Crypto & Fintech
What operating VASPs must prepare by 30 October 2026 to preserve continuity during the Central Bank authorization process.
Marinho de Gusmão Team
·
Virtual asset service providers that were already operating in Brazil on 2 February 2026 generally have until 30 October 2026 to submit the documents required for phase 1 of the Central Bank of Brazil authorization process. A timely filing may allow the provider to continue operating while the application is reviewed, but it is not an authorization and does not guarantee unrestricted access to financial infrastructure.
The transition regime is one of the most consequential aspects of Brazil’s virtual asset framework in 2026. For exchanges, custodians and other providers already in operation, the issue extends beyond obtaining a future license. It requires the business to establish whether it may continue operating, which conditions apply and how to manage the risks of a pending authorization process.
The distinction is equally relevant to investors and international groups considering the acquisition of a Brazilian operation, a corporate reorganization or market entry.
The answer requires a coordinated reading of Law No. 14,478/2022, BCB Resolutions No. 519 and 520/2025 and the supplementary rules issued in 2026, particularly those governing documentation, authorization deadlines and relationships with financial institutions. For a broader view of the regulatory perimeter, see our guide to SPSAV licensing and Central Bank authorization in Brazil.
What is the legal basis for the transition regime?
Article 9 of Law No. 14,478/2022 requires providers already conducting activities covered by the statute to adapt to the conditions established by the regulator. Decree No. 11,563/2023 designated the Central Bank of Brazil, or BCB, to regulate and supervise those activities.
In November 2025, the BCB issued Resolutions No. 519 and 520, which took effect on 2 February 2026. Resolution No. 519 governs authorization procedures, while Resolution No. 520 sets out the incorporation and operating requirements for Sociedades Prestadoras de Serviços de Ativos Virtuais, or SPSAVs, including transitional provisions.
The framework distinguishes providers already conducting regulated activities when the rules took effect from businesses seeking to launch later. Its purpose is to allow eligible pre-existing providers to enter the new regulatory perimeter without necessarily suspending operations throughout the administrative review.
That possibility is not a provisional license equivalent to final authorization. Continued operation arises from a specific transition rule, depends on the applicable eligibility conditions and remains subject to supervision and regulatory limitations.
Which companies may rely on the transition rules?
The primary timing requirement is the effective provision of activities covered by the rules on 2 February 2026. Article 26 of BCB Resolution No. 519/2025 establishes a differentiated procedure for companies active on that date, and BCB Normative Instruction No. 704/2026 requires a formal declaration of that status.
Incorporating the legal entity before that date is not enough. A company registered in 2025 that only began providing regulated services after February 2026 does not become eligible for the transition merely because its corporate registration predates the rules.
The legally relevant factor is the activity effectively performed by the applicant. The supporting record must therefore identify the entity responsible for the services, the nature of the activities conducted and how those activities correspond to the regulated categories.
Contracts, transaction records, operating documents and client information may be relevant evidence, depending on the business model. The declaration required in the application does not prevent the BCB from testing it against the underlying facts.
Foreign companies and international structures
For foreign groups, the analysis must distinguish the activity of a global platform from the activity that can legally be attributed to the entity seeking authorization in Brazil. The fact that an exchange operates in another jurisdiction does not, by itself, allow a Brazilian subsidiary to rely on the transition regime.
The review should cover the contracting entity, the entity effectively providing the services, functions performed abroad and the legal structure used for transactions connected with the Brazilian market.
The same reasoning applies to acquisitions and corporate reorganizations. Acquiring a pre-existing company does not automatically allow the buyer to rely on its regulatory position without complying with requirements applicable to changes of control and operating structure.
This distinction is particularly important where the valuation of an investment depends on the target’s ability to continue providing services during the authorization process.
What does the 30 October 2026 deadline mean?
Article 88 of BCB Resolution No. 520/2025 gives pre-existing providers 270 days from the effective date of the rule to apply for authorization. Article 9 of BCB Normative Instruction No. 704/2026 expressly identifies 30 October 2026 as the deadline for the phase 1 filing.
That date is not the deadline for the BCB to complete its review. Nor does it mean that every pre-existing provider must hold final authorization by the end of October.
Where all other requirements are met, a timely filing preserves the possibility of continued operation under the transitional provisions. Three legal situations should be kept distinct:
Timely filing by an eligible provider: possible continuity within the limits of the transition regime.
Authorization application under review: no final license, despite the applicable transitional status.
Favorable administrative decision after all requirements are verified: authorization granted.
Submitting documents is not the same as obtaining approval of the application. Inconsistencies in the evidence of pre-existing activity or in compliance with regulatory requirements may compromise the process even after filing.
The application should therefore be treated as a substantive legal and regulatory process, not as a formal exercise completed merely to meet a deadline.
