Brazil is entering a new phase for crypto oversight. With the Central Bank of Brazil (BCB) publishing Resolutions 519, 520 and 521, Virtual Asset Service Providers (VASPs) finally have a clear rulebook for how they are expected to operate.

On 24 November, Notabene’s Regulatory & Compliance team brought together regulators, legal experts and market leaders who are directly involved in crafting, interpreting and applying these rules. This recap pulls together the main points from that discussion and what they mean in practice for firms operating in or serving Brazil.

We were joined by:

• Pedro Henrique Nascimento Silva, Coordinator, Financial System Regulation Department, Central Bank of Brazil
• Marcos Coelho da Rocha, Partner, Veirano Advogados
• Nicole Dyskant, Co-Founder & CEO, RegDoor
• Bruno Antoniolli, Director of Risk, Controls & AML, Mercado Bitcoin

Moderated by Lana Schwartzman and Catarina Veloso from Notabene’s Regulatory & Compliance team.

1. How we got here: Brazil’s path to a full framework

Pedro opened by walking us through the path that brought us to this critical regulatory milestone. .

• In 2022, Brazil passed its virtual asset law. It set AML expectations and made clear that there would be a specific authority responsible for supervising virtual asset service providers.
• In mid-2023, a presidential decree formally designated the Central Bank of Brazil as that authority.
• From there, the BCB did something unusual for its regulatory process: instead of starting with a draft rule, it began with 38 open questions to the market.

That consultation step mattered. Market participants, including Notabene and many of our customers, have highlighted practical challenges and risks that only become apparent once you are deeply entrenched  in operations. The BCB used that input to shape three core pieces of regulation:

1. The authorization process for VASPs and related entities
2. The business rules for VASPs and for other regulated institutions that offer virtual asset services
3. The FX perimeter, defining when virtual asset activity is treated as foreign exchange

Across these, the BCB chose to align the new regime with existing financial sector regulation wherever possible: cybersecurity, AML/CFT, governance, risk management and vendor oversight. For VASPs, the framework also introduces three basic business models:

• Intermediary
• Custodian
• Exchange / combined model

2. Upcoming Milestones: What is Coming in 2026?

Nicole focused on what most firms are currently asking: what happens next and when.

Here is the high-level timeline as it stands today:

• February 2026: Resolutions come into effect. Firms can start submitting license applications.
• By end of October 2026: 
  • Existing VASPs that are already operating in Brazil must apply for authorization under one of the new categories.
  • Eligible authorized institutions (e.g., banks, broker-dealers) do not require a separate license, but must notify the BCB of the provisioning of crypto asset services and adjust procedures as needed. 
  • Foreign firms serving Brazilian clients and seeking to maintain that activity must also transfer activities to an eligible authorised instituion or a existing VASP.

During this transition period, firms should be working toward:

• Clear internal mapping to the correct license type
• Governance, risk and control frameworks that match the BCB’s expectations
• Consistent AML, sanctions, reporting, accounting and corporate governance practices
• Documentation that reflects reality, not “what we plan to do later”

Nicole stressed one point in particular: because the timelines are generous, the BCB expects applications to be substantive, not placeholders. Submitting an incomplete file and promising to “fix it later” is likely to result in a refusal.

3. How a major VASP is preparing: Mercado Bitcoin’s view

Bruno brought the operator angle, sharing how Mercado Bitcoin is preparing internally.

A few themes stood out:

• Much of the work started years ago. Mercado Bitcoin already runs annual cybersecurity audits, has listing and delisting processes, and maintains established AML and risk frameworks.
• The new regime is less about starting from scratch and more about elevating documentation and governance: making sure processes are written down, reviewed regularly and escalated through the right committees.
• One key challenge is ensuring a unified view of risk: linking on-chain monitoring, off-chain financial flows, and customer behaviour into a single methodology and risk scoring system.

On prudential rules, Bruno flagged that this will be a critical piece to watch. VASPs do not operate like banks, so the calibration of these rules will matter. The BCB’s Public Consultation no. 125/2025 on prudential treatment is open until 30 January 2026.

4. Travel Rule: What Resolution 520 actually requires

As this was a Notabene-hosted webinar, we dedicated part of the session to reviewing the Travel Rule and its implications. Catarina provided an overview of the obligations set out in Resolution 520:

• The Travel Rule applies to all virtual asset transfers, regardless of amount.
• The originator institution must transmit identifying information about both the originator and the beneficiary.
• The required data includes a richer set of information on the originator (your own customer) and a more limited set on the beneficiary (as provided by your customer).

