VASP Licensing in Brazil: the complete guide to the Central Bank's crypto regime

Yes. Law 14,478/2022 (art. 2) states that virtual asset service providers may only operate in Brazil with prior authorization from the competent authority, which Decree 11,563/2023 designated as the Central Bank of Brazil. Since 2 February 2026, the authorization is granted under BCB Resolutions 519 and 520 in one of three modalities: intermediary, custodian or broker. Banks and securities brokers already licensed by the BCB may offer the same services after notifying the BCB.

PSAV stands for Prestadora de Serviços de Ativos Virtuais, the Brazilian legal term for a VASP. SPSAV (Sociedade Prestadora de Serviços de Ativos Virtuais) is the company type created by Resolution 520 for entities whose main business is crypto services. The licence is the BCB's authorization to operate as an SPSAV in a given modality. The corporate name must contain the expression "Sociedade Prestadora de Serviços de Ativos Virtuais".

Intermediary (buying, selling and exchanging virtual assets for clients, distribution of issuances, portfolio management, staking, crypto FX), custodian (safekeeping of private keys and execution of client instructions), and broker (intermediary plus custodian in one entity). An intermediary cannot also be a custodian; that combination is only available through the broker licence (Res. 520, arts. 4, 7, 9 and 10).

30 October 2026 for companies that were already providing crypto services in Brazil on 2 February 2026 (Res. 520, art. 88, I, and IN BCB 704, art. 9). Filing on time allows the company to keep operating until the BCB decides. Missing the deadline means services must stop within 30 days (art. 88, §7). New entrants have no deadline because they cannot operate before authorization. Separately, from 6 November 2026 Brazilian banks and payment institutions may no longer deal with VASPs that are not authorized by the BCB (art. 91, as amended by Res. 589/2026).

The statutory maximum is 720 days for a new entrant and 1,080 days for an incumbent (360 days for phase 1 plus 720 for phase 2), under Res. BCB 548/2026, which amended the BCB's decision-deadline tables. These are ceilings, not targets. As of September 2026 no SPSAV authorization had been publicly announced.

Only if you were operating on 2 February 2026 and filed by 30 October 2026. In that case you may continue until the final decision but may not add a modality (art. 88, §6). Once the BCB issues a favorable opinion on phase 1, the "adaptation period" ends and full compliance is required even before the final decision (art. 88, §§1 and 3). A new entrant cannot operate before authorization.

This is the practical question after Res. 589/2026. From 6 November 2026, banks, payment institutions and other BCB-authorized entities may not carry out or facilitate crypto-market operations with VASPs that are not authorized by the BCB, "except as expressly permitted" in Res. 520 (art. 91). The amended text no longer refers to entities in the authorization process. The better reading is that an incumbent that filed by 30 October 2026 continues to operate lawfully under art. 88 and falls within the exception, but each bank will apply its own risk policy. Expect partners to ask for the filing protocol and for evidence of ongoing reporting, and agree the position in writing before 6 November.

Within 30 days of the denial or archiving, the company must stop providing crypto services, notify clients, transfer client assets to authorized institutions and return any funds (Res. 519, art. 18). A person whose application was denied cannot be an officer of another SPSAV for three years.

The BCB has not published a list of authorized SPSAVs and, as of September 2026, no authorization had been announced. Foreign groups have taken different routes: some acquired Brazilian licensed brokers or payment institutions with BCB approval, others incorporated Brazilian subsidiaries to file as incumbents, others migrated clients. The status of any specific platform should be checked with the BCB's registry once authorizations begin to be published.

No. Brazilian rules have no passporting or equivalence mechanism and no reverse-solicitation exemption. A foreign entity active in Brazil on 2 February 2026 had 270 days (until 30 October 2026) to transfer its operations and clients to a licensed institution or SPSAV and then cease (Res. 520, art. 23). From 6 November 2026, Brazilian banks and payment institutions may not deal with VASPs that are not authorized by the BCB (art. 91, as amended by Res. 589/2026), which closes local fiat on-ramps for unlicensed foreign platforms.

