QI Tech

1.1 Identity, founding, and regulatory positioning

QI Tech is a privately held Brazilian financial infrastructure company headquartered in São Paulo. The public legal footprint shown across its website footer and corporate pages is QI Sociedade de Crédito Direto S.A. for the credit institution and QI CTVM Ltda. for the securities broker-dealer arm, both operating from Pátio Rebouças in Jardim Paulistano. The company says it was founded in 2018 and built to act as a technological and regulatory layer for businesses that want to embed financial products without becoming full-stack banks themselves. The regulatory claim is central to the business model. QI Tech states that it was the first Direct Credit Society (SCD) approved by the Banco Central do Brasil and later became the first fintech to also hold a Securities Distributor / broker-dealer (DTVM / CTVM) license. Those permissions let QI Tech combine loan origination, payment flows, digital-account features, and capital-markets infrastructure in one stack. General Atlantic's 2023 investment release describes this as a "one-stop-shop" that wraps compliance, onboarding, credit underwriting, transfers, Pix, and FIDC structuring into modular APIs, while the company homepage frames the offer as financial infrastructure similar to an AWS-like utility for regulated finance.[CO001, CO002, CO003, CO004, CO005, CO006]

1.2 Founders, leadership, and governance

The founding trio disclosed in investment announcements is Pedro Mac Dowell, Marcelo Bentivoglio, and Marcelo Buosi. Public sources consistently identify Mac Dowell as founder and CEO, Bentivoglio as co-founder and CFO, and Buosi as co-founder / operating executive. The 2023 Series B communication notes that the round was completed on a pro-rata basis, preserving founder control without secondaries or cap-table exits. Public evidence further shows that QI Tech's leadership bench has expanded through acquisitions: Daniel Doll Lemos, formerly associated with Singulare, remained visible in post-acquisition communications, while Emílio Moreira was cited as the executive leading the Singulare integration. Governance visibility is still incomplete relative to institutional expectations. The public record confirms major shareholders such as GIC, General Atlantic, and Across Capital, but does not disclose precise ownership stakes, board seats, observer rights, or committee structure. That creates classic key-person dependence on Mac Dowell and the small founding group, especially because external evidence ties strategic direction, fundraising, M&A, and new product launches closely to the founder-CEO and CFO.[CO010, CO011, CO012, CO018, CO019, CO020]

1.3 Funding history, valuation, and capital base

QI Tech's capital formation has been unusually strong for a private Brazilian infrastructure fintech. In November 2021, the company announced a US$50M Series A led by GIC, at the time calling it one of the largest Series A rounds in Latin America. The 2023 Series B then brought US$200M (R$1B) led by General Atlantic, with Across Capital doubling its earlier position. General Atlantic's official release added an important quality signal by saying the company had already been profitable since its first year of operation, although the supporting audited financial statements are not public. In April 2024, QI Tech announced a US$50M Series B extension backed by General Atlantic and Across Capital. The company and subsequent coverage state that the extension took QI Tech to roughly a US$1.5B valuation and formalized unicorn status. In July 2025, the company announced another US$63M Series B extension, again led by General Atlantic with Across participating for a fourth consecutive time. Independent and official coverage frame the 2025 extension as capital for new products and acquisitions, and place the post-money valuation above US$2B. Across the disclosed 2021, 2023, 2024, and 2025 rounds, the public primary-source funding total is US$363M.[CO013, CO014, CO015, CO016, CO017, CO021]

1.4 Scale, product breadth, and operating footprint

QI Tech's product footprint spans banking-as-a-service, white-label banking, payments-as-a-service, lending-as-a-service, anti-fraud, onboarding, and FIDC administration / custody. The official product pages claim website-snapshot scale of US$88B in Pix transactions, US$19B in credit issued, US$18B protected against fraud, and US$28B under administration. The administration-and-custody page narrows that specifically to more than 1,100 funds and more than 700 FIDCs on the platform. These figures are website claims rather than audited disclosures, but they are directionally consistent with other scale signals from independent media and client case studies. The 2025 Series B extension materials add richer operating metrics: over 20 million anti-fraud analyses per month, more than 90 million verified registrations, and approximately US$13M in potentially fraudulent flows blocked monthly. The same source says that, after Singulare, QI Tech became Brazil's leading FIDC custodian with US$17B in assets under custody and US$25B in assets under management according to Anbima's July 2025 ranking. Separately, the company stated when Banco Central approved the Singulare deal that the combined platform would be managing over 1,000 funds and BRL121B in assets, including more than 650 FIDCs, using a 2024 Uqbar framing. These disclosures are not perfectly comparable, but together they show a business that grew from an API-led credit infrastructure vendor into a multi-license financial-operations platform with meaningful capital-markets scale.[CO023, CO024, CO025, CO026, CO027, CO028]

