Brazil Crypto License: VASP Registration Under Law 14.478

A Brazil crypto license is a Banco Central do Brasil (BCB) authorization to operate as a virtual asset service provider (VASP, or PSAV in Portuguese). Under Law 14.478/2022, any legal entity that exchanges, transfers, or custodies virtual assets for third parties must be authorized and supervised by the BCB.

Brazil spent three years moving from a framework statute to a working licensing regime. That regime is now operational. On 10 November 2025 the Banco Central do Brasil published Resolutions BCB 519, 520 and 521, which entered into force on 2 February 2026. If you have read older guidance describing Brazil as a market where "rules are expected in 2026," that framing is out of date. This guide sets out the live regime, the regulators behind it, what you need to be authorized, and how the process and timeline actually work.

*By Magnus Müller · Reviewed by Magnus Müller · Last updated: 2026-06-14*

Is Crypto Legal and Licensed in Brazil? (Status in 2026)

Yes. Crypto is legal in Brazil and now requires a license for service providers. Virtual assets have had a dedicated statute since Law 14.478/2022 entered into force on 19 June 2023, and the BCB authorization regime for VASPs went live on 2 February 2026. Running a crypto business now means obtaining and maintaining a BCB authorization.

Quick answer: yes, the VASP authorization regime is live since 2 February 2026

For several years, Brazil had a law but no operating authorization process. That gap closed in early 2026. The Banco Central do Brasil published Resolutions BCB 519, 520 and 521 on 10 November 2025, and they took effect on 2 February 2026. From that date, providing virtual asset services to Brazilian clients is a regulated, authorized activity, not an unregulated one. Two figures you may still see online are now superseded: the claim that "final rules are expected in 2026" and the old "BRL 1 to 3 million minimum capital" number. Both have been overtaken by the live framework.

What changed in 2025 to 2026

The change is structural, not cosmetic. Before, Law 14.478/2022 defined what a virtual asset and a VASP are, designated the BCB as regulator, and brought VASPs into the anti-money-laundering regime, but it left the operating rules to the central bank. Those operating rules arrived as three resolutions plus a procedural instruction. Resolution BCB 519 sets the authorization process; Resolution BCB 520 sets operational, prudential and conduct rules; Resolution BCB 521 integrates crypto into the foreign-exchange framework. Some foreign-exchange provisions in Resolution 521 are reported to be phased to May 2026 rather than 2 February 2026, a point we confirm against the BCB text before relying on it (see VERIFY notes below).

Brazil's Virtual Assets Legal Framework: Law 14.478/2022

Law 14.478/2022, formally the "Marco Legal dos Ativos Virtuais" (Virtual Assets Legal Framework), is the foundation of crypto regulation in Brazil. It was enacted on 21 December 2022 and entered into force on 19 June 2023 after a 180-day vacatio legis. The statute defines virtual assets, defines who counts as a VASP, designates the regulator, and amends Brazil's anti-money-laundering law to cover the sector.

What is a virtual asset under Brazilian law (art. 3)

Under article 3 of Law 14.478, a virtual asset is a digital representation of value that can be traded or transferred by electronic means and used for making payments or for investment purposes. The definition deliberately carves out several things: national and foreign fiat currency, electronic money governed by Lei 12.865/2013, loyalty and rewards points, and securities and financial assets already regulated by existing law. That last exclusion matters: security tokens are not "virtual assets" for this statute, and they remain under the CVM and Law 6.385/1976.

What is a PSAV / VASP (art. 5)

Article 5 defines a PSAV (prestadora de serviços de ativos virtuais), the Brazilian term for a VASP. A PSAV is a legal entity that, on behalf of third parties, performs at least one of these services:

• Exchange between virtual assets and national or foreign currency.
• Exchange between one virtual asset and another.
• Transfer of virtual assets.
• Custody or administration of virtual assets, or of instruments that enable control over them.
• Participation in, and provision of, financial services related to the offer by an issuer or the sale of virtual assets.

