On November 10, 2025, the Banco Central do Brasil (BCB) published three major resolutions — 519, 520, and 521 — establishing a comprehensive regulatory framework for virtual asset service providers (VASPs), officially termed “sociedades prestadoras de serviços de ativos virtuais” (SPSAVs).

This marks a historic milestone in Brazil’s journey toward implementing Law No. 14,478/2022, the country’s legal foundation for virtual assets, and positions Brazil among the most advanced jurisdictions in Latin America in providing legal certainty on how digital asset service providers can operate.

Scope of the New Resolutions

• Resolution 519/2025 – This resolution defines the authorization process for SPSVAs. It clarifies how entities must apply for approval by the BCB before engaging in virtual-asset services.
• Resolution 520/2025 – This key regulation governs how SPSVAs and other authorised institutions can operate within Brazil’s virtual-asset market. It covers the types of services, governance, risk management, anti-money-laundering (AML) and counter-terrorist-financing (CTF) obligations (including Travel Rule requirements), and transition provisions.
• Resolution 521/2025 – This resolution integrates virtual-asset activities into Brazil’s foreign-exchange (FX) regime. It recognizes operations such as cross-border payments, stablecoin transactions and transfers involving self-hosted wallets as falling under the FX regulatory framework in Brazil.

Who Can Operate in Brazil’s Virtual Asset Market?

1. Sociedades Prestadoras de Serviços de Ativos Virtuais (SPSAVs)

Under Article 4 of Resolution 520, SPSAVs must be authorized by the BCB and may be classified as:

• Virtual Asset Intermediaries — Entities facilitating the purchase, sale, exchange, and management of virtual assets, including staking and FX-related operations.
• Virtual Asset Custodians — Entities responsible for safeguarding assets and private keys, maintaining records, and executing client instructions.
• Virtual Asset Brokers — Entities performing both intermediary and custodial functions.

2. Eligible Authorized Financial Institutions

The following already-regulated financial institutions may also offer virtual asset services, provided they formally notify the BCB in accordance with the established procedures:

• Commercial, investment, and “bancos multiplos”, as well as Caixa Econômica Federal.
• Securities brokers, distributors, and foreign exchange dealers.

These are henceforth referred to as eligible authorized institutions.

Transition and Grandfathering: Preparing for Compliance

Institutions currently offering virtual asset services in Brazil must transition into the new regulatory regime established by the BCB. To ensure business continuity, the framework allows these entities to continue operating provided that they meet the following obligations by October 30, 2026 (270 days from the entry into force of Resolution 520 on February 2, 2026):

• Eligible authorized institutions (e.g., banks, brokers, distributors) must notify the BCB of their intent to continue providing virtual asset services.
• Other institutions currently providing virtual asset services must apply for authorization from the BCB to operate as SPSAVs.
• Foreign institutions offering virtual asset services to Brazilian clients must migrate their operations and customer base to either:(i) an eligible authorized institution, or
• (ii) an SPSAV already operating or established to carry out these activities.

To benefit from the grandfathering period, institutions must have already been offering virtual asset services before February 2, 2026.

After October 30, 2026, any institution that has not complied with the transition requirements will no longer be permitted to operate in Brazil’s virtual asset market and must cease operations within 30 days.

Finally, it is worth noting that Article 88 of Resolution 520 establishes an adjustment period between February 2, 2026 and the BCB’s decision on phase 1 of the authorization process, during which SPSVAs must demonstrate compliance with a defined set of obligations. These include:

• Implementing a risk-management framework covering market, credit (where applicable), operational, and liquidity risks.
• Maintaining a cybersecurity policy, an incident-response and action plan, and appropriate data processing, storage, and cloud-computing arrangements.
• Establishing internal controls to prevent the use of the Brazilian Financial System and Payment System for money laundering or asset-concealment crimes.
• Implementing procedures to comply with Law 13,810/2019 regarding UN Security Council sanctions.
• Adopting the accounting and audit standards applicable to financial institutions authorized by the Central Bank of Brazil.
• Complying with any additional requirements expressly imposed by regulation for institutions in the adjustment phase.

Once the aforementioned adjustment period has ended, SPSVAs must fully comply with the provisions of Law No. 14,478 of December 21, 2022, and with the regulations issued by the Central Bank of Brazil, even if no final decision has yet been made regarding their authorization request.

Travel Rule Implementation: Timeline and Requirements

Under Article 44 of Resolution 520, SPSAVs must comply with AML/CTF obligations and the Travel Rule, ensuring that identifying information accompanies virtual asset transfers.

Requirements

For each transfer, the originator’s institution must transmit data on both the originator and the beneficiary, as follows:

The resolution explicitly establishes the obligation to report suspicious activities and to notify the BCB of any difficulties in complying with the Travel Rule that stem from the practices adopted by counterparties authorized by the BCB.

Two-Year Phased Implementation

Travel Rule implementation will occur in two stages between 2026 and 2028, according to Article 89 of Resolution 520:

During both phases, SPSAVs may rely on self-declarations from clients to identify the transacting parties and the purposes of the transactions, provided these are documented and accessible to the BCB.

Full compliance will be mandatory starting February 2, 2028.

The illustration below provides an overview of the grandfathering timeline and the phased implementation schedule for Travel Rule requirements.

Self-Hosted Wallets and FX Integration

Resolution 521 defines self-hosted wallets (“carteiras autocustodiadas”) as wallets where the user controls the private keys without a third-party intermediary.

Under the resolution, the provision of services that include transfer to or from a self-hosted wallet is subject to Brazil’s foreign exchange (FX) framework, and SPSAVs are required to identify the wallet owner.

Key Takeaways

• Brazil’s Central Bank (BCB) is assuming full regulatory responsibility for the country’s virtual asset ecosystem, establishing clear rules for authorization, operation, and supervision.
• A grandfathering period allows existing providers to continue operating compliantly, provided they meet the notification and authorization requirements outlined in the resolutions by October 30, 2026.
• The two-year phased rollout of Travel Rule obligations offers the industry a measured timeline to adapt systems, processes, and counterpart relationships to the new compliance expectations.
• The requirement to identify self-hosted wallet owners under the foreign exchange (FX) regime represents a move toward comprehensive transaction traceability across the digital asset ecosystem.
• By implementing these measures, Brazil aligns its framework with global AML and Travel Rule standards, setting a regional benchmark for regulatory modernization in Latin America.

Prepare your business for Brazil’s new Travel Rule requirements.

Notabene helps virtual asset service providers automate compliance, exchange Travel Rule data securely, and stay aligned with local and global regulations. 

👉 Register for our upcoming webinar: How to Prepare for Brazil’s New Crypto Regulatory Framework if you operate in Brazil or support customers who do. This session will help you understand what’s changing and what comes next.