Brazil Virtual Assets Law: Central Bank Licensing, VASP Rules and FX Boundaries

Brazil's crypto regulatory framework moved from broad legislation into detailed central-bank supervision in 2026.

The foundation remains Law 14,478 of 2022, which created a legal framework for virtual-asset services. But a current review can no longer stop there.

Decree 11,563 assigned the main authorization and supervisory role to the Banco Central do Brasil (BCB), while preserving the authority of the Comissão de Valores Mobiliários (CVM) over securities. Then, in November 2025, the BCB published Resolutions 519, 520 and 521, which became the operational core of the regime in 2026.

Those rules took effect primarily on February 2, 2026.

They address three different questions:

• who needs authorization and how the transition works;
• how virtual-asset service providers must operate;
• when virtual-asset transactions fall inside Brazil's foreign-exchange and international-capital framework.

The result is much more specific than the phrase “crypto is regulated in Brazil.”

For users and businesses, the important questions are:

Which legal entity provides the service？

Is it authorized, in the authorization process or operating under a valid transition？

Is the product a virtual asset, a security, a derivative or a foreign-exchange service？

Which regulator and rule apply to that activity？

Those distinctions matter more than a generic “BCB regulated” label.

Brazil's framework now has several regulatory layers

Brazil's virtual-asset regime can be understood through four main layers.

1. Law 14,478

Law 14,478 establishes the basic legal framework for virtual-asset services.

It defines virtual assets, sets general principles for service providers and requires providers operating in Brazil to obtain authorization from the designated federal authority.

2. Decree 11,563

The Decree assigns the principal authorization, regulation and supervision responsibilities under Law 14,478 to the Central Bank of Brazil.

It does not remove the CVM's existing powers over securities.

3. BCB Resolutions 519, 520 and 521

These are the main operational rules introduced for 2026.

• Resolution 519 — authorization and transition;
• Resolution 520 — organization and operation of virtual-asset service providers;
• Resolution 521 — foreign-exchange and international-capital treatment for specified virtual-asset activities.

4. Later implementing and anti-fraud rules

The BCB has continued updating the framework through instructions and resolutions dealing with:

• technical certification;
• reporting;
• prudential requirements;
• transaction information;
• fraud prevention.

That means a 2026 compliance review needs more than the original framework law.

What counts as a virtual asset？

Law 14,478 defines a virtual asset broadly as a digital representation of value that can be electronically traded or transferred and used for payment or investment purposes.

But the law also excludes several categories.

These include, among other things:

• national and foreign sovereign currency;
• certain electronic-money structures;
• specified loyalty and reward instruments;
• assets already governed as securities or under other financial-asset regimes.

This is important because blockchain technology does not decide the legal classification.

A token can be represented on-chain and still be:

• a security;
• a derivative;
• a payment instrument;
• another regulated financial asset.

The useful sequence is therefore:

Asset rights → Transaction → Service → Regulatory classification

rather than:

Blockchain token → Automatically a virtual asset under the BCB framework

The BCB and CVM regulate different parts of the market

Decree 11,563 gives the Central Bank authority to:

• regulate virtual-asset service provision;
• authorize providers;
• supervise providers;
• exercise the other functions assigned under Law 14,478.

But the Decree expressly preserves the CVM's authority over securities.

The CVM has repeatedly clarified that BCB authorization for a virtual-asset service provider does not replace securities-law permissions.

If a token represents or constitutes a security, CVM rules may still apply.

This includes situations involving:

• tokenized traditional securities;
• tokenized receivables;
• public investment contracts;
• security-token offerings;
• certain derivatives.

A company therefore cannot rely on a BCB authorization to claim that every token it lists or distributes has been approved under securities law.

Tokenization makes this boundary especially important

Brazil's securities regulator has continued developing its own approach to tokenization.

In 2026, the CVM created a Tokenization Working Group to study activities including:

• issuance;
• offering;
• distribution;
• trading;
• recordkeeping;
• custody;
• settlement of securities using distributed-ledger technology.

