Picture a Monday stand-up at a São Paulo exchange. The compliance lead opens with three bullets: Resolution 520 is live, 580 just raised the prudential bar, and a 24-hour hold on big stablecoin transfers might land soon. Operations sigh. Legal reaches for coffee. Everyone knows the crypto business in Brazil just shifted for good.
That’s where we are. The Central Bank of Brazil now sits squarely over virtual-asset service providers. If you run a platform here — or serve Brazilian users from abroad — the rulebook isn’t a side document anymore. It’s the main story.
Let’s unpack what changed, what’s being proposed, and how both companies and users should navigate the next few months.
Brazil has pulled crypto into its mainstream financial perimeter. The Central Bank of Brazil (BCB) formally set out the authorization and supervision regime for virtual-asset service providers (VASPs), called PSAVs in Portuguese. The core rule, Resolution BCB No. 520, took effect on 2 February 2026, laying out how players get licensed and how the Bank will oversee them. The Bank followed up by classifying PSAVs as Type 3 institutions for prudential supervision via Resolution BCB No. 580 on 1 July 2026, with transitional mechanics that tighten how groups led by PSAVs are supervised until dates the rule specifies. See the BCB’s note and text for the official framing: Banco Central do Brasil (press release) and Resolução BCB nº 580/2026.
Brazil isn’t banning crypto; it’s domesticating it — pulling exchanges and custodians into a prudential regime that looks and feels like mainstream finance.
Who’s affected? Local exchanges and custodians, wallet providers with Brazilian users, fintechs that touch crypto rails, and foreign platforms that onboard Brazilians. Tokens that qualify as securities remain within the CVM’s orbit, but spot crypto and most platform activity now answer to the Central Bank.
Inside the new BCB rules: 520 and 580 in plain English
There are two pillars to understand: authorization to operate (Resolution 520) and how you’ll be supervised once you’re in the system (Resolution 580).
Authorization: who can legally serve Brazilians
Resolution 520 establishes the authorisation gate and ongoing supervisory expectations. The Bank’s press note makes it clear: if you’re providing virtual-asset services in Brazil, you need to be in the Central Bank’s line of sight as a PSAV/VASP. Foreign platforms with Brazilian activity are expected to regularize a local presence or migrate local customers to an authorized Brazilian entity during the transition window.
Prudential classification: how hard the guardrails are
Resolution 580 classifies PSAVs as Type 3 institutions for prudential supervision. In practice, that signals capital, governance, risk, and reporting standards that are tighter than a casual startup regime. The rule also sets transitional and segment deadlines, including stricter treatment for PSAV-led prudential conglomerates until specified dates, so groups can’t sidestep requirements by sitting crypto in a lightly supervised affiliate. See the rule: BCB 580.
What materially changes for operators
There are two pillars to understand: authorization to operate (Resolution 520) and how you’ll be supervised once you’re in the system (Resolution 580).
Topic Before BCB 520/580 After BCB 520/580 License status Patchwork. AML registration and best-effort compliance; no full prudential license specific to VASPs. Formal authorization required as PSAV under Central Bank supervision per BCB note. Prudential category Unclear category for crypto-only firms. PSAVs designated Type 3 institutions, with transitional, stricter segment treatment for PSAV-led groups per BCB 580. Group supervision Conglomerate rules not tailored to crypto-led groups. Prudential conglomerates led by PSAVs receive stricter oversight until deadlines in the rule. Consumer asset handling Market practice; segregation not uniformly specified. Stronger expectations on segregation, safeguarding, and disclosures as part of authorization and ongoing oversight. Cross-border/self-custody flows Standard AML/monitoring; no crypto-specific 24h hold. Proposal (under consultation) to allow up to 24h holds for reviews when totals hit US$10k same day; not final yet (Investidores Brasil).
Getting authorised: what a VASP must line up
The authorisation pack won’t read like a seed-stage deck. Expect something closer to a bank-lite application, tuned for crypto rails. Exact checklists belong to the Central Bank’s process, but if you’re planning, here’s the general flow that aligns with how Brazilian supervised institutions typically onboard.
