Brazil BCB 519, 520, 521 and 584 for PSAV

The platform for managing human risk in cybersecurity.

Brazil BCB 519, 520, 521 and 584 for PSAV

Brazil tightened PSAV rules on licensing, capital, audit and a 24-hour hold for higher-risk crypto transfers.

Whalemate Labs · AI-assisted researchFederico HombreAug 31, 202636 min read

Between 2023 and 2026, Brazil’s Central Bank built a dedicated regulatory perimeter for virtual asset service providers, first through Resolutions 519, 520 and 521, and later through 580 and 584. The result is a regime that no longer treats crypto assets as a gray zone, but as an activity subject to prior authorization, corporate governance, asset segregation, prudential oversight, independent audit and reinforced anti-money laundering, counterterrorism financing, sanctions and fraud controls.

Executive summary

Brazil consolidated a dedicated regime for virtual asset service providers between 2023 and 2026, with prior authorization, governance requirements, capital rules, asset segregation, independent audit and a 24-hour precautionary hold on higher-risk transfers. The regulatory package rested on Central Bank Resolutions 519, 520, 521, 580 and 584, and reshaped both the prudential perimeter and the AML/CFT obligations for PSAV and SPSAV.

The clearest point in the regulatory shift began on February 2, 2026, when Resolutions 519, 520 and 521 took effect, according to SoulBit. That trio defined how PSAV are organized and operate, created distinct operating models, and set conditions for a functioning license. Sources agree that the Central Bank stopped treating the crypto market as an informal space and began assigning rules similar to those of the traditional financial system, with access conditioned on structure, governance and controls.

Operational tightening deepened in August 2026. Instrução Normativa BCB 739, according to FinanceFeeds, began requiring a license application to include a reasonable assurance report from an independent auditor registered with the CVM, focused on controls against money laundering, terrorist financing and sanctions. In parallel, Resolution BCB 584 extended the fraud-prevention framework of Resolution 142/2021 to virtual asset services and imposed a 24-hour delay on higher-risk crypto transfers.

The most visible prudential change came with Resolution BCB 580. According to the sources gathered, that rule reclassifies PSAV and prudential conglomerates led by them as Type 3 institutions, keeps them in Segment 4 until June 30, 2028, and makes the new prudential rules effective starting January 1, 2027. Blueconsult and Boschirolli say the change aligns the sector with the rest of the financial system, but also raises the bar for players without scale or compliance infrastructure.

At a regional level, the impact goes beyond Brazil. The new rules affect how crypto flows interact with foreign exchange, self-custody and cross-border transfers, which are common routes for illicit off-ramping. The combination of authorization, audit, capital, reserve testing, monitoring and precautionary retention reduces the appeal of using crypto assets as a fast lane to move value outside the formal system. The tax and compliance reading points in the same direction, more friction, more traceability and less room for regulatory arbitrage.

Context and background

The starting point for the Brazilian regime was the decision to move virtual assets out of an undefined zone and into an explicit supervisory framework. The Central Bank of Brazil presentation at Febraban Tech 2026 says the authority had already set rules for authorization and the provision of virtual asset services, and had also defined which activities fall within the foreign exchange market and international capital regulation. That framing matters because it does not treat PSAV as mere technology intermediaries, but as obligated entities inside the financial architecture.

The way sources describe Resolutions 519, 520 and 521 helps explain that first step. SoulBit presents 519, 520 and 521 as the regulatory package that took effect on February 2, 2026, while Cointelegraph Brasil and Brasil em Folhas say the Central Bank used them to structure the authorization regime, formation rules and exchange classification of PSAV. The common reading is that the authority began regulating not only who can operate, but also how, under which models and within what functional limits.

Within that same block, Resolution 520 appears to be the most operational piece. SoulBit says it defines PSAV formation, operation and three models, intermediary, custodian and broker, each with its own capital and governance requirements depending on the activity risk. Marinho de Gusmão adds that the same resolution bans lending to clients, raising funds from the public except through share issuance, and using terminology that could confuse users into thinking the service is banking or professional investment management. The practical effect is to close off informal banking paths in the crypto business.

