Brazil Crypto Licence 2026: BCB VASP Authorisation After the 30 October Deadline
By Harry Khan, Founder · Published 30 October 2026 · Last reviewed 30 October 2026
WhatsApp and Telegram +44 7563 115980
[email protected]
Brazil regulates crypto businesses under Law 14,478 of 21 December 2022, the virtual asset law. Article 2 provides that a virtual asset service provider may operate in Brazil only with prior authorisation from the federal regulator, and Decree 11,563 of 13 June 2023 gave that role to the Banco Central do Brasil (BCB). Tokens that are securities stay with the securities regulator, the Comissão de Valores Mobiliários (CVM).
The law defines a virtual asset as a digital representation of value that can be traded or transferred electronically and used for payments or investment. Currencies, electronic money, loyalty points and regulated securities or financial assets are excluded. A provider is a company that, for others, exchanges virtual assets for currency or for other virtual assets, transfers them, holds them in custody, or takes part in an issuer's offer or sale of them.
The BCB turned the law into a licensing regime with three resolutions dated 10 November 2025 and in force since 2 February 2026: Resolution BCB 519 on the authorisation process, Resolution BCB 520 on how licensed firms are set up and run, and Resolution BCB 521, which brings certain crypto activity into Brazil's foreign exchange (FX) rules. The licensed company is a sociedade prestadora de serviços de ativos virtuais (SPSAV), a virtual asset service company.
| Date | What happens |
|---|---|
| 21 December 2022 | Law 14,478 enacted; it took effect 180 days after publication on 22 December 2022 |
| 13 June 2023 | Decree 11,563 names the BCB as regulator, in force from 20 June 2023 |
| 10 November 2025 | Resolutions BCB 519, 520 and 521 issued, published on 11 November 2025 |
| 29 January 2026 | IN BCB 704 sets the documents and deadlines for applications |
| 2 February 2026 | The BCB rules and the crypto FX rules take effect; the 270-day transition starts |
| 4 May 2026 | Payment purpose collection and monthly BCB reporting start for international crypto payments |
| 29 May 2026 | IN BCB 739 adds an independent AML reasonable assurance report to the application file |
| 1 October 2026 | Transfers to or from self-custodied wallets of US$10,000 or more become reportable to COAF, the financial intelligence unit |
| 30 October 2026 | Deadline for firms already operating to file phase 1 of their authorisation application |
| 6 November 2026 | Banks, payment institutions and other authorised institutions may no longer deal with unauthorised crypto providers |
| 1 January 2027 | BCB prudential rules apply to SPSAVs; revised reporting duties under Resolution BCB 589 apply |
| 2 February 2028 | Full travel rule information requirements apply to every authorised SPSAV |
| 30 June 2028 | End of the period in which every SPSAV sits in prudential segment S4 regardless of size |
Any company that provides the services listed in the law to clients in Brazil needs to be authorised. Resolution BCB 520 treats a provider as operating in Brazil when it is incorporated in Brazil, with its head office and management in the country. A group that wants Brazilian clients therefore serves them through a Brazilian company.
There are two routes into the market:
Banks and brokers already active in crypto on 2 February 2026 had 270 days to file their communication, accompanied by a technical certification from an independent qualified firm. The BCB may order them to stop within 30 days where the certification or the filing does not support continued activity.
Each SPSAV has one of three types, stated on its website and apps.
| Type | What it may do |
|---|---|
| Intermediary (intermediária) | Buy, sell and exchange virtual assets for clients; underwrite issuances; manage portfolios; offer staking; provide crypto FX services. After notifying the BCB it may also act as liquidity provider or market maker. |
| Custodian (custodiante) | Hold and control clients' private keys; keep and reconcile each client's position with the blockchain record; carry out transfer instructions. |
| Broker (corretora) | Both intermediation and custody. |
An intermediary or a custodian may not combine activities of the other types, so an exchange that also holds client assets applies as a broker. Changing type later requires BCB authorisation, and a firm in the transition may not take on another type while its application is pending.
