Brazil Central Bank classifies PSAVs as Type 3

Operation timeline

Attack chain and TTPs

The attack-chain label does not apply here in the classic sense of a technical intrusion with indicators, malware or hostile infrastructure. The material does not describe a compromise incident, but a regulatory operation with direct effects on Brazil’s crypto sector. Even so, an operational impact chain can be reconstructed, because the resolution forces concrete changes in control architecture, reporting and governance.

The first step is regulatory, not technical. The Central Bank issues a resolution that integrates PSAVs into the prudential framework and classifies them as Type 3 institutions. That changes the supervision model and ends the assumption that the sector sits in a soft or simplified layer. The second step is the removal of Segment 5 as a regulatory entry path for virtual asset activities, which closes a shortcut for lower-complexity institutions. The third is temporal and operational, since from 2027 onward the rule rolls out prudential circulars and resolutions on capital, risk, governance, internal controls and disclosure.

From there, the impact chain becomes more specific. The sector has to adapt how it calculates regulatory capital, structures reporting and documents its risk exposure. The Sharp Fintech and IBCCRIM agree that this requires reference capital, risk-weighted assets, integrated risk management and formal capital planning and management processes. MoneyTimes adds that the Central Bank will require risk-based capital along Basel lines, removing the sector’s last simplified regime. That convergence is the technical core of the change.

At the risk level, the resolution brings in or reinforces prudential treatment for vectors that in crypto are often seen as purely operational. The Sharp Fintech stresses that the Central Bank expects explicit management of liquidity, custody, technology and cybersecurity risks. That matters because it moves incidents such as key custody failures, technology outages or information-security compromises out of the category of technical glitches and into prudential risks subject to capital, internal controls and stronger governance. For an exchange or custodian, that means technology resilience now has a direct regulatory solvency impact.

The consulted literature also hints at a stronger compliance layer around control validation. Asper’s attribution, which is not confirmed by the regulatory text in the material, mentions annual penetration tests performed by independent professionals. Although that should be treated as unverified, it fits the broader logic of the resolution, which pushes the sector toward a discipline much closer to regulated financial institutions than to a lightweight fintech model.

Regulatory TTP matrix

Regional impact

Regional overview

The available evidence shows a strictly Brazilian case with regional relevance by contrast. The material contains no verifiable facts about regulatory responses in Argentina, Chile, Paraguay, Bolivia, Peru, Colombia, Mexico, the United States or Uruguay tied to this same resolution. Even so, the signaling effect is significant. Brazil is moving PSAVs from a sectoral authorization and supervision model toward a prudential framework built around capital, risk, governance and transparency. In Latin America, that creates a reference point for jurisdictions that are still at earlier or more fragmented stages of crypto regulation.

The resolution also organizes the local market in layers. First, it recognizes PSAVs as Type 3 institutions. Second, it prevents virtual asset services from being used as a ticket into Segment 5. Third, it sets a long S4 transition through 2028. That structure suggests an intent not to shut down sector operations abruptly, but to raise the regulatory cost and solvency standard with a logic closer to banking. For companies with regional operations, Brazil now stands out as a jurisdiction with heavier compliance demands than many neighboring markets.

Brazil

Brazil is where all the verified evidence sits. Resolução BCB No. 580/2026 amends Resoluções BCB No. 436/2024 and No. 201/2022 to classify PSAVs and prudential conglomerates led by them as Type 3 institutions. It also bans the use of virtual asset services to qualify for Segment 5 and sets a date for the prudential regime to start applying. Those three moves together redefine the sector’s place under Central Bank supervision.

Press and analysis sources agree that the real impact is on capital and governance. Starting in 2027, firms will have to adopt risk management policies, maintain minimum capital to absorb losses, and disclose financial and operational information. Portal do Bitcoin, Agência Brasil, R7 and The Sharp Fintech all note that the rules bring exchanges, custodians and trading platforms closer to the standards applied to securities brokerages and distributors. MoneyTimes adds the risk-based capital angle, along with the elimination of the simplified regime the sector had been using.

The staggered rollout is also part of the Brazilian impact. Bocater, Atlas Público, Agência Brasil and PtyCoin report that pure PSAVs will stay in S4 until June 30, 2028, regardless of size. That matters because it prevents the market from reading the reclassification as an immediate jump to a full regime with no adaptation period. The Central Bank is demanding compliance, but giving firms a window to adjust.