The prudential dimension was expanded later with Resolution 580. Blueconsult says the rule amends Resolutions 436/2024 and 201/2022 to classify PSAV and conglomerates led by them as Type 3 institutions, in the same group as broker-dealers and securities distributors. Boschirolli and Portal do Bitcoin note that the prudential requirements begin on January 1, 2027, and that PSAV remain in Segment 4 until June 30, 2028. While some sources differ on specific dates and scope, the technical point does not change, PSAV are being brought into the prudential perimeter under a logic comparable to the formal financial system.

The AML layer was already supported by the broader legal framework. MercGroup links the inclusion of PSAV in the AML/CFT perimeter to Lei 14.478/2022, Decree 11.563/2023 and Resolutions 519, 520 and 521, and says these entities must implement the travel rule, transaction monitoring and sufficient evidence for auditors. At the same time, ANBIMA helps define the perimeter by clarifying what is excluded from the digital asset category, such as national or foreign currency, electronic money and instruments that only grant access to specific products or services. That distinction reduces ambiguity in token and crypto asset classification.

Key facts table

Date	Event	Source	Confidence
2023	Decree 11.563/2023 is part of the legal framework MercGroup cites for bringing PSAV into AML/CFT scope.	MercGroup	Confirmed
2025-11-10	The regulatory package including Resolution 520 is published, according to SoulBit.	SoulBit	Confirmed
2026-02-02	Resolutions BCB 519, 520 and 521 take effect, according to SoulBit.	SoulBit	Confirmed
2026-02-02	The authorization regime and operational models for PSAV are consolidated.	SoulBit, Transfero, Brasil em Folhas	Confirmed
2026-07-01	Bitzo places Resolution BCB 580 as the Type 3 prudential classification rule.	Bitzo	Attributed by the source as uncertain
2026-08-04	VBSO says already active institutions must file their request by October 30, 2026.	VBSO Advogados	Confirmed
2026-08-05	SoulBit describes Resolutions 519, 520 and 521 as part of the package on stablecoins and PSAV.	SoulBit	Confirmed
2026-08-06	Marinho de Gusmão details bans on lending, fundraising and confusing language for PSAV.	Marinho de Gusmão Advogados	Confirmed
2026-08-07	Resolution BCB 584 is published, introducing the 24-hour precautionary hold.	Blueconsult, SpaceMoney, Okai	Confirmed
2026-08-11	MercGroup describes travel rule, monitoring and evidence requirements for audit.	MercGroup	Confirmed
2026-08-12	Transfero explains the scope of SPSAV and the types of activity covered.	Transfero	Confirmed
2026-08-13	EmprestimoDigital highlights the duty to apply the 24-hour hold to transactions above US$ 10,000.	EmprestimoDigital	Confirmed
2026-08-17	Gov.br says Resolution 584 aims to strengthen fraud prevention.	Gov.br	Confirmed
2026-08-18	Blueconsult places PSAV as Type 3 institutions under Resolution 580.	Blueconsult	Confirmed
2026-08-19	SpaceMoney reports the duty to hold crypto transfers abroad or to self-custody for up to 24 hours.	SpaceMoney	Confirmed
2026-08-25	SoulBit details the structure of Resolution 520 and its three operating models.	SoulBit	Confirmed
2026-08-26	FinanceFeeds reports the requirement for a reasonable assurance report for licensing.	FinanceFeeds	Confirmed
2027-01-01	The prudential regime under Resolution 580 takes effect, according to Boschirolli and Portal do Bitcoin.	Boschirolli Advogados, Portal do Bitcoin	Confirmed