1.5 Milestones, customer proof, and adverse signals

Customer proof in the public record is broader than a typical private fintech discloses. QI Tech's 2024 unicorn announcement said the company served more than 400 clients including Vivo, Unidas, 99, and QuintoAndar. Later materials and case studies show how that abstract claim turns into actual workloads: Vivo Pay built a financial vertical that had already generated more than R$400M in cumulative revenue by the end of 2025; Wellhub launched a R$100M credit vehicle for gyms and wellness partners using QI Tech infrastructure; Jeeves used QI Tech for local wallet / onboarding and note-issuance flows after entering Brazil in 2024; and Bettr / Ant International partnered with QI Tech to expand credit for merchants and consumers in Brazilian e-commerce. These examples support the view that QI Tech sells deep embedded workflows rather than one-off point products. The public record also contains meaningful adverse signals. Banco Central-linked reporting in March 2025 said data connected to 25,349 Pix keys at QI SCD had been exposed, though not sensitive balances or passwords. Separate 2026 Times Brasil reporting linked the company's name to market rumors around a problematic FIDC portfolio tied to a firm under investigation; QI Tech denied any active negotiations. The same article also referenced a court decision that maintained a block on QI Tech resources in litigation related to the collapse of the Canis Majoris group. None of these items amount to a disclosed existential impairment, but they are sufficient to mark regulatory, reputational, and legal monitoring as a continuing diligence priority.[CO034, CO035, CO037, CO038, CO039, CO040]

1.6 Exhibits

2.1 Market boundary, included spend, and substitutes

QI Tech's relevant market is not generic "fintech" or even generic banking-as-a-service. The retained evidence shows a narrower but still large financial-infrastructure layer: regulated APIs and operating services that let enterprises, fintechs, banks, marketplaces, and asset managers launch or operate credit, digital-account, payments, onboarding, anti-fraud, and fund-administration workflows. The company website and General Atlantic's 2023 release both describe QI Tech as a one-stop-shop for those workflows, while customer cases show usage in telecom-led consumer finance, cross-border fintech localization, wellness-network lending, and marketplace credit. What is included in this chapter's market lens is therefore the infrastructure-value layer: compliance-led banking APIs, payment orchestration, lending operations, identity / KYC / anti-fraud rails, open-finance connectivity, and capital-markets operations such as FIDC administration and custody. What is excluded is end-consumer loan principal sitting on third-party balance sheets, merchant GMV that only passes through a rail, and the entire revenue of enterprises like Vivo or Wellhub that merely use QI Tech as a backend component. Status-quo substitutes remain direct bank relationships, legacy core providers, fragmented specialist vendors, or internal buildouts, each of which trades lower integration convenience for potentially greater control.[CM001, CM002, CM003, CM004, CM020, CM021]

2.2 Sizing lenses: TAM, SAM, SOM proxies, and what public data cannot isolate

The public market data is best treated as a set of constrained lenses rather than a single authoritative TAM. The cleanest third-party top-down data point in the retained set is the Research and Markets databook summary carried by BusinessWire, which sizes Brazil's embedded-finance market at US$14.16B in 2025. That figure is useful because it points to the software-and-services revenue pool around embedded payments, lending, and banking. A second, narrower lens comes from the ezbob / CX Solutions open-finance piece, which cites a roughly US$1.9B Brazilian alternative-lending market by 2025. That is not QI Tech's full TAM, but it is a relevant floor for the credit-led part of the business. A third lens uses infrastructure throughput instead of revenue. The same ezbob piece says Pix is processing roughly six to seven billion monthly transactions in 2026 and about R$3T in monthly value, while QI Tech's own public materials advertise US$88B in Pix transactions and US$19B in credit issued. Those are not comparable units and therefore cannot be collapsed into a clean SAM or SOM. They do, however, show why QI Tech can plausibly monetize a multi-rail operating layer that sits across payments, credit, identity, and custody rather than one single product category. The correct market takeaway is breadth with measurement ambiguity: large opportunity, weak public take-rate transparency.[CM005, CM006, CM007, CM008, CM009, CM010]

2.3 Buyer, user, payer, and adoption path

The retained evidence points to four recurring buyer groups. First are fintechs and banks that need licensed rails but want a faster and more modular path than building everything themselves. Second are non-financial enterprises such as telecoms, marketplaces, and ecosystem operators that want to monetize their customer base through financial products. Third are asset managers and structured-credit operators that need fund administration, escrow, custody, or debt-instrument infrastructure. Fourth are global entrants that can design financial products elsewhere but need local regulatory, Pix, and credit-instrument plumbing to operate in Brazil. In those segments the economic buyer is usually not the end user but a CFO, treasury, risk, product, or financial services lead who owns P&L or launch accountability. The end user is the enterprise's customer, merchant, partner, or borrower. The payer is the enterprise itself, often justifying adoption through faster time-to-market, lower compliance burden, new revenue lines, or better risk controls. The Jeeves, Wellhub, Vivo, and Bettr examples are especially useful because each maps to a different trigger: local market entry, partner-network financing, installed-base monetization, and embedded-commerce credit.[CM016, CM017, CM018, CM019, CM020, CM021]

