Brazil Credit Card Ban April 9, 2026: PIX, TED, Debit Playbook

Brazil's regulated cashier closed off credit cards on April 9, 2026. Portaria SPA/MF 615 had banned them on paper since April 18, 2024, but the move from "stop accepting" to "BIN-block at the gateway before authorization runs" arrived in early April 2026, when the SPA audit cycle started flagging licensed operators whose deposit page still rendered a credit-card logo for a Brazilian IP, per the BSN iGaming summary of the April 2026 enforcement window and KYCAid's payment-blocking analysis. The compliance bar is now a player typing a credit BIN at a Brazilian-licensed cashier sees the deposit fail before the issuer model ever runs. That part of the rebuild is mechanical. The harder part is what the migration left in pieces. The high-roller cohorts who used to fund a wallet on a recurring auto-charge do not have a clean substitute on PIX, TED, or debit, because Pix Automático launched in June 2025 with betting excluded as a category, per The Fintech Times' rollout coverage and EBANX's product notes. This is the operator-side migration playbook for the post-April 9 cashier. Legal-firm coverage of Portaria 615 has been everywhere. The cashier-engineering substitute for credit-card auto-debits has not.

What April 9, 2026 actually demands at the gateway

The cascade that produced April 9 ran in five steps. Lei 14.790/2023 was signed in December 2023 and set the framework that limited regulated-market deposits to electronic transfers at Central Bank-authorized institutions, per the BNS Law translation of the statute. Portaria SPA/MF 615 was published in the Diário Oficial da União on April 18, 2024 and named the four permitted rails: PIX, TED, debit and prepaid cards, and book transfer (transferência nos próprios livros), per Yogonet's coverage of the rule. IBJR and ANJL members voluntarily expedited the ban to October 1, 2024 ahead of the regulated-market launch, per iGamingBusiness reporting on the trade-association agreement. The regulated market opened January 1, 2025. The transition period closed January 1, 2026, after which the SPA shifted from guidance to active audits, per KYCAid's compliance guide.

The mechanical implementation that survives an audit blocks credit BIN ranges before the deposit payload reaches the PSP. A typical Brazilian-licensed cashier carries a maintained list of credit-product BIN prefixes published by the issuer associations, validates the first six digits of any submitted PAN against that list at /deposit/initiate, and rejects with a fixed error code before the request leaves the operator's edge. Debit BINs are the inverse list, allowed through. Two-track BIN management at the gateway is the load-bearing engineering work, and operators who outsourced the decision to their PSP discovered in early April that PSP-side decline still posts the attempt to BACEN reporting via the acquirer, hits the operator's MID statistics, and shows up in the SPA audit log as a credit-card attempt the operator failed to block at source.

The pre-ban credit-card share of regulated deposits was small. IBJR estimated it around 0.5 percent of deposits across its member books. ANJL put the share at "less than 3 percent" of total bets on member platforms. Central Bank president Roberto Campos Neto suggested credit-funded transactions reached 10 to 15 percent of total flow, with the caveat that digital-wallet-routed credit was hard to track, per iGamingBusiness reporting on the figures the trade associations and the BCB published. The disagreement in the numbers obscures the real distribution. Credit was a thin slice of total deposit count, but a fat slice of session value among the high-roller cohort, where players preferred a recurring auto-charge and a 30-day settlement on the credit statement. That cohort is what the migration broke.

The debit-only fallback and where it leaves a gap

Debit is the formal substitute for credit at the cashier, and at first glance the migration is straightforward. Visa Debit, Mastercard Debit and Elo Débito all clear at MCC 7995 under the regulated framework, route through the same tokenization plumbing the credit flow used, and produce the same approval-or-decline pattern the cashier already handles. Industry-side compliance reporting from gr8.tech put the post-ban shift to debit at roughly 8 to 10 percent of total deposit volume, with smaller increments to open banking and e-wallets, per gr8.tech's 2026 operator guide. For mid-tier players (R$50 to R$500 deposits per session), the rail mostly works.