Not as an express exemption. Neither the law nor the BCB resolutions contain a client-initiated safe harbor; at most there is a narrow factual defense that requires evidence of a spontaneous approach by the Brazilian client, with no targeted advertising, organized solicitation or structured availability in Brazil. Marketing to residents, Portuguese-language onboarding, local payment methods and a Brazilian client base all indicate services "in the country". Structures that rely on reverse solicitation in the EU under MiCA should not be assumed to work in Brazil.

Yes. Resolution 519 (art. 8) allows direct control by financial institutions or similar entities headquartered abroad, as well as by individuals, BCB-authorized institutions and Brazilian holding companies. There is no local-partner requirement. The controller must prove economic capacity and licit origin of funds; its supervision status abroad supports the analysis. Control transfers after licensing need BCB approval (art. 3).

Yes. Officers of an SPSAV must be resident in Brazil (Res. 519, art. 11) and the company needs at least three officers with defined responsibilities for business conduct, AML/CFT, internal controls and compliance, risk and capital, and cybersecurity (Res. 520, art. 14). One officer may hold more than one role, but the BCB assesses technical knowledge of the crypto business for each.

Both are allowed (Res. 520, art. 14). An Ltda. must adopt four-year maximum mandates and apply the Corporations Law on a supplementary basis (Res. 519, art. 24). A single individual shareholder is not allowed. Foreign groups usually choose an Ltda. for simplicity and convert to an S.A. when they bring in investors.

Yes, and it is a common route. Banks, brokers and SPSAVs may outsource custody technology, liquidity, market making and BaaS (Res. 520, arts. 32 to 42), remaining fully liable to clients and to the BCB. The foreign provider must accept audit and access rights, continuity obligations and, in the crypto FX flow, must be a supervised entity (Res. 521, art. 76-B). The licensed institution, not the provider, is the regulated counterparty for the client.

It depends on control, not on labels. Resolution 520 (art. 9) defines custody functionally: safekeeping or control of private keys or other access instruments, execution of transfer instructions on the holder's behalf, and administration of positions. A provider that never holds key material required for the signing quorum, cannot sign or block transactions alone, cannot lock the client out and is paid by subscription rather than by assets is generally outside the custodian modality. A provider that holds key shares needed to sign, or whose participation is structurally necessary to move or recover assets, tends to be inside it. Hybrid models are assessed on a consolidated basis, so segregation must be contractual, operational and technical.

Public announcements during 2026 came mostly from domestic exchanges that cited the capital and compliance requirements; several transferred their client bases to other providers. Foreign platforms have generally either restructured through Brazilian entities or reduced marketing to residents. The picture will become clearer after the 30 October 2026 filing deadline and the art. 91 banking cut-off on 6 November 2026.

There is no fixed table. Joint Resolution CMN/BCB 14/2025 sets a formula: a cost component of R$ 2 million per category of activity (plus up to R$ 10 million if the company also offers technology-infrastructure services) and an activity component of R$ 5 million for intermediation and R$ 3 million for custody, multiplied by a funding factor between 60% and 200%. Res. BCB 517/2025 maps intermediary and broker to "intermediation" and custodian to "custody". Market analyses place the result between roughly R$ 10.8 million and R$ 37 million depending on modality and structure. Capital must be paid in cash (Res. 520, art. 18) and net worth must remain above the minimum; existing institutions phase in until 1 January 2028.

IN BCB 704/2026 lists them. Phase 1 (incumbents): Sisorf request form, proof of activity on 2 February 2026, corporate documents, identification and reputation evidence of controllers, qualified holders and officers, origin-of-funds declarations, proof of minimum capital and audited financial statements for the last three fiscal years. Phase 2 (and new entrants in a single submission): business plan, economic and financial evaluation, governance and policy set, custody contract, disclosure set and the independent technical certification under IN 701/2026 covering 17 minimum items (segregation, proof of reserves, key management, incident response, AML tooling, cybersecurity, client information).

A third-party assessment required by IN BCB 701/2026 before an institution communicates the start of crypto services or completes its application. An independent firm with no conflict of interest reviews segregation and proof-of-reserves mechanisms, private-key management, recovery plans, third-party dependencies (cloud, processing), AML and compliance policies, cybersecurity and resilience, market-abuse controls, the custody contract and the ten mandatory client disclosures. Working papers must be kept available to the BCB for five years.

