← مقالات وأدلة عن الاحتيال والأمن السيبراني والخصوصية
Mule and pooled accounts: how crime exploits Brazilian fintechs
From Operation Carbono Oculto to Law 15,397/2026: how mule and pooled fintech accounts enabled laundering in Brazil and what regulators changed.
For organised crime, making money is only half the job; the other half is moving it without leaving a trail. In Brazil, two tools stand out: mule accounts ("contas laranja"), opened in or lent under someone else's name, and pooled accounts ("contas-bolsão"), in which a fintech moves many clients' funds through a single bank account without identifying each holder.
The scale of mule accounts
A Serasa Experian study published in March 2026 estimated that more than 2.6 million people or accounts showed signs of acting as mules in 2025, up 62% from 2023. Only 3.2% were detected by financial institutions.
Operation Carbono Oculto
Launched on 28 August 2025 by the federal tax authority, prosecutors and the Federal Police, the operation targeted a scheme linked to the PCC gang in the fuel sector. According to Blocktrends, one payment institution acting as a "parallel bank" moved R$46 billion between 2020 and 2024; 40 investment funds controlled by the group held about R$30 billion; and around 350 search warrants were served in eight states. A second phase on 29 May 2026 targeted six fintechs that had moved R$26 billion between 2022 and 2025, replacing those hit in the first round, according to BBC News Brasil.
The scheme worked in layers: criminal cash entered fuel stations and distributors, passed through fintechs using pooled accounts, and ended up in investment funds that bought assets such as ethanol plants, trucks and real estate. The study also found that people who rarely use financial services were nine times riskier as potential mules, because they are slower to notice unusual activity. Pooled accounts made the problem worse: the bank only saw the fintech, not the individuals behind each transaction, which allowed legal and illegal money to mix (Diário do Grande ABC). In the second phase, investigators also identified R$365 million in crypto assets moved through the institutions, and the head of the tax authority described fintechs as the "entry point" for dirty money (BBC).
Regulatory response
- Normative Instruction RFB 2,278 (August 2025) requires payment institutions to file the e-Financeira report, like banks (Correio Braziliense).
- Since September 2025, new payment institutions need Central Bank authorisation before operating (BBC).
- CMN Resolution 5,261 and BCB Resolution 518 (3 November 2025) require banks to close accounts used to provide financial services without legal backing, effective 1 December (Diário do Grande ABC).
- Law 15,397/2026, signed on 4 May 2026, makes lending a bank account to move criminal proceeds a crime punishable by one to five years in prison (Finsiders).
Takeaways
Money-laundering risk sits along the chain: banks serving fintechs, fintechs that do not segregate clients, and fund managers that do not identify beneficial owners. Individuals should never lend their accounts and can check the Central Bank's Registrato service for accounts opened in their name.
المصدر
- Blocktrends – Receita Federal e PF miram fintechs e fundos em megaoperação (Carbono Oculto)
- Correio Braziliense – Receita iguala tratamento de fintechs ao de bancos (IN RFB 2.278/2025)
- BBC News Brasil via O POVO – Por que fintechs viraram meio 'fácil' de lavar dinheiro
- Diário do Grande ABC – BC lança regras para acabar com o uso de contas-bolsão
- Serasa Experian – Contas laranja potenciais crescem mais de 60% em dois anos
- Finsiders Brasil – Nova lei de golpes e fraudes digitais e contas laranjas (Lei 15.397/2026)