PSP Licensing and Local Acquiring in Brazil: The Operator Guide

"Get a PSP licence in Brazil" is a search query, not a regulatory category. Brazil doesn't licence a thing called "a PSP." Banco Central do Brasil (BCB) authorises specific service activities under the instituição de pagamento (IP) framework, and different activities carry different authorisation obligations, different capital requirements, and — in one case that trips up a lot of operators — no separate authorisation requirement at all. Answering "what licence do I need" requires first answering "what do I actually do in the payment flow," and that second question is where most operator research on this topic stops short.

This guide covers the regulatory structure BCB actually uses: the four IP service categories, the acquirer/sub-acquirer distinction and when a sub-acquirer needs its own authorisation, the separately regulated arranjo de pagamento (payment scheme) role that gets confused with acquiring, how the international PayFac concept does and doesn't map onto Brazil's sub-acquirer model, and the entity question — can a foreign company acquire in Brazil without incorporating locally. For the broader decision of whether local acquiring is worth pursuing in Brazil at all — the Elo scheme-reach argument, the market-entry timeline, and which acquirers foreign operators actually enter through — see local acquiring vs cross-border acquiring, which covers that ground and isn't repeated here. Pix, Brazil's instant-payment rail, is a separate topic with its own regulatory track covered in Brazil's Pix for operators; it doesn't route through the acquirer/IP framework described below at all.

One caveat before the structure: BCB's own website could not be fetched as a live source for this article — its regulation-search and normativo-lookup pages return only an empty Angular application shell over HTTP, with no server-rendered text, on every path tried. Two static BCB pages did resolve with real content and are cited directly below. Everywhere else, this guide relies on the actual resolution text as reproduced by a Brazilian legal-database provider, and on named, dated Brazilian law-firm regulatory alerts — never presented as if they were BCB's own words. Every specific number in this piece is sourced to one of those documents; anything that surfaced only as an unsourced AI-search summary during research has been left out rather than hedged in.

The Value Chain: Who Actually Sits Where

A Brazilian card transaction passes through more distinct regulated roles than the US or European equivalent, and conflating them is the single most common mistake in operator planning. In order:

• Merchant — the seller. Not regulated by BCB in this chain.
• Gateway — the technical layer that captures and encrypts payment data and routes it onward. Not itself a BCB-regulated activity; a payment gateway in Brazil is usually bundled into a broader IP's stack rather than existing as a standalone licensed role.
• Subcredenciadora (sub-acquirer) — enables the merchant to accept a payment instrument, operating under a participation contract with an already-authorised arrangement participant. Does not sit as creditor in the settlement chain.
• Credenciador (acquirer) — enables merchant acceptance and does sit as creditor in the settlement chain before the issuer. This is a BCB-authorised IP category on its own.
• Arranjo de pagamento (payment arrangement / scheme) — the rulebook a transaction runs under: Visa, Mastercard, Elo, or Pix. Governed by its instituidor, not by the acquirer.
• Instituidor de arranjo — the entity that defines and governs the scheme's rules. A card network for card schemes; BCB itself for Pix.
• Issuer — the cardholder's bank or IP, on the other side of the transaction.

A PSP or an acquirer, in the loose international sense operators use those terms, can occupy one or several of these roles simultaneously in Brazil — a large Brazilian acquirer typically holds both credenciador and emissor de moeda eletrônica authorisation, for instance. What BCB does not recognise is a single undifferentiated "PSP" category that covers all of it by default.

The Four IP Service Categories

Resolução BCB nº 80/2021 establishes instituição de pagamento as the umbrella status, then splits it into four distinct service modalities, each separately authorised:

An institution can hold more than one of these at once, and most sizeable Brazilian PSPs do. But each is authorised on its own terms — capital, governance, and operational requirements are not identical across categories, and an authorisation for one does not extend to another. An operator whose Brazilian entity plans to both acquire merchants and issue prepaid balances needs both authorisations, not one broader one.

BCB's own definition page frames the umbrella concept plainly: an instituição de pagamento is a legal entity enabling payment and resource-movement services within a payment arrangement, explicitly without the ability to grant loans or financing — a payment institution is not a bank, and the boundary between the two categories is a recurring source of confusion for operators used to jurisdictions where a single banking or e-money licence covers a broader scope.

