Sinqia attack diverts R$710 million and Brazil's Central Bank caps Pix and TED at R$15,000 for unlicensed institutions
Two months after the C&M Software case, a second Pix technology provider was breached through IT vendor credentials. On September 5, the Central Bank of Brazil answered with a R$15,000 per-transaction cap, minimum capital and mandatory authorization.
Historical reference: September 9, 2025. Published on this site on November 2, 2026. Dates in the text identify the period covered.
In this article
Key points
- On August 29, 2025, attackers used credentials of Sinqia's IT vendors to make unauthorized Pix transfers. Its parent company, Evertec, estimates R$710 million; according to the press, R$670 million from HSBC and R$40 million from Artta.
- On September 5, the Central Bank of Brazil (BCB) published BCB Resolutions 494 to 498: a R$15,000 cap per Pix or TED at unauthorized payment institutions or those connected to the system through IT service providers (PSTI).
- PSTIs must now hold capital and net worth of at least R$15 million, and unauthorized payment institutions must apply for a license between May 1 and 31, 2026.
- For companies that pay suppliers through fintechs, the rule changes the per-transaction limit: check whether the institution you use is authorized.
São Paulo, September 9, 2025 — Two months after the attack on C&M Software, Brazil's payment system suffered a second blow at a similar link: a technology provider that connects financial institutions to Pix, Brazil's instant payment system. On Friday, August 29, attackers used legitimate credentials of IT vendors to move funds in the Pix environment of Sinqia, owned by Evertec, a company listed in the United States. Evertec estimates unauthorized transactions against two client institutions at R$710 million. The following Friday, September 5, the Central Bank of Brazil (BCB) responded with rules that change life for anyone operating outside the perimeter of authorized institutions.
- Unauthorized transactions, according to Evertec (Sept. 2); early reports said R$420M
- R$710M
- Amount authorities managed to secure in the first days, according to Poder360
- R$366M
- Cap per Pix and TED transaction at the institutions affected by the new rule
- R$15,000
- Minimum capital required from IT providers that access the financial system
- R$15M
What happened on August 29
Sinqia supplies software to the financial market and runs an environment that connects institutions to Pix and the rest of the Central Bank's infrastructure. In that environment, unauthorized transfers were made on the 29th. The company isolated the Pix environment and, at around 3:30 p.m., was disconnected from access to the Central Bank, with no date to return. The preliminary investigation, described by Evertec in a filing to the SEC, the US regulator, on September 2, indicates that the attackers misused credentials of Sinqia's IT vendors. Those credentials were canceled, and the incident appears limited to the Pix environment, which serves 24 institutions.
The money left accounts that institutions hold at the Central Bank to settle transactions among themselves, not customer accounts. Evertec did not name the victims; according to Tecnoblog, R$670 million belonged to HSBC and R$40 million to Artta, a credit company. Both said customers and balances were not affected. The first estimate, published by NeoFeed, was R$420 million.
- 08/29/2025Unauthorized transactions in Sinqia's Pix environment. The company is disconnected from the Central Bank in the late afternoon.
- 08/31/2025Meeting of Artta with the Central Bank, Sinqia and HSBC, according to Poder360.
- 09/02/2025Evertec reports R$710 million in unauthorized transactions to the SEC and says part of it was recovered.
- 09/05/2025The Central Bank publishes BCB Resolutions 494 to 498, with the R$15,000 cap, minimum capital and prior authorization.
- 05/01 to 05/31/2026Window for unauthorized payment institutions to apply for a license.
What the Central Bank changed on September 5
The package was presented by Central Bank president Gabriel Galípolo, who cited the involvement of organized crime in recent attacks on financial and payment institutions. The measures target two kinds of players: payment institutions that still operate without authorization, and information technology service providers (PSTI), the companies that, like Sinqia and C&M, link smaller institutions to the financial system.
| Measure | What it says | When it applies |
|---|---|---|
| Per-transaction cap (Res. 496 and 497) | Pix of at most R$15,000 when the payer's account is at an unauthorized payment institution or at a participant connected through a PSTI; TED of R$15,000 or more prohibited for institutions connected through a PSTI | Immediate; ends when the PSTI is accredited and the institution proves its security controls with an independent report |
| Prior authorization (Res. 494) | Payment institutions already operating without authorization must apply for a license between May 1 and 31, 2026 (the previous deadline ran to December 2029); those that do not apply may operate for only 30 more days | Immediate |
| PSTI capital (Res. 498) | Capital and net worth of at least R$15 million, proven by audited statements; officers for security, risk and crisis management; annual independent audit and insurance | Immediate for new providers; those already operating have four months to apply for accreditation |
| Contracts | PSTI contracts with unauthorized payment institutions must be adapted, according to Tecnoblog | 180 days |
| Headquarters and certification (Res. 494 and 495) | Dedicated physical headquarters, with no virtual office or coworking space, except within the same conglomerate; the BCB may require independent certification | Immediate |
According to Reuters, the cap does not affect 99% of the transfers companies make today and reaches about 3% of accounts in the financial system. An affected institution can request an exemption, which lasts up to 90 days or until it meets the security requirements, whichever comes first.