There is no fixed capital figure per type. Since Joint Resolution 14 of 3 November 2025, the minimum paid-up capital and net equity of every BCB-authorised institution is calculated from the activities it carries out. Resolution BCB 517 classifies an intermediary as an intermediation business, a custodian as a custody business and a broker as both.
| Component | Amount |
|---|---|
| Cost component: each operational activity category | R$2 million per category |
| Cost component: technology-intensive services, such as banking as a service, Open Finance data aggregation or a Pix transactional account | R$5 million, plus 50% for each further service, capped at R$10 million |
| Activity value: custody and administration of third-party assets | R$3 million |
| Activity value: intermediation | R$5 million |
| Activity value: investment category | R$5 million (restricted) or R$8 million (free) |
| Funding factor applied to the activity values | 60% (own funds), 80% (institutional funding), 120% (public funds other than deposits) or 200% (deposits) |
The minimum is the cost component plus the activity component, which adds the values for each activity category and the investment category and multiplies the total by the factor for the firm's funding category. Capital must be subscribed in Brazilian currency and paid in full at subscription. For firms already operating, the BCB examines the minimum capital in phase 1 of the application, so the capital needs to be in place before the review.
From 1 January 2027 SPSAVs apply the prudential rules listed in Resolution BCB 580, and until 30 June 2028 every SPSAV sits in prudential segment S4 whatever its size.
A firm that was providing intermediation or custody on 2 February 2026 follows the two-phase process in Resolution BCB 519, article 26, and IN BCB 704. Phase 1 had to be filed by 30 October 2026. The BCB reviews three points in it: proof that the firm was active on 2 February 2026 and meets the SPSAV rules, the good reputation of its controllers and qualifying shareholders, and the minimum capital.
The phase 1 file contains declarations on activity, reputation and control, consents for the BCB to obtain tax returns and search records, and financial statements for the last three financial years audited by a CVM-registered auditor. The firm also evidences its risk management, cyber security and anti-money laundering (AML) controls, its procedures for asset freezes and accounting under the BCB's chart of accounts (Cosif).
Phase 2 is filed within 60 days of the BCB's favourable decision on phase 1, a period the BCB may extend by up to 60 days on a justified request. It covers the controllers' financial capacity and the lawful origin of the capital, a business plan summary, the directors' declarations and a reasonable assurance report on AML controls from a CVM-registered independent auditor, added by IN BCB 739 of 29 May 2026.
From filing, the firm sends client data to the BCB's register of financial system clients (CCS) and reports client balances, crypto held in custody, proof of reserves and staking totals to the BCB. Once the BCB decides on phase 1, the firm complies in full with the BCB rules even before the final decision. Resolution BCB 589 recasts these reporting duties from 1 January 2027 and extends them to banks and brokers that provide crypto services.
A firm that was not operating on 2 February 2026 files a single application under IN BCB 704, article 5. The file includes an executive summary of the business plan, and the BCB may ask for the full plan covering at least five years, which must show activities starting within 12 months of authorisation. Since 29 May 2026 it also includes the reasonable assurance report on AML controls.
The BCB publishes proposed controllers' and directors' names for 15 days of public objection, and may interview them and inspect the firm before it starts.
| Process | BCB maximum decision period |
|---|---|
| Phase 1, firms already operating | 360 days (about 12 months) |
| Phase 2, firms already operating | 720 days (about 24 months) |
| Whole authorisation, firms already operating | 1,080 days (about 36 months) |
| Authorisation of a new SPSAV | 720 days (about 24 months) |
These are the maximum periods set in Resolutions BCB 317 and 108, as amended by Resolutions BCB 548 and 594, not expected durations.
Resolution BCB 520 gave foreign entities already serving Brazil on 2 February 2026 a 270-day window, the same period domestic firms had to file phase 1. Within it they had to move their Brazilian operations and clients either to an eligible Brazilian bank or broker that had filed its communication, or to an SPSAV already operating or set up for the transition. The move required clients' informed consent, and the successor takes full responsibility for clients and compliance. The foreign entity ends its Brazilian activity once the transfer is complete, or at the end of the window if it is not.
The Brazilian company may keep providing services until the BCB concludes its process. The priorities now are the phase 2 file, which is due within 60 days of the phase 1 decision, the reporting described above and evidence of filing that banks and payment partners may ask for from 6 November 2026. A firm that offers international crypto transfers or stablecoin trades continues those FX operations only if its application included a request to operate in the FX market.
