Crypto & Fintech
A practical guide to who needs SPSAV authorization in Brazil, the available regulatory categories and what the Central Bank reviews.
Marinho de Gusmão Team
·
Brazil’s virtual asset market has moved decisively into an authorization and prudential supervision phase.
Law No. 14,478/2022 established that virtual asset service providers may operate in Brazil only with prior authorization from the competent federal authority. Decree No. 11,563/2023 designated the Central Bank of Brazil, or BCB, to regulate, authorize and supervise these providers, while preserving the jurisdiction of the Brazilian Securities and Exchange Commission, or CVM, over assets that qualify as securities.
The regime was implemented primarily through BCB Resolutions No. 519, 520 and 521, effective since 2 February 2026. The rules created the Sociedades Prestadoras de Serviços de Ativos Virtuais, or SPSAVs, and brought virtual asset intermediation and custody within a dedicated regulatory perimeter.
For exchanges, custodians, brokers, digital asset platforms and international groups evaluating Brazil, the practical consequence is clear: the authorization process starts before any application is filed with the BCB.
The first question is not which documents must be submitted. It is which activity will actually be carried out in Brazil and which entity, capital structure, governance model, technology and controls will support it.
Who needs an SPSAV license in Brazil?
Regulatory classification depends on the activities actually performed, not on the commercial label used by the company. The BCB looks at what the provider does on behalf of third parties and how asset and cash flows are structured.
BCB Resolution No. 520 created three SPSAV categories:
Virtual asset intermediary
Within the applicable limits, an intermediary may buy, sell or exchange virtual assets on behalf of third parties, manage certain portfolios, support staking activities and perform other services expressly permitted for this category.
Virtual asset custodian
A custodian safeguards and controls the instruments that allow rights over virtual assets to be exercised, including private keys. It also maintains and reconciles client positions and processes transfer instructions.
Virtual asset broker
A broker combines intermediation and custody within the same institution.
The distinction matters because intermediaries and custodians cannot simply combine activities assigned to other categories. The authorization must match the provider’s real operating model.
A generic description such as “crypto exchange” is therefore not enough. The analysis should identify who receives client orders, who executes trades, who holds the assets, who controls the keys, who settles each transaction, where the assets are located and which group entities participate in each step.
Does every crypto company need to incorporate an SPSAV?
Not necessarily. Resolution No. 520 allows certain institutions that are already licensed by the BCB to provide virtual asset intermediation and custody services, subject to the specific procedures and requirements that apply to them.
At least three scenarios should be distinguished:
a new company entering Brazil’s virtual asset market;
a crypto company that was already operating when the new framework took effect; and
an existing BCB-authorized institution adding virtual asset services to its business.
The applicable process, and especially whether the business may continue operating while the BCB reviews its file, is not the same in each case. This distinction is particularly relevant to fintechs, banks and financial groups that want to add crypto services without building an entirely separate operation.
Must an SPSAV be incorporated in Brazil?
Yes. The provider must be incorporated in Brazil and maintain its headquarters and management in the country, subject to Brazilian law and supervision. An SPSAV must be organized as a Brazilian limited liability company or corporation, and its principal corporate purpose must reflect the services allowed for the selected category.
Governance is no longer only a corporate law issue. Resolution No. 520 requires at least three directors or officers and a formal allocation of responsibility for the business, anti-money laundering and counter-terrorist financing, internal controls and compliance, risk and capital management, and cybersecurity, among other functions.
The legal name must include the Portuguese expression “Sociedade Prestadora de Serviços de Ativos Virtuais”, and the authorized category must be clearly disclosed through the institution’s channels.
For international groups, simply reproducing a structure used in the United States, Europe, Asia or another jurisdiction will not be enough. The Brazilian entity must meet local requirements for control, management, capital, technology and supervision.
What does the BCB review in an authorization application?
Authorization goes well beyond incorporating the entity and submitting corporate records. Resolution No. 519 includes the following requirements:
the controllers’ financial capacity;
the lawful origin of funds used as capital;
the economic and financial viability of the business;
technology infrastructure consistent with the complexity and risks of the operation;
an adequate governance structure;
the reputation of directors, controllers and qualifying shareholders;
the management team’s technical knowledge and experience;
compliance with minimum capital and net worth requirements; and
physical headquarters that meet the regulatory standard.
The headquarters requirement deserves practical attention. As a rule, the premises must be effectively and exclusively used by the institution. A coworking space, virtual office or other shared location will generally not qualify, except for the specific case of institutions within the same financial conglomerate.
The BCB may also request further information, interview controllers and directors, and require certifications or independent assessments. The operating model must be defensible before the application is filed.
What should be in place before filing?
In practice, an authorization project should begin with a regulatory map of the operation, not with forms.
Business model and regulatory perimeter
The company should define the products it will offer, whether it will trade, intermediate, custody, support staking, use stablecoins or conduct cross-border transactions, and whether any product may qualify as a security under the CVM’s jurisdiction.
Corporate structure, capital and financial planning
The ownership chain, ultimate beneficial owners, qualifying investors, source of funds and regulatory capital must be consistent with the chosen category, the activities to be performed and the risk profile.
Governance
Regulatory responsibilities must be assigned to directors with the appropriate qualifications and the practical ability to perform their roles.
Custody and technology
The provider must determine who will control the assets, which wallet architecture will be used, how segregation and reconciliation will work, which services will be outsourced and which providers will be located outside Brazil.
AML/CFT and transaction monitoring
KYC, KYB, beneficial ownership, transaction monitoring, self-hosted wallets, sanctions screening, alerts and reporting to COAF must be integrated into the actual operation.