Cointelegraph Brasil provides the only additional operational milestone in the corpus, reporting that active PSAVs have until October 30 to file the first phase of their operating application with the Central Bank. That points to an administrative compliance phase running alongside the prudential transition and forces firms to align documentation, controls and internal structure with the new standard.

Argentina

There are no additional verifiable facts in the material for Argentina linked to this resolution.

Chile

There are no additional verifiable facts in the material for Chile linked to this resolution.

Paraguay

There are no additional verifiable facts in the material for Paraguay linked to this resolution.

Bolivia

There are no additional verifiable facts in the material for Bolivia linked to this resolution.

Peru

There are no additional verifiable facts in the material for Peru linked to this resolution.

Colombia

There are no additional verifiable facts in the material for Colombia linked to this resolution.

Mexico

There are no additional verifiable facts in the material for Mexico linked to this resolution.

United States

There are no additional verifiable facts in the material for the United States linked to this resolution.

Uruguay

There are no additional verifiable facts in the material for Uruguay linked to this resolution.

Technical indicators

No classic IOCs were published in the research material. There are no hashes, IP addresses, domains, wallets, malware signatures or technical intrusion artifacts. This is a regulatory case, and its traceability rests on dates, segments, institutional types and prudential rules.

Analysis for security teams

For security teams, this resolution should be read as a regulatory maturity trigger. The most immediate impact is not an external technical threat, but the need to demonstrate internal control, operational resilience and the ability to absorb stress. A PSAV operating in Brazil, or seeking to operate there, will have to rebuild its security program around prudential obligations, not just fraud controls or infrastructure best practices.

The first priority is capital and risk. If the Central Bank requires risk-based capital, the security function stops being only a cost center and starts affecting the regulatory capital equation. Custody failures, downtime incidents, key compromises or weaknesses in segregation of duties can affect the assessment of operational risk and, by extension, solvency requirements or supervisory perception. Security teams should work closely with compliance, risk and finance to translate technical controls into auditable evidence.

The second priority is custody and liquidity management. The Sharp Fintech and Agência Brasil explicitly mention custody, liquidity and technology risks. In practice, that means clear maps of responsibility for assets, controls over keys, monitoring of hot and cold wallets, continuity testing, failure tolerance and recovery plans that can be presented to a supervisor. It also means reviewing how incidents are documented and how relevant events are reported on time.

The third priority is corporate governance and evidence. The sources repeatedly use terms such as governance, internal controls, disclosures and operational management. Controls are not enough if they cannot be demonstrated. Teams should expect scrutiny over written policies, role segregation, risk metrics, committee minutes, critical asset inventories, vendor management and traceability of technology changes. The old reactive security model is not enough for a Type 3 institution.

The same logic applies to pure cybersecurity. Although the material only offers the annual independent penetration-test requirement as an unconfirmed attribution, the regulatory intent is clear. An environment with asset custody, high-value transactions and digital channels needs a more formal posture on testing, hardening, monitoring and incident response. For a PSAV, red team exercises, recovery testing, privileged access controls and key protection become part of prudential compliance as much as technical defense.

Material limitations

The corpus does not include the full text of Resolução BCB No. 580/2026, so some operational details come from news coverage, legal briefs and third-party analysis. That is enough to reconstruct the overall architecture with reasonable confidence, but not to replace a full article-by-article reading of the rule.

There are also no technical IOCs, and no evidence of malware, phishing campaigns, hostile infrastructure or specific victims. For that reason, any reference to an attack chain in this report should be understood as a chain of regulatory and operational impact, not as forensic analysis of an intrusion.

A number of attributions are marked as uncertain in the material. These include the exhaustive list of more than 30 prudential circulars and resolutions referenced by PtyCoin, the annual intrusion-testing obligation reported by Asper and the Exame reading on a possible delay in mandatory reporting. Those elements are useful context, but they should not be treated at the same level as confirmed facts without further corroboration.

At the regional level, the material offers only one fully verifiable case, Brazil. No additional confirmed facts were identified for Argentina, Chile, Paraguay, Bolivia, Peru, Colombia, Mexico, the United States or Uruguay in connection with this resolution. For that reason, the regional reading should be understood as a reference impact, not as documented regulatory spillover beyond Brazil.