No. The same capital formula and governance requirements apply regardless of size or risk profile. Industry associations have proposed a proportional category with reduced capital for non-custodial, low-volume providers, but nothing has been adopted. Startups typically enter as technology providers to licensed institutions or raise capital before filing.

No. Payment institutions are not among the entities that may provide crypto intermediation or custody under Res. 520 (art. 20). A group with an IP licence needs a separate SPSAV or a bank or broker in the group. An SPSAV may, however, also be an e-money issuer (art. 7, §1) if it meets the payment-institution rules.

Stablecoins are legal and heavily used: about 80% of declared crypto volume in 2025. Buying, selling or exchanging a fiat-referenced stablecoin is an FX-market operation under Res. 521 (Res. 277, art. 76-A), so only FX-authorized banks, brokers and dealers, and authorized SPSAVs may offer it. Listing a foreign stablecoin such as USDT requires the SPSAV to perform due diligence on the issuer's regulation, reserves and audits (Res. 520, art. 65). Algorithmic stablecoins may not be listed.

Yes. Since 2 February 2026 the purchase, sale or exchange of stablecoins referenced to fiat currency, international payments or transfers with virtual assets, loading of international cards with crypto and transfers to self-custody wallets are all FX-market operations, with purpose codes, counterparty data and monthly reporting to the BCB by the fifth day of the following month (reporting from 4 May 2026). Settling a crypto trade in foreign currency is prohibited.

An SPSAV may execute international payments or transfers with virtual assets up to the equivalent of US$ 100,000 per transaction when the counterparty is not an institution authorized to operate in the Brazilian FX market (Res. 277, art. 29, IV, as amended by Res. 521). Securities brokers and dealers have a US$ 500,000 cap; banks have none. Transfers to supervised, FX-authorized counterparties are not subject to the cap.

Self-custody is not banned. The 2024 consultation proposed prohibiting transfers to non-resident self-custody wallets, but the final Res. 521 replaced the ban with duties: the provider must identify the owner of the self-custody wallet and keep documented procedures to verify origin and destination (art. 76-A, §5), and must report such transfers monthly. From 1 October 2026, transfers to or from self-custody wallets of US$ 10,000 or more are also reported to COAF automatically, regardless of suspicion (Res. 588). From 1 January 2027, transfers above US$ 10,000 to self-custody wallets or foreign VASPs are held for 24 hours (Res. 584).

Resolution BCB 584/2026 amended the fraud-prevention rules (Res. 142/2021) to require that a transfer order to a foreign VASP or to a self-custody wallet above US$ 10,000, per transaction or in daily aggregate per client, or flagged as high risk, be executed only 24 hours after the funds are received. Early release is possible with documented justification. It applies from 1 January 2027 to all BCB-authorized institutions, including SPSAVs.

Between residents and non-residents through an authorized SPSAV, yes, as an FX operation subject to the caps and reporting above. In the eFX segment (retail international payment providers), Res. 561/2026 prohibits, from 1 October 2026, the use of virtual assets to settle between the eFX provider and its foreign counterparty; settlement must go through the traditional FX market or a non-resident's account in reais. Remittance products built on a stablecoin rail must be mapped against both rules.

There is no issuer licence today. Issuers reach the market through licensed SPSAVs that list the token after due diligence. Bill 4,308/2024 would require full reserves, prohibit algorithmic coins and impose verification of foreign issuers; the BCB has argued, in a technical note to Congress reported by the press in April 2026, that fiat stablecoins should be treated as privately issued money. A Brazilian-real stablecoin issued locally may fall under e-money and payment-institution rules.

SPSAVs are not payment institutions and do not connect to Pix directly; they use a bank or payment institution that is a Pix participant, often through a banking-as-a-service arrangement. Client fiat must sit in segregated accounts at authorized institutions (Res. 520, art. 28). Courts have upheld banks' discretion to close crypto companies' accounts, and Pix participation rules were tightened in April 2026 (Res. BCB 559/2026), so banking partners should be secured early, with enhanced due diligence expected.

