Crypto & Fintech
Brazil's new virtual asset regime turns AML/CFT into an operating layer for SPSAVs. The latest rules on self-hosted wallets make integrated onboarding, blockchain monitoring, systems and governance essential.
Marinho de Gusmão Team
·
Brazil's virtual asset framework goes well beyond the need to obtain authorization from the Central Bank of Brazil (BCB).
For exchanges, custodians and other virtual asset service providers, one of the most consequential aspects of the new regime is that anti-money laundering and counter-terrorist financing obligations (AML/CFT) now form part of the operating architecture itself.
As discussed in “Brazil SPSAV Licensing: Who Needs Central Bank Authorization?”, BCB Resolution No. 520 brought virtual asset service providers into an authorization and supervisory environment that covers governance, internal controls and regulatory reporting. In several respects, this framework is similar to the one that applies to other BCB-supervised institutions. The regulator itself emphasizes client protection, AML/CFT, governance, security and internal controls.
In September 2026, the framework was strengthened again. BCB Resolution No. 588 added transfers to or from self-hosted wallets equal to or above US$10,000 to the transactions subject to specific reporting to the Brazilian Financial Intelligence Unit (COAF). The rule took effect on 1 October 2026.
The practical consequence is clear: crypto compliance cannot be treated as a set of policies prepared only for an authorization filing. KYC, on-chain monitoring, alert management, transaction investigations and regulatory reporting must work within the platform's actual systems and workflows.
What changes for virtual asset companies under Brazil's AML/CFT framework?
BCB Resolution No. 520 requires virtual asset service providers to comply with the specific framework for preventing and combating money laundering, terrorist financing and proliferation financing.
The regime goes beyond a general reference to traditional AML/CFT rules. For virtual asset transactions, an SPSAV must be able to transmit information about the originator and beneficiary to the receiving institution, including identification data, the accounts involved and the virtual asset wallets used in the transaction.
The same framework requires adjustments to internal controls and risk policies, the identification of suspicious or irregular transactions, and the retention of transaction records for at least five years.
In practice, this brings crypto closer to a control logic already familiar to the financial system, with one important difference: part of the information needed for the analysis is not found only in customer records or banking flows. It is also on-chain, in the relationships among addresses, wallets, counterparties and protocols.
This is why applying a conventional banking manual to an exchange is rarely sufficient.
KYC and KYB do not end at onboarding
In virtual asset markets, customer due diligence must continue to reflect the risk of the relationship.
For individuals, this means properly identifying and qualifying the user, understanding their profile and assigning a risk rating that is consistent with the expected nature of their transactions.
For legal entities, KYB requires a broader review: business activity, ownership structure, ultimate beneficial owners, jurisdictions involved, source of funds, intended transaction profile and exposure to higher-risk countries or sectors.
The central point is not to treat onboarding as a one-time event. An account may be opened with complete and valid documentation and later develop a transaction pattern that is entirely different from the one that supported its initial risk classification.
In crypto, risk indicators may emerge from transaction behavior: a sudden increase in volume, activity inconsistent with the customer's economic profile, repeated use of certain counterparties, routing designed to reduce traceability or interaction with addresses associated with higher-risk activity.
The process must therefore operate as a cycle: identification → risk classification → monitoring → alert → analysis → decision → recordkeeping → regulatory reporting, where applicable. This is the chain that must be defensible before the regulator.
Monitoring must include the on-chain dimension
An AML/CFT program for virtual assets cannot look only at Brazilian real flows.
Consider a customer who makes a fully identified fiat deposit, converts the funds into virtual assets and then transfers those assets to several external wallets.
From a banking perspective, the initial flow may appear ordinary. The risk may emerge only after the assets move on-chain.
Depending on the business model and the risk identified, the analysis should consider the source and destination of the assets, the history of relevant addresses, relationships among wallets, exposure to higher-risk counterparties and patterns designed to reduce traceability.
This does not mean that every interaction with an external wallet is suspicious. It means the control framework must be able to distinguish ordinary behavior from activity that requires further investigation and must document the criteria used.
This capability is particularly important because BCB Resolution No. 520 requires internal controls and the risk framework to support the monitoring rules that apply to virtual asset transactions.
What changed for self-hosted wallets on 1 October 2026?
A self-hosted wallet is one in which the user directly controls the private keys used to move the assets, rather than leaving that control with an exchange or custodian.