Operational timeline

Date	Event	Actor/vector	Verified source
2023	The general AML/CFT framework is expanded to include PSAV in the legal perimeter cited by analysts.	Brazilian legislation, PSAV	MercGroup
2025-11-10	Publication of the regulatory package including Resolutions 519, 520 and 521.	Central Bank of Brazil	SoulBit
2026-02-02	Resolutions 519, 520 and 521 take effect.	Central Bank of Brazil, PSAV	SoulBit
2026-02-02	The authorization and functional classification scheme for PSAV is enabled.	Central Bank of Brazil	SoulBit, Transfero
2026-08-04	VBSO reports the October 30 deadline to submit authorization requests.	PSAV already operating	VBSO Advogados
2026-08-07	Resolution 584 is published with the 24-hour precautionary hold.	Higher-risk crypto transfers	Blueconsult, Okai
2026-08-11	The scope of AML/CFT, travel rule and auditable evidence is described.	Monitoring and audit	MercGroup
2026-08-17	The Brazilian government explains the anti-fraud purpose of Resolution 584.	Fraud and scams involving virtual assets	Gov.br
2026-08-26	FinanceFeeds reports the independent audit requirement for licensing.	PSAV license application	FinanceFeeds
2027-01-01	Prudential rules under Resolution 580 start to apply.	PSAV Type 3, Segment 4	Boschirolli Advogados, Portal do Bitcoin
2028-06-30	The transition phase for PSAV in Segment 4 ends, according to Blueconsult and Portal do Bitcoin.	PSAV	Blueconsult, Portal do Bitcoin

Attack chain and TTPs

The technical reading of the material does not describe a specific cyberattack, but rather a chain of financial and operational risk that the regulator is trying to break. In that chain, the first link is a PSAV entering the market without a license or with an incomplete structure. The second is the ability to offer crypto services without asset segregation, sufficient capital, defined governance or AML/CFT controls. The third is the use of that infrastructure to move value abroad or into self-custody with low friction.

The sources describe several regulatory TTPs, if the parallel can be used. The use of exchange, transfer, custody, administration and participation in related financial service offerings creates different abuse surfaces. Added to that are practices such as off-ramping to foreign exchanges, splitting transfers below the threshold or using stablecoins to accelerate fund خروج. Resolution 584 is aimed precisely at slowing that final stage with a precautionary hold.

On the control side, MercGroup says PSAV must apply the travel rule, transaction monitoring and sufficient documentation for auditors to test control effectiveness. FinanceFeeds adds that the audit must come before the license, with a reasonable assurance report on controls against laundering, terrorism and sanctions. The underlying logic is to create ex ante traceability and ex post verifiable evidence, so the operator cannot hide behind the idea that it is only a technical intermediary.

Regulatory and risk TTPs table

TTP	Description	Source
Prior authorization	No PSAV may operate without Central Bank approval.	SoulBit, VBSO Advogados
Functional segmentation	PSAV are divided into intermediary, custodian and broker models.	SoulBit
Ban on informal banking	Lending, public fundraising and misleading banking language are prohibited.	Marinho de Gusmão Advogados
Travel rule	Entities must retain and transmit sufficient information to trace transactions.	MercGroup
Transaction monitoring	Continuous monitoring is required to detect suspicious patterns.	MercGroup
Asset segregation	Customer assets must be separated from the provider’s own assets.	Blueconsult
Daily proof of reserves	Daily reserve evidence is required, according to the source.	Blueconsult
Independent pre-license audit	The license application must include a reasonable assurance report.	FinanceFeeds
Precautionary hold	Transfers abroad or to self-custody above US$ 10,000 are executed after 24 hours.	Okai, EmprestimoDigital, SpaceMoney

Regulatory evolution of PSAV in Brazil — Main regulatory timeline from 2023 to 2028, with milestones for authorization, prudence, and precautionary retention.

Regional impact

Regional outlook

The regional effect of Brazil’s regulation is not limited to the local market, because Brazil has set a supervisory reference point for crypto assets in South America’s largest financial system. The mix of authorization, capital, audit, limits on operations and a 24-hour precautionary hold makes it harder to use PSAV as a fast bridge between the banking system and illicit exit channels. That affects Brazil, but also crypto routes that connect with other markets in the region.

The sources point to one concrete consequence for the illicit economy, less ability to move funds without traceability. Contábeis interprets Resolution 584 as a strategy to fight tax evasion and illicit capital flight, because it raises the cost and visibility of typical off-ramping routes. Gov.br, meanwhile, frames the measure as a way to strengthen fraud prevention. Both readings converge on the idea that the regulator is choosing operational friction over settlement speed.

Bringing PSAV into the AML/CFT perimeter also pushes regional players to revisit their compliance architecture. MercGroup says the travel rule, transaction monitoring and auditable evidence become central obligations. ANBIMA helps define which tokens and assets fall within the digital asset perimeter, reducing classification arbitrage. For operators handling cross-border flows, the equation is straightforward, more visibility, higher compliance costs and less tolerance for opaque structures.

