Pix Fraud, COAF Reporting, and Transaction Monitoring at Scale in Brazil

Pix processed over 62 billion transactions in 2024, growing nearly 48% year-over-year according to Banco Central do Brasil data. That volume makes Brazil the largest instant payment market in Latin America, and it creates a reporting obligation that every PSP and bank in the country faces directly: detecting suspicious patterns and communicating them to COAF, Brazil's financial intelligence unit, under penalties that include personal liability for executives.

Financial institutions operating in Brazil face a dual pressure. On the fraud side, losses tied to Pix have escalated alongside network growth: BCB data obtained via Lei de Acesso à Informação, cited by CNN Brasil, shows losses growing 70% and reaching R$4.9 billion. On the regulatory side, every PSP and bank supervised by BCB carries specific obligations to monitor transactions and report suspicious operations to COAF (Conselho de Controle de Atividades Financeiras), Brazil's financial intelligence unit. According to COAF, Communications of Suspicious Operations sent to the regulator grew 766% between 2015 and 2024, reaching 3.1 million reports in 2025 alone.

The architecture challenge is not detection alone. It is building a monitoring system that can operate at millions of daily transactions without generating so many alerts that the compliance team loses the ability to conduct meaningful analysis. This post covers the regulatory framework, what must be reported to COAF, and the architectural decisions that determine whether transaction monitoring becomes a compliance asset or an operational bottleneck.

The Regulatory Stack: BCB and COAF Obligations#

Brazil's AML compliance framework for PSPs and banks centers on two regulatory bodies with distinct but linked roles.

The Banco Central do Brasil (BCB) supervises financial institutions, authorizes payment institutions (IPs), and sets the operational rules for Pix participation. COAF, formally the Unidade de Inteligência Financeira (UIF), is the financial intelligence unit that receives, analyzes, and disseminates information about suspicious financial activity. COAF does not conduct criminal investigations; it produces the Relatórios de Inteligência Financeira (RIFs) that feed the Federal Police, Federal Prosecution, and Receita Federal.

A point that frequently causes confusion in implementation teams: reports go to COAF, not to BCB directly. BCB supervises whether institutions comply with their AML obligations, but the communications themselves flow exclusively through SISCOAF, COAF's reporting platform. Misrouting this creates both operational and regulatory risk.

The core regulatory instruments:

Lei 9.613/1998 establishes the legal obligation to report suspicious operations. All institutions supervised by BCB are "obligated persons" under this law.

BCB Circular 3.978/2020 is the operational rulebook for BCB-supervised institutions. Article 38 requires institutions to implement monitoring, selection, and analysis procedures for transactions and situations with the objective of identifying suspicious activity related to money laundering and terrorism financing. It mandates a documented risk-based approach, customer due diligence proportional to risk profile, and a formal PLD/FTP program.

Resolucao COAF 41/2022 details internal compliance requirements: written policies, a designated COAF correspondent within the institution, documented procedures for monitoring atypical operations, and the obligation to file reports without alerting the client under investigation.

Resolucao BCB 506/2025, published in October 2025, moved behavioral monitoring from best practice to mandatory requirement for direct SPI participants and introduced the fraud marking system (marcacao de fraude).

What Must Be Detected and Reported to COAF#

COAF receives two primary types of communications from financial institutions.

Communications of Suspicious Operations (COS): Filed when a transaction or behavioral pattern suggests money laundering, terrorism financing, or concealment of illicit assets. There is no minimum value threshold for a COS. A transaction of any amount can generate a COS if the context raises well-founded suspicion. Quality matters here: a structured, documented COS with a clear narrative supports intelligence production at COAF. A threshold-triggered report with no contextual analysis contributes almost nothing to the financial intelligence system.

Communications of Cash Operations (COE): Required for cash transactions above regulatory thresholds defined by BCB. These are mandatory for the defined amounts regardless of suspicion.

All reports are filed exclusively through SISCOAF. Late filing, even when the underlying suspicion is legitimate, constitutes an independent regulatory infraction.

Specific behavioral signals that typically require investigation and may generate a COS:

• Structuring: multiple smaller transactions that appear designed to stay below monitoring thresholds, but which aggregate to amounts that would otherwise attract attention
• Mule account patterns, known locally as "contas de passagem": accounts that receive funds and immediately forward them to other accounts, often within minutes, leaving minimal or zero balance
• Counterparty concentration: a single recipient receiving transactions from many unrelated senders in a short time window
• Pix key fraud flags in the DICT, BCB's Pix key registry, placed by other participants in the network
• CPF or CNPJ with an economic profile inconsistent with transaction volume, particularly for newly opened accounts
• High transaction velocity immediately after account opening, before any transaction history has been established
• PEP (Politically Exposed Person) exposure without documented enhanced due diligence

The DICT is a mandatory integration point. Institutions must consult it during onboarding and can flag counterparties as fraudulent, making those flags visible to all other Pix participants. A DICT fraud flag on a counterparty is one of the strongest automated signals available for triggering a compliance review.

The False Positive Problem at Pix Scale#

At 62 billion annual transactions, even a 0.1% alert rate generates 62 million alerts per year. A 0.01% rate still produces 6.2 million. Most rule-based monitoring systems, when applied to raw Pix data, run well above these thresholds because the behavioral patterns of legitimate Pix usage overlap significantly with fraud typologies: high velocity, frequent small transfers, transactions at unconventional hours, and immediate forwarding of received funds are all normal behaviors for certain business types.