BCB Resolution No. 588/2026 amended Circular No. 3,978/2020 and added transfers to or from self-hosted wallets equal to or above US$10,000 to the transactions subject to specific reporting to COAF.
The rule took effect on 1 October 2026. For this specific reporting obligation, the institution does not first need to conclude that the transaction is suspicious.
Two reporting logics must be distinguished. The existing framework already requires institutions to report suspicious transactions or situations following an analysis and a reasoned decision. Resolution No. 588 added an objective reporting trigger for transfers involving self-hosted wallets that meet the regulatory threshold.
Systems must therefore do more than monitor risk. They need to identify when the counterparty is a self-hosted wallet, calculate the transaction amount under the regulatory criteria and correctly trigger the reporting obligation.
Are self-hosted wallets now prohibited?
No. The new rule does not impose a general prohibition on transfers to or from self-hosted wallets.
It increases the traceability, identification and supervision of those transactions. The BCB explains that the specific treatment reflects the more limited information available when users directly control their private keys, compared with transactions in which assets remain with a regulated custodian.
This distinction also matters in client communications. Companies should not turn monitoring duties into a generic message that self-custody is prohibited. They should equally avoid assuming that a transfer to a self-hosted wallet falls outside the regulatory perimeter.
The appropriate treatment depends on the transaction, its value, the available information and the rules that apply to the relevant flow.
The Travel Rule becomes part of the operating model
Another material requirement concerns the information that must accompany transfers.
BCB Resolution No. 520 requires minimum originator and beneficiary information to be provided to the receiving institution in virtual asset transactions.
For the originator, this includes, among other data, the name or legal name, account identification, address, Brazilian tax ID or international equivalent, and the relevant wallet. Minimum identification and wallet information is also required for the beneficiary.
Internationally, this type of obligation is commonly associated with the Travel Rule.
For international operators, the challenge is not merely knowing that the information must be sent. Global systems, integrations with other VASPs, technology providers and internal workflows must be able to collect, validate, transmit and retain the data required for the Brazilian operation, including where the counterparty is in another jurisdiction.
This is a clear example of why compliance, technology and contracts must be designed together.
The US$10,000 threshold does not end in October: another change arrives in 2027
A second obligation involving self-hosted wallets must be distinguished from Resolution No. 588.
BCB Resolution No. 584/2026 introduced specific anti-fraud measures scheduled to take effect on 1 January 2027.
These measures include a precautionary hold of up to 24 hours for certain transfers above US$10,000 to foreign virtual asset market entities or self-hosted wallets, whether the threshold is met by an individual transaction or by the customer's aggregate activity on the same day, as well as other situations that require additional fraud-risk assessment.
These are different rules. From 1 October 2026, Resolution No. 588 creates the new COAF reporting trigger. From 1 January 2027, Resolution No. 584 adds a precautionary hold for further fraud-risk review in the circumstances it covers.
Conflating these obligations may lead to an incorrect operating design. Companies that are currently building or adapting systems should, however, prepare for both requirements in a coordinated way.
AML/CFT is also part of the SPSAV authorization process
Companies that were already carrying out activities covered by the new framework when BCB Resolutions No. 519 and 520 took effect must file phase 1 of their authorization process by 30 October 2026. The rules allow a justified extension request of up to sixty days, subject to the BCB's discretion.
BCB Normative Instruction No. 704 also requires active SPSAVs to submit a reasonable assurance report prepared by an independent audit firm registered with the Brazilian Securities and Exchange Commission (CVM). The regulatory scope includes reviews of AML/CFT policies, procedures and controls, regulatory reporting and transaction records.
This changes how compliance must be approached. A formally adequate policy is not enough. The operating structure must produce evidence that the controls work.
A policy may state that clients are classified by risk. The evidence shows how the classification is performed, in which systems, under which parameters, when it is reviewed and what decisions follow from it.
A policy may state that transactions are monitored. The evidence shows which scenarios generate alerts, how alerts are investigated, who approves closure and how decisions are recorded.
The transition from a document to a verifiable process is likely to be decisive in a genuinely supervised environment.
What should an SPSAV review now?