In September 2026, CVM technical staff completed a proposal for a DLT pilot intended to test tokenized capital-market activity.

That work reinforces an important principle:

Tokenization does not move a security outside securities regulation.

The technology used to represent the asset and the legal rights represented by the asset are separate questions.

The 2026 timeline

The framework developed in stages.

This timeline matters because:

Rule effective date

is not the same thing as:

Every provider already holding final authorization

and neither is the same thing as:

Every reporting or anti-fraud requirement already active.

Resolution 519: authorization and transition

Resolution BCB 519 establishes the authorization framework for the new virtual-asset service provider regime.

It covers both:

• general authorization procedures;
• transitional rules for providers already operating when the new framework took effect.

The BCB's objective was to avoid treating the transition as an overnight switch where every existing provider either immediately received a licence or had to disappear from the market.

Instead, authorization and transition need to be examined provider by provider.

For users, this creates three materially different statuses:

• Finally authorized
• In the authorization or valid transition process
• Neither authorized nor within an accepted authorization path

Those categories should not be collapsed into one “regulated” badge.

Resolution 520: how providers must operate

Resolution BCB 520 regulates the organization and operation of virtual-asset service providers.

It extends requirements familiar from the broader financial system into the crypto-service environment.

These include areas such as:

• customer protection;
• transparency;
• governance;
• internal controls;
• information security;
• anti-money-laundering controls;
• combating terrorist financing;
• recordkeeping;
• reporting;
• operational resilience;
• protection of digital assets.

The BCB has stated that providers are expected to maintain strong standards for protecting customer data and virtual assets, conduct stress testing and bear responsibility for relevant losses caused by negligence.

These requirements are more informative than the statement:

“Brazil regulates exchanges.”

The practical question is how the specific provider meets those obligations.

Brazil created dedicated SPSAV categories

The 2026 framework creates dedicated entities commonly referred to as SPSAVs — Sociedades Prestadoras de Serviços de Ativos Virtuais.

The BCB identifies categories including:

• virtual-asset intermediary;
• virtual-asset custodian;
• virtual-asset broker.

These categories should be read according to the actual Portuguese regulatory definitions rather than assumed from English-language labels alone.

For example, the fact that a business is classified as a custodian does not necessarily answer whether it can perform every activity of an intermediary.

Likewise, an intermediary authorization should not automatically be interpreted as unlimited custody permission.

The scope of the authorization matters.

Existing BCB-regulated institutions can also provide virtual-asset services

The framework is not limited to newly created SPSAVs.

Certain institutions already supervised by the Central Bank may also provide specified virtual-asset services.

For some institutions, the process involves formal communication to the BCB and technical certification before the activity begins.

BCB Instruction 701, for example, establishes procedures for technical certification accompanying communications relating to intermediation and custody services.

For relevant already-regulated institutions, the framework includes a 90-day period after formal communication before beginning specified activities.

This means a traditional bank or financial institution entering crypto services should not simply be marked:

“Already BCB authorized, therefore automatically approved for all crypto activities.”

The new activity still needs to follow the applicable procedures.

Technical certification is part of the implementation

BCB Instruction 701 requires relevant technical certification by an independent qualified company for specified communications.

The certification is designed to establish that the institution actually complies with the requirements of Resolution 520.

This creates another useful distinction:

Corporate authorization is not the same as operational readiness for a new virtual-asset service.

Systems, controls, custody arrangements and procedures matter.

The regulator is not evaluating only whether a company legally exists.

October 30, 2026 is an important transition date

Resolution 520 contains an important future restriction scheduled to apply from October 30, 2026.

From that date, institutions including banks, payment institutions and other entities authorized by the BCB will generally be prohibited from carrying out or facilitating relevant virtual-asset market operations with counterparties that:

• are not authorized by the BCB; and
• are not in the authorization process in Brazil,

except where the regulation expressly permits otherwise.

The restriction can reach activities such as:

• virtual-asset trading;
• intermediation;
• custody;
• foreign-exchange operations;
• payment-account services;
• payment transactions used to facilitate those operations.

This is an important practical transition mechanism.

