To read the full report, please download the PDF.
Executive Summary
With October 30, 2026 approaching, Brazil's virtual asset market faces the final deadline for virtual asset service providers (VASPs) to file authorization applications with the Central Bank, now accompanied by an independent assurance report. Brazil ranks 5th in the world for crypto adoption and received $318.8 billion on-chain over twelve months. Roughly 80% of declared volume moves in stablecoins, totaling R$1.58 trillion since 2019. Minimum capital requirements range from R$10.8 to R$37.2 million against an estimated 120 providers, while $1.32 billion was lost to hacks in H1 2026 alone. Regulation has moved from law to full supervision in under four years, with independent evidence now built into the application itself. October 2026 isn't the finish line; it's the start of a larger, more institutional market where the ability to prove replaces the ability to promise.
The Web3 Wave of Emerging Markets
The Global South Takes the Lead: Chainalysis's 2025 Global Crypto Adoption Index ranks India, the U.S., Pakistan, Vietnam, and Brazil as the top five markets by real usage. Four of the top five are emerging markets, and Latin America's on-chain value grew 63% year-over-year — the second-fastest pace globally. Adoption driven by genuine financial need, rather than speculation, tends to endure and eventually demands regulation.
A $318 Billion Market Hidden in Plain Sight: Brazilian wallets and platforms received $318.8 billion in on-chain value in the twelve months to June 2025, nearly a third of all Latin American activity, and roughly double Argentina and Mexico combined. Brazil ranked fifth across every subindex Chainalysis measured, yet remains underestimated internationally compared to hubs like Dubai or Singapore.
The Stablecoin Nation: Brazilians transacted approximately R$1.58 trillion in crypto-assets between 2019 and 2025, of which R$1.13 trillion was in stablecoins. Stablecoin share of declared volume rose from 3.5% in 2019 to consistently above 80% since 2023, with USDT alone representing 88.7% of stablecoin volume. This concentration is why the Central Bank, not the securities regulator, leads the regime, and why foreign exchange sits at the heart of the rules.
Beyond Trading: How Brazil Actually Uses Web3: Use cases extend well beyond trading: stablecoin rails for B2B payments and international settlement, exchanges and brokers serving retail through instant Pix onboarding, crypto ETFs listed on B3 since 2021, tokenization of receivables and real-world assets, and a growing institutional turn as Brazilian banks move into custody and tokenized products.
Why Brazil Was Ready: Pix, Open Finance, and the Rails That Came Before: Unlike Venezuela or Argentina, Brazil's crypto adoption sits on top of sophisticated infrastructure like Pix and Open Finance. Brazilians adopt new financial rails quickly when infrastructure is strong and rules are clear, and the Central Bank has repeatedly proven it can govern transformative financial infrastructure.
From Legal Vacuum to Full Supervision
The Foundation: Law 14,478/2022 and Decree 11,563/2023: The Legal Framework for Virtual Assets defined what a virtual asset and VASP are, set guiding principles (governance, security, consumer protection, AML/CFT), and left the "how" to the Executive Branch. Decree 11,563 (2023) named the Central Bank as the competent regulator, though nearly three years passed before rules followed.
The Design: Public Consultations in 2023 and 2024 shaped the three-resolution structure covering authorization, operation, and foreign exchange. The process showed a regulator willing to test hard positions (like a proposed ban on self-custodied wallet transfers) and calibrate based on market feedback, while still drawing clear inspiration from the EU's MiCA and FATF standards.
BCB Resolutions 519, 520, and 521 (November 2025): Published the same day, these resolutions govern authorization (519), create the SPSAV entity with three categories — intermediary, custodian, and broker/exchange (520), and classify virtual-asset-based international payments as foreign exchange operations (521). Minimum capital was set between R$10.8 and R$37.2 million. Incumbent banks and brokers were given a lighter path to add virtual asset services to their existing license.