If your business performs any one of these activities for clients, you fall within the art. 5 definition and need BCB authorization.

How Law 14.478 amended the AML regime

Law 14.478 did more than define terms. It amended Lei 9.613/1998, Brazil's anti-money-laundering law, to bring VASPs expressly into the obligated-party regime. That means KYC, transaction monitoring, and suspicious-transaction reporting to COAF, aligned with FATF recommendations. The statute also aggravated a fraud offence involving virtual assets in the Penal Code. In practice, AML compliance is not an add-on for a Brazilian VASP; it is a statutory duty baked into the framework from the outset.

Who Regulates Crypto in Brazil? BCB, CVM and COAF

Three bodies share oversight of the Brazilian crypto market, and knowing which one applies to you is the first practical question. The Banco Central do Brasil authorizes and supervises VASPs, the CVM steps in where a token is a security, and COAF receives AML reporting. The legal base for this split is Law 14.478/2022 and Decree 11.563/2023, which designated the BCB as the competent authority.

Banco Central do Brasil (BCB): the VASP authority

The Banco Central do Brasil is the lead authority. Decree 11.563/2023, published in March 2023, designated the BCB to regulate, authorize and supervise virtual asset service providers under Law 14.478. The BCB now applies the same prudential authorization model it uses for banks and brokers, which is why the resolutions speak the language of capital adequacy, controller suitability and governance rather than a light-touch registration.

CVM: where the token is a security

The Comissão de Valores Mobiliários (CVM) is the securities regulator. Where a token qualifies as a security or a collective-investment contract, it falls outside Law 14.478 and under the CVM and Law 6.385/1976 instead. This is the single most important classification step in any Brazilian project: a token that is a security is regulated as a security, not as a virtual asset, and the application route changes accordingly.

COAF: AML/CFT reporting

COAF (Conselho de Controle de Atividades Financeiras) is Brazil's financial intelligence unit. VASPs report suspicious transactions to COAF as obligated parties under the amended Lei 9.613/1998. COAF does not authorize anyone; it is the destination for the AML/CFT reporting that the BCB framework requires every authorized VASP to maintain.

The Live Authorization Regime: BCB Resolutions 519, 520 and 521

The three resolutions published on 10 November 2025 are the heart of the live regime. Each addresses a different layer of VASP operation, and together with Normative Instruction BCB 704 they make authorization a concrete, document-driven process. The table below summarizes their scope.

Resolution BCB 519: the authorization process

Resolution BCB 519 sets the authorization process, aligning VASP licensing to the same prudential model the BCB applies to banks and brokers. An applicant must demonstrate financial capacity, lawful origin of capital, integrity and suitability of its controllers, an adequate governance structure, technological adequacy, and the relevant capital and net-worth thresholds. This is a prudential authorization, not a notification. The bar is deliberately set at the level expected of a regulated financial institution.

Resolution BCB 520: operations, conduct and AML

Resolution BCB 520 governs how an authorized VASP operates. It defines the VASP modalities (intermediation or brokerage, custody, and exchange), mandates segregation of client assets from the firm's own assets with no proprietary use of customer virtual assets, and requires governance, independent audit and a full AML/CFT (PLD-FT) program. Critically, Resolution 520 requires a designated executive responsible for AML/CFT. Client-asset segregation is one of the most consequential rules in the whole regime for any exchange or custody business.

Resolution BCB 521: foreign-exchange integration

Resolution BCB 521 integrates virtual-asset operations into the câmbio (foreign-exchange) and international capital-markets framework. In effect, cross-border crypto flows become subject to FX-style reporting and declaration obligations. Sources indicate that some provisions of Resolution 521 are phased to May 2026 rather than taking effect with the rest of the package on 2 February 2026. We treat the precise phasing as a point to confirm against the BCB normative text before relying on it (see VERIFY notes).

