Brazil sets PSAV rules and crypto reporting for 2026

Operation timeline

Attack chain and TTPs

There is no classic technical incident in the material, with malicious actors, malware, or exploitation of vulnerabilities. Instead, there is a regulatory sequence that behaves like a control chain over fund flows. In that sense, the relevant chain is operational and compliance-related. The Central Bank first defines who needs authorization, then what minimum structure is required to operate, then which transactions must be held or reported, and finally which counterparties are off limits.

The first regulatory TTP is classifying the provider. Resolution 519 captures actors that intermediate, custody, exchange, or sell crypto for third parties. The second is the documentary and prudential proof needed to authorize the business. The third is heightened monitoring of transfers above $10,000, with two different responses depending on the case: a precautionary hold of up to 24 hours under Resolution 584 and automatic reporting to COAF under Resolution 588. The fourth is the restriction on unauthorized counterparties in Resolution 589.

This means the regime should be read as a sequence of growing friction, not as a single isolated rule. Virtual assets are not banned, but their high-value movement is traced, paused, or conditioned on the counterparty and destination type. For security and compliance teams, the practical equivalent is clear: transaction monitoring, wallet classification, third-party license validation, and evidence retention become part of business control.

Regional impact

Brazil is the center of the report’s regulatory package, but the material also shows a regional spillover effect. Argentina appears as a counterpoint with a PSAV registration regime before the CNV, anti-money laundering obligations, and mandatory registration for foreign providers targeting Argentine residents. That combination makes cross-border operations stricter and raises the cost of serving regional clients without local structure or multi-jurisdiction compliance.

Regional outlook

The sources reviewed suggest that the Southern Cone is converging on models where the focus is not only the virtual asset, but especially the service provider. Brazil does so through prior authorization, prudential classification, and COAF reporting. Argentina does so through PSAV registration before the CNV and requirements related to net worth, custody, governance, and cybersecurity. In both cases, foreign providers fall within the radar if they target local customers.

Brazil

Brazil concentrates the largest volume of changes and the broadest sequence. Resolution 519 opens a 270-day window until October 30, 2026, to request authorization. Resolutions 520 and 521 organize the formation and operation of SPSAV entities, with paid-in capital, segregation of assets, and defined operating models. Later, Resolution 580 places PSAV firms under the prudential framework, Resolution 584 introduces precautionary holds for sensitive transactions, and Resolutions 588 and 589 add COAF reporting and granular duties before the Central Bank.

For the local market, that means operating without authorization is no longer a gray area, it is a continuity problem. Portal do Bitcoin reported Coinext’s case as an example of market exit, while BlueConsult warned that providers that do not adapt will have to stop operating. The pressure is not limited to traditional exchanges. It also reaches OTC desks, P2P platforms, fintechs, and foreign players that capture Brazilian users.

Argentina

Argentina does not change the central focus of the report, but it serves as a comparative reference for understanding the region. The Argentine government said the new compatibility matrix for PSAVs, Agents, Collective Financing Platforms, Markets, and Clearing Houses had entered into force. Stablecoin Insider and Prifinance agree that PSAV registration before the CNV is mandatory, including for foreign providers serving Argentine residents.

KPMG added an operationally relevant point, noting that the requirement that the PSAV where the virtual asset is deposited be domiciled in Argentina and subject to Argentine law was removed. That adjustment makes it easier to use providers based in other jurisdictions, but it does not remove the registration obligation or the compliance, custody, and cybersecurity rules.

Chile

No specific verifiable facts about Chile were provided in the consolidated material.

Paraguay

No specific verifiable facts about Paraguay were provided in the consolidated material.

Bolivia

No specific verifiable facts about Bolivia were provided in the consolidated material.

Peru

No specific verifiable facts about Peru were provided in the consolidated material.

Colombia

No specific verifiable facts about Colombia were provided in the consolidated material.

Mexico

No specific verifiable facts about Mexico were provided in the consolidated material.

Uruguay

No specific verifiable facts about Uruguay were provided in the consolidated material.

United States

No specific verifiable facts about the United States were provided in the consolidated material.