Regional coverage of the report — Brazil accounts for the verified incidents; the rest of the countries have no confirmed data in the research.

Brazil

Brazil is the only country in the material with broad, sustained verifiable facts, and it concentrates most of the regulatory shift analyzed here. Resolutions 519, 520 and 521 defined the authorization, formation and operational models for PSAV. Resolution 580 reclassified those entities as Type 3 institutions and set a prudential transition through 2028. Resolution 584, in turn, introduced a 24-hour precautionary hold for higher-risk crypto transfers.

The operational detail matters. According to SoulBit, Resolution 519 requires directors responsible for risk and cybersecurity, a formal AML policy, international sanctions compliance and accounting under COSIF. Resolution 520 bans client lending, public fundraising and misleading terminology, while also setting the rules for intermediary, custodian and broker models. Cointelegraph Brasil adds that 520 already includes basic staking obligations. Taken together, the authority is not just issuing licenses, it is also defining exactly which products may exist and under what constraints.

At the same time, audit is becoming an entry filter. FinanceFeeds says Instrução Normativa BCB 739 requires a reasonable assurance report from an independent firm registered with the CVM, reviewing AML/CFT and sanctions controls. Portal do Bitcoin reported that sector entities asked to push back the final October 30, 2026 deadline because of the extra burden created by Instructions 734 and 739 on COSIF and audit. VBSO and TJS Auditores agree that the deadline for already active PSAV to submit their authorization request is October 30, 2026.

Resolution 584 completes the pressure on outgoing flows. Okai reproduces the official text and confirms that transfers abroad or to self-custody are subject to a 24-hour wait when they exceed the equivalent of US$ 10,000 per operation or per daily accumulation, with possible application to smaller amounts. EmprestimoDigital says the measure is mandatory even if there are no apparent signs of fraud, while SpaceMoney and the Brazilian government present it as a direct response to fraud and scams involving virtual assets. The result is explicit friction on value-exit channels.

Layers of the Brazilian regulatory regime — From authorization and conduct to prudence and outflow controls.

Argentina

No additional verifiable facts were found in the research for Argentina.

Chile

No additional verifiable facts were found in the research for Chile.

Paraguay

No additional verifiable facts were found in the research for Paraguay.

Bolivia

No additional verifiable facts were found in the research for Bolivia.

Peru

No additional verifiable facts were found in the research for Peru.

Colombia

No additional verifiable facts were found in the research for Colombia.

Mexico

No additional verifiable facts were found in the research for Mexico.

United States

No additional verifiable facts were found in the research for the United States.

Uruguay

No additional verifiable facts were found in the research for Uruguay.

Technical indicators

No classic technical IOCs were published, such as hashes, IPs, domains or infrastructure names. The material does provide regulatory and operational indicators that are useful for detection and prioritization.

Type	Value	Source
Effective date	February 2, 2026 for Resolutions 519, 520 and 521	SoulBit
Hold threshold	US$ 10,000 per transaction or daily cumulative amount	Okai, EmprestimoDigital, SpaceMoney
Hold window	Up to 24 hours	Okai, SpaceMoney
Prudential start date	January 1, 2027	Boschirolli Advogados, Portal do Bitcoin, Blueconsult
Segment 4 transition end	Through June 30, 2028	Blueconsult, Portal do Bitcoin
Authorization request deadline	October 30, 2026	VBSO Advogados, TJS Auditores, Portal do Bitcoin
PSAV models	Intermediary, custodian, broker	SoulBit
Prudential category	Type 3 institutions	Blueconsult, Boschirolli Advogados, Portal do Bitcoin

Required controls matrix — Prudential, AML/CFT, and anti-fraud controls appearing in the research.

Analysis for security teams

The material describes a regulatory shift that forces security, compliance and risk teams to work with verifiable controls, not just policy statements. The top priority is to check whether a PSAV operation or linked provider can sustain authorization, asset segregation, daily proof of reserves, independent audit and sufficient AML/CFT evidence. If one of those links fails, the problem stops being reputational and becomes one of business continuity.