The Rulebook: IN 701 and IN 704: Instruction 704 governs new entrants and crypto-natives, detailing authorization procedures and documentation. Instruction 701 governs incumbents (banks, brokers, dealers), requiring technical certification from an independent firm covering asset segregation, service provider capacity, recovery planning, and AML/CFT policies.
The Proof Shift: IN 739: Issued May 29, 2026, this instruction conditions the SPSAV authorization application on a reasonable assurance report (NBC TO 3000 standard) from a CVM-registered audit firm, attesting to the effectiveness of AML/CFT and sanctions controls. Applications, with the report attached, are due October 30, 2026.
DeCripto, CARF, and the Federal Revenue Service's Long Arm: Starting July 2026, crypto transactions must be reported to the Federal Revenue Service through DeCripto, aligned with the OECD's CARF framework. The obligation explicitly reaches foreign providers serving Brazilian clients.
The View from the Trenches: Veirano Advogados: Marcos Rocha of Veirano notes that firms consistently underestimate the complexity of the authorization process, which spans governance, compliance, AML/CFT, cybersecurity, and more. He recommends treating the application as one integrated project from the outset, given the Central Bank's thorough and technical review approach.
Does This Law Apply to You?
What Counts as a Virtual Asset Service: Virtual assets are digital representations of value used for payment or investment, excluding currencies, electronic money, loyalty points, and securities (which stay with the CVM). The Central Bank's regime covers exchange, transfer, custody, and offering services provided to third parties.
The Grey Zones: Wallets, PSPs, Tokenizers, Gaming, and DeFi: Ambiguity persists around custodial-adjacent wallet infrastructure (assisted recovery, MPC schemes), fintechs partnering with licensed providers, tokenizers (a tokenized share is still a share under CVM jurisdiction, per Guidance Opinion 40), gaming tokens with liquid secondary markets, and DeFi front-ends operating commercially in Brazil.
Serving Brazil from Abroad: Foreign entities already serving Brazilian clients had 270 days to transfer operations to an authorized local vehicle. Remaining options are: incorporate locally, acquire an authorized operation, act as a contractor to an authorized PSAV, or exit. Rocha notes there's no one-size-fits-all structure — the right path depends on existing operations and long-term strategy.
The Economics of the Deadline
What the Application Really Requires: Applications must document ownership and fund sourcing, a detailed business plan, governance structure with resident statutory officers, minimum capital, and asset segregation and security measures — plus, since IN 739, the reasonable assurance report itself.
The Assurance Bottleneck: Why September is Already Too Late: Every applicant needs the same scarce resource: assurance reports from a narrow pool of qualified, CVM-registered auditors. The real sequence — gap assessment, remediation, technical testing, then assurance — takes weeks per stage. Starting in September doesn't leave enough calendar to finish by October.
The Consolidation Thesis: Against ~120 existing providers, an eight-figure capital floor, and a lengthy authorization process, the math doesn't work for everyone. Licenses become valuable assets, and M&A becomes the fastest entry route — a consolidation pattern already seen following MiCA and VARA licensing deadlines elsewhere.
The Next Regulatory Waves
Stablecoins: The Bill, the 24-Hour Proposal, and the Calibration Test: Congress is considering PL 4,308/2024 to regulate stablecoins by statute. Separately, the Central Bank has proposed holding certain stablecoin transactions (over $10,000, destined abroad or to self-custodied wallets) for 24-hour risk review — a proposal the industry has asked to delay given the concurrent authorization crunch.
Crypto-as-a-Service: SPSAVs can engage third parties while remaining fully responsible for compliance. This creates a path for fintechs and founders to offer crypto services without becoming a licensed entity themselves, plugging into an authorized partner's license instead.
Tokenization and RWAs: Tokenization sits at the intersection of Central Bank and CVM jurisdiction: a tokenized share remains a share under CVM's Guidance Opinion 40. B3 is exploring its own tokenization platform, with a stablecoin envisioned as the settlement layer.
FX and International Payments: A series of rules (Resolution 561, the June 2026 notification on FX fund structures, and Resolution 574) are systematically closing gaps that let international crypto flows bypass supervision, reinforced by IOF-Câmbio taxation and transaction caps for unauthorized counterparties.