Banks and fintechs already authorized by the Central Bank that do not depend on an unaccredited PSTI keep their own limits. The cap applies to the account the money leaves, not to the recipient.
Why technology providers became targets
To connect directly to Pix, an institution needs expensive, certified infrastructure. Many fintechs hire a PSTI to do it for them. The arrangement is efficient, but it concentrates risk: whoever breaches the provider reaches several institutions at once, often through third-party credentials, as this case showed. It was the same pattern as the attack on C&M Software in late June, and the same weak point as the Coinbase leak: legitimate access in the wrong hands.
The Central Bank also pointed to the risk of unlicensed institutions operating at scale without the oversight of players with the required capital, governance and audit. In the September 5 press conference, director Gilneu Vivan cited pooled accounts (contas-bolsão), opened by fintechs at traditional banks, as a possible next target and said crypto-asset regulation should come in the coming months. It will complete the 2022 law that already requires authorization for virtual asset service providers.
What companies should check now
- If the company pays suppliers through a fintech or digital account, confirm that the institution is authorized by the Central Bank and uses an accredited PSTI.
- Review payments of R$15,000 or more: they may be blocked until the institution regularizes its situation.
- Keep a second account, at an authorized institution, approved by finance for larger payments.
Internal controls against improper access, such as least privilege, limits and dual approval, are the same ones discussed in the C&M case: IT vendor credentials are an entry point and call for strong authentication and periodic review.
What is still unclear
As of September 9, the final amount recovered had not been disclosed. According to Evertec, Sinqia will only resume processing transactions in the payment system after the Central Bank approves the measures it adopted. There are also no public details on how the credentials were obtained. Police investigations and complementary regulation are still under way, and the figures in this report may change.
Frequently asked questions
How much was diverted in the Sinqia attack?
Evertec, Sinqia's parent company, estimated R$710 million in unauthorized transactions in a filing to the SEC on September 2, 2025. According to the press, R$670 million came from HSBC and R$40 million from Artta. Part of the amount was recovered: authorities had secured R$366 million in the first days, according to Poder360.
Was customer money affected?
According to Sinqia, HSBC and Artta, no. The money left the institutions' reserve accounts at the Central Bank, used for settlement among them. Even so, the incident led to Sinqia's disconnection from the system.
Does the R$15,000 cap apply to every Pix?
No. Since September 5, 2025, it applies to Pix payments made from accounts at unauthorized payment institutions or at institutions connected to the system through an IT provider, and to TED transfers issued by those provider-connected institutions. Authorized banks and fintechs with their own connection keep their limits. The cap ends when the provider is accredited and the institution proves the required controls.
What is a PSTI?
It is an information technology service provider that connects financial institutions to the national financial system and to Pix. Under BCB Resolution 498, it needs at least R$15 million in capital and net worth, an annual independent information security audit, insurance, and officers responsible for security, risk and crisis management.
Until when can unlicensed fintechs apply for authorization?
The Central Bank moved the deadline up: applications must be filed between May 1 and 31, 2026. Before, the deadline ran to December 2029. Those that do not apply must end their activities within 30 days.
Found it useful? Share it with anyone who pays suppliers abroad.
Sources
- Ataque hacker a empresa que opera o Pix desviou R$ 710 milhões · Tecnoblog, Sep 2, 2025
- Sinqia diz que recuperou parte de R$ 710 mi desviados em ataque hacker · Poder360, Sep 2, 2025
- Após ataque ao Pix, Banco Central reforça segurança do sistema financeiro · Tecnoblog, Sep 5, 2025
- BC endurece regras para fintechs e cria teto de Pix e TED para coibir crimes · Forbes Brasil, Sep 5, 2025
- Form 8-K, Evertec, Inc., item 8.01 (incidente na Sinqia) · SEC, Sep 2, 2025
- Resolução BCB nº 496, de 5 de setembro de 2025 (Pix) · Banco Central do Brasil, Sep 5, 2025
- Resolução BCB nº 497, de 5 de setembro de 2025 (TED) · Banco Central do Brasil, Sep 5, 2025
For information only, not investment advice. Third-party brands mentioned belong to their owners; the mention is journalistic and does not indicate a partnership or relationship with Swapo Finance.
International payments with the speed of Pix and Central Bank rules.
Convert reais into USDT and send it to your supplier on the TRON network. One fee shown upfront, asset segregation policy, human support. Virtual assets have no FGC coverage; authorization application filed with the BCB.