For detection, the most useful signal is not technical but transactional. The rules in Resolution 584 require identifying transfers abroad or to self-custody above the US$ 10,000 threshold and subjecting them to a 24-hour hold. That means monitoring split attempts, daily concentrations near the threshold, abrupt changes in withdrawal destination and stablecoin usage patterns that could serve as off-ramping paths. The precautionary hold does not replace monitoring, it makes it more demanding.

On mitigation, the biggest change is evidence building. MercGroup insists that the travel rule, transaction monitoring and documentation must allow an auditor to prove control effectiveness. FinanceFeeds adds that the audit must come before the license application. In practical terms, teams should prepare end-to-end traceability, customer data maps, approval flows, decision logs and evidence showing who authorizes exceptions. If that does not exist before the application, the regulatory friction spreads to the entire business.

There is also a corporate structure issue. VBSO warns that the new regime is not limited to companies directly engaged in intermediation or custody, but may reach related structures as well. Security teams should therefore review corporate boundaries, outsourcing, financial infrastructure providers, integrated fintechs and companies within the same conglomerate. The risk is not only in the visible exchange, but in the group supporting it.

Operational prioritization should follow three layers. First, minimum authorization and governance compliance, because without that the operation should not keep growing. Second, AML/CFT and sanctions controls, because those affect the relationship with the Central Bank and the auditor. Third, outgoing flow and self-custody controls, because that is where the highest-risk paths for fraud, evasion and illicit capital flight appear. Resolution 584 turns that last stage into a friction point designed by the regulator.

Frequently asked questions

What changed in Brazil between Resolutions 519, 520 and 521 and Resolution 584?

Resolutions 519, 520 and 521 created the authorization regime, operating models and basic controls for PSAV, while Resolution 584 added a 24-hour operational barrier for certain crypto transfers. In practice, the Central Bank moved from regulating market entry to also intervening in fund خروج.

Why is Resolution 580 relevant if authorization rules already existed?

Because Resolution 580 moves PSAV into the prudential perimeter, classifies them as Type 3 institutions and sets requirements that apply starting January 1, 2027. Resolutions 519, 520 and 521 remain the foundation for authorization and conduct, but 580 adds supervision closer to traditional finance.

Which operations are most affected by the 24-hour hold?

Crypto transfers abroad or to self-custody when they exceed the equivalent of US$ 10,000 per transaction or per daily cumulative amount. Okai reproduces the official text and EmprestimoDigital says the measure is mandatory even when there are no apparent signs of fraud. The focus is on the value-exit stage.

What compliance controls does the new regime require from a PSAV?

The sources cite asset segregation, daily proof of reserves, directors responsible for risk and cybersecurity, a formal AML policy, international sanctions compliance, the travel rule, transaction monitoring and an independent audit with a reasonable assurance report. The requirement is not only documentary, it is also evidentiary and auditable.

What impact does the regulatory package have on the regional illicit economy?

It reduces the ability to use crypto assets for fast off-ramping, tax evasion and capital flight. Contábeis describes the 584 rule as deliberate systemic friction, while MercGroup and the Brazilian government emphasize traceability, fraud prevention and auditable evidence. The effect is higher cost and more visibility.

Who is covered by the regime beyond visible exchanges?

The scope is not limited to companies that directly intermediate or custody assets. VBSO says corporate structures and related companies may also be covered, and Transfero includes trading platforms, custodians, transfer agents, fintechs and financial infrastructure providers. The perimeter is broader than the public-facing crypto shop.

Limitations of the material

The available material makes it possible to reconstruct the Brazilian regime in high detail, but it does not provide verifiable facts for Argentina, Chile, Paraguay, Bolivia, Peru, Colombia, Mexico, the United States or Uruguay. It also does not include classic technical IOCs, victims, domains, hashes or infrastructure. Some secondary references, such as Bitzo or Blueconsult, present specific scopes or dates as uncertain according to the source, so they were preserved with that caution.

The documents gathered describe regulations, interpretations by law firms, specialized media and official notices, but do not provide the full text of every resolution cited. For that reason, in cases where a source summarizes or interprets, this report preserves that attributed nature and avoids turning it into an absolute statement when there is no direct textual reproduction.

Sources

Report verification flow — The findings are supported by converging regulations, official notices, and industry analysis.