2.4 Growth drivers, adoption constraints, and preserved diligence gaps

Brazil remains one of the strongest structural markets globally for regulated financial infrastructure. The BCB's 2025-2026 priorities explicitly include Open Finance evolution, Pix expansion, evaluation of eFX rules, AI monitoring, and enactment of BaaS regulations. Chambers likewise describes a credit market in which fintechs keep expanding credit access while regulation evolves to balance prudential oversight with modernization. These drivers matter directly to QI Tech because a company with licensing, compliance, and multiple operating modules benefits when customer demand shifts from isolated point solutions toward integrated, regulator-ready stacks. The constraints are equally real. Compliance and trust requirements are high; sales cycles can be long because the budget owner often has to sign off on KYC, fraud, treasury, and legal-risk implications together. The competitive set is crowded: Celcoin, Dock, Zoop, Pluggy, Matera, and internal-bank alternatives all serve different slices of the stack. And the public evidence still cannot isolate core market metrics such as take rate, net revenue per client, or the precise boundary between payment value and software revenue. The result is a market that is clearly large and expanding, but one where investors still need deeper bottom-up pricing and cohort data before converting rail volume into durable equity value.[CM028, CM029, CM030, CM031, CM033, CM034]

2.5 Exhibits

3.1 Landscape: direct peers, adjacents, substitutes, and likely entrants

The relevant competitive landscape has at least six classes. First are direct embedded-finance infrastructure peers selling a broad enterprise stack: Celcoin, Dock, and Zoop. Second are adjacent data / connectivity players such as Pluggy that cover a narrower but strategically important slice of the workflow. Third are core-platform vendors such as Matera and Pismo that can power digital banks, card issuing, wallets, and real-time payments, even when they do not mirror QI Tech's regulatory wrapper or custody angle. Fourth are incumbent banks and sponsor-bank relationships that let enterprises launch financial products through partnerships rather than software-led infrastructure. Fifth are fragmented multi-vendor architectures where a buyer combines open-finance, KYC, payment, and credit tools from different suppliers. Sixth is internal build, especially for large enterprises with capital and patience. QI Tech therefore does not win by existing alone; it wins when a buyer prefers an integrated, regulated local stack over a mix-and-match architecture or a global core-banking platform. That distinction matters because many rivals can match one module, but fewer can match regulated credit origination, Pix, anti-fraud, onboarding, and FIDC / fund administration under one local operating umbrella.[CP001, CP002, CP006, CP008, CP012, CP016]

3.2 Direct peer profiles: Celcoin, Dock, and Zoop

Celcoin is the most obviously broad direct peer in the retained set. Its own materials and Summit Partners' funding release show a modular platform spanning banking, payments, and credit, including BaaS, liquidating bank, white-label cards, open-insurance and regulatory modules, Pix and ITP functionality, CCB, escrow, commercial notes, and payroll-linked credit products. The scale disclosures are also meaningful: more than 6,000 business customers, over 400 financial-industry customers, more than 5,000 non-financial companies, US$63M ARR in Q1-2024, and more than 200 million monthly Pix transactions. Dock competes from a different angle: a larger, older platform emphasizing payment infrastructure, cards, fraud prevention, acquiring, and white-label banking. Dock's public pages stress 25-plus years of operating history, direct Pix participation, and a very broad payment-plus-cards portfolio. Zoop, now explicitly tied to the iFood ecosystem in its public positioning, focuses on unified commerce and embedded payments but also has payment-institution licensing, direct Pix / core-banking capability, and notable scale in processed payments, marketplaces, and merchant endpoints. Relative to QI Tech, Celcoin looks closest on modular breadth, Dock on enterprise-grade payment and card infrastructure, and Zoop on ecosystem / marketplace distribution.[CP002, CP003, CP004, CP005, CP006, CP007]

3.3 Adjacents, pricing signals, and build-versus-buy alternatives

Pluggy demonstrates how a narrower competitor can still be strategically relevant. It is positioned around reading banking data and moving money in Brazil, is authorized by Banco Central as an ITP, and publicly advertises one of the few visible pricing schedules in the set: data products starting at R$2,500 per month and payments products starting at R$500 per month. That public price transparency makes Pluggy a useful benchmark for point-solution economics, even though its scope is narrower than QI Tech's. Matera and Pismo are different again: both present as deep platform layers for banks and large financial institutions, with stronger emphasis on core modernization, ledger / wallet performance, and card issuing than on local sponsor-like regulatory packaging. For many buyers the real alternative is not one named competitor but a hybrid architecture. A company can combine a data connector such as Pluggy, a bank or sponsor arrangement, a payments provider such as Zoop or Dock, and an internally built product layer. That keeps optionality high but raises integration, compliance, and vendor-management burden. QI Tech's integrated pitch is strongest when the buyer values reduced orchestration complexity more than it values picking the cheapest point tool in each category.[CP012, CP013, CP014, CP015, CP016, CP017]

3.4 Switching cost, moat durability, and competitive risk

QI Tech's moat is not strongest where the market is most transparent. Public pages make many rivals sound broad, modern, and AI- or API-native. The more defensible edge appears where multiple regulated workflows are bundled: credit origination, anti-fraud, onboarding, Pix, debt instruments, and post-Singulare custody / administration. Once a client runs production flows across several of those layers, switching cost rises because legal, treasury, risk, and product teams all need to move in sync. This is especially true in credit and fund-operations contexts, where internal controls and regulatory process matter as much as front-end UX. The risks are also clear. Breadth can become a commodity if rivals such as Celcoin keep adding modules and if large platforms like Matera, Pismo, or Dock convince buyers to treat finance infrastructure as a general platform layer rather than a local regulated specialist. Pluggy's public pricing also shows how point-solution categories can turn into price-led, transparent software markets faster than integrated stacks do. The core diligence question is not whether QI Tech has competitors — it plainly does — but whether its multi-license and custody-linked stack keeps it on the short list when buyers want fewer counterparties and deeper local execution.[CP020, CP021, CP022, CP023, CP025, CP026]

