Brazil Central Bank tightens crypto and Pix rules

Update September 15, 2026: Brazil’s central bank has set a final deadline for virtual asset service providers to seek authorization and confirmed that, starting October 30, 2026, regulated entities will not be allowed to provide services to firms without approval or a filed application. The regulatory framework is already in force and speeds up the end of the transition period for domestic and foreign operators.

Brazil’s central bank tightened rules in 2025 and 2026 for virtual asset service providers, Pix operations, and financial system security controls. Measures already disclosed include minimum crypto capital of between R$10.8 million and R$37.2 million, new governance and cybersecurity requirements, adjustments to the Special Refund Mechanism, and automatic restrictions in Pix for new devices.

What changed for crypto companies?

Brazil’s central bank set minimum capital of up to R$37.2 million for companies operating with crypto assets in Brazil, according to LetsMoney and Valor Econômico, under resolutions BCB Nos. 519, 520 and 521/2025. Valor also reported that the regulatory floor was set between R$10.8 million and R$37.2 million, depending on the activity and the risks taken.

The final regulation announced in November 2025, according to Valor Econômico, requires governance structures, internal controls, risk management, security, AML and CTF procedures, technical certification, auditing, and periodic reporting to the regulator. Other coverage says the framework also requires customer asset segregation, compliance with the Travel Rule, and consumer protection.

FCM Law detailed that Resolution BCB No. 520/2025 regulates the formation and operation of virtual asset service provider companies, with requirements covering corporate form, operating models, outsourcing, cybersecurity, disclosure, and market abuse prevention. The same firm said Resolution BCB No. 521/2025 brings certain virtual asset uses into the foreign exchange regime, including cross-border transfers with crypto, stablecoins, transfers to self-custody wallets, and card top-ups with virtual assets.

Resolutions BCB Nos. 519/2025, 520/2025 and 521/2025 have been in force since February 2026 and create the Sociedade Prestadora de Serviços de Ativos Virtuais, or SPSAV, according to Exame. That same report said companies operating with virtual assets in Brazil must be incorporated in the country, have headquarters and management in Brazilian territory, and appoint directors responsible for risk, anti-money laundering, and cybersecurity.

Exame also reported that the rules apply to banks, payment institutions, and virtual asset service providers that allow clients to trade, custody, or transfer cryptocurrencies. The Rio Times added that custodians, intermediaries, and brokers must meet capital, governance, cybersecurity, anti-money laundering and counterterrorism financing, and consumer protection requirements, in line with Law 14,478/2022.

Local crypto media noted that, after Resolutions BCB 519, 520 and 521, international payments and transfers involving virtual assets are now legally treated as foreign exchange operations. Livecoins said this forces payment gateways and solutions such as BRICS Pay to operate under licensing and foreign exchange market limits, adding another layer of regulatory control over remittances and cross-border crypto payments.

What deadline is left to apply for authorization?

Virtual asset firms that were already operating before the new framework have until October 30, 2026, to seek authorization from Brazil’s central bank, according to The Rio Times and FinanceFeeds. If they do not submit an application during that transition period, they risk being pushed out of the regulated market.

Obitcoin also reported that, as of October 30, 2026, institutions regulated by the central bank, including banks and payment institutions, will no longer be able to provide services to unapproved virtual asset service providers or to firms that have not filed an application with the regulator. The restriction is based on Article 91 of Resolution BCB No. 520.

That end to the transition period applies to both domestic and foreign operators. FinanceFeeds described it as a cutoff point for exchanges and other crypto firms that have not regularized their status with the central bank.

What is the scope of the new Pix rules?

The measures published in 2026 reinforce Pix security and add operational controls to reduce fraud, according to Globoplay, MixVale, Cryptoid, Hora AGHA, Clearingpost and Gabriel Valerio Advocacia. The most visible change is the extension of the deadline to respond to refund requests under the MED, from 30 to 80 calendar days starting September 1, 2026.

Cryptoid reported that Normative Instruction BCB No. 766/2026 was published on July 27, 2026, and took effect on September 1, consolidating version 8.5 of the DICT Operational Manual and formalizing the administrative dispute process for Pix tied to the MED. Hora AGHA said the new 80-day period runs from the date the refund was made, while Gabriel Valerio Advocacia noted that the MED became mandatory for participating institutions on February 2, 2026.

MixVale added that the central bank also tightened Pix rules for transfers made from new mobile phones and computers, with automatic value limits on the first transactions. Clearingpost said implementation of Normative Instruction BCB No. 766/2026 is moving in phases and that the first stage connects to the removal of the R$500 cap for contactless Pix payments starting in October 2026.

What does the central bank require on testing and security?

The central bank also expanded intrusion testing requirements for banks and financial institutions, covering internet banking, mobile banking, Pix APIs, cloud environments, Active Directory, and systems integrated with STR and RSFN, according to Vantico. The scope also reaches third-party assets that support critical operations.

Vantico’s analysis said pentest reports must include technical evidence of exploitation for each finding, an explicit mapping of the vulnerability against regulatory requirements, retesting results proving remediation, and a correction plan with owners and deadlines. A Revista added new security, governance, and protection requirements for information technology providers that serve financial institutions.

A Revista also said, as a reference attributed to that same coverage and not officially confirmed in the material, that Resolution BCB No. 584 provides for a precautionary hold of up to 24 hours on certain virtual asset transfers above the equivalent of US$10,000, destined abroad or to self-custody wallets, with entry into force expected in January 2027. The magazine’s report also frames these measures as part of a broader tightening by the central bank and the National Monetary Council on security, governance, and protection across the financial system.

What effect could this have on the market?

Coverage from Valor Econômico, LetsMoney, and international media agrees that the new minimum capital and other prudential requirements reduce the number of viable players in Brazil’s crypto market. Valor even said only ten crypto startups should obtain a central bank license under this framework.

Crypto.news, Mitre, Cryptopolitan, and CryptoNews.net described a framework in which banks, custodians, intermediaries, and brokers can offer clients exposure to crypto assets, but outside their own balance sheets and under stricter rules on capital, asset segregation, independent auditing, cybersecurity, AML and CTF, the Travel Rule, and consumer protection. Revista Tópicos added that Resolution BCB No. 519/2025 shifts part of the due diligence burden into the regulated perimeter, especially in transactions involving self-custody wallets and cross-border crypto flows.

Bitnoticias said that, to win authorization, companies must document at least five areas: business model and risk, corporate and governance structure, AML and CTF and cybersecurity policies, proof of operational and technological capacity, and the organization of evidence and processes for the authorization file.