It can reduce the ability of unregulated or out-of-process providers to rely on the Brazilian regulated financial system.

What happens on October 30 should not be misunderstood

The October rule does not mean:

“Every crypto company without a final licence becomes illegal overnight.”

The text distinguishes firms in the authorization process.

The more useful check is:

Is this provider authorized or properly within the BCB authorization process？

That is why the provider's exact legal status matters more than the logo shown to customers.

International groups also need to identify which entity is actually serving Brazilian clients.

A foreign exchange brand cannot assume that authorization of a different group company automatically covers its Brazilian operations.

Resolution 521 connects crypto with foreign-exchange regulation

Resolution BCB 521 is one of the most important and distinctive parts of Brazil's framework.

It places specified virtual-asset activities within Brazil's foreign-exchange and international-capital rules.

The BCB identifies activities including:

• international payment or transfer using virtual assets;
• virtual-asset transfers related to international use of cards or other electronic payment methods;
• certain transfers to or from self-custody wallets;
• purchase, sale or exchange of virtual assets referenced in fiat currency.

This means using a blockchain asset does not automatically remove a transaction from foreign-exchange regulation.

The economic purpose of the transaction still matters.

Stablecoins can fall inside foreign-exchange rules

Resolution 521 is particularly important for fiat-referenced tokens.

The BCB places the purchase, sale or exchange of virtual assets referenced in fiat currency within the foreign-exchange framework under the specified conditions.

This means a stablecoin interface can involve more than ordinary crypto trading.

A transaction can potentially include:

• fiat conversion;
• stablecoin purchase;
• custody;
• cross-border transfer;
• recipient conversion;
• local payout.

The fact that the blockchain leg settles successfully does not automatically establish that every fiat or FX obligation has been satisfied.

Users should check:

• exchange rate;
• fees;
• provider identity;
• settlement conditions;
• recipient conditions;
• FX treatment.

Brazil's framework is not a standalone stablecoin issuer law

It is important not to confuse Resolution 521 with legislation such as the U.S. GENIUS Act.

Brazil's 2026 virtual-asset framework focuses heavily on:

• providers;
• services;
• foreign-exchange treatment;
• custody;
• operations;
• supervision.

It should not automatically be described as a dedicated stablecoin-issuer regime equivalent to a law built primarily around issuer reserve and redemption requirements.

When analysing a stablecoin in Brazil, separate:

• the stablecoin issuer;
• the virtual-asset service provider;
• the FX transaction;
• any securities features;
• the user's customer contract.

Different parts of the structure can fall under different rules.

International virtual-asset payments can be subject to limits

The BCB framework also applies foreign-exchange limits in relevant cases.

The BCB explained that where the provider is subject to transaction limits in the FX market, international payments and transfers involving virtual assets can be subject to equivalent restrictions where the counterparty is not an institution authorized to operate in the FX market.

The 2025/2026 rules also introduced a US$100,000 equivalent limit for certain international payment or transfer services conducted by SPSAVs where the counterparty is not an institution authorized to operate in the foreign-exchange market.

This is another reason a stablecoin transfer should not be interpreted as economically identical to an unrestricted wallet-to-wallet movement.

The regulated service can still be subject to FX controls.

Self-custody is not prohibited

One of the easiest misconceptions about the Brazilian framework is:

“Brazil banned self-custody.”

That is not what the rules say.

Resolution 521 expressly addresses transfers involving self-custody wallets.

The BCB defines a self-custody wallet as one where the owner controls the private key and can move the assets without participation by a virtual-asset service provider.

For relevant transfers between a regulated provider and a self-custody wallet, the provider must follow specified procedures.

These can include:

• identifying the wallet owner;
• maintaining documented processes;
• verifying the origin and destination of the virtual assets.

Regulating the service provider's handling of a self-custody transfer is not the same as prohibiting individuals from holding their own private keys.

Self-custody transfers can involve more documentation

The practical effect for users is that moving crypto between:

Exchange → Personal wallet

or

Personal wallet → Exchange

can involve compliance checks.