How does authorization work for pre-existing providers?
Article 26 of BCB Resolution No. 519/2025 establishes a two-phase procedure.
In phase 1, the BCB reviews evidence of pre-existing activity, compliance with the reputation requirement in article 2, item VI, the conditions applicable to controllers and holders of qualified interests, and the requirement in article 2, item IX. The review therefore includes corporate, reputational and financial matters expressly identified in the rules.
BCB Normative Instruction No. 704/2026 specifies the required documents, including the declaration of pre-existing activity and information about the persons and structures subject to regulatory assessment.
Phase 2 covers the remaining authorization requirements, including financial viability, governance, technology infrastructure, internal controls and operational capacity.
Article 10 of BCB Normative Instruction No. 704/2026 requires phase 2 documents to be filed within 60 days after a favorable phase 1 decision. The BCB may grant an extension of up to 60 days upon a reasoned request.
BCB Normative Instruction No. 739/2026 added a requirement for a reasonable assurance report issued by an independent auditor registered with the Brazilian Securities and Exchange Commission, or CVM, in accordance with Annex IV to Normative Instruction No. 704. The report covers anti-money laundering and counter-terrorist financing controls, reinforcing the importance of effective controls during authorization.
BCB Resolutions No. 548 and 549/2026 also established parameters for administrative review periods. Those periods are distinct from the company’s filing deadline and do not produce automatic authorization when they expire.
Can the company continue operating while authorization is pending?
Article 88, paragraph 6, of BCB Resolution No. 520/2025 provides that virtual asset service providers that file the required application on time may continue providing those services until the authorization process is concluded.
The rule includes an express restriction: the provider may not assume another regulated category during that period. The transition may preserve existing activities where its conditions are met, but it does not allow the company to expand its regulatory scope without limitation.
This distinction matters to operators planning to add intermediation, custody or other activities subject to authorization.
Continued operation also depends on the company’s actual status as a pre-existing provider and compliance with the transition obligations. Filing an application does not turn an ineligible company into a legitimate participant in the regime.
What if the company misses the deadline?
Article 88, paragraph 7, provides that companies that fail to file on time must cease providing virtual asset services within 30 days after the regulatory deadline.
This rule should not be read as a 30-day operating grace period for new entrants. It is part of the transition regime for providers that were previously active.
Any shutdown must also address the company’s contractual and regulatory responsibilities, particularly where it holds client funds or virtual assets.
A company unable to establish eligibility for the transition must assess the ordinary authorization rules before starting activities subject to BCB supervision.
How does the transition interact with banking restrictions?
The transition regime and access to financial infrastructure are related but distinct legal issues.
BCB Resolution No. 589 of 23 September 2026 amended article 91 of BCB Resolution No. 520/2025. Under the revised provision, beginning on 6 November 2026, financial institutions, payment institutions and other BCB-authorized institutions may not conduct or facilitate virtual asset market transactions with counterparties that provide virtual asset services but are not authorized to operate in Brazil, except in the forms expressly permitted by regulation.
The amendment moved the original 30 October date and removed the express reference in the main provision to entities with pending authorization applications. The change requires careful interpretation.
Article 88, paragraph 6, allows certain pre-existing providers to continue offering services while their applications are reviewed. Article 91, in turn, imposes restrictions on financial institutions and other supervised institutions that enable virtual asset transactions. The provisions have different addressees and address different conduct.
A provider’s ability to continue operating during the transition does not necessarily require or authorize every financial institution to maintain any form of operational relationship with it. At the same time, the restriction directed at financial institutions should not automatically be read as repealing the transitional provision that permits eligible providers to continue operating.
The provisions must be applied together in light of the transactions involved, the relevant counterparties and the express exceptions. The sole paragraph of article 91 states that the restriction reaches, among other acts used to facilitate the transactions covered by the main provision, virtual asset trading, intermediation and custody, foreign exchange transactions, payment accounts and payment transactions.
The assessment should therefore extend beyond whether a bank account exists. It should consider the purpose of the relationship and its connection with the regulated operation.
Financial institutions’ own customer identification, anti-money laundering and risk management duties also remain relevant. Filing an authorization application does not automatically guarantee the opening or maintenance of accounts or access to financial services.
For businesses dependent on banking infrastructure, operational continuity requires a parallel review of regulatory, contractual and financial considerations.
Which obligations remain applicable during the transition?
The transition regime does not generally suspend the obligations created by the new framework. Article 88 of BCB Resolution No. 520/2025 imposes adjustment and information requirements on active providers. Each obligation must be assessed against its own effective date and specific conditions.
Relevant areas include capital and financial requirements, anti-money laundering, client protection, operating controls and information on transactions and virtual assets. The rules also impose duties related to custody, including identification, control and reporting requirements appropriate to the service provided.
