other side: of who pays to it. Reducing the types of claimable keys to just one, and mandating notice when the account holder behind a favorite changes, is anti-fraud design addressed to a specific step in the flow, not interface cleanup.

The MED Was Not Reformed in September

The most repeated characterization of IN 774 — that it reformulates the Special Reversal Mechanism — is wrong, and the error erases the history that matters. I insist on this because the true reform passed nearly unnoticed.

The reform was MED 2.0, established by BCB Resolution nº 493, optional for use since November 2025 and mandatory for all participants since February 2nd, 2026. It altered the mechanics, not the presentation: it now allowed reversal not only from the original receiving account but also from the accounts through which the amount passed afterward; it obliged continuous reporting of intra-bank transactions, so the Central Bank can see stretches of the chain that were previously invisible; it transferred to the Central Bank itself, via DICT, the automatic generation and forwarding of breach notifications along the tracing; and it came to mark as involved in fraud, in DICT, the receiving accounts in the chain when a notification is accepted. None of this is in 7.4. Version 7.4 changes the screen through which the user enters this mechanism: everyday language to identify the type of fraud, field to describe what happened, attachment of documents and receipts, and clearer signaling of when the case is not eligible — commercial disagreement without fraud, delivery delay, product different from expected.

It is also not true that the package did not change timelines. It did — three days earlier, in another standard, and on the other side of the operation. IN BCB nº 766, which published version 8.5 of the DICT Operational Manual, extended from 30 to 80 days, effective September 1st, 2026, the deadline the original beneficiary has to contest a reversal made by MED. The victim's deadline for triggering the mechanism was already 80 days and remains so. Much of the coverage merged the two and reported an enhancement of protection to the victim that did not occur. What occurred was the symmetrically opposite: more time for the good-faith merchant who had value debited to defend against an unfounded dispute.

And here is the number against which I measure all of this. Between January 2022 and April 2026, R$ 24.52 billion were subtracted in Pix fraud and R$ 2.2 billion were returned by MED — 8.9%, with an average of 271,500 confirmed fraud cases per month. In the most recent published data, from January to April 2026, there were 11.8 million requests opened and 10.7 million denied: refusal rate of 90.3%, with R$ 264.7 million returned, about 10% of the recognized amount. The Central Bank declares it publishes these statistics thirty days after the close of each month; data from May onward have not yet been released.

Against this backdrop, allowing the victim to attach proof is not an improvement in experience. It is an attempt to move a recovery rate that has been catastrophic from the beginning. Whether it will move it is an open empirical question, and there is reason for doubt: MED recovers value that still exists in the traced chain, and the restriction may be speed, not proof quality. The Central Bank itself indicated that the production of expanded tracing began covering about 5% of recoveries, with gradual expansion. Better proof does not return money that has already left.

The Fine Is Proportional; the Exile Is Not

What transforms a screen specification into a balance sheet obligation is what happens to those who violate it.

BCB Resolution nº 507/2025 approved the Pix Penalties Manual, applicable to infractions committed as of September 30th, 2025. Penalties are warning, fine and exclusion from the arrangement; suspension ceased to exist as a standalone sanction. The fine starts from a base value between R$ 50 thousand and R$ 1 million depending on the severity band, multiplied by a weighting factor tied to the participant's total assets, with aggravators for recidivism, reducers for damage repair and discount for paying without appeal. The manual's ceiling is R$ 500 million, against R$ 25 million in the previous regime.

This ceiling, however, is almost never the binding limit. The manual limits the sum of fines in the same process, for institutions authorized to operate by the Central Bank, to the greater of 25% of required minimum capital and 25% of net worth; for other legal entities, to R$ 1.25 million. The fine, therefore, scales with size by construction. The manual is severe at the top and restrained at the bottom — which is conventional and defensible sanctions design.

Exclusion does not work that way. BCB Resolution nº 506/2025 raised from 12 to 60 months the minimum period for an excluded participant to request new accession, began requiring minimum net worth of R$ 5 million as a condition of participation, and created coercive daily fine of up to R$ 200 thousand, limited to 60 days, for non-compliance with regulator determination. BCB Resolution nº 559/2026, from April, added loss of participant status for anyone who goes more than 90 consecutive days without active participant in SPI.

