Brazil tightens PSAV rules in 2026

Attack chain and TTPs

The material does not describe a technical intrusion, malware campaign or active security incident. What it does document is a regulatory and operational chain that affects the financial infrastructure used by the crypto sector. In that chain, the first link is authorization before the Central Bank, the second is internal operating adjustment, and the third is the foreign-exchange and AML treatment of certain virtual asset transactions.

From a technical operations and controls standpoint, the equivalent of an exposure surface is not an exploit, but the compliance infrastructure. PSAVs must prove financial capacity, lawful capital origin, technology architecture, governance, internal controls, monitoring and asset segregation. KYC, KYB, reports to Coaf and cybersecurity reviews in the institutions interacting with the segment are added on top of that.

The relevant TTP shift for security and compliance teams is therefore regulatory and functional. Loss of access to banking channels for unauthorized providers acts as a containment mechanism, while the treatment of stablecoins and transfers to self-custodied wallets within the foreign-exchange regime adds traceability and classification requirements that were not previously spelled out at this level of detail.

Regional impact

Regional overview

Brazil is the only country in the source material with a verifiable regulatory development, so it carries most of the regional impact. HokenFI, ABBC, Finsiders, Clav and Transfero all read the Central Bank’s move as the creation of a dedicated perimeter for PSAVs, with authorization, operations, controls and transaction classification inside the FX market. The result was both formalization of the sector and immediate pressure on players operating without a license or with incomplete licensing.

That pressure became visible on two levels. The first is prudential, with tougher capital, governance, internal controls and audit requirements. The second is commercial, with a progressive closing of access to the regulated financial system for firms that fail to adapt. Article 91 of Resolution 520, strengthened by Resolution 589, creates a concrete barrier for banks and payment institutions. The practical consequence is that operating without authorization is no longer just an administrative issue, it also means exclusion from banking rails.

The other regional layer is foreign exchange. Resolution 521 pushes Brazil to treat certain virtual asset transactions as part of the exchange and international capital regime. That matters especially for stablecoins and transfers to self-custodied wallets, because it introduces controls that were previously less clearly defined. Coverage from Investing.com Brasil and Diário do Comércio shows the market reading this as a structural reclassification, not a minor adjustment.

Brazil

Brazil was the center of the period’s main regulatory, operational and enforcement shift. Resolution 519 defined authorization requirements for SPSAVs, 520 structured operating rules and 521 extended foreign-exchange coverage to certain virtual asset transactions. Transfero, Clav and Marinho de Gusmão agree that the new regime took effect on Feb. 2, 2026, and fully reached intermediation, custody and brokerage.

The transition phase was short and strict. Companies already active had until Oct. 30, 2026, to file their authorization request. Blueconsult said that, weeks before the final deadline, only five requests had been filed, suggesting a wide gap between the companies covered by the rule and those actually in process. AtlasPublico, for its part, described the deadline as 270 days from the effective date.

The regulatory closure solidified from Nov. 6, 2026. Bartolo and Clav report that Article 91 prevents regulated institutions from working with unauthorized providers, except in express cases. Vault Capital adds that this effectively blocks access to Pix and banking channels for unregulated PSAVs. Bocater and Okai also show that Resolution 589 strengthened the AML front and adjusted the text of 520, with a focus on AML and CFT.

The market impact was visible. Finsiders talks about consolidation in the segment and a licensing queue under pressure from the new requirements. ABBC says financial institutions had to review audit, KYC, KYB, monitoring, Coaf reporting, fraud prevention and cybersecurity. A meeting between ABRACAM, the Central Bank and the FX market confirms that, a year into the new rules, practical debates were still open on transaction classification and authorization.

Argentina

The material does not describe a new Argentine regime, but it does make an explicit comparison with Brazil. El Cronista says minimum capital requirements for companies tied to cryptoassets in Argentina are lower, in a range of roughly US$35,000 to US$150,000, and contrasts them with Brazil’s higher regulatory cost. That difference helps explain some of the competitive shift within the Southern Cone.

Lemon is the clearest example. Forbes Argentina reported that the fintech shut down its Brazilian operations and redirected resources toward Argentina, Peru and Colombia. The Token Times and Valor Investe specify that the exit was limited to Brazil and that operations in Argentina continued as normal. The material does not show Brazil’s framework affecting Lemon’s local business in Argentina.

The market reading is therefore asymmetric. Brazil tightened authorization, operations and banking access, while Argentina appears in the material as a relatively lighter venue in terms of minimum capital. That does not mean there is no Argentine regulation, only that the entry burden looks lighter than Brazil’s new cost of entry.

Chile

No verifiable facts were identified for Chile in the provided material.

Paraguay

No verifiable facts were identified for Paraguay in the provided material.

Bolivia

No verifiable facts were identified for Bolivia in the provided material.