3.5 Exhibits

4.1 Revenue model and public scale: multi-line infrastructure monetization with one visible revenue snapshot

QI Tech's economic model is broader than a single BaaS subscription. Public product surfaces show at least six monetization families: Banking as a Service, payment processing, lending infrastructure, risk / onboarding, administration and custody of funds, and DCM / securities infrastructure. The common pattern is regulated, API-driven enablement sold into enterprises that want to launch or operate financial products without building the full local stack in-house. The revenue mechanism therefore likely mixes implementation, ongoing platform usage, transaction fees, fund-administration fees, documentation / issuance services, and support for cross-sell into adjacent modules. That breadth is strategically attractive because no single product line needs to carry the full commercial burden. The best public revenue datapoint remains Bloomberg Línea's July 2024 interview after the Singulare approval. That article says QI Tech expected R$680 million of revenue in 2024, with lending contributing 35%, administration and custody 30%, banking 25%, and compliance 10%. It also reports 400-plus clients, expected expansion to 750 with Singulare and 1,000 by the end of the following year, and management's view that lending would remain the largest revenue line while custody would matter disproportionately for cross-sell. Later 2025 official materials stop short of disclosing revenue, but they do disclose operating-scale proxies: more than 400 client projects, US$25 billion of AUM, US$17 billion of FIDC custody, over 20 million anti-fraud analyses per month, more than 90 million validated registrations, and insurance premium issuance above US$27 million within six months of launch. Those proxies support continued scale-up, but they do not replace audited financial statements.[CI001, CI002, CI003, CI004, CI005, CI006]

4.2 Pricing, sales motion, and unit economics: enterprise contracts are visible, realized economics are not

QI Tech's public pages strongly imply a consultative enterprise-sales motion rather than transparent self-serve pricing. Product pages repeatedly route buyers to specialists, emphasize modular integration, and anchor value in faster launch, regulatory coverage, automation, and reduced orchestration burden. The documentation site, webhook guides, and playground reinforce that point: this is sold as production infrastructure with sandbox / production segregation, JWT-authenticated APIs, webhooks, and a 65-endpoint playground rather than as a low-touch SaaS SKU. The strongest explicit implementation-speed signal is on the credit-engine page, which says integrations can connect in up to two days. Customer cases consistently frame the value proposition as replacing multiple vendors, compressing operational lead times, and turning regulatory complexity into faster go-to-market. The unit-economics problem is that public revenue per customer, gross margin, churn, and support-cost data are absent. The only price book retained in the public record is the transparency-portal tariff PDF for end-user / regulated banking services; that document is useful to show QI Tech's regulated operating perimeter, but it is not a good proxy for realized B2B enterprise pricing. Public evidence therefore supports only directional conclusions. First, recurring quality should be higher in fund administration, custody, payment rails, and embedded recurring flows than in one-off implementation work. Second, margins are likely below pure software benchmarks because QI Tech combines regulated operations, customer support, and fiduciary / back-office obligations with software. Third, cross-sell probably matters economically: case studies repeatedly show the same customer using multiple modules, and the 2024 revenue-mix disclosure explicitly positions custody as a strategic wedge into other infrastructure. But until management discloses realized take rates, attach rates, and service-delivery costs, public unit economics remain inferential.[CI017, CI018, CI019, CI020, CI021, CI022]

4.3 Cost structure, capital adequacy, and funding dependency

QI Tech's cost structure appears to sit between SaaS infrastructure and regulated financial operations. Software, product development, compliance, customer success, and integration work are likely the core controllable expenses; unlike a lender, QI Tech does not appear to need large proprietary balance-sheet funding to book most customer credit volume itself. That said, the platform is not economically weightless. Administration and custody, escrow, securities issuance, and ombudsman / regulatory obligations add labor, control, and governance costs that a pure API gateway would not bear. The first-half-2025 ombudsman report, for example, shows 3,483 service interactions, 4.4-business-day average response time, and 2,435 external-channel demands, which is useful as a reminder that scale also creates support and control overhead. Capital adequacy looks directionally strong but not fully measurable from public data. QI Tech raised US$200 million in late 2023, then an additional US$50 million in April 2024 largely to finance the Singulare acquisition, and a further US$63 million in July 2025 to fund new solutions, support M&A, and strengthen cash position. Management has repeatedly framed acquisitions as a permanent part of the strategy, not a one-off event. That capital support lowers near-term existential financing risk, especially because General Atlantic and Across have kept participating, and because official sources say the company has been profitable since its first year. But the public record still omits the variables investors actually need for underwriting: current cash, monthly burn, operating cash flow, segment margin, debt / preferred obligations, and whether acquisitions or new regulated-product launches consume capital faster than internal profits replenish it.[CI007, CI008, CI009, CI029, CI030, CI031]

