Crypto & Virtual Assets Compliance in Brazil

Brazil is open to crypto businesses, but only through a locally incorporated, BCB-authorised entity. Offshore models that serve Brazilian customers from abroad are no longer permitted, and from November 2026 the banking system enforces that line.

The BCB is the licensing and conduct supervisor for crypto services. COAF receives suspicious and threshold reports, the Securities and Exchange Commission of Brazil (CVM) regulates tokens that are securities, and the Federal Revenue Service collects monthly transaction data.

The biggest obstacle for a new entrant is the authorisation itself: a Brazilian company with at least three accountable directors resident in Brazil, an activity-based minimum capital, segregated client assets with published audits, and a full anti-money laundering (AML) programme in place before the first customer.

1. Who regulates this sector

Law 14.478 of 21 December 2022 requires prior federal authorisation for any virtual asset service provider and left the choice of regulator to the executive. Decree 11.563 of 13 June 2023 gave the BCB the power to regulate, authorise and supervise VASPs, while preserving the competences of the CVM and of consumer protection bodies. The Consumer Defence Code also applies to crypto operations (Law 14.478, art. 13). The FATF/GAFILAT mutual evaluation of December 2023 rated Brazil partially compliant on virtual assets (Recommendation 15) because providers were then unregulated.

2. Licensing and authorisation

BCB Resolution 520 of 10 November 2025 [In force since 2 Feb 2026] defines three types of virtual asset service provider company (sociedade prestadora de serviços de ativos virtuais): an intermediary (buying, selling and exchanging crypto, portfolio management, staking, crypto services in the foreign exchange market), a custodian (safekeeping of private keys and client positions) and a broker, which combines both (arts. 4 to 10). Banks, securities brokers and dealers, and foreign exchange brokers (intermediation only) authorised for at least a year may also offer crypto services after 90 days' notice to the BCB (arts. 20 and 21).

Requirements

• A Brazilian limited company or corporation whose sole partner is not an individual, with “Sociedade Prestadora de Serviços de Ativos Virtuais” in its name and its type shown on its website and app (Res. 520, arts. 14 and 15).
• At least three directors accountable to the BCB for operations, AML and counter-terrorist financing (CFT), internal controls, risk and capital, and cyber security (art. 14).
• Controllers and managers of good repute, a lawful source of capital, a business plan, adequate IT and governance, and a headquarters address for the firm's exclusive use: coworking spaces and virtual offices are not accepted. Directors must reside in Brazil, and investment funds may not be controllers (BCB Resolution 519, arts. 2, 7 and 11).
• Minimum capital and net equity under Joint Resolution 14 of 3 November 2025, built from amounts per activity (R$ 5 million for intermediation, R$ 3 million for custody) plus an investment amount, multiplied by a factor for the funding sources the firm may use, plus R$ 2 million per activity for costs (arts. 8 to 10).

Firms already operating

Providers active on 2 February 2026 had until 30 October 2026 to file phase 1 of a two-phase application, which checks controllers' reputation and minimum capital; the phase 2 filing is due within 60 days of a favourable phase 1 decision (Res. 519, art. 26; Res. 520, art. 88; BCB Normative Instruction 704, arts. 9 and 10). All applicants must file an independent auditor's reasonable-assurance report on their AML controls (IN 704, arts. 5 and 10, as amended by IN 739). Timely applicants may keep operating; others must stop within 30 days (art. 88, §§ 6 and 7). Foreign entities had until the same date to transfer their Brazilian customers to a Brazilian provider or eligible institution (Res. 520, art. 23).

3. AML, KYC and customer due diligence

Virtual asset service providers are obliged persons under the AML law, Law 9.613 of 3 March 1998, art. 9, XIX (added by Law 14.478). They must identify customers and keep records for at least five years (art. 10), report to COAF without tipping off (art. 11) and register with their regulator. Resolution 520 requires providers to apply the BCB's AML rules (arts. 44 and 87), which are set out in BCB Circular 3.978 of 23 January 2020, as amended most recently by BCB Resolution 591 of 30 September 2026.

Know your customer

Identification, qualification and risk classification of every customer, with reinforced measures for higher-risk categories and a director-approved manual (Circular 3.978, arts. 13 to 20). No business relationship may start before identification and qualification are complete; only missing qualification data may be completed within 30 days (art. 23).

Beneficial ownership and PEPs

Corporate customers are traced through the ownership chain to the natural person, using a risk-based threshold no higher than 25% (arts. 24 and 25). PEP status, and that of family members and close associates, must be checked; starting the relationship needs a decision by someone more senior than the approver (art. 19). Checks must include the national PEP register (CNPEP) on the Transparency Portal (Law 9.613, art. 12-A).

Monitoring and suspicious reports

Selection within 45 days, analysis within 45 more, and a report to COAF by the next business day after deciding to report (arts. 39, 43 and 48).