A platform may request information such as:

• confirmation of wallet ownership;
• source of funds;
• destination purpose;
• transaction background.

This should not be confused with a request for the user's seed phrase or private key.

A legitimate regulated provider should never need the private key to prove that a user owns a self-custody wallet.

Users should supply documentation only through the provider's official secure process.

A new 24-hour anti-fraud rule begins in 2027

Brazil added another important rule in August 2026.

Resolution BCB 584/2026 introduces a precautionary holding mechanism for certain virtual-asset transfers.

The rule is scheduled to take effect on January 1, 2027.

For covered transactions above US$10,000 equivalent, considered either individually or through the customer's total activity on the same day, providers can be required to apply a precautionary holding period of up to 24 hours before completing transfers to:

• foreign virtual-asset service providers; or
• self-custody wallets.

The purpose is fraud prevention.

The holding period gives the institution additional time to perform risk analysis before the assets leave the regulated environment.

The 24-hour rule is not a permanent freeze

The BCB expressly distinguishes the precautionary retention from a permanent block.

The institution can complete the operation before the full 24 hours if its risk analysis is completed and the applicable requirements are satisfied.

Providers must also inform customers about the hold.

This is important because a user seeing:

“Transfer pending for risk review”

after January 1, 2027 should not automatically interpret that status as a withdrawal failure or confiscation.

The rule is designed as a temporary anti-fraud control.

As of September 2026, it is not yet in force.

Reporting deadlines also changed during 2026

The 2026 framework has already been amended in several operational details.

One example is foreign-exchange reporting.

Early BCB explanations referred to reporting requirements beginning in May 2026.

Later amendments changed the timetable.

BCB Instruction 756, issued in July 2026, adjusted reporting so that information relating to covered virtual-asset services in the FX market is required for operations from November 2026, consistent with the amended Resolution 277 framework.

This is a useful reminder for regulatory research:

A launch announcement is not always the final operational timetable.

Current rules and later amendments should take precedence over older explanatory material.

Brazil's rules increase traceability

The BCB has emphasized traceability as one of the objectives of the new virtual-asset framework.

Providers are expected to maintain records enabling regulators to understand:

• who conducted a transaction;
• where assets came from;
• where they went;
• which provider handled the activity.

That approach aligns Brazil more closely with the international AML/CFT direction promoted by bodies such as FATF.

For users, the practical consequence is that regulated crypto services can increasingly resemble traditional financial services in their documentation requirements.

Crypto transfers may be technically permissionless at the blockchain layer while the regulated provider still has legal obligations to identify and monitor the customer transaction.

Customer assets and custody receive more explicit protection

Resolution 520 also addresses controls around customer assets and information.

The BCB has highlighted requirements involving:

• protection of digital assets;
• protection of customer data;
• governance;
• internal controls;
• stress testing;
• operational security.

The regulatory framework also introduces reporting requirements around custody and proof-of-reserve-related information for relevant providers operating during the transition.

BCB Instruction 713, for example, establishes reporting procedures covering:

• proof-of-reserves information;
• staking operations;
• custody services.

This does not mean every provider's public PoR is automatically validated by the BCB.

It means reserve and custody information has become part of the regulatory reporting environment.

Regulation is not a central-bank guarantee

The presence of BCB supervision should not be translated into:

“The Central Bank guarantees exchange deposits.”

The regulatory framework can reduce certain risks through:

• authorization;
• operational standards;
• asset controls;
• reporting;
• supervision;
• accountability.

It does not guarantee:

• crypto prices;
• exchange profitability;
• zero cyber risk;
• zero operational failures;
• repayment of every loss.

Recovery depends on the specific facts, contracts and law.

Regulation strengthens oversight.

It does not turn virtual assets into guaranteed bank deposits.

The CVM still matters for securities and derivatives

The BCB's role does not eliminate the securities regulator.

The CVM states that its jurisdiction applies when the crypto asset or transaction constitutes a security.

Its current guidance identifies examples including:

• tokens representing traditional securities;
• tokenized receivables;
• publicly offered collective investment contracts.

