Crypto & Fintech
Marinho de Gusm?o
·
Brazil has moved beyond regulatory uncertainty in virtual assets. In November 2025, the Central Bank of Brazil (BCB) issued Resolutions No. 519, 520 and 521, effective from 2 February 2026. Together with the Virtual Assets Legal Framework (Law No. 14,478/2022) and Decree No. 11,563/2023, they define who may provide services, under which conditions and through which authorization process.
For exchanges, custodians, service providers and foreign investors, the practical message is clear: the adjustment window is open, but it is time-bound. From 30 October 2026, BCB-authorized institutions may not transact with counterparties that are neither authorized nor in the authorization process. An operator that does not adapt risks losing access to Brazil's financial system.
The timeline that drives the decision
December 2022: Law No. 14,478 establishes the Virtual Assets Legal Framework.
June 2023: Decree No. 11,563 designates the BCB as the principal regulator.
November 2025: BCB Resolutions No. 519, 520 and 521 are issued.
2 February 2026: the authorization regime starts.
May 2026: reporting rules for qualifying foreign-exchange and stablecoin transactions begin to apply.
July 2026: DeCripto reporting to the Brazilian Revenue Service begins.
30 October 2026: deadline to file an authorization application and the critical date for access to the financial system.
PSAVs and SPSAVs: the distinction matters
PSAV is the broad Brazilian term for a virtual-asset service provider. It covers legal entities that, on behalf of third parties, intermediate, custody, transfer, trade or settle virtual assets. Existing BCB-authorized banks and securities firms may enter this activity subject to the applicable notice and regulatory requirements.
SPSAV is the corporate form designed for a company whose exclusive corporate purpose is providing virtual-asset services. It is the relevant form for exchanges, custodians and crypto brokers that are not already authorized financial institutions. The entity's name and corporate purpose must accurately reflect the regulated activity.
SPSAVs may act as intermediaries, custodians or brokers. That choice is not merely commercial: it affects capital, governance, technology and control requirements.
What must be in place for authorization
A Brazilian operating entity
An overseas institution serving Brazilian clients must transition the local operation and customer base to a BCB-authorized Brazilian PSAV, or to another authorized institution that meets the applicable rules. From the regulatory transition date, a purely offshore model is not a sustainable route to serving the Brazilian market.
Capital, segregation and governance
The applicable minimum capital follows the activities and risk profile of the institution under the BCB's prudential methodology. The business plan should address source of funds, financial capacity, operating viability, directors and controllers, and, where applicable, audited financial statements.
Client funds must be segregated from the provider's own assets through individualized payment or deposit accounts. This is central to auditability, proof of reserves and business continuity. It may require a redesign of pooled-liquidity or shared-wallet models.
Authorization also requires a real Brazilian headquarters, a credible management structure, clear evidence of directors' suitability and the required technical certification of the platform. Virtual offices and generic governance arrangements are not an answer to these requirements.
Activities that require a separate legal assessment
Resolution No. 520/2025 restricts PSAVs from extending credit to clients, raising funds from the public other than through share issuances, or using language that could mislead the public into thinking the provider conducts banking or investment-management activities. Yield, interest and remunerated-staking products should therefore be reviewed before launch.
Stablecoins and the foreign-exchange perimeter
Resolution No. 521/2025 brings certain virtual-asset transactions into Brazil's foreign-exchange and international-capital rules. The treatment of foreign-currency-referenced stablecoins depends on the flow, counterparties and settlement structure, but it has direct implications for operating models involving USDT, USDC and similar assets.
Monthly reporting: PSAVs may have to report qualifying transactions to the BCB, including information related to non-custodial wallets.
Counterparty controls: higher-value transactions require careful assessment of whether the counterparty is a properly authorized institution.
Cross-border corporate flows: stablecoins used between a foreign parent and a Brazilian operation require a foreign-exchange, registration and tax analysis before execution.
DeCripto and tax reporting
Brazil's DeCripto regime, established by RFB Normative Instruction No. 2,291/2025, aligns reporting with the OECD Crypto-Asset Reporting Framework. The information obligation is broader than a tax-payment obligation: Brazilian and foreign service providers operating with Brazilian clients may need to report even where no tax is due.
For investors, tax treatment may differ according to where assets are held and the nature of the transaction. The custody model, the investor's tax profile and the transaction trail should be assessed before relying on any exemption or rate.
Compliance is part of the operating model
PSAVs need a documented AML/CFT framework, ongoing customer monitoring, suspicious-transaction reporting through Siscoaf, risk assessments by customer and product, and a responsible officer. The rules also increase the importance of identifying holders of self-custodied wallets in relevant transfers.
Cybersecurity, technology outsourcing and information-security controls are equally material. Technical compliance and regulatory compliance are connected: a platform architecture that cannot evidence segregation, monitoring and traceability will not support the regulatory file.
A practical sequence for foreign operators
Incorporate the appropriate Brazilian entity and define its exclusive corporate purpose.
Structure the foreign investment and the required registrations.
Appoint a Brazil-based legal representative with adequate powers.
Fund the business at the capital level applicable to the intended services.
Prepare and file the BCB authorization dossier before the deadline.
Implement client-asset segregation, AML/CFT, KYC and cybersecurity controls.
Prepare BCB, COAF and Brazilian Revenue Service reporting flows.
Map the stablecoin and cross-border use cases before they go live.
Issues still developing
The framework will continue to develop around DeFi, tokenized financial assets, NFTs and utility tokens, and the tax treatment of stablecoin flows. Operators should track BCB and CVM consultations as part of their governance calendar rather than treat regulation as a one-time licensing exercise.
Conclusion
Brazil's virtual-asset market is now governed by an authorization, capital, governance and reporting framework. For foreign operators, the decision is not whether to adapt, but how quickly the local legal, technical and compliance structure can be put in place without compromising the business model.
This article is for general information only and is not a substitute for legal advice on a specific matter.
Official sources
Does a foreign exchange need a Brazilian company to serve Brazilian clients?
Under the transition to the authorization regime, an overseas operator must move the Brazilian operation and customer base to a BCB-authorized Brazilian PSAV or another authorized institution that meets the applicable requirements. A purely offshore model should not be assumed to remain viable after 30 October 2026.
How much capital is required to open an exchange in Brazil?
The applicable capital depends on the activities and risk profile of the PSAV, including whether it intermediates, custodies or combines both functions. Capital must be assessed against the current BCB prudential methodology and the authorization file.
What is DeCripto and when does it apply?
DeCripto is the Brazilian virtual-asset reporting regime under RFB Normative Instruction No. 2,291/2025. It begins in July 2026 and may apply to Brazilian and foreign providers serving Brazilian clients, even when there is no tax due on a given transaction.
Are stablecoins treated as foreign currency in Brazil?
Qualifying stablecoin transactions have been brought within Brazil's foreign-exchange and international-capital perimeter. The treatment depends on the facts of each flow, so settlement structures involving foreign-currency-referenced stablecoins require a specific legal and tax analysis.
Can a PSAV offer yield or remunerated staking products?
Products that may be characterized as raising funds from the public, extending credit or resembling regulated banking activity require careful review under Resolution No. 520/2025 before being offered.
What happens if the authorization application is not filed by 30 October 2026?
From that date, BCB-authorized financial and payment institutions may not transact with PSAVs that are neither authorized nor in the authorization process. In practical terms, this can affect banking access, payment processing and BRL settlement.
Share this article