What it does not work for is the player who deposited R$10,000 or more per session on credit and used the credit line to delay settlement. Brazilian debit cards carry per-transaction and per-day caps that are bank-set, sit roughly in the R$2,000 to R$5,000 daily range on retail accounts, and are not negotiable on a per-deposit basis. A high-roller hitting that ceiling rolls a debit retry sequence the issuer model reads as iterative pinging and starts declining. The decline-rate uplift on iterative debit at MCC 7995 is the same shape the issuer applies to the credit retries that motivated the ban in the first place, with the difference that the player has no headroom on the underlying account to absorb it.

The second gap debit leaves is the cohort that does not use debit at all. About 40 percent of Brazilian adults rely primarily on PIX and have not maintained an active debit card balance, per central-bank-cited adoption figures across operator coverage. For that segment, the credit-to-debit migration is not a migration, it is an exit. Operators that pushed a debit-first cashier to the entire Brazilian player base saw approval-rate drift in early April that traced back to debit attempts on accounts the player had not topped up since the ban hit.

The cashier engineering that lands cleanly on the debit gap exposes both rails on the deposit page, with debit ranked above credit for the issuer-decline reason and below PIX for everyone else. CPF-matching against the registered KYC profile applies to debit the same way it applies to PIX, and the same-CPF rule under Portaria SPA/MF 722 binds the depositor's CPF to the registered player's regardless of the rail (the cross-check engineering for that is detailed in the PIX MED 2.0 reconciliation analysis). Reserved BIN-prefix lists for debit have to ship as a maintained dependency, not a hand-coded constant.

PIX at 96 percent and the four percent that matters

PIX's share is the headline. The mechanics behind the share are what the cashier actually has to design against. PIX is real-time gross settlement on the BACEN-operated SPI infrastructure, settles in under 10 seconds, runs 24/7 including weekends and holidays, and carries no upper cap that bites on iGaming retail deposits because BACEN-set institutional limits sit well above typical betting amounts. The minimum deposit on PIX can be R$1, which collapses the friction floor under any other rail, per market commentary cited in iGaming Brazil and supporting industry analysis. The same-CPF cross-check binds the depositor's CPF to the registered player's, which kills third-party deposits at the gateway level, and DICT-bound withdrawal keys close the loop on the payout side.

The four percent is where this article earns its keep, because it is not residual noise. It is two specific cohorts the cashier needs to design for. The first is the player who wants a confirmed receipt and a separate-account audit trail, which is what TED gives and PIX does not, and which matters for high-roller deposits where the player and the player's accountant or treasurer want a paper-trail rail. The second is the recurring-deposit segment that used to run on credit-card auto-charge and which neither PIX nor PIX Automático can carry under the regulated rules, because PIX is player-initiated by design, the static-QR repeat flow is one-tap not zero-tap, and PIX Automático excludes betting. That gap is the operator-side migration problem that absorbs the credit-card cohort whose value-per-session was meaningfully above the median.

The static-QR repeat flow is the lift PIX gives to the recurring-deposit problem without solving it. Once a player completes a first deposit through a saved QR code, the banking app stores the merchant's profile, and the second deposit is a one-tap repeat through the player's phone. Pay4Fun and EBANX both report a roughly 7 percent lifetime-value lift from static-QR adoption versus dynamic single-use codes. The flow is still player-initiated. The credit-card auto-charge cohort wanted exactly the opposite of player-initiated, because the appeal of the auto-charge was the absence of a deposit decision at session start.

TED is the high-value rail no one is talking about

TED, Transferência Eletrônica Disponível, is the older bank-rail credit transfer that predates PIX and still runs as one of the four permitted rails under Portaria 615. The properties that matter for the cashier are specific. TED settles within minutes, but only during BCB business hours of 6:30 to 17:30 Monday through Friday. There is no upper cap at the rail level, and bank-side caps are negotiable for corporate or premium-account players. The sender pays a fee, typically R$5 to R$30 per transfer at retail accounts, which is a non-issue at high-roller deposit sizes. Every TED transaction generates an institutional confirmation document the sender's bank archives.

The rail-level shape is the same shape Brazilian corporate treasuries already use for vendor payments and high-value settlements. For high-roller iGaming deposits in the R$10,000-and-above range, TED replaces the credit-card auto-charge with a player-side scheduled transfer the player initiates from their corporate or premium retail account, often during the business-day window the player's treasurer or accountant runs other settlement work. The player loses the zero-friction auto-charge property and gains a paper-trail property they sometimes preferred to begin with.