The CVM also notes that crypto assets such as Bitcoin and many ordinary cryptocurrencies generally fall outside its securities jurisdiction unless the activity involves matters such as derivatives.

This means the regulatory map can look like:

Ordinary virtual-asset service → BCB

Security token or securities transaction → CVM

Relevant FX activity → BCB foreign-exchange framework

The same business group can therefore interact with more than one regulator.

“RWA” is not a regulatory category by itself

Tokenization projects increasingly use labels such as:

• RWA;
• tokenized asset;
• security token;
• digital bond;
• tokenized receivable.

Those marketing descriptions do not decide legal status.

A tokenized Brazilian receivable can still be a security.

A blockchain representation of fund units can still fall under investment-fund or securities rules.

A token used only as a payment asset may fall within another framework.

For every RWA project, ask:

• What legal right does the token represent？
• Who issued it？
• How was it offered？
• Is it transferable？
• Does it represent a security？
• Who provides trading and custody？

The underlying rights matter more than the term “RWA.”

Provider authorization should be checked at legal-entity level

An international exchange brand can serve different countries through different companies.

Brazilian regulatory analysis should therefore identify:

• legal entity;
• CNPJ where applicable;
• service category;
• BCB authorization or authorization process;
• transition basis;
• customer agreement.

A licence or application associated with one group company should not automatically be extended to every affiliate.

The useful verification chain is:

Brand → Legal Entity → BCB Status → Service Category → Product → Customer Agreement

not:

Brand → “Registered in Brazil”

Company formation is not BCB authorization

A Brazilian company can have:

• a CNPJ;
• commercial registration;
• local employees;
• a website in Portuguese;

without that automatically establishing final authorization as a virtual-asset service provider.

Likewise, submitting documents to the BCB does not mean the authorization process is complete.

The distinction between:

• incorporated;
• applied;
• transitionally permitted;
• in authorization process;
• authorized;

needs to be preserved.

This is particularly important during 2026 because the authorization framework is still transitioning existing providers into the new regime.

How to check a Brazilian crypto provider in 2026

A useful provider check can be completed in several steps.

1. Identify the legal company

Start with the Terms of Service or customer agreement.

Find the actual legal entity providing services to Brazilian users.

2. Identify the service

Determine whether the business provides:

• intermediation;
• custody;
• brokerage;
• payments;
• foreign-exchange-related services;
• securities services.

Different rules can apply to different functions.

3. Check the BCB status

Determine whether the provider is:

• authorized;
• formally in the authorization process;
• operating under a recognized transition;
• outside the applicable authorization path.

Do not rely only on a company press release.

4. Check whether CVM rules also apply

If the product involves:

• securities;
• public investment contracts;
• tokenized financial instruments;
• derivatives;

verify the relevant CVM framework separately.

5. Review custody and withdrawal terms

Understand:

• who holds the assets;
• whether a third-party custodian is involved;
• network support;
• self-custody transfer procedures;
• withdrawal controls.

6. Check foreign-exchange treatment

For stablecoins, international payments and cross-border transfers, determine whether the transaction falls within the BCB's FX rules.

7. Save the date of the review

The transition continues to evolve.

Record:

• provider status;
• source;
• date checked;
• applicable resolution;
• agreement version.

This makes future updates auditable.

What users should expect from the 2026 framework

Brazil's regulatory model makes crypto services look more like regulated financial infrastructure.

Users should increasingly expect:

• identity checks;
• source-of-funds reviews;
• wallet-ownership verification;
• transaction monitoring;
• enhanced cross-border controls;
• documented custody processes;
• more formal complaints and compliance procedures.

That can create more friction than an offshore no-KYC platform.

The purpose is to place virtual-asset service provision within a supervised financial framework.

The important distinction is between:

more compliance friction

and

a prohibition on crypto ownership or self-custody.

They are not the same thing.

What the framework means for stablecoin users

Stablecoin users need to pay particular attention because one transaction can cross several regulatory layers.

