Brazil tightens crypto rules

Brazil’s central bank published Resolução BCB No. 584/2026 on Aug. 7, 2026, amending Resolução BCB No. 142/2021 and expressly bringing virtual asset service providers, or PSAVs, under the mandatory fraud-prevention rules that apply to regulated institutions.

24-hour precautionary hold

The new wording adds Article 2-B and states that institutions providing virtual asset services, or executing payments linked to those services, may only process transfer orders 24 hours after receiving the contributed funds when the destination is a foreign entity operating in the virtual asset market or a self-custody wallet whose private key is held exclusively by the owner.

According to ConJur’s interpretation, the hold is strictly precautionary, is meant for risk analysis, and does not amount to a permanent freeze of the virtual assets. The 24-hour period is a ceiling, and the institution may release the transaction earlier through a reasoned decision that takes into account, at a minimum, the risk profile of the client, the transaction, the counterparty, and the destination jurisdiction.

The measure also applies to transfers whose individual value or combined same-day value for a customer exceeds the equivalent of $10,000, although each institution’s risk management policies and structures may extend that threshold to lower amounts.

Regulatory scope and industry response

Resolução BCB No. 584/2026 covers the virtual asset services defined in Article 5 of Law No. 14.478/2022, including intermediation, custody, brokerage, and stablecoin-related services. In practice, the central bank is extending fraud-prevention requirements to a broader range of crypto products.

The rule triggered political and market reactions. A federal deputy filed a bill to overturn the 24-hour block on crypto transfers, while some players in Brazil’s crypto sector criticized the measure as potentially ineffective or excessive. Others defended it as a necessary consumer protection tool.

A regime that has been tightening for some time

The August resolution builds on a regulatory framework the central bank has been refining since 2025. Resolução BCB No. 520/2025, which governs the incorporation and operation of virtual asset service companies, defines functional PSAV categories for intermediation, custody, and brokerage, and requires internal security policies, risk management, rules for contracting relevant services, and segregation between proprietary assets and customer assets.

Other readings of the framework note that the regulation creates three provider categories, ties each one to authorization and minimum capital requirements, and turns authorization into a substantive process similar to that used for new financial institutions. According to market analysis, the minimum required capital can range from about R$ 10.8 million to R$ 37.2 million, depending on the category.

In the same vein, legal and consulting analyses describe Resolução BCB No. 580/2026 as classifying PSAVs as type 3 institutions, barring them from qualifying under segment 5 in a simplified manner, and setting a transition toward stricter prudential requirements. That increases demands for capital, risk management, and reporting for conglomerates led by virtual asset service providers.

Licensing, audits, and market exit

The licensing framework is also tied to a specific date. Brazil’s regime requires any company that allows clients to trade, custody, or transfer cryptoassets to file an authorization request with the Banco Central do Brasil by Oct. 30, 2026. That filing must include a reasonable assurance report issued by an audit firm registered with the securities regulator, certifying the effectiveness of anti-money-laundering and sanctions controls.

Audit firms and local consultancies say the authorization and operating requirements also include a physical office in Brazil, administrators subject to suitability criteria, fully paid-in minimum capital, proof of the lawful origin of funds, a biennial independent audit of customer asset segregation, robust anti-money-laundering and cybersecurity programs, adoption of the travel rule, and integration with the supervisor’s official reporting systems.

International analyses of the licensing regime also explain that Resolução BCB No. 520/2025 took effect on Feb. 2, 2026, and governs both service provision by entities already authorized by the central bank and the creation of new companies specifically for that purpose. Guidance from specialized law firms emphasizes that, without that authorization, companies must stop operating in the country at the end of the 2026 transition period.

In parallel, market reports indicate that foreign providers will have to move their Brazilian customers and operations to a domestically authorized entity within the transition period set by the central bank.