The cashier engineering to expose TED at scale is non-trivial, which is why most regulated books have not bothered. TED reconciliation is bank-statement-driven rather than webhook-driven, the operator's settlement account has to be matched against incoming TED line items by reference text or by the player's pre-supplied transfer ID, and the credit to the player's wallet has to wait for the deposit-confirmation step rather than firing on a real-time event. Operators on AstroPay, PayRetailers, Nuvei, Adyen or Paysafe inherit the bank-statement integration from the PSP. Operators on direct-bank Pix integrations have to build the TED layer themselves, and orchestration platforms like IXOPAY, Solidgate or Primer normalize it through whichever underlying PSP they connect to. EBANX and Pay4Fun cover TED as part of their default Brazilian merchant-of-record stacks.

The deposit page that exposes TED to the right cohort segments by player tier. Mid-tier and casual players see PIX and debit. Players whose 30-day deposit total crosses an operator-set threshold (a common threshold is R$30,000) see a third option labeled with the bank-transfer instructions, the operator's CNPJ, the agency and account number to direct the TED to, and the per-deposit reference ID the player needs to include for reconciliation. Books that ship TED as an undifferentiated fourth choice on a single deposit page see almost no adoption because retail-side players never select TED voluntarily.

The recurring-deposit migration that broke for high-roller cohorts

PIX Automático launched in production on June 16, 2025, per The Fintech Times' rollout coverage, and the categories the BCB approved at launch were utilities, streaming subscriptions, gym memberships, school tuition, subscription clubs and similar recurring services. Betting was excluded by design, per industry analysis cited in PaymentExpert's launch-window coverage. The exclusion sits at the intersection of two issues. Pix Automático authorizes a one-time signed mandate that the receiving institution then debits at scheduled intervals, and Lei 14.790's player-protection framing requires player-initiated deposits with explicit per-session friction, which is the opposite of what an auto-debit mandate is engineered to do. Even if the BCB extended the category list, the regulator's player-protection rules would push back against any operator that routed recurring credits through it.

The substitute the cashier needs to ship is a friction-light prompt rather than an auto-debit. The shape that works in production at regulated books has four pieces.

1. Static QR codes saved in the player profile after the first deposit, so a return deposit is a one-tap repeat through the player's banking app. The pattern lifts return-deposit conversion roughly 7 percent versus dynamic single-use codes, per Pay4Fun's market commentary cited across industry coverage.
2. Scheduled deposit prompts on the operator side, sent by push or email at a player's historical deposit time, with a deep link into the cashier with the saved QR pre-loaded. The prompt does not deposit; it removes the decision-and-friction sequence to a single tap.
3. A separate high-roller flow that exposes TED instructions with a personalized reference ID and an account-onboarding handoff to a relationship-management team. For the cohort that previously relied on credit-card auto-charge, the operator's customer-facing playbook is to migrate the player to a scheduled-TED routine the player runs from a corporate or premium-retail account during BCB business hours, with the operator's reconciliation system matching the line item to the player's wallet within the same day.
4. Cohort segmentation that identifies the high-roller players whose recurring credit charges broke on April 9 and routes them to a manual outreach sequence rather than a generic debit fallback. Retention math is brutal here. Books that did not segment lost the credit cohort to competitors who did, and the loss compounded in the first 30 days because the cohort tested alternatives once and then settled.

The operator-side cost is engineering plus relationship-management, and it is what the migration costs that legal-firm coverage of Portaria 615 did not surface. The credit-card cohort accounted for a small share of deposit count and a meaningfully larger share of session value. Books that shipped a debit-only fallback page absorbed roughly 20 to 30 percent LTV loss on that cohort by the end of April. Books that built the static-QR plus scheduled-TED plus manual-outreach stack retained the bulk of it. The difference is engineering work the operator commits to, not regulatory uncertainty.

The compliance bar at the gateway is the easier half. BIN-block at deposit-initiate, decline credit BINs before the issuer model runs, and the SPA audit cycle does not flag the operator. The migration playbook for the credit-card cohort is the harder half, and Pix Automático is not coming to fix it. The operators who treated April 9 as a deadline and shipped the cashier rebuild plus the recurring-deposit substitute by mid-May are the ones who keep the cohort. The operators who shipped only the BIN-block kept the license and lost the players.