A simple-looking remittance can involve:

BRL → Stablecoin → Blockchain transfer → Stablecoin → Foreign fiat

Each stage can involve:

• different providers;
• different exchange rates;
• custody;
• FX classification;
• transaction monitoring;
• recipient requirements.

The blockchain transaction is only one component.

For a reliable cost comparison, look at the entire route:

BRL paid → Fees → Exchange rate → Stablecoin amount → Transfer → Recipient amount

not merely the token's nominal 1:1 peg.

What the framework means for self-custody users

Self-custody remains possible.

But interaction between a regulated provider and a self-custody wallet increasingly sits inside a compliance process.

Users should be prepared to demonstrate:

• wallet ownership;
• asset origin;
• destination;
• transaction purpose where required.

From January 1, 2027, higher-value transfers covered by Resolution 584 can also be subject to the new temporary anti-fraud hold.

That makes withdrawal planning more important for time-sensitive transfers.

A regulated exchange withdrawal to self-custody can involve regulatory controls even though the destination wallet itself remains under the user's private-key control.

What the framework means for exchanges

For exchanges, the new regime creates a much higher operational bar.

A provider may need to address:

• authorization;
• capital;
• governance;
• custody;
• data security;
• AML/CFT;
• transaction traceability;
• stress testing;
• reporting;
• foreign-exchange rules;
• customer communication.

An exchange that previously served Brazil mainly through a translated website and offshore entity now faces a much more formal domestic regulatory environment.

That increases compliance cost.

It also gives users a more concrete basis for evaluating providers.

The most important 2026 shift is implementation

Brazil's virtual-asset law is no longer best described as:

“Brazil passed a crypto framework in 2022.”

That description misses the operational change.

The more accurate 2026 position is:

• Law 14,478 provides the legal foundation;
• Decree 11,563 assigns the main BCB role;
• Resolutions 519 and 520 create the authorization and provider framework;
• Resolution 521 connects specified crypto activity with FX and international-capital regulation;
• the CVM continues to supervise securities;
• implementation instructions are now active;
• transition milestones continue through late 2026;
• additional anti-fraud controls are already scheduled for 2027.

Brazil has moved from framework legislation into active implementation and supervision.

Conclusion

Brazil's crypto regulation is increasingly built around the activity being performed rather than the word used to describe the token.

The same blockchain asset can interact with different rules depending on whether it is being:

• traded;
• held in custody;
• used for international payment;
• transferred to self-custody;
• represented as a security;
• used inside a derivative.

That is why the strongest regulatory question is not:

Is crypto regulated in Brazil？

It is:

Who is providing which service, under which authorization, for which type of asset and transaction？

In 2026, the most important practical boundaries are clear.

BCB authorization does not replace CVM securities regulation.

A company in the authorization process is not the same as a finally authorized provider.

Fiat-referenced virtual-asset activity can fall within FX rules.

Self-custody is not prohibited, but regulated providers must apply compliance procedures to relevant transfers.

From October 30, 2026, regulated financial institutions face stronger restrictions on dealing with providers outside the BCB authorization framework.

From January 1, 2027, certain higher-value transfers to foreign providers and self-custody wallets will face additional anti-fraud controls.

For users, the right method is therefore:

Check the entity.

Check BCB status.

Check whether the CVM also has jurisdiction.

Check the transaction type.

Check custody and withdrawal rules.

Check the current regulatory date.

That is more reliable than treating one “Brazil regulated” badge as an answer to every crypto activity.

Frequently asked questions

What is Brazil's main crypto law？

Brazil's principal framework law is Law 14,478 of December 21, 2022.

It establishes guidelines for virtual-asset services and requires service providers operating in the country to obtain authorization under the federal regulatory framework.

Which regulator supervises crypto exchanges in Brazil？

Decree 11,563 assigns the main regulation, authorization and supervision of virtual-asset service providers to the Banco Central do Brasil.

However, the CVM retains authority over securities, including securities represented digitally as tokens.

When did the BCB's main 2026 crypto rules take effect？

Resolutions BCB 519, 520 and most of Resolution 521 took effect on February 2, 2026.