Companies using foreign service providers may need to review technology, data processing, custody and material outsourcing agreements. Global compliance policies do not displace Brazilian requirements. See also our analysis of AML/CFT, KYC, KYB and self-hosted wallets under Brazil’s SPSAV framework.
It is also essential to distinguish obligations that apply immediately from those subject to their own implementation schedules. BCB Resolution No. 589/2026, for example, provides that certain changes related to regulatory reporting will take effect only on 1 January 2027.
The company should build its compliance plan around each obligation rather than assume that every requirement follows the same implementation deadline.
What are the consequences of denial or dismissal?
A timely application does not guarantee approval. BCB Resolution No. 519/2025 provides for applications to be dismissed or denied, including where the filing is deficient or the applicable regulatory requirements are not met.
Article 18 establishes duties for an operating provider after a final denial or dismissal, when no further appeal is available. The provider has 30 days from receipt of notice of the decision to adopt the prescribed wind-down measures.
Those measures include ceasing services subject to authorization, notifying clients and returning virtual assets and financial resources, as applicable.
The possibility of an adverse decision should be addressed from the outset. A provider that has custody of third-party assets must retain the capacity to identify clients, reconcile positions, execute transfers and preserve the records necessary to meet its obligations.
The risk also has a contractual dimension. Companies entering long-term contracts, undertaking continuing service obligations or making significant investments should account for the fact that authorization remains subject to administrative review.
In acquisitions, regulatory uncertainty may justify conditions precedent, specific compliance covenants and contractual risk allocation mechanisms.
What should companies and investors prioritize before October 2026?
The approaching deadline calls for an integrated assessment that goes beyond assembling documents for filing.
Confirm the company’s eligibility and identify the services effectively provided on 2 February 2026.
Test the consistency of the corporate and operating record, including information on controllers, officers, capital structure and phase 1 obligations.
Assess phase 2 requirements in advance instead of waiting for a favorable phase 1 decision to begin preparation.
Review relationships with financial institutions, payment institutions and infrastructure providers.
For international groups, identify the effective responsibilities of each entity, particularly where functions are outsourced or distributed across jurisdictions.
Prepare contingencies for additional regulatory requests, operating restrictions or an adverse administrative decision.
These measures allow the business to manage transition risk without assuming that authorization will necessarily be granted.
Final considerations
The 30 October 2026 deadline is a significant milestone for virtual asset service providers that were already active when the BCB framework took effect.
It sets the deadline for the initial documentation required under the transitional authorization process. It is not a date on which a license is granted automatically.
Article 88, paragraph 6, of BCB Resolution No. 520/2025 allows services to continue while the application is pending, subject to the applicable conditions, including the prohibition on assuming another regulated category.
That possibility must be considered alongside the broader regulatory obligations and the restrictions directed at financial institutions, particularly after the changes introduced by BCB Resolution No. 589/2026.
For companies and investors, the central issue is not merely whether an application is filed on time. It is whether the operation has the legal basis, corporate structure and operating conditions required to continue.
The transition therefore calls for a coordinated authorization, governance, financial infrastructure and risk management strategy that addresses both the course of the administrative process and its possible outcomes.
This article is for general information only and does not replace legal advice on a specific matter.
Related practice area: Crypto & Fintech.
Official sources
Law No. 14,478/2022 — Brazil’s Virtual Assets Legal Framework
BCB Resolution No. 520/2025 — SPSAV incorporation, operation and transition
BCB Normative Instruction No. 704/2026 — authorization documents and procedures
BCB Normative Instruction No. 739/2026 — reasonable assurance report
BCB Resolution No. 589/2026 — adjustments to the virtual asset framework
What is the authorization deadline for pre-existing VASPs in Brazil?
Providers that were effectively operating on 2 February 2026 must submit the phase 1 application documents by 30 October 2026 under BCB Normative Instruction No. 704/2026.
Can the company continue operating while its application is reviewed?
An eligible provider that files on time may continue the services covered by the transition regime until the process is concluded, subject to the other applicable conditions and without assuming another regulated category. This continuity is not a final license.
Does filing guarantee access to bank accounts and financial infrastructure?
No. Regulatory continuity and access to financial infrastructure are separate issues. An application does not require financial or payment institutions to open or maintain accounts and does not displace applicable restrictions or risk assessments.
What happens if the company misses the 30 October 2026 deadline?
A provider subject to the transition regime that fails to file on time must cease providing virtual asset services within 30 days after the deadline. This rule does not create an operating period for new entrants.
What happens if the application is finally denied or dismissed?
Once no further appeal is available, an operating provider has 30 days after notice to take the wind-down measures required by the rules, including ceasing services, notifying clients and returning virtual assets and financial resources, as applicable.
Share this article