Peru

No specific verifiable facts were identified for Peru beyond Lemon’s continued operations there, according to Forbes Argentina, The Token Times and Valor Investe, after closing in Brazil. No other regulatory or supervisory details are available in the research.

Colombia

No specific verifiable facts were identified for Colombia beyond Lemon’s continued activity in that market after leaving Brazil, according to The Token Times and Valor Investe. The research does not add more on local regulation or sector impact.

Mexico

No verifiable facts were identified for Mexico in the provided material.

United States

No verifiable facts were identified for the United States in the provided material.

Uruguay

No verifiable facts were identified for Uruguay in the provided material.

Technical indicators

There are no classic technical IOCs in the material, such as hashes, malicious domains, IPs or malware samples. This case is regulatory and operational, so the available indicators are effective dates, transition deadlines, authorization thresholds and control points.

Analysis for security teams

For security teams, the Brazilian case should be read as a change in operational exposure for any company handling cryptoasset flows in Brazil. The main priority is to verify whether the organization falls into the PSAV category, whether it has already filed for authorization and whether its model depends on local banking channels, especially settlement accounts, Pix or payment-institution integrations.

The first step is to inventory products and flows. Custody, brokerage, intermediation, administration, transfers and conversion services need to be separated, because the Central Bank framework does not treat all activities the same way. Resolution 521 also requires reviewing whether any operation falls under the foreign-exchange regime, which changes control and reporting requirements. This is key for stablecoins and transfers to self-custodied wallets.

Compliance and security must work together. ABBC makes clear that KYC, KYB, transaction monitoring, reports to Coaf, fraud prevention and cybersecurity become part of the control expected by banks and other entities dealing with the sector. If the company is a PSAV, a written policy is not enough. It must show operational traceability, asset segregation and real control capability.

The second priority is to review banking dependency. Since the end of November 2026, doing business with an unauthorized PSAV may mean banks and payment institutions cannot intermediate funds. That makes models dependent on traditional banking rails fragile. Any business relationship with crypto providers in Brazil should include documentary validation of regulatory status and the stage of the authorization request.

The third priority is monitoring regulatory change. Resolution 589 shows that the Central Bank can keep adjusting the framework, especially on AML and CFT. The issue should not be treated as closed after the initial publication of resolutions 519, 520 and 521. The regime is still evolving and has already shown it can harden further.

Frequently asked questions

What changed in Brazil between February and November 2026 for PSAVs?

Brazil moved from publishing a specific regulatory framework to making it operational and then more restrictive. Resolutions 519, 520 and 521 took effect on Feb. 2, 2026, and the transition deadline to request authorization expired on Oct. 30. From Nov. 6, unauthorized entities were excluded from the regulated financial system.

What activities fell within the Central Bank’s regulatory perimeter?

The Brazilian framework covered custody, intermediation, brokerage, administration and transfer of virtual assets, plus certain transactions that Resolution 521 brought into the foreign-exchange regime. That includes international payments, transfers to self-custodied wallets and cryptoassets pegged to fiat currency, according to the texts cited by Transfero and Diário do Comércio.

Why is the Brazilian crypto market being described as consolidating?

Because authorization requires capital, governance, technology infrastructure and compliance controls that not every company can support. Finsiders and ABBC describe a cleansing effect, while Blueconsult reported only five license requests weeks before the deadline. Restricted banking access also favors firms that did regularize their status.

How did Brazilian regulation affect companies operating in other countries in the region?

The best-documented case is Lemon. Forbes Argentina, The Token Times and Valor Investe all say the company closed Brazil but kept operating in Argentina, Colombia and Peru. The material does not show equivalent regulatory spillover in those countries, although El Cronista compares Argentina with Brazil and places it at a lower capital threshold.

What role did AML and CFT rules play in this process?

A central one. ABBC called for new audit routines covering KYC, KYB, monitoring, Coaf reporting and cybersecurity, and Bocater reported that Resolution 589/2026 strengthened anti-money laundering and counter-terrorism financing obligations. That raised the control bar for PSAVs and for the financial institutions that interact with them.

Material limits

The available research is strong on Brazilian regulation and selective regional comparisons, but it provides no verifiable facts for Chile, Paraguay, Bolivia, Mexico, the United States or Uruguay. It also does not include classic technical IOCs, because the subject is a regulatory shift rather than a malware campaign.

The sources are mostly news articles, sector analyses and law firm notes. In some cases, such as Finsiders on Resolution 580/2026 and BitNotícias on the number of requests, the material itself flags uncertainty or less-than-fully confirmed attribution. Those references were kept as such and were not elevated to hard fact.

The material does not provide a full list of applicant companies or an official inventory of licenses granted or denied. It also does not include the full text of all resolutions, only descriptions, excerpts and partial quotes reproduced by third parties. For that reason, this report avoids inference about individual compliance status or the exact state of each exchange beyond the cases mentioned.