On top of the data elements themselves, the resolution reinforces two core obligations:

1. Suspicious activity reporting

   The Travel Rule is there to support detection of illicit activity, not to create a data-sharing exercise for its own sake. Firms should design their implementation so that Travel Rule data meaningfully strengthens AML and sanctions controls.

2. Reporting of non-cooperative counterparties

   If a BCB-supervised counterparty prevents you from complying with the Travel Rule, you are required to notify the central bank. That gives the BCB visibility into systemic obstacles and repeat offenders.

Phased rollout: domestic first, cross-border next

Article 89 sets out a phased approach over two years:

• Phase 1: February 2026 to February 2027

  Travel Rule applies to domestic transfers between institutions operating in Brazil.

• Phase 2: February 2027 to February 2028

  Travel Rule extends to cross-border transfers involving foreign institutions.

• From February 2028, full compliance is expected.

Throughout both phases, VASPs can rely on documented self-declarations from customers when dealing with self-hosted wallets, provided those declarations are properly documented and can be produced to the BCB on request.

Pedro highlighted that Travel Rule compliance is non-negotiable and called attention to an important milestone: by 2 February 2027, any firm operating legally in Brazil will either already be licensed or be in the licensing process, and will be expected to comply with Travel Rule requirements for domestic activity.

5. Notabene’s Brazil Travel Rule Testnet

From Notabene’s experience in other regions, we know Travel Rule implementation cannot be left to the last minute. It affects transaction flows, customer UX, sanctions screening and counterparty relationships all at once.

In this context, during the webinar, we announced that we are launching a Brazil-specific Travel Rule testnet program. This will allow Brazilian VASPs and global firms serving Brazil to:

• Test Travel Rule data exchange aligned with Resolution 520
• Trial customer journeys and transaction flows before go-live
• Identify and fix counterparty frictions early

We have seen how powerful this approach can be. In 2023, we supported two successful rounds of testing in the UK under the FCA’s sandbox, which helped firms enter enforcement with fewer surprises in production. 

We’re now bringing that proven model to Brazil, tailored specifically to the obligations and technical realities of Resolution 520.

Any institution is welcome to join the program by signing up below.

It’s a unique opportunity for the industry to prepare together before full enforcement begins. Register your interest to join the Brail Travel Rule Testnet today.

6. Stablecoins: Where the rules stand today

The BCB has made it clear that stablecoins dominate crypto flows in Brazil, with an estimated 80–90 percent of volume in recent years involving stablecoin pairs.

Marcos outlined how the resolutions handle this reality:

• Algorithmic stablecoins are banned. Brazilian VASPs will not be allowed to offer or intermediate purely algorithmic pegs.
• The rules focus on fiat-backed stablecoins, defined as virtual assets backed by reserve assets and intended to maintain a peg to a specific fiat currency.
• VASPs must carry out and document due diligence on:
  • The issuer's compliance with the token with the offering and public markets regulations of its home jurisdictions
  • The issuer’s regulatory and legal status
  • The structure and quality of the reserve
  • Concentration risks in those reserves
  • The stabilization mechanism and its track record
  • Audited financial statements of issuers and custodians
• Finally, Article 65 also requires VASPs to publicly disclose their methodology for selecting and maintaining stablecoin listings. The intention is that customers can evaluate whether a firm’s criteria align with their own risk appetite.

Pedro noted that stablecoins will be a central regulatory priority for 2026. He explained that although assets like Bitcoin and Ethereum once dominated Brazil’s crypto market, stablecoins have now become the primary vehicle for transactions. According to the BCB’s early, though still incomplete, data analysis, USD-denominated stablecoins account for the overwhelming majority of activity. Congress is debating several bills specific to stablecoins. Depending on which proposals advance, the BCB’s mandate may expand or shift, potentially requiring a more comprehensive regulatory framework governing issuance, reserve structures, and overall oversight.

What firms should be doing now

Across all speakers, a few practical messages were repeated:

• Map your activities to the new categories. Assess whether you are an intermediary, custodian, combined broker or a regulated financial institution expanding into virtual assets.
• Start license preparation early. Governance, documentation, audits and risk assessments take time.
• Treat Travel Rule as a core compliance project, not an add-on. It touches customer onboarding, transaction monitoring, sanctions, product and engineering.
• Take stablecoin due diligence seriously. Given their dominance in Brazilian flows, they will be a major focus for supervisors.

At Notabene, we will keep working with both Brazilian and global firms as they prepare for this next phase, including through our Brazil Travel Rule testnet and ongoing regulatory updates.

If you would like to participate in the testnet program or want a more tailored discussion on how these rules affect your specific business model, our team would be happy to talk to you today.