The regulator no longer asks whether you have control. It asks what you did with it

In Brazil, payment operations that do not monitor, communicate, and educate their users are handing the Banco Central and the SPA exactly the kind of evidence they do not want to see: repeated bad behavior that the platform tolerated. For PSPs and high-risk merchants, the point is no longer whether the tooling exists, but whether it is being used in a way regulators can verify.

1. The focus of supervision has shifted from formal compliance to user behavior. The old question was whether a company had a compliance policy, antifraud tools, and a process for answering notices. The new one is simpler and more uncomfortable: what did the operation do with that capability. If a platform keeps receiving recurring MEDs from the same users month after month and does nothing, it builds a record that is visible from the outside.
2. When an operation accepts irregular movement without questioning it, fails to observe bad financial behavior by the end user, and does not communicate with or guide its base, it is effectively showing the Banco Central and the SPA that it does not exercise real control over who operates on the platform. That is the thing regulators can read in the numbers.
3. The article draws a hard line on MEDs opened without fraud. Filing an MED when there was no scam or fraud is not a convenience feature; it is a false statement inside a regulatory mechanism, and it is recorded as such. In practice, the user often does this because nobody explained the rules. That makes user education part of the control framework, not a nice-to-have.
4. The operational consequence is not abstract. According to the text, the absence of monitoring, training, and communication can lead to CNPJ marking, restrictions with banking partners, stronger compliance demands, and worse settlement conditions. For PSPs serving high-risk verticals, that is not a theoretical risk; it is the kind of outcome that changes which partners stay in the chain and on what terms.
5. The message for operators is blunt: having monitoring, tracing, and MED response tools is not a competitive differentiator or a sign of maturity. It is a demonstrable obligation. The operation needs evidence that it monitors, trains the team, tracks behavior patterns, and communicates good usage practices to the end user. Without that, it is not just absorbing losses; it is teaching the user base to treat MED as a shortcut.

For high-risk PSPs, this is the part that matters: regulators are no longer satisfied with saying the tools exist on paper. They want to see whether the operator actually changed user behavior, because that is where control becomes provable.