Three architectural decisions determine whether a monitoring program can operate at this scale.

Segmentation Before Scoring#

A payment aggregator processing thousands of merchants looks nothing like a retail banking customer. Both produce different transaction patterns, and applying the same rules and thresholds to both generates systematic false positives for at least one of them. Effective monitoring at scale starts with customer segmentation that assigns each account to a behavioral peer group before any rule or model is applied. Rules and thresholds then run within the segment, comparing behavior against relevant peers rather than against a single universal baseline.

Behavioral Baseline Before Threshold#

Static thresholds, such as flagging any transfer above a fixed amount after a given hour, produce high false positive rates when applied without context. A behavioral model that establishes each customer's individual baseline (typical transaction size, usual hours, common counterparties, historical velocity) and flags deviations from that specific baseline is substantially more precise than one operating on absolute thresholds. This approach is also what Resolucao BCB 506/2025 now mandates for direct SPI participants: real-time mechanisms to identify atypical movements based on historical and behavioral patterns specific to each account.

Layered Processing: Real-Time and Batch#

Not every decision in a monitoring pipeline needs to happen in the transaction processing path. Lightweight signals (velocity deviation, counterparty DICT status, transaction amount relative to baseline) can be evaluated in real time as a first filter. Heavier enrichment work (graph analysis of counterparty networks, PEP screening, cross-referencing fraud databases, risk scoring using features that require historical aggregation) runs in batch cycles and enriches the alert queue before it reaches compliance analysts.

The goal is not zero false positives. The goal is an alert queue that is actionable: each alert carries enough context (counterparty history, DICT status, behavioral baseline deviation, transaction graph) for an analyst to make a decision in a reasonable amount of time. When alert queues become unmanageable, the practical outcome is triage by volume rather than by risk, which inverts the purpose of the system.

Resolucao BCB 506/2025: Behavioral Monitoring Is Now Mandatory#

Resolucao BCB 506/2025 formalized requirements that many institutions were treating as aspirational.

Direct SPI participants must now implement real-time mechanisms to identify atypical movements based on historical and behavioral patterns in their SPI account. They must monitor BCB notifications for atypical movement alerts and minimum balance alerts on the Conta PI.

The fraud marking system (marcacao de fraude) introduced by the same resolution allows a PSP to identify a transaction of its own client as suspicious. Once a fraud mark is issued or accepted, all Pix transactions involving the marked user must be blocked, except refunds. This creates a concrete operational requirement: institutions need decision systems capable of acting on fraud marks in real time and maintaining accurate block lists.

For PSPs operating Pix participation with passive or batch-only monitoring, this resolution is a forcing function. Passive posture is no longer compliant.

COAF Report Quality and the Modernization Effort#

Volume of COS is one dimension of the obligation. Quality is the other.

In March 2026, COAF, FEBRABAN, and ABBC signed a technical cooperation agreement to modernize COAF's systems using AI, with financial participation from the banking sector. The stated reason: the current infrastructure cannot process the volume and complexity of reports being received daily. The 3.1 million COS received in 2025, producing an average of 56 RIFs per day, are straining a system not designed for this throughput.

For financial institutions, this has a practical implication. The supervisory environment is tightening. BCB has classified all payment institutions as operating under "increased risk in terms of AML" and has been actively inspecting them. A new Selo de Conformidade em PLD/FTP, launched in March 2026 by Abracam with participation from ABBC, Acrefi, ABFintechs, Abranet, and Zetta, signals that self-regulatory compliance standards are becoming operational prerequisites in parts of the sector.

Institutions that orient their monitoring programs toward report quality, not just volume, will be better positioned in this environment.

Compliance Infrastructure at Pix Scale#

The most effective transaction monitoring programs share one structural characteristic: they treat fraud prevention and COAF reporting as two related but distinct workflows, with different real-time requirements and different documentation standards.

Fraud detection targets stopping a transaction before it settles. COAF reporting documents suspicious patterns that may indicate money laundering, regardless of whether any individual transaction was blocked in time. An institution can have a solid fraud prevention layer that blocks mule account transactions in real time while simultaneously failing to build the analysis and documentation workflow that COAF compliance requires.

A monitoring program that produces defensible COAF reports requires:

• A documented risk matrix with explicit rationale for each detection rule or model
• Audit trails showing when each transaction was analyzed, by what mechanism, and what decision was taken
• Case management tooling that links individual transactions into patterns, because a single COS typically covers multiple related events
• A reporting workflow that produces structured, detailed narratives, not just threshold triggers with no context

For PSPs and banks in Brazil, building this capability at Pix scale is a multi-year infrastructure commitment. The regulatory pressure from BCB, the behavioral monitoring mandates of Resolucao 506/2025, and the COAF modernization effort all point toward the same conclusion: transaction monitoring needs to be treated as core infrastructure, not as a compliance layer added on top of operations.

Gu1 covers the compliance stack for financial institutions operating in Brazil, from transaction monitoring to COAF reporting workflows. If you are building or scaling a PSP or bank in the country, contact us at gu1.ai.