A group with no Brazilian filing applies as a new entrant and does not serve Brazilian clients until it is authorised. The work runs in this order:
A foreign exchange can also act for an authorised Brazilian SPSAV as liquidity provider, market maker or custodian. The contract must contain the clauses Resolution BCB 520 prescribes, including BCB access to the provider's documents and premises, and a liquidity provider may not trade against the Brazilian firm's other clients on its trading venue except in request-for-quote trades. Where an international crypto payment or transfer involves a foreign provider, the Brazilian firm checks that it is under effective prudential and conduct supervision or part of a group under consolidated supervision, and documents a risk assessment where the home jurisdiction sets no such requirements. An EU authorisation under MiCA, covered in our MiCA CASP licence guide, is one way to show supervised status.
Article 91 of Resolution BCB 520, as amended by Resolution BCB 589 with effect from 1 October 2026, prohibits banks, payment institutions and other BCB-authorised institutions, from 6 November 2026, from carrying out or enabling operations in the virtual asset market where the counterparty provides virtual asset services and is not authorised by the BCB, except in the forms the Resolution expressly allows. It covers trading, custody, FX, payment accounts and payment transactions where they enable those operations.
The original text set 30 October 2026 and also excluded firms with an authorisation process under way. That phrase does not appear in the amended text. Article 88 separately allows an SPSAV that filed on time to keep providing services until its process concludes. An institution should therefore hold, for each crypto counterparty, evidence either of BCB authorisation or of the legal basis on which it continues to operate, and confirm its reading with the BCB or its legal advisers where the position is unclear.
Licensed crypto firms that need new account or payment partners after 6 November can use the firm's banking and payment processing service, and businesses that move money in and out of Brazil can compare routes in our guide to cross-border payment providers for Brazilian businesses.
Resolution BCB 521 brings four crypto activities into Brazil's FX market from 2 February 2026: international payments or transfers made with virtual assets; transfers of virtual assets to settle obligations from the international use of cards or other electronic payment methods; transfers to or from a self-custodied wallet that do not involve an international payment; and buying, selling or exchanging virtual assets referenced to a fiat currency (stablecoins).
Resolution BCB 520 defines a stablecoin as a virtual asset backed by reserve assets and created to keep its value linked to a fiat currency, with reserve assets limited to that currency and government bonds issued by the same government. Before listing one, a provider weighs ten factors, including its regulatory standing in the issuer's home country, the reserve policy, proof of backing and audited accounts. It publishes its criteria and may not offer stablecoins whose reserves are controlled by algorithms.
The firm's financial crime practice builds and tests AML programmes that cover these controls for licensed crypto and payment firms.
The firm's crypto licensing team also aligns a Brazil licence with a group's MiCA, UK and US authorisations, so one compliance framework serves every market.
Yes. Law 14,478 requires prior authorisation for virtual asset service providers, and the BCB authorises them as intermediaries, custodians or brokers through a company incorporated and managed in Brazil.
It was the last date for crypto firms already operating on 2 February 2026 to file phase 1 of their BCB authorisation application, under IN BCB 704, article 9.
It must stop providing virtual asset services within 30 days of the end of the filing period. It can then apply as a new entrant and serve Brazilian clients once authorised.
No. The BCB treats a provider as operating in Brazil only if it is incorporated and managed in Brazil, and foreign entities had 270 days from 2 February 2026 to move Brazilian clients to a Brazilian authorised institution.
They may no longer carry out or enable crypto operations, including accounts, FX and payments, with virtual asset providers that are not authorised by the BCB, except as Resolution BCB 520 expressly allows.
There is no single figure. Joint Resolution 14 sets the minimum from fixed values per activity, such as R$5 million for intermediation and R$3 million for custody, plus cost and investment components and a funding factor.
The BCB's maximum decision periods are 360 days for phase 1 and 720 days for phase 2 for firms already operating, and 720 days for a new SPSAV.
Yes. Buying, selling or exchanging stablecoins falls within the FX market under Resolution BCB 521, providers apply listing criteria to them, and stablecoins with algorithm-controlled reserves may not be offered.
Buckingham Capital Consulting has handled payments, e-money and cryptoasset licensing from London and New York since 2013, preparing authorisation files for exchanges, brokers and custodians across the UK, the EU and the US. For Brazil, the firm structures the local virtual asset service company, its governance and AML framework, and the banking and FX arrangements the BCB rules require.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or [email protected].
This article is general information, not legal advice. Requirements change, and the regulator’s own publications take precedence.