Threshold reports

Cash operations of R$ 50,000 or more and, since Resolution 591, cash foreign exchange and transfers to or from self-hosted wallets of US$ 10,000 or more go to COAF by the next business day (art. 49). Operations from 1 October to 31 December 2026 are reported on the first business day of January 2027.

Know-your-customer data must be kept for ten years after the relationship ends (Circular 3.978, art. 67); Resolution 520 adds a five-year minimum for transaction records (art. 45).

4. Identity verification and onboarding

The anchor of Brazilian onboarding is the taxpayer number. The minimum identification data are full name and CPF for individuals, and company name and CNPJ for legal entities (Circular 3.978, art. 16, § 2, as amended by BCB Resolution 119). Providers must obtain, verify and validate the authenticity of identification data, comparing it with public and private databases where necessary (art. 16, § 1). Non-residents who are not required to hold a CPF may be identified with a travel document, recording the issuing country, number and type (§ 3).

Qualification adds the place of residence and the customer's financial capacity, including income, with verification depth set by risk (art. 18). On top of the AML rules, Resolution 520 requires a suitability profile covering the customer's familiarity with crypto, financial interests and risk tolerance, with a specific risk acknowledgement for operations outside that profile (arts. 58 and 59). The provider's authorisation status and the absence of deposit guarantee cover must be shown before the contract is signed (arts. 54 and 68).

The BCB rules do not prescribe a particular remote method, such as document plus selfie, liveness detection or chip reading, and set no technical standard for them. The choice is left to the provider's risk assessment, which must cover all distribution channels and new technologies (art. 10).

5. Digital channels: what's different

Bottom line: customer due diligence is channel-neutral, but what a crypto customer can do with verified funds is not: transfers to self-hosted wallets and foreign platforms carry identification, reporting and, from 2027, holding duties.

Self-hosted wallets

Transfers to or from self-hosted wallets are classed as foreign exchange market operations, and the provider must identify the wallet's owner and have documented processes to verify the origin and destination of the assets (BCB Resolution 277, art. 76-A, § 5, inserted by BCB Resolution 521). Transfers of US$ 10,000 or more are reported to COAF (Circular 3.978, art. 49, V). From 1 January 2027, BCB Resolution 584 [Adopted, effective 1 Jan 2027] requires providers to wait 24 hours after receiving funds before executing a transfer to a self-hosted wallet or a foreign crypto entity when it exceeds US$ 10,000, alone or in the day's total, or when the provider's risk criteria call for a review. The customer must be told the hold is precautionary; the provider then releases or rejects the transfer, and may release early only on a documented decision (Resolution 142, art. 2-B, as amended).

Travel rule

For each transfer, the provider must pass to the receiving institution the originator's name, account, address, CPF or CNPJ (or a foreign equivalent) and wallet, and the beneficiary's name, account and wallet (Res. 520, art. 44) [Phased]. Exchanges between Brazilian providers must be in place by 2 February 2027 and cross-border exchanges by 2 February 2028; until then providers may rely on documented customer self-declarations and a risk-based review (art. 89).

6. Data protection and biometrics

The Brazilian Data Protection Law (LGPD), Law 13.709/2018, applies to onboarding data. Biometric data linked to a person are sensitive personal data (art. 5, II). Face matching needs no consent where indispensable to meet a legal or regulatory obligation or to prevent fraud in electronic identification and authentication (art. 11, II, a and g); otherwise specific, highlighted consent is required (art. 11, I). Retention to meet a legal obligation, such as Circular 3.978's ten years, is permitted (art. 16). ANPD fines reach 2% of Brazilian turnover, capped at R$ 50 million per infringement (LGPD, art. 52).

7. Sector-specific obligations

Segregation and proof of reserves

Client crypto must be held in wallets separate from the provider's own, with documented proof-of-reserves methods and a published independent audit every two years (Res. 520, arts. 29 and 30). A provider may keep its own assets in client wallets only to meet immediate liquidity needs, capped at 5% of client holdings.

Listing and stablecoins

Assets may be listed only under published selection criteria (art. 64 and Annex). For fiat-referenced stablecoins, providers must assess reserves, the issuer's audited statements and risk ratings, and may not offer stablecoins whose reserves are controlled by algorithms (art. 65). Buying or selling crypto against foreign currency is prohibited (Res. 277, art. 76-A, as amended by Res. 521).

Tax reporting

Normative Instruction RFB 2.291 of 14 November 2025 created the DeCripto return, aligned with the OECD Crypto-Asset Reporting Framework. It covers Brazilian providers and foreign providers serving Brazil, for example through a “.br” domain, Pix or advertising aimed at Brazilians (art. 5). Since 1 July 2026, every operation, including transfers to self-hosted wallets, is reported by the last business day of the following month, with year-end balances by the end of January (arts. 6, 7, 12 and 19). Providers must obtain a tax-residence self-certification from each new customer and check it against their KYC records (Annex II, items 28 to 32). Inaccurate or missing information is fined 3% of the operation's value (art. 13).