4.4 Financial verdict: attractive platform economics are plausible, but the evidence set is still investor-incomplete

The positive financial case is straightforward. QI Tech has strong fundraising support, publicly claimed early profitability, a broad product stack, visible enterprise traction, and a business model that appears more capital efficient than principal-at-risk fintech lenders. The 2024 revenue forecast, the disclosed revenue mix, and the 2025 operating-scale proxies collectively suggest a company that is already meaningfully scaled and diversifying. Customer cases also support the idea that QI Tech sells high-value workflow compression rather than generic payment APIs alone: Vivo Pay, Wellhub, Ouro Preto, and LBA all describe QI Tech as an operating layer that bundles credit, documentation, custody, escrow, and fund infrastructure into one regulated counterparty. The adverse case is equally clear. QI Tech does not publish current audited revenue, gross margin, cash runway, customer concentration, or realized pricing. Public scale metrics are also inconsistent: older English pages show US$88 billion Pix volume and US$28 billion under administration, 2025 Portuguese pages show +R$494 billion Pix and +R$170 billion under administration, and DCM pages claim R$175 billion under administration. Those discrepancies do not prove misstatement, but they do show that investors cannot treat public surface metrics as a clean time series. The right financial verdict is therefore cautiously positive on business quality and negative on disclosure quality. QI Tech may already be a good business; the problem is that public evidence still cannot tell an outside investor how good, how profitable, or how cash-generative it really is.[CI016, CI025, CI026, CI027, CI028, CI030]

4.5 Exhibits

5.1 Product surface: a modular one-stop shop spanning risk, banking, credit, and capital-markets workflows

QI Tech's product surface is unusually broad for a Brazilian financial-infrastructure provider. Public pages show five operating clusters. Risk Solutions includes onboarding, OCR-based document capture, facial recognition and liveness, background checks, device registration for Pix, transactional anti-fraud, and a no-code credit engine. Banking as a Service includes digital accounts, Pix, TED, boletos, BolePix, white-label banking, card issuance, and recurring-payments infrastructure. Lending covers multiple credit workflows such as consignado, FGTS-linked flows, CCB issuance, and related formalization. DCM and securities infrastructure cover escrow, escrituração, liquidation, custody, and direct integration into Brazilian capital-markets processes. Administration and custody adds the post-Singulare fund layer with structuring, fiduciary administration, custody, and controllership. The shared product logic is not consumer UX but regulated workflow compression. QI Tech repeatedly presents itself as the single counterparty that lets customers avoid stitching together separate KYC, payment, credit, documentation, custody, and fund administrators. Customer cases reinforce that framing: Vivo Pay combines credit, CCB issuance, and FIDC administration; Wellhub combines fund admin, note escrituração, and digital signature; Jeeves uses wallet plus KYC plus commercial-note infrastructure; and Ouro Preto uses white-label manager tooling, escrow, and credit documentation. The breadth itself is therefore part of the product thesis. QI Tech is not only selling features; it is selling fewer operational handoffs across a regulated stack.[CE001, CE002, CE003, CE004, CE005, CE006]

5.2 Architecture and developer model: credible integration surface, limited deep-stack disclosure

Public developer materials are good enough to prove that QI Tech has a real integration platform. The API documentation states that sandbox and production are fully separate, with distinct hosts for BaaS / LaaS, CaaS, and CertifiQI-related services. The playground exposes 65 endpoints and automates JWT signing in the browser. The webhook documentation shows that integrations are configured through the platform, allows custom headers, warns clients not to hard-map webhook schemas too tightly, and sets a 10-second response timeout. On the credit-engine page, QI Tech says integrations can connect in up to two days, uses RESTful APIs, and offers logs and call-status monitoring via dashboard. Those are all meaningful developer signals. What is missing is the internal architecture that larger infrastructure customers usually want to see in diligence. Public materials do not disclose cloud provider, region strategy, data-store choices, message bus design, multi-tenant isolation model, disaster-recovery RTO / RPO, or observed uptime history. The product pages do prove modular coupling: onboarding flows into automated credit decisioning, anti-fraud into payments, DCM into banking, and recurring Pix into collections. But that is commercial architecture, not systems architecture. The product-tech verdict is therefore asymmetric: the external operating model looks integration-ready and production-oriented, while the internal technical stack remains largely opaque.[CE015, CE016, CE017, CE018, CE019, CE020]

5.3 Trust, safety, compliance, and critical dependencies

QI Tech's public trust posture is stronger than its deep architecture transparency. The cybersecurity policy says the conglomerate aligns to LGPD, CMN Resolution 4.893/2021, BCB Resolution 85/2021, and guidance from ANBIMA and CVM, while referencing ISO/IEC 27001 and the NIST Cybersecurity Framework as organizing standards. The transparency portal centralizes ethics, tariffs, terms, and policies, and the ombudsman policy describes the group-level complaint-handling framework for the SCD and DTVM. Product-level pages add more concrete controls: Device Scan is explicitly framed around Resolution 403 and IN 491, including the R$200 / R$1,000 limits for unregistered devices; Payment as a Service emphasizes certificate-based authentication, audit logs, and granular permissions; and Anti-Fraud claims coverage across Pix, TED, cards, and boletos. Still, there is no clean public proof of third-party security certification. The cybersecurity policy references ISO 27001 and NIST but does not say QI Tech is certified. Nor do public materials disclose SOC 2, PCI DSS scope, independent penetration-test results, or incident-frequency metrics. The 2025 Banco Central-reported data leak involving QI Sociedade de Crédito shows why this gap matters: even for a company with substantial compliance signaling, controls must be judged by observed outcomes as well as policy language. Product dependencies are also visible. QI Tech depends on Banco Central and CVM rule evolution, B3-linked market infrastructure for capital- markets workflows, external data sources such as Open Finance / SCR / bureaus, and customer engineering teams implementing the APIs correctly. That is manageable, but it means technical risk is partly institutional.[CE025, CE026, CE027, CE028, CE029, CE030]