Signals for 2027 and Beyond: Four signals define what's next: Congress is actively shaping the regime through new legislation; the Central Bank is using its full regulatory toolkit at speed; traceability and perimeter enforcement continue tightening; and focus is shifting from rule-making to supervisory decisions — approvals, denials, and sanctions.
When Markets Mature, Security Becomes Infrastructure
Every Market that Formalizes Ends Up in the Same Place: Banking, card payments, and capital markets all moved from self-declaration to independent third-party verification after major failures (crises, fraud epidemics, Enron). Crypto followed the same arc, accelerated by FTX's collapse, and Brazil's IN 701/IN 739 design represents one of the most explicit versions of this pattern yet.
The Global Benchmark: Brazil vs. MiCA, VARA, and MAS: Brazil's regime shares the same grammar as MiCA, VARA, and MAS — authorization, capital, segregation, governance, AML/CFT. Its distinguishing feature is timing: independent proof is required at filing, not validated afterward through supervision, making it one of the strictest regimes globally on this specific point.
The Threat Landscape: CertiK's Hack3d H1 2026 Report found $1.32 billion lost across 344 incidents. Wallet compromise was the costliest vector ($444.5 million), followed by phishing ($366.3 million); code exploits remained the most frequent vector. North Korea-linked groups stole $2.02 billion in 2025, validating IN 739's specific focus on sanctions controls.
The Economics of Assurance: Independent proof now unlocks counterparties under the lock-out regime, reduces friction with investors and acquirers, reprices incident risk against costly losses, and functions as a commercial argument in institutional due diligence.
The Transition Challenge
Three Markets, One Company: Companies are navigating three eras simultaneously: the past unregulated market, the current transitional period (rules apply, authorization doesn't yet exist), and the coming fully regulated market with continuous supervision.
The Practical Pains: Real burdens include governance restructuring around resident statutory officers, capital requirements that reshape the cap table and investor conversations, architectural rebuilds for fund and asset segregation, AML operations that must generate auditable evidence rather than policy documents, and even physical office requirements (coworking is prohibited).
Web3-Native Companies in a Newly Regulated Market: Companies face three paths: pursue a proprietary license, operate under an authorized PSAV's umbrella, or become a supplier selling infrastructure/compliance tools into the regulated perimeter. Neto notes rising M&A between operators and license holders, with the "carrier" model becoming the default for early-stage teams facing Brazilian retail.
The PSAV Compliance Roadmap
Step Zero: The Gap Assessment: Before drafting the dossier, companies must map current practices against regulatory requirements, producing a gap matrix with owners and deadlines — the document that should order everything that follows.
Pen Testing and Architecture Review: Penetration testing, key-management review, and incident response planning are now annual regulatory obligations under Resolutions CMN 5,274 and BCB 538 (effective March 2026), with evidence retained for at least five years.
Smart Contract Audits: IN 701 requires policies for listing, suspending, and delisting assets based on technical evaluation criteria — audits turn listing decisions into documented, defensible choices.
AML/CFT, KYT, and Sanctions: Requirements include on-chain transaction monitoring, sanctions screening, Travel Rule implementation, and a risk matrix by client and operation — all generating auditable evidence for the IN 739 assurance review.
Custody, Segregation, and Proof of Reserves: Segregation is the regime's central client promise, and Proof of Reserves — periodic cryptographic verification that client assets exist and are covered — has become the recurring demonstration of that promise, and a key competitive differentiator in due diligence.
Conclusion
Brazil has built a complete regulatory architecture for virtual assets in public, compressing the final stretch into under twelve months, and closed the perimeter through a rule barring dealings with unauthorized counterparties. The agenda continues beyond October with stablecoins, tokenization, and foreign exchange. The deadline is real, assurance capacity is scarce, and proof has become the new product — companies that treat compliance as infrastructure, not an occasional expense, will turn each new requirement into a competitive advantage.