For active operators and companies in the authorization process, the AML/CFT review should be managed as a multidisciplinary project. Priority areas include:
program governance and a clear allocation of responsibility to the relevant director;
KYC and KYB, including ultimate beneficial ownership and risk classification;
customer data refresh criteria and periodic reviews;
fiat and on-chain transaction monitoring;
identification and treatment of self-hosted wallets;
configuration of the specific COAF reporting required by Resolution No. 588;
procedures to identify, investigate and document suspicious transactions;
collection and transmission of the originator and beneficiary data required by Resolution No. 520;
record retention and audit trails;
integration with blockchain analytics tools and other technology providers;
review of third-party contracts supporting KYC, custody, monitoring or transaction processing;
system readiness for the anti-fraud measures that take effect in January 2027; and
organization of the evidence that may be reviewed during the authorization process and by the independent auditor.
The objective is not to produce as many policies as possible. It is to build a structure in which the written policy matches the behavior of the systems and the day-to-day work of the teams.
Where operators are most exposed
The most material issues tend to arise in the gap between legal design and execution.
A program may appear complete and still fail if the blockchain analytics tool is not integrated into platform workflows; alerts are closed without a reasoned analysis; risk criteria are not updated; data required for reporting is unavailable; or a foreign group entity performs a significant part of the monitoring without clearly allocated responsibilities.
Another risk is the indiscriminate use of global policies. An international exchange may have a sophisticated AML program in its home jurisdiction and still need to adapt its procedures to the BCB's specific requirements, local banking flows and Brazilian reporting obligations.
Outsourcing tools also does not outsource regulatory responsibility.
The operator must still demonstrate why a solution was selected, which risks it addresses, where its limitations lie and how its outputs are incorporated into the institution's decisions.
Crypto compliance is now regulatory infrastructure
Brazil's new framework places AML/CFT within the core architecture of a virtual asset business.
KYC, KYB, blockchain analytics, wallet identification, the Travel Rule, alert management, COAF reporting and record retention are no longer peripheral compliance topics.
They affect authorization, banking relationships, technology, product design, contracts and the ability to remain under BCB supervision.
The October changes reinforce that conclusion. Since 1 October, transfers to or from self-hosted wallets equal to or above US$10,000 have been subject to specific COAF reporting. In January 2027, new anti-fraud measures will add further controls to certain cross-border and self-hosted wallet flows.
For operators, the question is no longer simply whether an AML/CFT policy exists.
The regulatory question is now whether the company can demonstrate, transaction by transaction, that its systems, people and controls actually perform what the policy requires.
That is the level of maturity Brazil's new regulatory environment now demands.
This article is for general information only and does not replace legal advice on a specific matter.
Related practice area: Crypto & Fintech.
Official sources
What changes for virtual asset companies under Brazil's AML/CFT framework?
SPSAVs operate under specific rules addressing money laundering, terrorist financing and proliferation financing. They must identify and qualify clients and companies, monitor fiat and on-chain transactions, transmit originator and beneficiary information, investigate alerts, retain records for at least five years and report transactions to the authorities where required.
Are transfers to self-hosted wallets now prohibited?
No. The framework does not prohibit self-custody. Since 1 October 2026, transfers to or from self-hosted wallets equal to or above US$10,000 are subject to specific COAF reporting, in addition to the risk-based monitoring that applies to other transactions.
Is every US$10,000 transfer to a self-hosted wallet considered suspicious?
No. The specific reporting obligation under BCB Resolution No. 588 is an objective requirement and is distinct from suspicious transaction reporting. The SPSAV must identify the wallet type, calculate the value under the regulatory criteria and submit the required report without automatically treating the transaction as unlawful.
What does the Travel Rule require from SPSAVs?
BCB Resolution No. 520 requires certain originator and beneficiary information to accompany virtual asset transfers. The operation must be able to collect, validate, transmit and retain identification, account and wallet data, including where the counterparty is in another jurisdiction.
Which controls take effect in January 2027?
From 1 January 2027, BCB Resolution No. 584 provides for a precautionary hold of up to 24 hours for certain transfers above US$10,000 to foreign virtual asset entities or self-hosted wallets, as well as other situations that require additional fraud-risk assessment.
How does AML/CFT affect the SPSAV authorization process?
The BCB and the independent auditor expect evidence that controls work in practice, not only formally adequate policies. Systems, monitoring parameters, alert management, decisions, records, governance and audit trails must be integrated into the operation and capable of being demonstrated.
Share this article