If you use Pix to pay, transfer, or receive money, the September 6, 2026 deadline does not create a new task for you. The Central Bank of Brazil's SPI Notice 007/2026 deals with digital certificates used in the Pix infrastructure by system participants. It does not require customers to replace a certificate, Pix key, password, registered phone, or banking app.
The core issue is technical: institutions that still use certificates that do not comply with the new requirements must adjust their production configurations by September 6, 2026. For ordinary users, the practical rule is simple: there is no “Pix certificate” that you need to install or replace because of this deadline.
What actually changes on September 6
On June 8, 2026, the Central Bank published new security requirements for digital certificates in the Pix environment. The change appears in Communication No. 45,351, in version 6.00 of the National Financial System Security Manual, and was detailed for participants in SPI Notice 007/2026.
The requirement combines two ideas:
- separation by purpose: each certificate must be used only for the function for which it was issued;
- Pix-only use: certificates from the Pix environment must not be reused in other environments cited by the Central Bank, such as SPB and MES.
For certificates that were already in use and did not meet the new standard, the Central Bank set two compliance milestones: July 8, 2026 in the testing environment and September 6, 2026 in production. Since June 8, 2026, the notice has also prohibited the submission of new certificates that fail to meet section 5.1 of the manual.
Who actually needs to take action
The operational target of the change is Pix participants that use these certificates, especially teams responsible for technical connectivity, security, infrastructure, and credential management. The Central Bank's page on Pix participating institutions distinguishes participation models and explains access to the Instant Payment System (SPI) and DICT.
In practice, an institution needs to check whether its configuration respects purpose separation and exclusive use. Depending on its technology setup, compliance may involve replacement, activation, deactivation, or reorganizing how certificates are used. The safe conclusion, however, is not to overstate the rule: the notice requires non-compliant configurations to be corrected; it does not say that every certificate at every institution must necessarily be reissued.
CERTPIC and CERTPIA in plain language
Section 5.1 of the National Financial System Security Manual – Volume II separates two functions that must no longer be mixed:
- CERTPIC: a channel-authentication certificate. It is used to authenticate and protect connections to Pix APIs.
- CERTPIA: a certificate used for the digital signing of messages.
The new rule says a CERTPIC must not be used to sign messages as though it were a CERTPIA, and a CERTPIA must not be used for channel authentication. The goal is to reduce reuse of the same credential across different purposes and make responsibility boundaries clearer within the infrastructure.
This all happens far from the screen a customer sees. Pix users normally access the service through the app or internet banking of the institution where they hold an account, as the Central Bank explains in its Pix FAQ. The certificates covered by the September 6 deadline belong to the system's technical communications layer, not to a customer's everyday account setup.
What users do not need to do because of this deadline
| Question | Answer |
|---|---|
| Do I need to download or install a Pix digital certificate? | No. The notice creates no such obligation for customers. |
| Do I need to replace my Pix key? | No. The deadline concerns infrastructure certificates, not Pix keys. |
| Do I need to re-register my tax ID, phone, or device because of September 6? | Not because of this notice. It does not establish that procedure for users. |
| Do I need to update my banking app specifically because of the deadline? | The Central Bank does not require that in SPI Notice 007/2026. Your institution may still recommend normal app updates for other reasons. |
| Who has to comply? | Participants using certificates that do not meet the new requirements. |
Does the September 6 deadline mean Pix will stop working?
That is not what the document says. September 6, 2026 is a production compliance deadline. SPI Notice 007/2026 does not announce a nationwide Pix shutdown, scheduled national maintenance, or a customer-facing operational change on that date.
If a particular institution experiences its own operational problem because it did not complete a technical adjustment, that would be an infrastructure issue for that institution; it is not something a customer fixes by installing a certificate, replacing a key, or sharing security codes. This is why it matters to separate what the Central Bank actually required from alarmist claims.
How to spot a suspicious message about a “Pix certificate”
The notice is directed at participant infrastructure. Therefore, a message that uses the September 6 deadline to ask a customer to download a file, install a “new Pix certificate,” provide a password, token, SMS code, or make a transfer to “validate the account” does not match the procedure described by the Central Bank in this document.
That does not mean every security message from your bank is fake. An institution may send legitimate communications for other reasons. A safer check is to open the official app or website yourself, without using received links, and look for notices inside the authenticated area or on official support channels.
Why this change exists
Digital certificates are critical credentials used to prove technical identity, protect connections, and sign information exchanged between systems. When one credential is reused for different functions, it becomes harder to isolate responsibilities and limit the impact of misuse. The 2026 rule reinforces the principle that each certificate should have a defined purpose and remain restricted to the Pix environment.
For end users, the expected effect is indirect: infrastructure with clearer controls. The required action, however, remains on the institutions' side and with their technical teams.
In short: what to do by September 6
If you are a Pix customer, keep using the service normally and do not replace any certificate because of the September 6 deadline. If you work in the technical operation of a participating institution, the relevant task is to verify compliance with section 5.1 of the National Financial System Security Manual – Volume II and with the deadlines in Communication No. 45,351 and SPI Notice 007/2026.
The distinction is essential: September 6 is an infrastructure deadline for participants, not a call for users to update their Pix accounts.
