Pix onboarding puts Brazilian KYC analysts in charge of reviewing AI agents that check CPF and CNPJ data, assess onboarding exceptions and flag likely mule accounts. Training covers provenance on identity evidence, held verdicts and logged practice decisions. Onboarding, blocking and reporting decisions stay with analysts. Banco Central do Brasil, the LGPD and the ANPD set the frame.
What does a KYC analyst at a Brazilian payments firm do?
Pix made account opening and instant transfers available to almost everyone, and fraudsters followed. Payment institutions open accounts digitally at high volume, and the KYC team works the cases automated checks cannot resolve: a selfie that does not match the document, a CPF whose registration status is irregular, a company whose CNPJ activity code does not fit what it says it sells. Analysts also review merchants who accept payments through links and QR codes.
Mule accounts are the persistent problem. Accounts opened in the names of people who sold or lent their identity receive stolen funds and pass them on within minutes. Analysts review accounts flagged for mule patterns, decide whether to restrict them, and pass suspicious cases to the team that reports to Brazil's financial intelligence unit. Refreshing data on higher-risk customers and answering requests from partner banks fill the rest of the week.
Where do agents help, and at what depth?
Agents take the evidence gathering. Each use runs at a depth proven on the institution's own past files.
- CPF and CNPJ status checks (depth 1). The agent retrieves registration status and activity codes and compares them with the application.
- Onboarding exception review (depth 2). For a failed document or face match, it assembles the evidence and drafts a recommendation. The analyst decides.
- Mule pattern review (depth 2). It gathers account age, device data and the flow of Pix transfers, and drafts a restrict-or-release note.
- Merchant activity checks (depth 1). It compares a merchant's declared activity with its transaction pattern and public presence.
Restricting an account can be allowed at depth 3 within the institution's limits, because it protects victims and can be reviewed. Releasing a restriction should be held for an analyst. Our guide on how KYC analysts review an AI agent's decisions covers the review routine.
What must analysts learn, and what stays with them?
Provenance is the first skill. A CPF status retrieved from the official registry is sealed. A document photo uploaded by the applicant is declared, and a message from someone claiming to be the account holder that arrives through an unauthenticated channel is external. An external claim cannot authorise anything, including lifting a block. Analysts need to see these stamps on every fact before they approve a release.
Held verdicts are the second. When the agent holds a release, it names the analyst and the bound that held it. Analysts must review each one on its merits. Approving held releases in bulk during a busy afternoon is how mule accounts get reopened.
Practice is the third. Analysts build judgement by reviewing real decisions and comparing their calls with a senior reviewer's. A practicum log template for KYC analysts structures that record, and Pryme Intelligence Academy's Operator track uses a two-week practicum of real review decisions with an assessor's sign-off.
What stays with the analyst: approving or declining onboarding exceptions, releasing restricted accounts, closing accounts, and deciding whether to escalate a case for reporting. Our piece on whether AI agents will replace KYC analysts explains why these remain human.
Which Brazilian rules shape oversight and literacy?
Banco Central do Brasil authorises and supervises payment institutions and operates Pix. It sets requirements on customer identification, internal controls, AML and counter-terrorist financing, and Pix security, including fraud prevention measures, limits and mechanisms to return funds in fraud cases. When an agent prepares onboarding or restriction decisions, it sits inside controls the central bank already supervises, and the institution stays accountable.
The LGPD governs personal data, with the ANPD as supervisor. Biometric data used in face matching is sensitive personal data under the LGPD and requires particular care. The LGPD also lets a person ask for review of decisions made solely by automated processing that affect their interests, such as an account being refused, so the institution must show where a person decided.
AML obligations follow the FATF Recommendations, with suspicious transactions reported to Brazil's financial intelligence unit. The CVM matters only where a payments firm also offers investment products.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What does a 90-day training plan look like?
| Period | Focus | Who | Evidence |
|---|---|---|---|
| Days 1 to 30 | Depth, the five bounds, provenance, verdicts; first use: CPF and CNPJ checks at depth 1 | Whole KYC team | Completion records |
| Days 31 to 60 | Parallel review of onboarding exceptions; practicum logs | Three analysts | Logged disagreements, banked corrections |
| Days 61 to 90 | Calibration on mule cases; approver list; decide on mule review at depth 2 | Analysts and KYC lead | Signed approver list |
The training plan template for KYC analysts turns this into a document the team can adopt.
Where the Academy fits
Pryme Intelligence Academy's Foundations track gives the whole team the vocabulary in about four hours, free. Analysts who review daily take the Operator track, whose written exam is passed at 32 of 40 questions and whose practicum asks for at least 95 in every 100 review decisions correct with no missed red line. Certified Pryme Operator is valid for 12 months.
Questions people ask
Can an agent restrict a suspected mule account?
At depth 3 within the institution's limits, it can, because the restriction protects victims and is reviewed. Lifting it should stay with an analyst.
Is face matching data sensitive under the LGPD?
Biometric data is sensitive personal data, so processing needs an appropriate legal basis and strong safeguards.
How quickly should analysts act on held releases?
Fast enough that a legitimate customer is not locked out for long, slowly enough to check provenance. Set a target time and track it from the record. Our piece on why KYC analysts are the real control and the guide to AI agent skills by role explain the analyst's place.