Certain reporting and international-capital provisions followed different implementation dates and have been amended during 2026.

What is an SPSAV？

SPSAV stands for Sociedade Prestadora de Serviços de Ativos Virtuais.

The BCB framework provides categories including virtual-asset intermediary, custodian and broker, each subject to the scope defined in the regulations.

Are all Brazilian crypto exchanges already fully authorized？

Not necessarily.

Final authorization, valid transition status and being in the authorization process are separate situations.

A provider's exact legal status should be checked rather than inferred from the fact that it continues operating in 2026.

What changes on October 30, 2026？

Resolution 520 provides that, from October 30, BCB-regulated financial and payment institutions will generally be restricted from carrying out or facilitating relevant virtual-asset market activity with service providers that are neither authorized nor in the BCB authorization process, subject to the regulation's exceptions.

Does BCB authorization cover security tokens？

No.

BCB authorization under Law 14,478 does not replace the securities regulatory framework.

The CVM retains authority over securities regardless of whether they are represented by tokens.

Are stablecoins regulated as foreign exchange in Brazil？

Specified activities involving virtual assets referenced in fiat currency fall within the foreign-exchange framework under Resolution 521.

That does not mean Brazil has one standalone stablecoin-issuer law covering every stablecoin structure.

The issuer, provider and transaction need to be analysed separately.

Can virtual assets be used for international payments？

Yes, but specified international payment and transfer services involving virtual assets fall within Brazil's foreign-exchange regulatory framework.

Relevant provider authorization, transaction limits and reporting rules can apply.

Did Brazil ban self-custody wallets？

No.

The rules expressly contemplate transfers to and from self-custody wallets.

Regulated providers may need to identify the wallet owner and verify the origin and destination of virtual assets.

Does a regulated exchange need my seed phrase to verify my wallet？

No.

A seed phrase or private key should not be handed to an exchange as ordinary proof of wallet ownership.

Providers can use other verification and documentation methods.

What is Resolution BCB 584/2026？

Resolution 584 is an anti-fraud measure published in August 2026.

From January 1, 2027, covered transfers above US$10,000 equivalent to foreign virtual-asset providers or self-custody wallets can be subject to a precautionary holding period of up to 24 hours while the provider performs additional risk analysis.

Is the 24-hour hold already in force？

No.

As of September 2026, the new holding requirement is scheduled to take effect on January 1, 2027.

Does the 24-hour rule permanently block withdrawals？

No.

The BCB describes it as a temporary precautionary holding mechanism.

A provider can complete the transfer before the 24-hour period expires once the required risk review is complete.

Does BCB regulation guarantee customer crypto balances？

No.

Authorization and supervision impose operational and conduct standards but do not create a blanket central-bank guarantee against market loss, cyber incidents, business failure or every custody loss.

Does Brazil's framework apply to tokenized securities？

The use of blockchain does not remove securities regulation.

Where a token is legally a security or represents a securities transaction, the CVM framework remains relevant.

How should I verify a provider in Brazil？

Use this chain:

Brand → Legal Entity → BCB Status → Service Category → Asset / Transaction Type → CVM or FX Boundary → Customer Agreement

Do not rely only on a company's marketing claim that it is “regulated in Brazil.”

Official sources

• Law 14,478 of 2022
• Decree 11,563 of 2023
• BCB — Regulation of virtual assets and service providers
• BCB — English explanation of Resolutions 519, 520 and 521
• Resolution BCB 520
• Resolution BCB 521
• BCB Instruction 701 — technical certification
• BCB Instruction 713 — PoR, staking and custody reporting
• BCB Instruction 756 — amended FX reporting timetable
• BCB — Resolution 584 anti-fraud measures
• CVM — BCB and CVM regulatory boundary
• CVM — When crypto assets fall under CVM rules
• CVM — 2026 Tokenization Working Group

Disclaimer: This article is for regulatory research and informational purposes only. It is not legal or investment advice. Provider authorization, transition status, reporting requirements and transaction controls can change, so current information should be verified against BCB, CVM and the applicable customer agreement before use.