Five years out of Pix is not a sanction graduated by size: it is the same interval for everyone, and for a Brazilian provider whose value proposition depends on a transaction account it is indistinguishable from shutdown. The regime's proportionality is in the fine; the penalty that has no proportionality is precisely the one that cannot be absorbed. That is why a clause about what can appear on the receipt is a matter for the board of directors and not for a design team.

Card Network Rules and Central Bank Mandate

Card networks also specify interface. Network rules address brand positioning, authentication screens, error texts, receipt format. The mechanism is the same: whoever operates the rail determines what the participant shows.

The difference is the nature of adhesion. Affiliation to a network is a commercial relationship; the exit is a business decision, with cost and alternatives. Participation in Pix, for whoever offers a transaction account in Brazil, is compulsory infrastructure in everything but name — and the exit, when imposed, lasts sixty months. The same instrument, interface specification, operates under incomparable leverage. A network that hardens its rules too much loses issuers to another. A central bank that hardens theirs loses no one.

I am not criticizing the design. I am noting that Pix created a category of regulatory risk that the sector still treats as if it were product compliance: mandatory interface changes, with a cadence of two to three per year, funded entirely by the participant, sanctioned by a regime whose extreme is market exit. Those with margin absorb it. Those without finance a richer dispute tool until March 2027 with the same budget.

Where the Thesis Does Not Hold

Part of the current reading of IN 774 has no evidence, and I looked: that participants had been treating the receipt as their own cross-selling space and the regulator reacted to that.

I did not find a single source naming a bank, fintech or wallet that placed an ad or link on a Pix receipt. After the announcement of the rule, portals began describing the practice as current — pre-approved loan offers, installment plans, insurance, partner store coupons right below the beneficiary's data — without naming the institution, without image, without primary source. The Central Bank's stated justification is fraud: reducing the risk of the document being used as a vector for fraud, especially through fraudulent links.

There is a second piece of counter-evidence, and for me it is more eloquent than the first: nobody in the market complained. I did not find any statement by trade body or named participant about the loss of this surface. When the sector spoke publicly about MED, in July, the stated concern was reduction of false positives and proper treatment of the good-faith beneficiary — operational risk, not lost inventory. A monetization asset that nobody defends when it is taken away probably was not a monetization asset.

My reading, therefore, is narrower and more interesting than that of attention economy. It is not that the regulator took back a commercial surface. It is that the regulator preemptively specified a surface before it became commercial — and could do so because interface specification is already his, by regulation, with sanction behind it. The ability to close an advertising market that does not yet exist is the clearest demonstration of who owns the product.

What to Watch

The first marker I will track is October 26th, 2026, when the inter-institution communication stage of MED 2.0 begins, delayed from August. It is the piece that determines the speed of chain tracing, and speed is the variable that decides whether there is balance left to return.

The second is the resumption of MED statistics. Public data stop in April 2026, despite the stated cadence of thirty days. Without a series from May through February, there will be no baseline against which to measure the effect of the new dispute journey starting March 2027 — and the absence of baseline is how regulatory interventions fail to be evaluable. It is also worth tracking the proportion of recoveries that actually pass through expanded tracing, starting from about 5% at the beginning of production.

The third is October 1st, 2026, when customizable limits enter and the fixed ceiling per transaction in contactless Pix falls. It is the vector that grows while the sector's attention is on the receipt screen.

The fourth, and for me the most revealing, is the first enforcement proceeding opened on the basis of an item from the user experience manual. Until that happens, the hypothesis that the interface specification is a true obligation remains untested — and participants with tight budgets will continue to prioritize it below requirements whose enforcement they have already seen work.

The fifth is silence. If, by March 2027, no participant publicly requests more time, no entity estimates compliance cost and no institution is identified as having lost revenue from the prohibition, the interpretation that this was a preventive anti-phishing rule will be confirmed by absence — and the sector will have accepted, without debate, that the screen where the user spends the most time is specified by whoever operates the rail.

Portuguese edition reviewed by Alexandre Goes.