Restricted use cases for payments in Brazil, and why

Restricted use cases for payments in Brazil are the business types a payment provider refuses to serve, called prohibited, or serves only after enhanced due diligence, called high-risk. Anti-money-laundering law, sanctions rules and partner-bank policy draw the lines, so provider lists overlap but differ.

A provider's list mixes what the law forbids, what it licenses and what a bank will not touch. This post separates them, using the list Lumx publishes, read on November 6, 2026.

What counts as a restricted use case in Brazil?

The three outcomes a provider's restricted list can produce, and what each asks of the client

What Lumx does at this point: it publishes all three. Its prohibited-activities page lists 12 high-risk categories and 17 prohibited ones, and its supported-countries page sorts every jurisdiction into Supported, High-Risk (EDD required) or Restricted. Brazil is in the Supported tier.

Why providers refuse them: the law, sanctions rules and partner banks

Four forces produce a list. Brazilian criminal law comes first. Anti-money-laundering law is second. Law 9.613 of March 3, 1998 covers the crimes of laundering and the prevention of using the financial system for them, and created COAF, Brazil's financial intelligence unit. Law 14.478 of December 21, 2022, the virtual assets law, amended Article 10, II of Law 9.613 so the transaction record names virtual assets.

Sanctions are third. Law 13.810 of March 8, 2019 enforces United Nations Security Council sanctions. OFAC, EU and UK lists are not Brazilian law, but the banks on a dollar or euro leg apply them.

The fourth is the banking partner, which explains the part of every list that looks arbitrary. Lumx's docs say its country tiers reflect internal risk appetite and partner-bank requirements, next to sanctions lists and FATF guidance.

What Lumx does at this point: every business customer goes through KYB (know your business, the verification of a company and its owners) before it can transact.

The 17 prohibited categories and what drives each refusal

Lumx publishes all 17 prohibited categories in full, so a company can see the reason for a refusal before it applies. The table reads that list and adds a driver for each category. "Law" means a crime or an authorization requirement in Brazil. "Visibility" means the provider cannot see whose money it is. "Policy" means the activity can be lawful and the provider or its banks decline it anyway. Statutes are linked where read, otherwise cited by number.

Lumx's 17 prohibited categories as read on November 6, 2026, with the main driver of each refusal (the driver is the author's reading, not a Lumx statement)

The driver column counts 9 rows of law, 3 of visibility and 5 of policy. About three in ten refusals rest on the provider's own risk appetite and its banks' view, so a refusal alone does not tell you the business is illegal in Brazil.

What Lumx does at this point: it publishes these categories on its docs and collects a businessActivity value from every business customer during KYB, which drives how deep the review goes and which documents are asked for. The KYB onboarding flow shows where it fits.

Which businesses are high-risk but allowed?

The high-risk list is where most real payments companies sit. Being on it triggers review, nothing more.

Lumx's 12 high-risk categories, allowed with disclosure, risk assessment and enhanced due diligence, as read on November 6, 2026

Two entries turn a likely "no" into a longer review. Licensed betting is high-risk and unlicensed betting is prohibited, so the licence is the whole difference. A politically exposed owner gets a longer review instead of a refusal.

Disclosure decides which side of the line a company lands on. A payment company that calls itself "software" on the form but moves customer funds is re-classified as a money-services business at KYB, after weeks in the wrong review. For a borderline case, email compliance@lumx.io before applying with the activity description, the licences held and the ownership chart.

What Lumx does at this point: it serves these customers under enhanced due diligence and ongoing monitoring, and it may ask for extra documents through an RFI (request for information, a compliance hold that asks for a document before a transaction clears). High-risk customers should plan for verification windows beyond the standard target.

Restricted countries and what counts as a tie

Country is the third filter: where the customer lives or is incorporated, does business and where its beneficial owners sit.

The three jurisdiction tiers on the Lumx docs, as read on November 6, 2026

Any of the four ties gets onboarding rejected. The list is on the supported countries page.

What Lumx does at this point: it runs the tiers from that page and screens parties against sanctions lists as part of KYB and destination verification. A company with an owner in a restricted country is rejected, and one with an owner in a high-risk country gets the deeper review. Lumx may approve or refuse onboarding outside the standard tier in limited cases. Grey-area cases and pre-approval requests go to compliance@lumx.io.

The restriction also reaches the payer and the beneficiary, though the test differs. The country tie is judged on the customer and its owners. A payer or beneficiary in a restricted country or on a sanctions list is counterparty exposure, which lets a provider refuse a payment from an onboarded customer.

What Lumx does at this point: it makes the parties in the chain visible and screens them, and a payout destination has to be approved before money moves, a check that includes sanctions. Stablecoin payments are lawful in Brazil under the virtual assets framework, covered in the Brazil regulation post, so the restriction attaches to who and what is paid.

