Brazil’s Central Bank rolls out strict new crypto rules for VASPs

Capital requirements up to $7 million and mandatory audits could squeeze out smaller operators while consolidating Brazil's crypto market around established financial players.

Share

Add us on Google by Editorial Team Jun. 8, 2026

Brazil just drew a line in the sand for its crypto industry. The country’s Central Bank (BCB) published three new resolutions that impose demanding requirements on virtual asset service providers.

The rules, which take effect on February 2, 2026, require every exchange, custodian, and intermediary operating in Brazil to obtain prior authorization from the BCB.

What the new resolutions actually require

The regulatory package consists of Resolutions 519, 520, and 521, all published on November 10, 2025. Together, they create a framework that treats crypto firms less like tech startups and more like traditional financial institutions.

VASPs must now hold between R$10.8 million and R$37.2 million in capital, roughly $2 million to $7 million. That’s a significant jump from what was initially proposed during public consultations.

Advertisement

Beyond the capital bar, the resolutions mandate robust anti-money laundering and counter-terrorism financing protocols. That includes a phased rollout of the Travel Rule, the international standard requiring crypto firms to share sender and recipient information on transactions. Cybersecurity standards and asset segregation, meaning customer funds must be kept separate from company funds, are also baked in.

The framework also pulls virtual asset operations into Brazil’s foreign exchange regime. Transactions with non-authorized counterparties are capped at $100,000. Reporting of FX-related virtual asset transactions begins on May 4, 2026.

A subsequent Normative Instruction, No. 739, issued around May 2026, adds another layer: VASPs must undergo independent audits conducted by entities registered with the Comissão de Valores Mobiliários (CVM), Brazil’s securities regulator. Without that audit, no license.

Existing operators get a 270-day window to apply for authorization. If they don’t, they shut down.

The legal backstory

Brazil passed its foundational Virtual Assets Law, Law 14,478/2022, and a subsequent decree in June 2023 formally handed regulatory authority to the BCB. The three new resolutions are the operational teeth behind that legislation.

What this means for investors and the market

The most immediate consequence is consolidation. A $2 million to $7 million capital requirement removes the bar entirely for smaller operators who cannot meet it. Traditional banks and large brokerages already sitting on the required capital will have a structural advantage.

Asset segregation requirements specifically address the kind of risk that destroyed FTX customers, where company and client funds were commingled with disastrous results. Independent audits add another layer of accountability.

The $100,000 transaction cap with non-authorized counterparties adds friction to cross-border activity for institutional players accustomed to moving large sums.

Requiring CVM-registered auditors limits the pool of eligible firms, creating a bottleneck that could slow the licensing process. Investors should watch how many current operators actually complete the authorization process within the 270-day window versus how many simply exit the market.

Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.