VASPs are obliged entities under Law 9,613/1998 (art. 9, XIX) and, once under BCB supervision, follow Circular 3,978/2020: internal risk assessment, KYC with periodic refresh, beneficial ownership at 25%, PEP screening, transaction monitoring, suspicious-activity reports to COAF and five-year records. From 1 October 2026, transfers to or from self-custody wallets of US$ 10,000 or more must be reported to COAF automatically, whether or not they are suspicious (Circular 3,978, art. 49, V, added by Res. 588/2026). Resolution 520 (art. 44) requires originator and beneficiary data to accompany transfers, including wallet identification; domestic implementation by 2 February 2027, international by 2 February 2028, when the travel rule becomes mandatory for all authorized SPSAVs (art. 89). Mixers and obfuscation tools are prohibited (art. 90).

DeCripto is the tax-reporting system created by IN RFB 2,291/2025, aligned with the OECD CARF. It applies to providers organized or managed in Brazil and to foreign providers that render crypto services in Brazil, whether or not they hold a BCB licence. Aggregated reporting of reportable persons runs from 1 January 2026 (first annual filing January 2027); detailed monthly reporting from 1 July 2026. Residents transacting through foreign platforms above R$ 35,000 a month report themselves. Fines apply for late or inaccurate filings.

Gains are taxed as capital gains at 15% (up to R$ 5 million of monthly gain), 17.5%, 20% and 22.5% above R$ 30 million, payable by the last business day of the following month, with an exemption when total monthly disposals do not exceed R$ 35,000. Provisional Measure 1,303/2025, which proposed a flat 17.5%, lost effect on 8 October 2025 without conversion into law. Crypto held with a foreign custodian is taxed under Law 14,754/2023 at 15% annually in the tax return. Holdings above R$ 5,000 per asset type must be declared.

No. In July 2026 the CVM stated to the press, citing Guidance Opinion 40/2022, that the SPSAV licence does not authorize tokenized shares or derivatives; these are securities under CVM competence, requiring market-operator and intermediary authorizations that SPSAVs do not hold. The CVM has previously settled enforcement with a foreign exchange over derivatives offered to Brazilians. Tokenized receivables and fixed income are typically securities and are offered through registered crowdfunding platforms up to R$ 15 million.

Yes, by express provision of Law 14,478 (art. 13). The Superior Court of Justice held in 2025 (REsp 2,104,122) that crypto platforms answer objectively for fraud losses in client transactions, applying the standard used for banks. Terms of use, dispute channels and insurance should be designed for a consumer-protection jurisdiction with a consumer-domicile forum rule.

Drex is the Central Bank's tokenization project. According to press reports quoting BCB officials, the DLT pilot platform was wound down in late 2025 over privacy limitations of the tested architecture; the 2026 phase concentrates on tokenized collateral and credit use cases in an interoperable environment, not on a retail digital real. Drex does not affect the VASP licensing regime directly, but it signals the BCB's preference for regulated tokenization over private stablecoins.

Yes, within the conduct rules, and from 31 March 2027 under an opt-in regime. Resolution BCB 602/2026 (23 October 2026) requires SPSAVs, and banks and brokers offering crypto, to let each individual client choose which products and services they receive advertising and active offers about (arts. 1, 2 and 4). The option must be prominent in every channel, from apps and push notifications to e-mail, SMS, messaging and partners acting in the institution's name. Without a choice, offers on all products remain allowed. Clients may revoke at any time, the provider must remind them every six months, and records must be kept for five years under a named officer (arts. 7, 9 and 10). Credit-type offers to clients who need qualified attention require prior, product-specific consent (arts. 5 and 6). Institutions have 120 days from publication to adapt systems and channels (art. 12). Foreign platforms without a licence remain outside this regime only because they cannot market to Brazilian residents at all.

Administrative sanctions under Law 13,506/2017 (fines, disqualification of officers, cease orders); mandatory wind-down within 30 days for non-filers (Res. 520, art. 88, §7); loss of banking and Pix access through the art. 91 prohibition; possible criminal exposure for operating a financial institution without authorization and, where fraud is involved, under Penal Code art. 171-A (4 to 8 years). Officers can be personally liable, particularly for segregation failures.

