Joint Resolution 16/2025: The BaaS Deadline Is Approaching. Is Your Operation Ready?

December 31, 2026 is right around the corner. It is the deadline for existing Banking as a Service (BaaS) contracts to comply with Joint Resolution No. 16/2025 from the National Monetary Council and the Central Bank of Brazil.

For those offering accounts, acquiring, or credit through other companies, this is not just about revising a clause. The regulation makes it clear who is responsible for each stage of the operation, including fraud prevention.

What is Joint Resolution 16/2025

Following Public Consultation 108/2024, the regulation established the first specific regulatory framework for BaaS in Brazil. It came into effect on 11/28/2025, and those with existing contracts were granted until 12/31/2026 to adapt.

Under the regulation's definition, BaaS occurs when an institution authorized by the Central Bank (the provider) offers financial services through another company (the contracting company), which owns the customer experience. The rule limits the scope of BaaS to these services:

• opening, maintaining, and closing deposit or payment accounts, and the payment services conducted through them;
• accreditation, meaning acquiring;
• credit operations.

Excluded from the BaaS concept, for instance, are banking correspondents, data processing and storage, cloud services, Open Finance partnerships, and the activities of sub-acquirers and network service providers under payment arrangement regulations.

The key point: accountability cannot be outsourced

The contracting company may perform support tasks, but the provider remains responsible for customer identification and qualification, risk profile analysis, fraud prevention, and anti-money laundering and combating the financing of terrorism (AML/CFT). No contract transfers this responsibility.

In practice, when fraud slips through a BaaS operation, regulatory enforcement falls on the authorized institution, even if the end customer has never seen its brand.

What needs to be ready by 12/31

• Contract with minimum mandatory content: roles and responsibilities of each party, compensation, data processing security, provider access to documents and systems, and rules for handling customer demands.
• Contracting party assessment: the provider must verify the partner's technical capability and evaluate risks prior to contracting.
• Transparency with the end customer: the contracting company must disclose that it is not an institution authorized by the Central Bank, where applicable, and cannot use names that imply it is part of the financial system.
• Governance: designated responsible director and risk management policies with specific rules for BaaS.
• Controls: monitoring mechanisms with audit trails, metrics and indicators, tested by internal audit at least once a year.

And it is worth noting: the Central Bank can veto or restrict BaaS contracts and even order their suspension or termination when the operation poses a risk to system security.

Why regulatory scrutiny tightened

Resolution 16 is part of a broader move by the Central Bank to tighten anti-fraud rules throughout 2025. The context helps explain why: according to Febraban, losses from scams in the banking sector grew from R$ 8.6 billion in 2023 to R$ 10.1 billion in 2024, a 17% increase.

When fraud escalates and operations are spread across multiple partners, knowing exactly who controls each step is no longer just a legal detail—it becomes a matter of business survival.

How Akua is built ready

Akua does not replace the authorized institution's accountability. What it does is embed the controls required by the regulation directly into the product, without requiring a side project:

• Auditability per customer, not per platform: multi-tenant architecture from the ground up, with organization-level segregation. For those processing for third parties, each client has its own audit trail.
• Identification and risk: KYC, KYB, and AML with an audit trail, and every transaction evaluated in real time with AI anti-fraud, rules engine, and 3DS.
• Tailored rules: configurable anti-fraud rules by payment method, including specific dynamics for Pix.
• Mandates under control: card scheme releases and mandates monitored before they become an issue.
• Core security: PCI DSS 4.0, PCI PIN, SOC 2, and ISO 27001 certifications.

And when you need to discuss this, it is the Akua team in Brazil answering.

Time is running short

If your operation provides or contracts BaaS services and still has pending items, the best time to check off that list is now, not the last week of December. Talk to the Akua team in Brazil: akua.la/br

This content is for informational purposes only and does not substitute for legal advice regarding your specific case.