← Guides

Brazil's DREX: How a CBDCA central bank digital currency is state-issued digital money that can be designed for full traceability, policy enforcement, and programmable restrictions.Glossary → Becomes a Surveillance Tool

Brazil already has more than 150 million active Pix users, crypto reporting that has run since 2019, and a pending central bank digital currency called DREX. DREX can limit where money works, what it buys, and whether it expires.

Banco Central do Brasil has already described programmable welfare payments with spending limits as a DREX use case. Brazilians know what state control over money looks like. Hyperinflation in the 1980s and the 1990 Plano Collor freeze made that plain. The tools changed. The logic did not.

Brazil now has a layered surveillance stack: Pix, DREX, and Receita Federal crypto reporting. This piece maps that stack and the tools outside it.

Pix is fast because it is centralized

Pix launched in November 2020 and took over Brazilian payments within two years. More than 150 million people and 14 million businesses use it. It is free for individuals, runs all day, and settles instantly. By 2024 it handled more than 5 billion transactions a month.

From a privacy angle, Pix is a central ledger with extra steps. Every payment passes through Banco Central's Instant Payment System, SPI, and the Transaction Accounts Identifier Directory, DICT, which maps CPF numbers, phone numbers, and email addresses to bank accounts. Banco Central also runs an antifraud database and requires providers to feed it flagged-user data.

Pix traffic is encrypted in transit, but Banco Central holds the keys. Transaction history, who paid whom, how much, when, and from which device, sits in one place. Courts and regulators can reconstruct a user's full Pix history. Brazilian law enforcement already does. In 2023 alone, Banco Central received more than 3,400 judicial requests tied to Pix accounts.

Brazil also forces the CPF tax ID into almost every financial action. You need it to open a bank account, register a Pix key, trade on a domestic exchange, or buy foreign currency. Receita Federal cross-checks CPF data across banking, tax, and crypto reporting systems. There is no anonymous banking lane here.

DREX puts rules inside the money

DREX is Brazil's CBDC. The pilot started in March 2023 with wholesale market use cases and banks such as Bradesco, Itaú, and Nubank. A second phase ran through 2025. Retail rollout was aimed at late 2025 or early 2026, but privacy and architecture issues slowed it.

Programmability is the point. Banco Central describes DREX as infrastructure for smart contracts and conditional payments. That means the money can carry rules that execute on their own:

• Conditional disbursement: welfare payments that only work at approved merchants or for approved goods. Bolsa Família tied to school attendance is an explicit BCB example.
• Time-limited funds: money that expires if you do not spend it in time. That blocks saving and forces consumption.
• Geographic restrictions: emergency funds locked to one city or region.
• Automated tax collection: taxes deducted at settlement before the recipient gets paid.
• Corporate tax credit locking: business credits restricted to approved categories such as research, hiring, or infrastructure.

The first DREX rollout focused on market plumbing: tokenized bond settlement, delivery-versus-payment, and interbank liquidity. The retail risk comes next. Once conditional payment logic exists for bonds, extending it to welfare, refunds, or stimulus is a policy choice, not a technical leap.

Brazil is not China, but the rails rhyme

DREX often gets compared with China's e-CNY. That comparison helps, but politics matter as much as code.

The main difference is political structure, not technical power. China has already frozen accounts of dissidents, Uyghur residents, and protesters. Brazil still has constitutional privacy protections. Article 5 of the 1988 Constitution protects private life and financial privacy, and Brazilian courts have generally required specific judicial orders to access financial data.

DREX does not erase those protections today. The danger is the infrastructure. Once programmable money is live, future governments inherit it ready-made.

Brazil built crypto reporting early and kept going

Brazil started building crypto reporting before many countries had crypto laws at all. Normative Instruction 1,888 took effect in August 2019 and forced domestic exchanges to report customer transaction histories to Receita Federal. The reporting net has widened since.

Brazil ranks fourth worldwide in crypto adoption, with about $93.9 billion in annual volume by Chainalysis 2023 estimates. Stablecoins now dominate. By late 2025, Receita Federal data put them at roughly 90% of Brazilian crypto volume. Major exchanges such as Mercado Bitcoin, Foxbit, NovaDAX, and Binance Brazil all run full KYCKnow Your Customer rules require users to submit identity information such as passports, selfies, addresses, or phone numbers before accessing a service.Glossary → and file monthly reports.

The 2025 DeCripto system expanded reporting to foreign platforms and self-reported P2P trades. Exchanges now classify crypto-to-fiat conversions, crypto-to-crypto swaps, retail payments above R$50,000, withdrawals to unhosted wallets, and wallet-to-wallet transfers. That unhosted wallet category matters. If you move crypto from a Brazilian exchange to self-custody, the exchange must report the move. Receita Federal cannot see what happens after withdrawal, but it knows the withdrawal happened.

Brazil also joined the OECD's Crypto-Asset Reporting Framework early. Automatic international exchange of data began in January 2026. Using a foreign exchange to dodge local visibility is getting harder.

How to operate outside this stack

The constitutional gap

Brazil's 1988 Constitution came after military rule and includes explicit financial privacy protections. Article 5, Section XII protects financial data. Lei Complementar 105/2001 requires specific judicial orders to break bank secrecy. The Supreme Federal Court has repeatedly treated financial privacy as a fundamental right.

DREX does not directly break that framework yet. Today's design focuses on wholesale oversight more than retail micromanagement. But DREX still places Banco Central at the technical center of the money layer and gives it the ability to encode conditions inside the currency.

That matters because constitutional rules cover disclosure of data better than restrictions baked into money itself. No judge is needed to stop a welfare payment from working at the wrong merchant if that limit is already coded into the funds.

Brazil is the test case others will copy

Pix, DREX, and DeCripto/CARF together form one of the most mature financial surveillance stacks in any democracy outside China.

The Bank for International Settlements already cites Brazil as a leading CBDC implementation. When the ECB or the Federal Reserve looks for reference models, Brazil will be in the room. If Brazil normalizes expiring welfare money or merchant-restricted payments, those examples will travel.

The pattern is clear: instant payment rail, then programmable CBDC, then crypto reporting that pulls self-custody users into the data net, then CARF to close the foreign exchange gap. Brazil is ahead of most OECD states on this path.

Brazilians have seen this before in simpler form. The 1990 Plano Collor froze bank accounts overnight and converted savings above a threshold into 18-month government bonds. Hyperinflation made local-currency saving irrational in the 1980s. People who lived through that did not need lectures about self-custody. They built P2P networks, non-custodial wallets, and swap routes because they knew what happens when institutions control the rails.

Monero, non-custodial wallets, and decentralized exchanges are tools for keeping financial life outside any institution's permission.

Cunicula does not provide tax or legal advice. Brazilian residents are subject to Receita Federal reporting obligations for crypto transactions above applicable thresholds, including the R$30,000/month self-reporting requirement for P2P trades. Privacy tools described in this article are legal to use in Brazil. Research your obligations before transacting. Figures and regulatory timelines are current as of March 2026. Affiliate disclosure.