Brazil’s open finance ecosystem is redefining how payments, risk and compliance interact, forcing operators to balance real-time innovation with regulatory discipline.
Brazil’s open finance system has reached a scale that few markets anticipated. With more than 42 million user consents and billions of API calls processed across the ecosystem, what began as an open banking reform has evolved into something more: a redesign of how financial identity, payments, and trust operate in a regulated digital economy.
For payment providers and operators in regulated sectors such as betting and gaming, the implications extend well beyond faster checkout. According to Carolina Franchini, Open Finance and Financial Institutions Manager at KPMG, the real transformation lies in how trust is now portable across the system.
“The most transformative impact is the democratisation of financial identity,” she tells Payment Expert ahead of SBC Summit Rio. “For decades, data was siloed within big banks, creating a massive information asymmetry. With 42 million consents, we’ve shifted the power to the consumer.”
For the wider financial system, she argues, this has created what she calls “portability of trust.” A customer’s verified financial behaviour is no longer locked within a single institution.
“A user can now take their years of good financial behavior from a traditional bank and use it to access better limits or tailored services in a fintech or gaming platform instantly. It has effectively turned ‘cold’ users into ‘warm,’ verifiable customers from day one,” she says.
From static KYC to dynamic intelligence
Brazil’s open finance rollout, overseen by the Central Bank of Brazil (BCB), has been accompanied by strict API and security standards, including adoption of the Financial-grade API (FAPI) profile. At the same time, the country’s instant payment system Pix, launched in 2020, has become one of the most widely used real-time payment infrastructures globally, processing billions of transactions each month.
Together, these rails are altering risk management models.
“It’s a paradigm shift from static KYC to dynamic intelligence,” Franchini says. Traditional onboarding processes rely on document uploads and point-in-time verification. Open finance APIs, by contrast, allow real-time verification of financial data.
“Open Banking allows for ‘Source of Funds’ verification in real-time without the friction of document uploads,” she notes. For regulated industries, particularly betting, this has direct compliance implications.
“For the betting industry, this is the holy grail of Responsible Gaming and AML compliance. We can now identify patterns of financial distress or unusual spikes in volume through API-driven data, allowing operators to intervene before a risk becomes a breach,” she says.
The resilience question
Scale, however, introduces new operational pressures. With API volumes running into the billions, uptime and redundancy become systemic concerns.
Franchini points to what she describes as a “resilience gap” among mid-tier players. While major banks and licensed payment initiators have largely aligned with the BCB’s standards, she suggests operational readiness remains uneven.
“As volumes hit the billions, firms must prioritize ‘Redundancy and Observability,’” she says. “You cannot rely on a single gateway or a single API provider.”
She argues governance structures must evolve accordingly. “Governance must include automated ‘failover’ protocols—if one bank’s API goes down, the system must reroute seamlessly. Additionally, firms need a dedicated API Governance Committee that treats third-party connectivity not as an IT ticket, but as a core systemic risk. If your API fails, your business stops,” she says.
For operators dependent on real-time deposits, particularly during peak sporting events, these considerations move to commercial necessity.
Personalisation meets LGPD
Brazil’s data protection framework, the Lei Geral de Proteção de Dados (LGPD), adds another layer of complexity. Like Europe’s GDPR, LGPD enshrines principles such as purpose limitation and transparency in data use.
Franchini sees the main tension emerging around how firms balance granular consent with increasingly sophisticated personalisation models.
“The tension lies in ‘Purpose Limitation.’ LGPD dictates that data must be used for a specific, disclosed intent. Personalization, however, often thrives on discovering non-obvious correlations,” she explains.
In practice, this requires a shift away from broad, catch-all permissions. “The challenge for operators is to move away from ‘blanket consents’ toward granular, value-driven transparency. If you want to use data to personalise a betting offer, you must prove to the user that the trade-off—giving up some privacy for a better, safer experience—is worth it. Transparency is the only way to resolve this friction,” she says.
Pix, A2A and the card question
Open finance in Brazil cannot be separated from Pix. Since its launch, Pix has been adopted by hundreds of millions of individuals and businesses, and it has steadily eroded cash usage while also competing with traditional card rails for certain transaction types.
Franchini believes account-to-account payments, combined with Open Banking’s payment initiation capabilities, will further shift the balance.
“In Brazil, the ‘Pix phenomenon’ combined with Open Banking’s Inactive Payment (ITP) capabilities is already cannibalizing credit and debit card volumes in the digital space,” she says.
For gaming and entertainment, she argues, A2A has structural advantages. “It eliminates interchange fees and, more importantly, it removes the risk of chargebacks.” Looking ahead, she adds: “By 2026, I expect A2A to be the primary rail for any high-frequency digital entertainment sector in Brazil, leaving cards for high-value, long-term credit purchases only.”
While card schemes remain deeply embedded in global commerce, Brazil’s model suggests that coordinated regulatory and infrastructure reform can materially alter payment mix in a short timeframe.
Regulator, operator or market?
As innovation accelerates, the question becomes who determines its limits.
“The regulator sets the floor, but the market sets the ceiling,” Franchini says. While the Central Bank provides the framework, she argues consumer behaviour ultimately determines viability. “If a protective measure is too cumbersome, users will migrate back to unregulated or ‘grey’ markets.”
For operators, the responsibility therefore lies in designing protection as part of the product experience. “The responsibility falls on operators to innovate within the guardrails, making protection feel like a feature (trust) rather than a bug (friction),” Franchini says.
As Brazil’s open finance model continues to evolve, it is increasingly viewed by other emerging markets as a template. “Brazil is already the blueprint,” Franchini says. The combination of proactive regulation, standardised APIs and a national instant payment rail has created a system in which payments, compliance, and customer intelligence are tightly integrated.
Ready to attend SBC Summit Rio? Here’s how:
Secure your place with a VIP Event Pass for R$3000 – enjoy full access to all conference sessions, the exhibition floor, exclusive networking events, and complimentary food and drink at our Food Festival.
Bringing the team? Take advantage of our Group Pass Discount — purchase three or more VIP Event Passes and pay just R$1800 per ticket.
Operator or affiliate? You may be eligible for a complimentary VIP Event Pass, which includes full access to the exhibition, conference, and exclusive networking events. Apply now to reserve your spot.
Expo+ Pass: Gain access to the full exhibition floor and all conference sessions. This does not include access to our exclusive VIP evening networking events.
Expo Only Pass: Free to attend, this pass gives you access to the exhibition floor – perfect for networking and exploring the show without attending the conference sessions.
Source: Payment Expert