Map your legal footprint. Decide whether you’ll form a Brazilian entity or partner with an authorised PSAV to serve local users. Foreign platforms need to regularize or exit Brazilian retail.
Assemble governance. Name accountable directors, an independent board or advisory oversight, and a designated compliance and risk head with real authority.
Design your safeguarding model. Detail how client assets are segregated, how wallets are managed (hot/cold), who has signing authority, and how you reconcile balances daily.
Put monitoring on rails. Implement transaction monitoring tuned to crypto typologies, sanctions screening, travel rule connectivity where applicable, and case management with audit trails.
Prove resilience. Document cybersecurity posture, key management, vendor risk controls, incident response, disaster recovery, and business continuity tests.
Capital and liquidity. Prepare to evidence financial resources in line with Type 3 expectations. That means buffers and reporting cadence, not just runway.
Customer treatment. Set transparent fee schedules, clear risk disclosures, complaint handling, and a user support channel consistent with Brazilian norms.
Regulatory reporting. Build the data pipes to file periodic reports on operations, risk, and prudential metrics according to Central Bank formats and timelines.
Local presence vs. partnering
A local license is the cleanest route for full retail access. Some foreign firms may instead white-label through an authorised Brazilian PSAV. It’s workable, but you still inherit due-diligence and oversight burdens. If you market directly to Brazilians or touch their funds, expect the Central Bank to expect accountability.
What to expect in reviews
The Bank will look for substance over slides. Do the people in charge have experience in financial risk and crypto infrastructure? Are you actually segregating assets, or just saying so? Can you pause suspicious flows quickly? Systems, not promises.
The 24-hour stablecoin hold proposal and how it would work
There’s a separate, hot-button topic: a proposal to let VASPs hold certain crypto transfers for up to 24 hours for risk review when the amount is large. According to reporting on the consultation, the measure would allow holds on transfers to self-custody wallets or destined abroad when a single transaction — or same-day aggregate — hits US$10,000. The consultation period closed in early July 2026, and the Bank is reviewing feedback. See coverage here: Investidores Brasil.
What users might notice
If adopted, users could encounter a short review delay when pushing large sums out to an external address or foreign venue. It’s not a freeze; it’s a timeout window to run enhanced checks. Below the threshold, normal speed. Above it, a pause for risk screens, source-of-funds lookbacks, and sanctions checks.
What platforms need ready
Two things: good thresholds and fast triage. If your rules fire too often, you’ll throttle legitimate flows and annoy customers. If they fail open, you’ll miss the point. Also note the aggregation rule: multiple same-day transfers that sum to US$10k or more could trigger a hold.
Key point: this is still a proposal. Don’t implement on rumor. Monitor the Central Bank’s final text if it proceeds.
Foreign platforms and Brazilian users: migration clocks are ticking
Brazil’s framework expects foreign VASPs with Brazilian activity to either regularize their presence locally or stop serving local customers, migrating them to an authorized Brazilian VASP within the transition timetable. Legal commentary and market practice guides flag 2026 milestones, with an October 30, 2026 target cited for certain transitions and operational changes. See an overview in the Brazil chapter from Chambers: Chambers and Partners.
What this means for users
Expect emails and in-app banners from foreign exchanges over the coming months. Some will open local entities and keep you in place. Others will ask you to move to a Brazilian partner or close positions. If you ignore the notices, you risk cutoffs at inconvenient times. Read them.
What this means for operators
Audit your user base. If you have non-trivial Brazil exposure, plan the migration path now: data portability, KYC portability within local law, asset transfer mechanics, and clear communications. Sloppy migrations create consumer harm and regulatory heat.
What this means for markets in 2026 and after
Short term, expect some friction. Onboarding slows as applications queue up. Banks and larger fintechs may feel more comfortable partnering with licensed PSAVs, which could pull liquidity toward compliant venues. Retail might notice tighter withdrawal checks, especially if the 24-hour proposal is adopted for high-value transfers.
