It defines how institutions must investigate, communicate, decide, and execute refunds under a mandatory and standardized process enforced by the Central Bank of Brazil (BACEN). MED ensures consumer protection, consistency across institutions, and full auditability within the Pix ecosystem.

​

When MED applies

---

A Pix transaction enters the MED process when a financial institution identifies the need for formal, regulated investigation, typically in cases such as:

• Fraud (phishing, account takeover, social engineering)
• Unauthorized transactions (user did not approve the payment)
• Operational errors (duplicate sends, incorrect recipient, wrong value)
• System or processing failures causing financial impact

MED runs independent of standard Pix refund flows. Standard refunds are voluntary; MED is mandatory and regulated.

​

Regulatory MED lifecycle

---

Every MED case follows a strict set of states defined by BACEN. Institutions must comply with the deadlines and response requirements at each stage.

​

Lifecycle overview

​

Valid reasons for MED disputes

---

A MED case must be opened under one of the regulated dispute categories: Each case must include justification and supporting evidence aligned to BACEN’s requirements.

​

Possible outcomes

---

Approved cases trigger a pacs.004 message for refund execution through SPI.

​

MED process — step-by-step flow

---

Below is the regulated MED process followed by all Pix institutions:

​

1. Validation

• Transaction exists and is in COMPLETED state
• Transaction age ≤ 30 days
• Minimum value R$ 1,00
• No existing open MED case for the same transaction

​

2. Evidence collection

• Fraud markers from DICT
• Internal risk analysis
• Upload of evidence (documents, screenshots, logs)
• Compliance verification

​

3. Case creation

• MED ID assigned
• Regulatory deadlines computed (7 / 10 days)
• Notifications sent to involved institutions
• Timeline and audit trail started

​

4. Analysis phase

• Examination of submitted evidence
• Evaluation of counterpart’s response
• Application of internal and regulatory rules

​

5. Decision

• Refund executed via pacs.004 (if approved)
• Ledger postings applied (debit/credit)
• Institutions notified
• All events logged for audit

​

6. Completion

• Case moves to COMPLETED, REJECTED, or EXPIRED
• 90-day retention period begins
• Evidence archived and audit trail locked

​

Integration points

---

Although MED is a regulatory process, it interacts with core Pix components:

​

Compliance expectations

---

Institutions must ensure:

• Enforcement of all regulatory deadlines
• Cryptographic protection of evidence files
• Full audit trail including timestamps and event logs
• Standardized MED communication with counterpart institutions
• SLA monitoring and status tracking
• Consistent customer notification logic
• Proper use of dispute categories and reason codes

These controls guarantee system-wide integrity and consumer protection.

​

Relationship with refunds and reversals

---

While refunds and reversals are standard Pix operations, MED is the regulated mechanism used when:

• The refund is tied to fraud or unauthorized activity
• The originating institution disputes the transaction
• Additional evidence and regulated communication is required

In these cases, the refund is executed through the MED decision, not as a voluntary action.

​

Infraction reports

---

Infraction reports are the formal mechanism for a Pix participant to report suspected fraud or unauthorized activity associated with a transaction. They are the starting point of the MED dispute resolution process.

​

When to file an infraction report

An infraction report is filed by the payer’s PSP (the institution that initiated the original transaction) when a customer reports fraud or unauthorized activity. The report notifies the counterparty PSP (the receiver’s institution) and initiates the investigation. Two types of infraction reports exist:

​

Time limits and deadlines

Infraction reports operate under strict regulatory deadlines:

​

Infraction report lifecycle

An infraction report progresses through the following statuses:

​

Closure and automatic fraud markers

When an infraction report is closed with an AGREED result, a fraud marker is automatically created for the affected individual. This links the infraction investigation directly to the anti-fraud system, ensuring that flagged individuals are tracked across the Pix ecosystem.

​

Available operations

• Create: File a new infraction report for a transaction
• List: Query infraction reports with filters (status, transaction, participant, analysis result)
• Retrieve: Get full details of a specific report
• Close: Submit the closure analysis with AGREED or DISAGREED result
• Cancel: Cancel a report that is no longer valid (only from OPEN or ACKNOWLEDGED status)

​

Refund requests

---

Refund requests are the mechanism for returning funds to the original sender after an infraction has been confirmed. They represent the financial execution step of the MED process.

​

When to create a refund request

Refund requests are created after an infraction report has been investigated and closed. The rules depend on the reason:

​

Time limits

​

Analysis outcomes

When the counterparty participant analyzes a refund request, three outcomes are possible: Rejection reasons include: NO_BALANCE (insufficient funds), ACCOUNT_CLOSURE (account has been closed), INVALID_REQUEST (request does not meet requirements), or OTHER.

​

Available operations

• Create: Open a new refund request for a transaction
• List: Query refund requests with filters (status, transaction, participant, analysis result)
• Retrieve: Get full details of a specific request
• Close: Submit the closure decision with analysis result
• Cancel: Cancel a refund request before it is processed (only from OPEN status)

​

Fraud markers

---

Fraud markers flag individuals (by CPF/CNPJ) or specific Pix keys as associated with fraudulent activity. They are a central component of the Pix anti-fraud ecosystem managed through BACEN’s DICT.

​

How fraud markers are created

Fraud markers can be created in two ways:

1. Directly: A participant explicitly registers a fraud marker for a tax ID or Pix key through the API
2. Automatically: When an infraction report is closed with an AGREED result, a fraud marker is automatically created for the affected individual

​

Fraud classification types

Each fraud marker is classified into one of the following types:

​

Fraud marker lifecycle

Only the participant who created a fraud marker can cancel it. Cancelled markers cannot be reactivated — a new marker must be created if needed.

​

Available operations

• Create: Register a new fraud marker for a tax ID and optionally a Pix key
• List: Query fraud markers with filters (key, document, status)
• Retrieve: Get full details of a specific marker
• Cancel: Cancel a previously registered marker (only from REGISTERED status)

​

Statistics and risk assessment

---

The MED statistics capabilities provide aggregated anti-fraud and transaction data for risk assessment. This data helps institutions evaluate the risk profile of a person or Pix key before processing a transaction.

​

What statistics are available

Statistics are available at two levels:

​

Person statistics (by CPF/CNPJ)

Aggregated data for a specific individual or entity, including:

• Settlement history: Number of settled transactions over different time periods
• Fraud markers: Counts by fraud type (application fraud, mule accounts, scammer accounts, other)
• Total fraud amounts: Monetary impact of fraud-related transactions
• Infraction reports: Open and rejected report counts
• Registered accounts: Number of accounts with Pix keys linked to this person

​

Key statistics (by Pix key)

Data for a specific Pix key, independent of its current owner, plus the current owner’s statistics:

• Key-level data: Settlement history, fraud markers, infraction reports, and account registrations for the key itself
• Owner-level data: Full person statistics for the key’s current owner (same structure as person statistics)

​

Time periods

All statistics are aggregated over three time windows:

​

Use cases

• Pre-transaction risk scoring: Query destination key statistics before approving a cash-out to assess recipient risk
• Onboarding verification: Check person statistics during account opening or key registration
• Monitoring dashboards: Track fraud marker trends across your portfolio
• Regulatory compliance: Demonstrate due diligence in fraud prevention to auditors and regulators