5.4 Maturity, roadmap, and differentiation

QI Tech's most mature public surfaces appear to be in onboarding / anti-fraud, banking / payments, lending infrastructure, and administration / custody. Those areas have repeated claims, multiple adjacent product pages, detailed docs, and customer cases using them in production. Newer or less proven lines include insurance-as-a- service, foreign exchange infrastructure, recurring Pix features, and DCM expansion from fund operations into the broader securities-writing and bank-liquidation stack. The product pages themselves reveal a roadmap posture: worker-credit flows are linked to new regulation, Pix Automático is positioned around the market's recurring- payments shift, and DCM is clearly trying to move QI Tech from FIDC-specialist adjacency into a larger fixed-income operating layer. The differentiation is less about secret algorithms than about local workflow depth. QI Tech's public story is not that it has the world's best generic KYC or the world's most beautiful bank app; it is that it can combine those modules with local licenses, legal instruments, and capital-markets plumbing in one integrated operating model. That is a real product distinction in Brazil. But because the public record does not expose uptime history, developer adoption metrics beyond the docs surface, or detailed release notes, the maturity judgment should stay moderate rather than absolute. Production readiness is well signaled; engineering excellence is suggested, not yet fully evidenced.[CE003, CE012, CE014, CE017, CE018, CE022]

5.5 Exhibits

6.1 Customer segments: enterprises, fintechs, asset managers, and ecosystem operators

QI Tech is not selling a single monolithic product into a single buyer. The public record supports at least five customer archetypes. First are large enterprise ecosystems such as Vivo and Wellhub that want to embed finance into an existing distribution base. Second are fintech and cross-border operators such as Jeeves that need local Brazilian regulatory and operational infrastructure without building it alone. Third are fund managers and structured-credit specialists such as Suno Asset, Estímulo, Ouro Preto, Ártico Capital, LBA, and Multiplike, where the problem is fiduciary administration, custody, escrow, and document flows rather than retail banking UI. Fourth are correspondents / lending operators such as Fintech do Corban and similar credit-originator partners. Fifth are vertical operators such as Almah that need integrated accounts, payments, onboarding, and anti-fraud. This mix matters because it implies buyer sophistication is high and sales cycles are probably consultative. QI Tech's customers are typically not picking a cheap point tool; they are outsourcing a regulated workflow. Public corporate materials also make clear that the company sells into companies that want to create their own financial products under their own brands. That increases potential revenue per customer but also raises switching costs and implementation friction. The visible customer surface therefore supports an enterprise infrastructure interpretation much more than a self-serve fintech-software interpretation.[CU001, CU002, CU003, CU004, CU005, CU006]

6.2 Adoption trajectory and named customer proof

QI Tech's best adoption signals come from two places: company-level logo counts and rich case-study proof. Official and investor-linked sources say the company had 400-plus clients in 2024, more than 400 projects in 2025, and expected to jump to roughly 750 customers after the Singulare acquisition, with a path to 1,000 by the end of the following year. Those figures show reach, but the named customer proof is more informative because it reveals which kinds of customers actually trust QI Tech in production. Vivo Pay is the clearest proof of an embedded- finance enterprise customer: the case cites a telecom base of 116 million accesses, 85 million app users, 1,800+ stores, and more than R$400 million cumulative revenue for the financial vertical by end-2025. Wellhub shows QI Tech working as a fund-and-documentation layer inside a global wellness ecosystem through a R$100 million fund. Jeeves shows QI Tech as a local launch partner for a multi-country fintech. The asset-management and structured-credit cases deepen the proof set rather than simply repeat it. Suno Asset says it manages more than R$3.3 billion and 230 thousand investors, with three funds already under QI Tech administration. Ouro Preto says fund-structuring time fell from 60 to 30 days. LBA cites 200-plus operations, 70-plus developers, and 150-plus escrow accounts. Multiplike cites R$4 billion of equity under management. These are not all comparable customer metrics, but together they show that QI Tech's proof skews toward high-complexity, production financial workflows rather than pilot-stage fintech experiments.[CU011, CU012, CU013, CU014, CU015, CU016]

6.3 Retention, expansion, and concentration: promising signals, little hard disclosure

Public evidence implies expansion is real but does not quantify it. QI Tech's cases repeatedly show the same customer adopting multiple modules—Vivo combines lending documents and FIDC workflows; Wellhub combines fund admin, escrituração, and signature; Jeeves combines wallet, KYC, and commercial-note credit; asset-manager cases combine custody, escrow, credit instruments, and white-label or payment layers. That pattern strongly suggests expansion by module, which should raise customer lifetime value once a client is live. The Singulare acquisition also appears to function as a customer-base expansion wedge because it brought hundreds of additional client relationships into the broader operating stack. But retention metrics remain missing. There is no public GRR, NRR, churn, logo-retention rate, average contract duration, or renewal schedule. Concentration is also hard to judge. The named customers are large enough that it is plausible a small number of flagship relationships contribute an outsized share of revenue or credibility, especially on the enterprise embedded-finance side. Conversely, the large number of funds, projects, and client logos suggests some diversification across buyer types. The correct customer-quality reading is therefore mixed: public cases support meaningful expansion potential and sticky workflows, but investors cannot yet quantify whether QI Tech is broadly diversified or quietly dependent on a handful of anchor programs.[CU024, CU025, CU026, CU027, CU028, CU029]