Technical indicators

No classic IOCs were published in the material, such as hashes, IPs, domains, wallets, or malware samples. The available technical indicator is regulatory and operational: a $10,000 threshold for reporting or holding, and a 24-hour precautionary hold window for certain transfers.

Analysis for security teams

The main operational risk is not a technical intrusion, but noncompliance with a traceability and authorization regime that now affects business continuity. Security, compliance, and product teams should treat these resolutions as architecture controls, because the Central Bank is defining which counterparties can exist, which transfers must be stopped, and which events must be recorded.

On the detection side, the priority is correctly classifying the destination type. Transfers to or from self-custody wallets and to foreign entities carry the highest regulatory friction. That requires distinguishing the user’s own wallets, unauthorized counterparties, and providers with valid licenses. It also requires tracking daily customer accumulation, because the $10,000 threshold is interpreted, according to the sources, both per individual transaction and by the total moved in the same day.

On mitigation, the focus is on three fronts. First, onboarding and verification of the counterparty’s regulatory status. Second, implementing automatic or semi-automatic holds where applicable, with enough evidence to release before 24 hours when there are no signs of irregularity. Third, timely submission of reports to COAF and the Central Bank with consistent data, especially on balances, custody, and staking. Resolution 589 raises the cost of misclassification because it combines COAF reporting, prudential reporting, and counterparty restrictions.

Implementation priority should be immediate for any actor that has not yet started the authorization process. The critical date has already been marked by several outlets as October 30, 2026. For technical teams, that means reviewing deposit and withdrawal flows, wallet screening rules, evidence logs, aggregated transaction monitoring per customer, and precautionary hold mechanisms. For legal and risk teams, it means confirming the scope of the license, the relationship with foreign third parties, and whether the operation fits the prudential framework that begins to apply in 2027.

Frequently asked questions

What date marks the end of the first PSAV authorization deadline in Brazil?

The most cited deadline in the material is October 30, 2026. BlueConsult and Hodle say the 270-day window opened by Resolutions 519, 520 and 521 runs until that date, and that firms that do not comply must stop operating or providing services.

What activities fall under Resolution BCB 519, and what do Resolutions 520 and 521 require?

OTC desks, P2P platforms, fintechs that sell crypto, foreign exchanges serving Brazilians, and more broadly anyone who intermediates, custody, or exchanges crypto for third parties, are covered. Resolutions 520 and 521 organize the formation of SPSAV entities, with capital, asset segregation, governance, and defined operating models.

What changes for crypto transfers above $10,000?

From October 2026, transfers to or from self-custody of $10,000 or more must be reported to COAF, and from January 2027 certain transfers to foreign recipients or self-custody wallets can be held for up to 24 hours. The threshold acts as a control trigger, not a ban.

Does the 24-hour hold mean funds are permanently blocked?

No. Campos Thomaz says the hold under Resolution 584 is precautionary, not final. If the internal review finds no signs of irregularity, the transfer can be released before the deadline, as long as the decision is documented and justified.

Are Brazil and Argentina following the same crypto regulatory model?

Not exactly. Brazil emphasizes prior authorization by the Central Bank, prudential classification, and reporting to COAF for self-custody and unauthorized counterparties. Argentina, according to the sources reviewed, uses PSAV registration before the CNV with custody, cybersecurity, and anti-money laundering obligations, including for foreign providers.

Material limitations

The material does not include the full text of the resolutions, so the reconstruction is based on secondary coverage and sector analysis. There are also no classic technical IOCs, victims, domains, or forensic artifacts, because the report is regulatory rather than a security incident.

There is one reference marked as uncertain in Times Brasil regarding the link between transfers above $10,000 and COAF reporting under Resolution 584. That note was checked against other sources that do confirm COAF reporting under Resolution 588, so the original uncertainty was preserved and the effects of 584, 588, and 589 were kept separate.

No additional facts were verified for Chile, Paraguay, Bolivia, Peru, Colombia, Mexico, the United States, or Uruguay. Those sections were not padded out, and the regional analysis was centered on Brazil and Argentina, the only countries with enough material to support a technical comparison.