The Sub-Acquirer Trap: When a Subcredenciadora Needs Its Own Authorisation

This is the distinction most international operators get wrong, because "sub-acquirer" reads as a smaller version of "acquirer" and implies a smaller version of the same licence. It isn't.

A subcredenciadora enables a merchant to accept a payment instrument, exactly like a credenciador — but it does so under a participation contract with an already-authorised participant in a payment arrangement, and it does not sit as creditor in the settlement chain before the issuer. Because of that structural difference, a subcredenciadora is not, by that activity alone, required to hold its own BCB authorisation. Brazilian regulation treats it as a contractual participant inside a regulated arrangement rather than as an independently regulated entity.

That exemption is narrower than it sounds. A subcredenciadora becomes subject to IP authorisation the moment it independently performs one of the four regulated activities above — most commonly by starting to hold customer funds as an e-money issuer, or by acquiring merchants directly rather than through the participation-contract structure. Plenty of Brazilian sub-acquirers cross that line as they scale, sometimes without a deliberate decision to do so, simply because a product feature (holding a merchant balance, say) quietly converts the entity into an emissor de moeda eletrônica.

There's a second trap sitting downstream of the authorisation question, and it's newer: centralised settlement participation. Brazilian payment-arrangement rules require subcredenciadores to participate in centralised settlement (liquidação centralizada) when acting as receivers of settlement flows. Until November 2025, a subcredenciadora below a rolling 12-month transaction-volume threshold of R$500 million could opt out of centralised settlement specifically in its role as payer to end-user receivers — a real, sourced exemption, not a rumour. Resolução BCB nº 522/2025 revoked that exemption outright: centralised-settlement participation as payer is now mandatory for every subcredenciadora regardless of volume. An operator whose Brazilian sub-acquiring volume comfortably sat under that R$500 million line as recently as late 2025 may now have a live settlement-infrastructure obligation it didn't have a year earlier — worth checking explicitly rather than assuming a prior comfortable-volume assessment still holds.

Instituidor de Arranjo: The Role Operators Confuse With Being a PSP

"I run a payment arrangement" and "I'm an acquirer" get collapsed into the same sentence more often than the regulatory distance between them justifies. An instituidor de arranjo de pagamento is the entity that defines and governs a payment scheme's rules and structure — a card network, or BCB itself in the case of Pix. Resolução BCB nº 150/2021 requires an instituidor to be constituted in Brazil with a corporate purpose compatible with that role, and to maintain the technical-operational, organisational, administrative, and financial capacity plus governance mechanisms the role requires — a materially different bar from acquirer authorisation, aimed at scheme governance rather than merchant-facing acquiring.

An operator building, say, a closed-loop payment network or a proprietary instrument scheme inside Brazil may be building an arranjo de pagamento and stepping into instituidor obligations without realising it — a separate regulatory question from whether the same operator also needs credenciador authorisation to acquire the merchants inside that scheme. The two questions get asked as one and shouldn't be. Separately, whether an arrangement must integrate into the Brazilian Payment System (SPB) itself turns on its own volume threshold — a further reason "am I an acquirer" and "am I a scheme" need to stay two separate questions rather than one.

PayFac Doesn't Translate Cleanly to Brazil

International operators arriving with a PayFac mental model — sign up for a master merchant account with the card networks, onboard sub-merchants under it, own the underwriting risk — tend to reach for "subcredenciadora" as the Brazilian translation. The functional overlap is real: both structures aggregate smaller merchants under a bigger entity's standing relationship with the payment ecosystem. The legal basis is not the same, and the gap matters for compliance planning.

A US payment facilitator derives its standing from direct registration with Visa and Mastercard as a master merchant, under card-network rules the networks themselves enforce. A Brazilian subcredenciadora derives its standing from a participation contract inside a specific BCB-regulated payment arrangement, governed by that arrangement's own rules and by BCB's resolutions on payment arrangements generally — a different regulator, a different rulebook, and (as covered above) a different, narrower authorisation trigger. A PayFac compliance and underwriting program built around card-network master-merchant obligations does not transfer directly onto a Brazilian subcredenciadora structure; treating "subcredenciadora" as a drop-in Portuguese synonym for "PayFac" is exactly the kind of flattening that produces the wrong compliance conclusion. Where the concepts genuinely diverge and where a US PayFac program actually maps onto sub-merchant risk ownership more broadly is covered in PSP vs PayFac operations.