6.4 Support signals and adverse customer evidence

The main adverse customer evidence in the retained set comes from QI Tech's own ombudsman reporting rather than from a consumer-review platform. For first-half 2025 the report shows 3,483 service interactions, average response time of 4.4 business days, satisfaction score of 2.2, and 2,435 external-channel demands, alongside Banco Central and consumidor.gov indicators. That is materially less flattering than the product marketing language and is worth taking seriously even though the report aggregates multiple regulated entities and channels. It suggests that once a company reaches meaningful scale across regulated operations, customer-support and complaint-handling quality can become a real operating variable rather than a back-office afterthought. The 2025 data-incident coverage adds a second adverse layer: for enterprise infrastructure, trust is part of the customer product. A reported incident does not directly prove churn, but it can affect procurement, renewal pace, and the willingness of larger enterprises to broaden module adoption. The right interpretation is not that QI Tech's customer quality is weak; public case proof is too strong for that. It is that customer durability cannot be scored only from glossy logos and success cases. Ombudsman and incident data show that the lived service layer deserves as much diligence as the API and regulatory layer.[CU033, CU034, CU035, CU036, CU037, CU038]

6.5 Exhibits

7.1 Regulatory and licensing risk: advantaged position, heavier burden

QI Tech's most important structural risk fact is also one of its advantages: it operates with real regulated licenses rather than trying to wrap regulated activity around a lightly supervised software shell. Public materials, terms, and investor releases consistently frame the company as the first SCD approved by Banco Central and, after Singulare, as a platform spanning additional capital-markets permissions. That lowers the basic risk of sudden business-model invalidation relative to unlicensed embedded-finance vendors. But it replaces licensing fragility with operating burden. Once the company sits inside a regulated perimeter, every new product, partner, or workflow brings conduct, AML, complaints, fraud, prudential, and data-governance obligations. This burden is unlikely to shrink. External legal commentary says Banco Central's 2025-2026 agenda includes Open Finance changes, virtual-asset rules, AI monitoring, expanded Pix functionality, fraud prevention, and prudential reviews. For a company whose product strategy explicitly rides on credit, payments, onboarding, and data workflows, that means regulatory change is not background noise; it is part of the roadmap. QI Tech therefore benefits from its licensed posture, but it also inherits a recurring implementation tax every time regulation evolves.[CR001, CR002, CR003, CR004, CR005, CR006]

7.2 Control environment and governance risk

On paper, QI Tech's control environment is more developed than many startup peers. The retained set shows a privacy notice built on LGPD, a cybersecurity policy referencing ISO/IEC 27001, NIST CSF, CMN 4.893/2021 and BCB 85/2021, an AML/CFT policy with named governance roles and committees, an anti-corruption policy with public-sector and gifts guidance, a code of ethics with whistleblowing posture, and a transparency portal that centralizes the public control stack. Those are meaningful positives because they imply governance has been formalized as the company scaled. But policy visibility is not control proof. None of the public documents prove operating effectiveness, incident response maturity, segregation of duties quality, or audit-closure performance. The strongest charitable read is that QI Tech has built the right scaffolding for a regulated platform. The skeptical read is that scaling quickly, integrating acquisitions, and broadening product scope can easily outrun the day-to-day quality of execution behind the policies. This is the classic fintech-infrastructure risk gap: governance documents can be strong while control assurance remains hard to underwrite from public evidence alone.[CR010, CR011, CR012, CR013, CR014, CR015]

7.3 Data protection, cyber, and reputation risk

The most concrete adverse risk event in the retained set is the March 2025 incident involving 25.34 thousand people tied to QI Sociedade de Crédito. Independent coverage and Banco Central's incident page corroborate that a real event occurred. For a company selling regulated infrastructure, this matters disproportionately because trust is part of the product: customers adopt QI Tech not only for APIs and licenses but also for safe handling of identity, payment, and credit data. The privacy notice itself says QI Tech processes data on behalf of partners and their end customers, which means the company sits close to high-sensitivity information flows. The public record does not support an overreaction. One incident does not prove systemic control failure across the platform, and the company also publishes a substantial cyber-governance policy. Still, the right diligence posture is to treat the incident as a serious prompt for remediation review. Investors should want postmortems, root-cause analysis, compensating controls, notification timelines, and evidence that the event did not materially impair new enterprise sales or renewals. The incident is therefore a medium-to-high trust risk, even if it is not yet enough to overturn the broader business thesis.[CR019, CR020, CR021, CR022, CR023, CR024]