Can a restricted business use another company's account?

No, and providers watch for this move more than any other. A business that cannot be onboarded sometimes asks to run payments through a customer that can, which is called nesting, and it turns a refusal into a prohibited structure.

Providers ask whose money it is and whose business it pays for. If either answer is an entity the provider has not onboarded, it is nesting, and a party the provider cannot see escapes KYB and sanctions screening. A payer who is not the account holder can be legitimate, and that case has its own post.

What Lumx does at this point: its docs prohibit nested payments and allow marketplaces, payroll providers and investment vehicles only when every party in the chain is onboarded, for example each seller as its own customer with a partner fee for the platform. A parent paying a subsidiary's suppliers is allowed when compliance approves the flow of funds in writing at compliance@lumx.io. For a company that wants to reuse a partner's identity check, the limits are in the post on relying on a client's KYC.

How a refusal shows up

At onboarding, a fixable problem such as a blurry document or a wrong tax ID puts the customer in RFI and can be resubmitted. A prohibited activity or a restricted tie is rejected, and a FINAL_REJECTION cannot be resubmitted. After onboarding, hidden exposure can lead to suspension, frozen funds and notice to partners and authorities. At payment time, a flagged transaction is held for an RFI, and an unanswered one can end with the money refunded to the sender, as why payouts get rejected and false alerts from monitoring rules explain.

I would write the business down in one sentence before opening any provider's form, and I would put the awkward part in the sentence. The form is built from that classification, so a client that calls itself a marketplace while running a prepaid-card programme is reviewed as the wrong thing and rejected later. Over-disclosure costs days of review. A mismatch found later costs the account.

What Lumx does at this point: a customer in RFI gets a customer.rfi webhook that carries the reject labels and the documents at issue. On payments, compliance reaches out by email or Slack and expects an answer within 24 hours. Complaints about a decision go to operations@lumx.io and questions about whether a case is allowed to compliance@lumx.io.

When is a restricted-use list the wrong thing to plan around?

When the business sits in a prohibited category or has a restricted owner. Restructuring changes neither answer, and a nested account only hides the activity. A high-risk business without its licence or ownership chart should wait until it has them.

What this looks like when a Brazilian company onboards with Lumx

Lumx is stablecoin payments infrastructure for businesses that move money between Latin America and the rest of the world: one API to collect, hold, convert, and pay out in BRL, MXN, COP, USD, EUR, and GBP or in USDC and USDT, over local rails such as PIX, SPEI, PSE, Bre-B, ACH, FEDWIRE, SEPA, and Faster Payments, with SWIFT and on-behalf-of payments and collections (POBO and COBO) in USD, EUR, and GBP, plus named virtual accounts, custodial wallets, and KYB/KYC built in.

The Brazilian company is the customer. It goes through KYB with its businessActivity, incorporation and ownership documents, and every UBO and representative as an associated party. Lumx targets one business day for a standard KYB review, as a target, not a promise. Once approved, it gets its named virtual accounts.

Screening runs before every transaction, in both directions. In Brazil, the reporting duties on a customer's operations sit with Lumx, as the virtual asset service provider (SPSAV, Sociedade Prestadora de Serviços de Ativos Virtuais) that filed its authorization request with the Central Bank on October 27, 2026 and operates under the transition regime of Article 88 of Resolution BCB 520 of November 10, 2025, which is not an authorization. Article 88 gives companies already running these activities 270 days from the resolution's start on February 2, 2026 to request one. See what a VASP is, stablecoin AML for fintechs and the Travel Rule guidelines.

The baseline is what KYB is.

Methodology and sources

The Lumx docs on prohibited activities, countries, nested payments and RFI were read on November 6, 2026 on docs.lumx.io.

The title and summary of Laws 9.613/1998, 14.478/2022, 13.810/2019, 11.343/2006, 10.826/2003 and 14.790/2023 were read on lexml.gov.br on November 6, 2026. It serves no article text, so Article 10 of Law 9.613/1998 is cited by number. Laws 12.865/2013, 6.385/1976, 9.279/1996, 13.709/2018, 1.521/1951 and Decree-Law 2.848/1940 are cited by number and not linked. Article 88 and Article 92 of Resolution BCB 520 (the 270 days and the February 2, 2026 start) were read on the Central Bank norms API on November 6, 2026. The Article 10, II wording follows our earlier post on stablecoin AML, read on September 24, 2026; planalto.gov.br did not answer.

Verified on November 6, 2026. Operational context, not legal, tax, or investment advice.

Cover photo: ashwin rai on Unsplash.