The Entity Question: No Foreign-Branch Path

Every IP category — credenciador included — must be constituted as a Brazilian sociedade limitada or sociedade anônima. A single-partner corporate structure isn't permitted, and the entity's corporate name must carry the words "Instituição de Pagamento." There is no direct-branch route and no path to holding IP authorisation as a foreign-registered entity operating cross-border into Brazil.

The practical consequence is the one nearly every foreign operator ends up taking: enter through an already-licensed Brazilian acquirer or PSP rather than pursue direct BCB authorisation. That route — which acquirers actually offer it, what the realistic timeline looks like, and where a specialist Latin American acquirer becomes necessary for Elo specifically — is covered in the local acquiring reference's Brazil section linked above rather than repeated here.

One development worth flagging rather than treating as settled: BCB opened a public consultation in September 2025 (Consultation 124) proposing to restrict international payment and transfer services — cross-border FX-adjacent payment flows, not domestic acquiring — to regulated, authorised institutions, with transitional rules for currently unauthorised providers. It signals where BCB's thinking is heading on foreign providers operating into Brazil without local authorisation, but it was a consultation, not a final rule, at the time of writing. If your Brazil entry model involves any cross-border payment or FX-adjacent service rather than pure domestic acquiring through a licensed local partner, confirm the current status of this consultation before finalising a structure around it.

What Changed in 2025 — and Why Older Numbers Are Now Wrong

BCB substantially reworked the authorisation and capital regime for payment institutions through 2025, in three separate instruments that get run together in casual summaries but that changed three different things:

BCB Rule 494/2025 amended Article 9 of Resolução 80/2021 to require every service modality an institution intends to operate to be included in a single, consolidated authorisation application — replacing an earlier framework of staggered deadlines tied to an institution's transaction volume. Payment institutions already operating without authorisation must file a regularisation request between 1–31 May 2026, with a further 30-day operating window for late filers.

Resolução Conjunta CMN/BCB nº 14/2025 replaced the flat minimum-capital figures Resolução 80/2021 originally set out — R$2,000,000 for e-money issuers, postpaid issuers, and acquirers; R$1,000,000 for payment initiators; R$3,000,000 for closed-system participants, all now revoked — with a formula: a base cost per operational activity category, an added component for data-processing and cybersecurity infrastructure, activity-specific components that vary by service type, and a multiplier tied to the institution's funding source. New minimums take effect 1 July 2026, with a transition running through 31 December 2027.

Resolução BCB nº 522/2025 is the one covered above: it removed the R$500 million volume exemption that let smaller subcredenciadores skip centralised-settlement participation as payer.

This guide deliberately does not compute what the new formula produces for any specific operator, and deliberately doesn't restate the old flat-capital figures as if they were still current — they aren't, and stating either as a working number would be exactly the kind of confidently-wrong guidance that does real damage to a market-entry plan. The formula is category- and risk-dependent, the rule was still mid-transition at the time of research, and BCB's own regulation-search infrastructure was not reachable to verify a current computed figure directly. Confirm the applicable minimum with BCB or Brazilian counsel before budgeting around any number — including any number in this article.

Which Category Do You Actually Need?

A rough map from what an operator does to which regulatory question follows, offered as a starting framework rather than a substitute for counsel:

Before You Plan Around Any Figure

Given how much of Brazil's current authorisation and capital framework changed in 2025 and is still transitioning through 2027, the responsible planning step is direct verification, not adoption of any figure — including the sourced ones in this article, given how recently and substantially the underlying rules moved. Confirm current minimum capital for your specific activity combination, current authorisation-application timelines under the consolidated process, and whether your sub-acquiring volume now triggers centralised-settlement obligations it didn't a year ago, directly with BCB or Brazilian financial-regulatory counsel before committing a market-entry budget or timeline to it.