7.4 Customer-service, execution, and strategic risk

QI Tech's ombudsman reporting is unusually useful because it exposes lived service quality rather than policy intent. The first-half 2025 report shows 3,483 interactions, 4.4 business-day average response time, satisfaction score of 2.2, and 2,435 external-channel demands. Those are not catastrophic metrics, but they are materially less polished than the company's growth narrative. In a B2B infrastructure business, service quality matters for renewals, implementation expansion, and referenceability. The public record therefore supports a real operational risk that the company could scale logos and AUM faster than it scales support quality. Strategic execution risk is the second major layer. Bloomberg Línea and Finextra describe an acquisition-led expansion posture after Singulare and the 2025 extension round. That can be value-accretive, but it raises integration, control harmonization, and management-focus risks—especially when the company is also pushing new Pix, lending, anti-fraud, and fund-administration motions. The final risk verdict is not bearish, but it is clear: QI Tech's next-stage failure modes are less about finding product-market fit and more about coordinating regulation, controls, incident response, customer operations, and M&A integration without dilution of trust.[CR028, CR029, CR030, CR031, CR032, CR033]

7.5 Exhibits

8.1 Valuation history and public anchor points

The clearest public valuation anchors are straightforward. QI Tech's April 2024 extension round placed the company at a US$1.5B valuation, confirming unicorn status. By July 2025, independent and official coverage described a US$63M extension that took valuation to US$2B+. That implies roughly one-third valuation growth in about sixteen months, with no evidence of a full repricing collapse despite tighter global fintech sentiment. On its face, that is a strong signal that investors see QI Tech less as a commodity BaaS layer and more as a scarce licensed infrastructure asset with multiple monetization vectors. Still, the anchor points have limits. Public materials do not disclose exact ownership dilution, liquidation preferences, revenue-recognition policies, EBITDA, or free cash flow. The 2025 step-up therefore cannot be read as a clean mark-to-market on transparent operating metrics alone. It is better read as a strategic scarcity valuation supported by growth narrative, product breadth, and capital-markets optionality after Singulare.[CV001, CV002, CV003, CV004, CV005, CV006]

8.2 Operating scale support for valuation

The best support for a premium valuation is that QI Tech does not look like a single-surface fintech. Portuguese product pages show the same broad operating footprint across modules: R$494B Pix transacted, R$98B protected against fraud, R$107B credit issued, and R$170B under administration. The administration-and-custody page adds 1,000-plus funds and 740-plus FIDCs in portfolio. The Risk Solutions page adds 20M analyses per month and 90M validated registrations. These are company-claimed metrics, but they matter because they show scale evidence across payments, credit, administration, and data workflows rather than in a single product bucket. Bloomberg Línea's 2024 revenue projection of R$680M is the most concrete monetization clue, and the article said Singulare would represent around 40% of revenue after consolidation. That suggests the valuation is not only about transaction volume optics; it is also tied to real revenue scale and a more diversified business mix. The caution is that official English pages still show older, lower metrics, which weakens confidence in perfect disclosure hygiene. The valuation case benefits from operating breadth, but the underwriting discount should reflect metric drift and the lack of audited profitability disclosure.[CV011, CV012, CV013, CV014, CV015, CV016]

8.3 Comparables, scarcity, and sector context

QI Tech should not be valued as a plain API tool. Brazilian financial-infrastructure assets with licensing or core processing depth have attracted meaningful capital and strategic interest: Summit Partners said Celcoin reached US$63M ARR in Q1 2024 and secured a US$125M investment; Startups.com.br said Zoop generated over R$700M revenue in calendar 2025 and expected to exceed R$1B in the fiscal year ending March 2026; Brazil Journal reported Matera raised R$500M from Warburg Pincus. Taken together, those datapoints support the idea that scaled infrastructure players in Brazil can command premium valuations even before pristine public profitability disclosure. QI Tech's differentiated angle is breadth across credit, banking, payments, risk, and fund administration inside a regulated perimeter. That combination is rare. It does not guarantee the valuation is cheap, but it makes a pure low-multiple software comparison too harsh. The right contextual read is that QI Tech belongs in the upper tier of strategic infrastructure assets, while still deserving a discount for private-company opacity, integration risk, and unresolved customer-quality questions.[CV022, CV023, CV024, CV025, CV026, CV027]

8.4 Scenario analysis and valuation verdict

The central valuation question is not whether QI Tech is good—it clearly has meaningful market position—but whether US$2B+ already prices most of the next leg of execution. In the bull case, product breadth converts into durable cross-sell, Singulare integration expands monetization, and the company's scale metrics turn into strong revenue and margin progression. In that world, a premium private-market valuation is defensible. In the bear case, public scale metrics overstate monetization quality, support / incident issues slow enterprise adoption, and multi-entity integration makes the operating model more complex than the revenue base can justify. With current public evidence, the most defensible stance is constructive but disciplined. QI Tech looks more likely overvalued on disclosure risk than on strategic quality. Put differently, the company probably deserves a premium to simpler fintech tooling peers, but investors should demand a diligence discount until they see audited revenue, segment gross margins, concentration, cohort retention, and incident-remediation evidence. Recommendation: positive strategic view, moderate valuation caution, and strong insistence on deeper diligence before treating US$2B+ as a fully proven fair value.[CV032, CV033, CV034, CV035, CV036, CV037]

8.5 Exhibits