Entering into force on February 2, 2026

Brazil has officially implemented a comprehensive supervisory model for Virtual Asset Service Providers ("VASPs"), through Resolutions BCB 519, 520, and 521, published by the Central Bank of Brazil ("BCB") on November 10, 2025. This regulatory framework positions Brazil among the jurisdictions with the most robust and structured oversight of digital-asset activities.

Below is a high-level summary of the key changes and requirements.

  1. Scope and Definition of "Virtual Assets"

The new rules adopt a broad and functional definition of virtual assets as digital representations of value used for investment or payments and transferable electronically.

Excluded: local and foreign currency, electronic money (Law 12,865), loyalty points, and assets already regulated under other frameworks (e.g., securities).

Included:

  • Stablecoins (virtual asset referenced in fiat)
  • Reserve assets supporting the stablecoin
  • Virtual-asset wallets enabling access and authorization of transactions on DLT-based systems

  1. Licensing Categories for VASPs

VASPs must obtain authorization under one of three categories:

  • Virtual-Asset Intermediaries
  • Virtual-Asset Custodians
  • Virtual-Asset Brokers (intermediation + custody as corporate purpose)

Importantly, intermediaries and custodians cannot cumulatively perform activities that fall under other VASP categories.

  1. Key Activities Under Each License

Intermediaries

May perform, among others:

  • underwriting of virtual-asset issuances
  • buying, selling, and exchanging virtual assets
  • portfolio management involving virtual assets and traditional financial instruments
  • acting as trustee
  • staking operations
  • FX transactions involving virtual assets
  • advisory and structuring services for virtual-asset offerings
  • market-making and liquidity-provision activities

Custodians

Responsible for:

  • safeguarding private keys
  • maintaining updated positions by client
  • executing movement instructions
  • processing events related to virtual assets
  • managing information relating to rights associated with the asset

  1. Corporate Structure and Governance Requirements

VASPs must:

  • be organized as a Brazilian Ltda. or corporation
  • adopt a corporate name including "Sociedade Prestadora de Serviços de Ativos Virtuais"
  • designate at least three officers responsible before the BCB for:
    • AML/CFT
    • internal controls & compliance
    • risk & capital management
    • cybersecurity & incident response
    • business conduct and operations

A single officer may accumulate functions if no conflicts exist.

Governance policies must be documented, approved at the highest level, and reviewed every two years.

  1. Minimum Capital Requirements

Minimum paid-in capital varies depending on the scope of services and technology infrastructure:

  • Base value: R$2M per operational category
  • Add-on: R$5M (up to R$10M cap) for services requiring processing, storage, network and cybersecurity infrastructure
  • Activity component (per category):
    • R$1M – service activities
    • R$3M – custody
    • R$5M – intermediation
    • R$7M – lending
  • Investment categories: R$5M (restricted) or R$8M (unrestricted)
  • Funding multipliers: 60% to 200% depending on type of funds used

The final capital requirement = cost component + activity component.

  1. Authorization Process (Two Phases)

The BCB authorization will occur in two stages:

Phase 1:

  • Verification that the company operated on the publication date
  • Compliance with incorporation rules
  • Evaluation of IT infrastructure, controllers, and capital/equity requirements

Phase 2:

  • Review of all remaining regulatory obligations
  • BCB may request audited financials and updated documents

BCB may also interview controllers and require independent technical assessments.

  1. Foreign Entities Operating in Brazil

Foreign VASPs operating in Brazil on February 2, 2026 have 270 days to:

  • transfer clients and operations to a Brazilian-regulated VASP, or
  • incorporate a new Brazilian entity to assume local operations.

During the transition, foreign entities must guarantee continuity, security, transparency, client consent, proper segregation, and compliance with data-protection and internal-control requirements.

If the transfer is not completed within 270 days, operations must cease.

  1. Restriction on Interactions with Unauthorized VASPs

Beginning October 30, 2026, financial institutions, payment institutions, and all entities supervised by the BCB will be prohibited from conducting or facilitating any virtual-asset operations with counterparties that provide VASP services without BCB authorization (or without being in the authorization process).

This ban covers negotiation, intermediation, custody, FX involving virtual assets, opening/maintaining payment accounts, and payment transactions, among other activities.

  1. Additional Requirements and Restrictions

  • Management must reside in Brazil and meet "fit-and-proper" criteria.
  • Restrictions apply to who may hold control or qualified participation (limited to natural persons, BCB-authorized institutions, equivalent foreign institutions, or specific Brazilian holding entities).
  • Limited-liability VASPs must apply elements of the Brazilian Corporations Law (profit retention, reserves).
  • Headquarters must be in an exclusive-use physical space (no coworking).

  1. Why This Matters

The new framework:

  • Creates a clear path to regulatory authorization for VASPs;
  • Increases investor protection, transparency, and market integrity;
  • Aligns Brazil with global standards on AML/CFT, custody, governance, and capital adequacy;
  • Requires foreign players to become locally compliant;
  • Opens opportunities for new domestic and international players to structure compliant VASP operations in Brazil.

  1. How HNaves Advogados Can Assist Foreign Clients

HNaves Advogados has deep experience advising international financial institutions, fintechs, payment companies, and digital-asset businesses entering the Brazilian market. Our team assists foreign clients with:

  • Regulatory strategy and structuring for VASP operations in Brazil, including the evaluation of licensing models (intermediation, custody, brokerage).
  • Incorporation and onboarding of Brazilian entities, including governance design, officer appointments, internal policies, and capital-planning models.
  • End-to-end authorization processes before the Central Bank of Brazil, including preparation of filings, responses to technical inquiries, and support during interviews or independent assessments.
  • Cross-border migration of clients and operations, ensuring compliance with the 270-day transition period.
  • Drafting and implementation of governance frameworks, cybersecurity and incident-response policies, AML/CFT programs, risk-management structures, and contractual arrangements.
  • Market-entry planning, including regulatory mapping, corporate structuring, and alignment with securities, FX, data-protection, and tax requirements when applicable.

With expertise in both Brazilian and international regulatory environments, HNaves offers a fully integrated, high-specialization approach to support foreign groups in establishing compliant and efficient VASP operations in Brazil.