Brazil's New Crypto License: What VASPs Must Do Before October 29, 2026

For years, crypto companies could serve Brazilian users with little more than a local presence and a payment partner. That period is ending. The Central Bank of Brazil (BCB) now requires prior authorization for any company that provides virtual asset services to Brazilian clients. The window for existing operators to apply closes on October 29, 2026, and from November 6, 2026, Brazilian banks and other regulated institutions can no longer do business with crypto providers that aren't authorized.

If your company runs an exchange, a custody service, a crypto brokerage or a platform with Brazilian users, this deadline affects you directly. Here's what the new framework requires and what to do now.

‍

What changed

On November 10, 2025, the Central Bank of Brazil published three resolutions that put the country's crypto market under a full regulatory framework: BCB Resolutions 519, 520 and 521. They build on Brazil's crypto law, Law 14,478 of 2022, and Decree 11,563 of 2023, which named the Central Bank as the market's regulator. The rules took effect on February 2, 2026.

‍The latest update: on September 23, 2026, the Central Bank published Resolution 589, which amends Resolution 520. It sets November 6, 2026 as the date from which banks, payment institutions and other Central Bank-regulated institutions can no longer carry out or enable virtual asset operations with providers that aren't authorized to operate in Brazil. It also adds new reporting obligations from January 1, 2027, covering client balances, assets held in custody, proof of reserves and, where applicable, staking.

‍

What is an SPSAV?

The resolutions create a specific type of licensed company: the SPSAV, or Sociedade Prestadora de Serviços de Ativos Virtuais (Virtual Asset Service Provider Company). An SPSAV can be authorized in one or more of three categories:

• Intermediary: facilitates the purchase, sale or exchange of virtual assets on behalf of clients.
• Custodian: safeguards clients' virtual assets and private keys, keeps records and executes client instructions.
• Broker: combines intermediation and custody, similar to a full exchange.

Traditional financial institutions that are already authorized by the Central Bank can also offer some of these services under the new rules.

‍

Who needs authorization

Any company that intermediates, holds in custody or brokers virtual assets for clients in Brazil needs prior authorization from the Central Bank. That includes:

• Brazilian operators already in the market, which must apply during the transition window.
• Foreign platforms serving Brazilian clients, which, under Resolution 520, must transfer their operations and clients within 270 days to an authorized institution or to an SPSAV already operating in Brazil.

‍

What the license requires

The new framework treats crypto providers much like other Central Bank-regulated institutions. The main requirements include:

• Minimum capital, which depends on the activities the company performs. According to ANBIMA, Brazil's financial and capital markets association, it ranges from R10.8milliontoR37.2 million.
• Segregation of client assets from the company's own assets, both money and virtual assets, with documented procedures and proof-of-reserves mechanisms that show the provider holds the assets it reports on behalf of clients.
• Anti-money laundering and counter-terrorist financing controls proportionate to risk, including suspicious activity reporting and compliance with UN sanctions.
• Cybersecurity, risk management and governance standards comparable to those of financial institutions.
• Travel Rule compliance, in line with the standards of the Financial Action Task Force (FATF): identifying information about the sender and recipient must travel with each transfer. Compliance becomes mandatory for all authorized providers from February 2, 2028.
• Self-custody wallets: transfers to and from them are allowed, but providers must identify the users involved and verify the origin and destination of funds.

‍

Crypto and foreign exchange: Resolution 521

Resolution 521 brings crypto into Brazil's foreign exchange framework. International payments and transfers made with virtual assets, including stablecoins, are treated as foreign exchange operations and must follow the same rules as traditional ones. Among other points:

• SPSAVs can't carry out operations involving cash, in Brazilian or foreign currency, and buying or selling virtual assets with payment or receipt in foreign currency is prohibited.
• Providers must classify operations, identify overseas counterparties and report information on crypto-based FX operations to the Central Bank. These reporting rules took effect in May 2026.
• When the counterparty isn't an institution authorized to operate in Brazil's FX market, an SPSAV can make international payments or transfers with virtual assets of up to the equivalent of US100,000.SomeotherFX-authorizedinstitutionsthatalsoprovidevirtualassetserviceshaveahigherlimitofUS500,000.

‍

Key dates

‍

What happens if you miss the deadline

Under Resolution 520, providers that don't file their authorization request on time must stop providing virtual asset services within 30 days after the deadline. The Central Bank can also order a provider to cease operations within 30 days if its application doesn't meet the requirements. And from November 6, 2026, Brazilian banks and other regulated institutions can't work with providers that aren't authorized. For platforms with a meaningful Brazilian user base, that's not only a regulatory risk. It can mean losing the market and those client relationships.

‍

What to do now

1. Map your activities. Confirm whether what you do counts as intermediation, custody or brokerage, and which SPSAV category or categories apply.
2. Choose your route. Decide whether to apply for your own SPSAV authorization or to serve Brazilian clients through an already authorized institution.
3. Check the capital requirement. Make sure the Brazilian entity can meet the minimum capital for its category.
4. Prepare your compliance file. AML/CFT policies, client asset segregation, cybersecurity, governance and Travel Rule processes will all be reviewed.
5. Review your FX flows. If you process international payments or stablecoin transfers, confirm they fit the rules and limits of Resolution 521, and that your banking relationships can support them.
6. Plan the local structure. Foreign platforms need a Brazilian entity or partner. Our guide to opening a company in Brazil explains the main steps.

‍

How JJ Associates can help

JJ Associates supports crypto and fintech companies expanding into Latin America with company formation, corporate structuring, banking and compliance, as well as global payment solutions such as multi-currency accounts, payment gateways and wallet infrastructure. For Brazil, we help you assess whether the new rules apply to you, structure the local entity and coordinate with local counsel and banking partners so your application is complete from the start.

Schedule a consultation and our team will understand your specific situation and map out the right path forward.

‍

Frequently asked questions

What is an SPSAV in Brazil?

An SPSAV (Sociedade Prestadora de Serviços de Ativos Virtuais) is the type of company authorized by the Central Bank of Brazil to provide virtual asset services. It can operate as an intermediary, a custodian or a broker.

When is the deadline to apply for a VASP license in Brazil?

Existing operators have 270 days from February 2, 2026, which runs until October 29, 2026, to request authorization. Foreign platforms must transfer their Brazilian operations and clients to an authorized provider within the same period.

Do foreign crypto exchanges need a license to serve Brazilian clients?

Yes. Foreign platforms must move their Brazilian activities and clients to a locally authorized provider, either their own SPSAV or an authorized institution, within the transition period.

How much capital does an SPSAV need?

It depends on the activities the company is authorized to perform. According to ANBIMA, minimum capital ranges from R10.8milliontoR37.2 million.

Did the deadline change in September 2026?

The application deadline didn't change. Resolution 589 of September 23, 2026 set November 6, 2026 as the date from which banks and other regulated institutions can no longer operate with unauthorized providers, and added new reporting obligations from January 1, 2027.

Are stablecoin payments regulated in Brazil?

Yes. Under Resolution 521, international payments and transfers with virtual assets, including stablecoins, are treated as foreign exchange operations and must follow Brazil's FX rules.

Sources: Central Bank of Brazil Resolutions 519, 520 and 521 (November 10, 2025) and 589 (September 23, 2026); ANBIMA; Felsberg Advogados. This article is for general information and is not legal advice.

‍