8. Risk indicators and red flags

Crypto onboarding and transaction red flags

• Shared digital fingerprints: the same email or IP address used by unrelated customers (BCB Circular Letter 4.001, art. 1, III, k and l).
• Unverifiable identity: information that is hard to verify or conflicts with public records (III, c and m).
• Threshold avoidance: transfers kept just below reporting limits (IV, b).
• Obfuscation tools: flows through mixers or tumblers, which Res. 520 forbids providers to use (art. 90).
• Sanctioned addresses: exposure to sanctioned wallet addresses at home or abroad (Res. 520, art. 34).
• Fast cash-out: fraud proceeds converted to crypto or stablecoins and sent abroad or to self-hosted wallets, the risk the BCB cited for Res. 584 (Vote 90/2026).
• FX arbitrage laundering: crypto bought with foreign currency through arbitrage schemes to move funds abroad, a case in the 2023 FATF/GAFILAT evaluation (Box 3.5).

9. Enforcement and penalties

• AML law. Failures to identify, keep records or report can lead to a warning, a fine of up to twice the transaction value, twice the actual or presumed profit, or R$ 20 million, disqualification of managers for up to ten years, and suspension or withdrawal of authorisation (Law 9.613, art. 12).
• BCB sanctions. Law 14.478 (art. 7, III) applies the BCB's sanctioning law, Law 13.506 of 13 November 2017. Its fines can reach the greater of 0.5% of the previous year's financial revenue or R$ 2 billion (art. 7), alongside public reprimand, activity bans, disqualification and loss of authorisation (art. 5).
• Criminal law. Law 14.478 added crypto fraud to the Penal Code (art. 171-A), punishable by four to eight years' imprisonment, raised money laundering sentences by one third to two thirds where virtual assets are used (Law 9.613, art. 1, § 4), and brought crypto providers within the law on crimes against the national financial system.

Operating without authorisation is the most immediate risk: non-applicants must stop, and regulated institutions may not serve them (Res. 520, art. 91). The BCB's list, updated 6 November 2026, shows 120 applicants: one refused, the rest under examination. In April 2026 the CVM narrowed a stop order against the OnilX group to exclude crypto intermediation, which it said falls outside its remit (CVM Declaratory Act 25.300).

10. Recent changes and what to watch

• 2 February 2027 and 2 February 2028[Adopted, phased]: travel rule data exchange becomes mandatory domestically, then internationally (Res. 520, art. 89).
• 31 March 2027[Adopted, effective 31 Mar 2027]: VASP companies must let individual customers choose which products they accept targeted marketing for (Res. 602).
• 1 January 2027[Adopted, effective 1 Jan 2027]: 24-hour hold on transfers above US$ 10,000 to self-hosted wallets or foreign platforms (Res. 584), and prudential rules for VASP companies, in segment S4 until June 2028 (Res. 580).
• 9 November 2026[In force]: the BCB began publishing the list of applicant providers, which may operate while their requests are examined, and of authorised institutions offering crypto services. Inclusion is not authorisation.
• 6 November 2026[In force]: regulated institutions may no longer deal with crypto providers the BCB has not authorised (Res. 520, art. 91, as amended by Res. 589).
• 3 November 2026[In force]: crypto services classed as foreign exchange are reported to the BCB by the fifth of the following month (Res. 574).
• 30 October 2026[Deadline passed]: application deadline for providers already active (IN 704, art. 9).
• 1 October 2026[In force]: cash foreign exchange and self-hosted wallet transfers of US$ 10,000 or more reported to COAF; fourth-quarter 2026 operations reported in January 2027 (Res. 591).
• 2 September 2026[Bill, not enacted]: a Senate committee approved Bill PL 1.536/2023, which would write client asset segregation and minimum capital into Law 14.478; it awaits a rapporteur in the Economic Affairs Committee.
• 1 July 2026[In force]: DeCripto monthly reporting replaced the 2019 crypto return and extends to foreign providers serving Brazil (IN RFB 2.291).

11. What this means for identity verification

• CPF first. Key resident customers to a validated CPF, with a travel-document route for non-residents.
• Method is a risk decision. No remote method is mandated, so document checks, face match and liveness must be justified in the risk assessment and KYC manual.
• Wallet-level identity. Identify self-hosted wallet owners and build transfer flows for reporting, travel rule data and the 2027 hold.
• Tax residence. Capture a tax-residence self-certification at onboarding for DeCripto.
• Retention and lawful basis. Keep onboarding evidence for ten years after the relationship ends, relying on the LGPD's legal-obligation and fraud-prevention bases for biometric data.