Yes, if the regulated activity is actually performed by the licensed institution. Resolution 520 allows an SPSAV, bank or broker to contract relevant services (custody technology, liquidity, market making, BaaS) from third parties, who act on the licensed entity's behalf and under its guidelines (arts. 32 to 42). The licensed entity must keep effective control of KYC and KYT, AML/CFT, custody and segregation, compliance, regulatory reporting and risk management, and remains liable to clients and to the BCB. A licence cannot serve as a formal cover for an unauthorized partner to perform the VASP activity in practice; the BCB looks at who exercises control in each layer. Marketing by the partner counts as marketing by the licensed institution: from 31 March 2027 the client's choice of which products it receives offers about binds offers made through BaaS, correspondents or other third parties acting in the institution's name (Res. 602/2026, art. 4, §3).

DeFi is not prohibited but has no dedicated regime; the BCB framework was written for centralized providers with an identifiable operator. Permissionless, open-source protocols with self-custody and on-chain governance sit in an area of low regulatory definition. The analysis focuses on control in each layer (interfaces, on and off ramps, sequencers, oracles, bridges, liquidity providers, multisigs, admin keys, pause functions, settlement flows) rather than on a binary "decentralized or not" label. A Brazilian entity that maintains the client relationship, selects protocols, controls the interface or administers financial flows tends to be treated as providing VASP services. DAOs are not a corporate type in Brazil; a company, association or foundation is needed to contract, hold treasury, pay taxes or deal with regulators, and if that entity performs VASP activities it needs authorization and substance (physical office, qualified officers, capital).

Yes. Staking is an activity of the intermediary modality (Res. 520, art. 7) and of full-service custodians (art. 9, §5), and it is the one use of client assets permitted without qualified-investor consent (art. 31). Providers must disclose staking risks, including slashing (art. 71), report staked totals monthly (document 5710) and register the start date of staking in Unicad. From 1 January 2027, applicants report verifiable totals of client assets allocated to staking from the date of filing (art. 88, III, e, as amended by Res. 589/2026). BCB officials said in September 2026 that further guidance on staking is being prepared. Yield promises tied to reserve income or protocol returns can be characterized as investment offerings and attract CVM analysis.

The law does not mention NFTs. Under the functional test, an NFT that is a unique digital collectible is generally not a virtual asset used for payment or investment, while a fractionalized NFT or one that represents a right to income can be a virtual asset or a security (CVM Guidance Opinion 40). Tax reporting under DeCripto expressly covers fractionalized NFT structures. Brazil has no specific legislation on blockchain records and copyright, but courts accept on-chain records as evidence of authorship and dates.

Direct, bilateral, occasional trading between two private parties is not expressly prohibited. What requires authorization is professional or commercial operation: platforms, order matching, escrow, custody or facilitation for third parties. P2P activity is nonetheless affected indirectly: transfers to self-custody are FX operations with identification duties, residents must report P2P and DeFi transactions above R$ 35,000 a month to the tax authority, and from 2027 large outbound transfers face a 24-hour hold.

Neither. The Brazilian authorization is valid only within the national perimeter; a Brazilian SPSAV serving other markets must assess each jurisdiction's VASP, payment, FX, custody, securities and AML rules separately. In the other direction, a MiCA, VARA, MAS or FCA licence gives no rights in Brazil; a Brazilian entity is required.

Two. The Central Bank's sandbox (Res. BCB 29/2020) and the CVM's capital-markets sandbox (Res. CVM 29/2021). Both have operated as instruments of supervised innovation with limited reach for blockchain projects so far. The CVM is studying a thematic sandbox for tokenization and its Tokenization Working Group (July 2026) was tasked with proposing an experimental framework for securities on DLT.

There is no special resolution regime for digital-asset firms; general judicial reorganization and bankruptcy rules apply. The protection comes from segregation: client fiat in segregated accounts and client crypto in separate wallets, with proof of reserves, an officer personally responsible, and procedures for returning or transferring client assets in distress scenarios (Res. 520, arts. 28 to 31). A bill to write asset segregation into the law itself (PL 4,932/2023) is pending in the Senate. Virtual assets are not covered by the deposit guarantee fund.