Medium term, spreads could narrow on local books as institutional market makers enter with better comfort on counterparty risk. Insurance, custody, and audit providers will likely grow a Brazil desk. Internationally, Brazil joins the list of major markets with a defined crypto licensing path, alongside the EU’s MiCA and the UK’s FSMA crypto regime — different details, same direction of travel.
Key dates to keep in mind
Date What happened / may happen Why it matters Feb 2, 2026 Resolution BCB No. 520 takes effect Authorization and supervision of PSAVs is formally in force (BCB). Jul 1, 2026 Resolution BCB No. 580 published PSAVs classified as Type 3; transitional/segment deadlines set (BCB). Early Jul 2026 Consultation window closes on 24h hold idea BCB reviews feedback on US$10k stablecoin/crypto transfer holds (Investidores Brasil). Oct 30, 2026 Market-cited transition milestone Guides cite this as a target for certain foreign VASP migrations/changes (Chambers).
Risks & What Could Go Wrong
Approval bottlenecks. If application reviews pile up, smaller firms could be left in limbo, eroding competition.
Overcorrection on withdrawals. A blunt 24-hour hold regime, if adopted, could frustrate legitimate users and push volumes to informal channels.
Operational drag. Type 3 prudential demands raise costs; weakly capitalized startups may exit or cut product lines.
Migration mishaps. Foreign platforms could mishandle customer moves, creating stranded assets or tax surprises.
Perimeter gaps. DeFi front ends and P2P brokers might sit just outside the easy-to-supervise perimeter, inviting regulatory whack-a-mole.
Legal overlap. Boundary cases between spot crypto (BCB) and tokenized securities (CVM) can confuse disclosures and marketing.
Regulation reduces chaos, not risk itself. Poor execution can still create outages, user harm, and arbitrage into less safe venues.
Frequently Asked Questions
Does every crypto company in Brazil now need a Central Bank license?
Any business providing virtual-asset services in Brazil falls under the Central Bank’s authorization and supervision framework introduced by Resolution 520. Some edge cases remain (for example, tokens that are securities stay with CVM). If you have Brazilian users, assume you need to either be authorized as a PSAV or work through one.
What is a Type 3 institution and why should I care?
Under Resolution 580, PSAVs are slotted into the Type 3 prudential category. That drives expectations around capital, governance, risk, and reporting. In plain English: you need more structure and safety tooling than a lightweight fintech. It also affects how your wider group is supervised, especially during the transitional period.
Is the 24-hour hold on stablecoin withdrawals already in force?
No. It’s a proposal from the Central Bank’s consultation process, reported as allowing up to 24 hours of hold time for risk review when transfers to self-custody or abroad hit or exceed US$10,000 in a day. The consultation closed in early July 2026 and the Bank hasn’t published a final rule yet.
I use a foreign exchange app. Will I be forced to move?
Possibly. Brazil’s framework expects foreign VASPs with Brazilian activity to regularize locally or migrate customers to an authorized Brazilian PSAV within the transition timetable. Market guides point to October 30, 2026 as a key target for certain transitions. Watch for official notices from your provider.
What changes for custody of client assets?
Oversight tightens. Expect explicit segregation, wallet management standards, reconciliation routines, and clearer disclosures under the authorization regime. You should see cleaner statements and stronger controls around who can move funds and how quickly exceptions are reviewed.
How will this affect trading spreads and liquidity?
Near term, some venues may slow onboarding or withdrawals while they adapt, which can widen spreads. Longer term, licensed PSAVs could attract deeper market maker participation and bank connectivity, which usually narrows spreads and improves fiat ramps.
What about P2P or DeFi?
Where an intermediary markets to Brazilians or custody touches Brazilian users, the Central Bank will expect accountability. Purely decentralized protocols are harder to supervise, but any front end or facilitator with Brazilian nexus should assume scrutiny. Don’t expect a free pass if you’re effectively operating like a VASP.
Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.