Contracts, cybersecurity and business continuity
Client agreements and arrangements with custodians, liquidity providers, cloud providers, foreign exchanges and group companies must align with the Brazilian entity’s regulatory responsibilities. Data recovery, incident management and controls must also reflect the nature of the assets and the risks involved.
The authorization application is therefore the consequence of a structure that has already been organized.
How does the process work for existing operators?
SPSAVs that were already carrying out regulated activities on 2 February 2026 fall under the transition regime and must file phase 1 of the authorization application by 30 October 2026. BCB Normative Instruction No. 704 sets out the relevant procedures and documents.
Phase 1 reviews initial requirements concerning the operating company, its control structure, reputation and compliance with the applicable capital requirements.
Following a favorable BCB decision, phase 2 addresses the remaining regulatory requirements in greater depth, including financial capacity, source of funds, business viability, governance and technology. Normative Instruction No. 704 provides up to sixty days from the favorable phase 1 decision to submit the next stage of the file.
The transition does not allow a company to keep operating exactly as before while it waits. During the adjustment period, providers become subject to specific BCB reporting obligations covering clients, balances, custody, proof of reserves and staking, where applicable.
What changed in September 2026?
On 23 September 2026, the BCB issued Resolutions No. 588 and 589.
Resolution No. 589 adjusted supervisory reporting rules and moved to 6 November 2026 the restriction preventing banks, payment institutions and other BCB-authorized institutions from carrying out or facilitating certain virtual asset transactions with providers that are neither authorized nor in the authorization process.
Resolution No. 588 strengthened AML/CFT reporting. From 1 October 2026, transfers to or from self-hosted wallets equal to or above US$10,000 must be specifically reported to COAF.
These changes confirm that licensing cannot be treated as an isolated event. The institution must be prepared for continuous supervision and an evolving regulatory environment.
What about a foreign company that has not yet entered Brazil?
A new entrant must generally obtain the relevant authorization before beginning regulated services. The 270-day transition was designed for companies that were already active when the framework took effect. It is not a general window for a foreign operator to launch now and seek authorization later.
A market-entry project should therefore start with the Brazilian structure. Key questions include:
which group entity will control the Brazilian company;
who the ultimate beneficial owners will be;
how capital and funding will be structured;
which directors will hold the regulatory responsibilities;
which services will remain with foreign group entities;
where custody will be located;
how intragroup agreements will be structured;
which data and systems must remain accessible to Brazilian authorities; and
whether related activities also fall within foreign exchange, payments or capital markets rules.
Brazilian regulation permits international structures, but it does not allow the local company to operate as a shell while the regulated activity remains materially offshore.
Which issues tend to create problems in the authorization process?
A recurring mistake is selecting the regulatory category based on marketing rather than actual transaction flows. Another is adapting global contracts and policies without confirming that they reflect the Brazilian entity’s responsibilities.
Compliance cannot be treated as a stand-alone document exercise. A sophisticated policy is of little value if the systems cannot run the monitoring described, produce evidence, maintain an audit trail or support required reporting.
The same applies to custody. Outsourcing technology or using a foreign custodian does not remove the Brazilian institution’s responsibility. Resolution No. 520 includes specific rules on custody agreements, controls, audits, access to information and supervision, including in international structures.
Leaving capital, directors, audits and operating evidence until the final weeks is likely to turn a regulatory question into an execution problem.
An SPSAV license is not only a filing exercise
Bringing virtual assets within the BCB’s perimeter changes how a crypto business must approach Brazil. The objective is not simply to obtain a formal authorization.
The company must show that its business model, entity, controllers, capital, management, technology, custody, security, compliance and contracts work coherently under regulatory supervision.
For existing operators, the immediate milestone is 30 October 2026, the phase 1 filing deadline under the transition regime. For new entrants, the regulatory structure must be defined before operations begin.
In both cases, the central question is this: what operation will the company conduct in Brazil, and what must be structured for that operation to remain both authorizable and sustainable after authorization?
This article is for general information only and does not replace legal advice on a specific matter.
Related practice area: Crypto & Fintech.
Official sources
Law No. 14,478/2022 — Brazil’s Virtual Assets Legal Framework
BCB Resolution No. 520/2025 — incorporation and operation of SPSAVs
BCB Resolution No. 521/2025 — foreign exchange and international capital
BCB Normative Instruction No. 704/2026 — authorization documents and procedures
BCB Resolution No. 589/2026 — adjustments to the virtual asset framework
Who needs an SPSAV license in Brazil?
A company providing virtual asset intermediation or custody services on behalf of third parties within the BCB’s regulatory perimeter should assess whether it must be authorized as an SPSAV. The analysis follows the actual activities and transaction flows, not the platform’s commercial label.
Does every crypto company need to incorporate a new SPSAV?
No. Certain institutions already authorized by the BCB may provide virtual asset services under procedures specific to them. A new business without an existing license will generally need to structure the appropriate Brazilian entity.
Must an SPSAV have its headquarters and management in Brazil?
Yes. The entity must be incorporated in Brazil, maintain its headquarters and management in the country, and be organized as a Brazilian limited liability company or corporation with a corporate purpose consistent with its authorized category.
What is the deadline for providers that were operating on 2 February 2026?
They must file phase 1 of the authorization application by 30 October 2026. BCB Resolution No. 589 moved to 6 November 2026 the restriction on certain transactions between BCB-authorized institutions and providers that are neither authorized nor in the authorization process.
Can a foreign company start operating in Brazil during the transition period?
The transition was designed for providers that were already active when the new rules took effect. A new entrant must generally obtain the applicable authorization before launching regulated services in Brazil.
What does the BCB assess in an authorization application?
The review covers, among other matters, the controllers’ financial capacity, source of funds, business viability, governance, management suitability and experience, capital and net worth, technology, physical headquarters and consistency between the requested category and the actual operation.
Share this article