Normative Instruction BCB 704: the procedural detail

Normative Instruction BCB 704, in force 2 February 2026, supplies the procedural layer the resolutions leave open. It details the documents an applicant must submit, the deadlines that apply, and the internal flow of the authorization procedure inside the BCB. If Resolution 519 is the "what," Normative Instruction BCB 704 is the "how" of filing a complete and acceptable application.

Requirements to Be Authorized as a VASP (PSAV) in Brazil

Authorization under the live regime is demanding. It combines corporate, prudential, governance and AML obligations, and it expects an applicant to look and operate like a supervised financial institution. The core requirements are below.

Brazilian legal entity and local presence

A PSAV must be a Brazilian legal entity (pessoa jurídica) with local presence and BCB authorization. There is no route to operate the regulated activity directly through a foreign shell; the entity that holds the authorization is incorporated and grounded in Brazil. For foreign founders this means establishing a local company before the authorization request can be filed.

Minimum capital and net worth

Capital is the requirement most often misreported. The minimum capital and net worth are reportedly scaled by activity and complexity, in a band of roughly BRL 10 million to BRL 37 million, a substantial step up from the BRL 1 to 3 million figure floated during consultation. We do not publish a single hard number, because the exact tiers must be confirmed against the text of Resolutions 519 and 520. Treat the band as indicative and the precise tier for your activity as a verification step (see VERIFY notes). The one thing that is settled: the old BRL 1 to 3 million figure is superseded.

Governance, suitability and independent audit

Applicants must show suitability and integrity of controllers and managers, lawful origin of capital, a governance structure proportional to business complexity, and independent audit. These are standard prudential expectations, and the BCB assesses them as part of the Resolution 519 authorization. Weak controller suitability or unverified capital origin is a common reason prudential applications stall.

Client-asset segregation

Resolution BCB 520 mandates segregation of client assets from the firm's proprietary assets and prohibits proprietary use of customer virtual assets. For exchanges and custodians this is operationally significant: customer holdings cannot be commingled with the firm's own balance sheet or deployed for the firm's own purposes. Segregation must be designed into the operating model, not retrofitted.

AML/CFT program and the designated executive

Every authorized VASP runs a full AML/CFT (PLD-FT) program: KYC, transaction monitoring, suspicious-transaction reporting to COAF, and a designated AML/CFT executive, with travel-rule-style counterparty controls. A reported USD 100,000 limit applies to transactions with unauthorized or unregulated counterparties, and declarations are required for virtual assets sent or received abroad. These controls are statutory, flowing from the Lei 9.613/1998 amendment and reinforced by Resolution 520.

Book a free 15-minute discovery call with our licensed advisors. If you are weighing a Brazilian VASP authorization, our team can map your activity to the right resolution, the right capital tier and the right regulator before you commit. No obligation. Book a Call

How to Get a Brazil Crypto License: Process and Timeline

Authorization is a structured, multi-stage process built on Resolution 519 and the procedural detail in Normative Instruction BCB 704. The sequence below reflects how a prudential application actually progresses, and how long each phase realistically takes.

Step-by-step authorization process

1. Classify the activity. Confirm whether your service is a VASP service under art. 5 of Law 14.478, and whether any token you handle is a security (which routes to the CVM rather than the BCB).
2. Incorporate the Brazilian entity and assemble the governance, capital and compliance documentation.
3. File the authorization request with the BCB under Resolution BCB 519 and the procedure in Normative Instruction BCB 704, covering financial capacity, controller integrity, governance, AML/CFT and technology.
4. BCB review under the prudential authorization model.
5. Authorization granted, then ongoing supervision: prudential reporting, AML/CFT reporting to COAF, FX reporting for cross-border flows under Resolution 521, and independent audits.

How long does BCB authorization take

There is no statutory fixed turnaround. A BCB authorization follows the prudential model and is multi-month. New entrants should budget several months to roughly a year or more, given the depth of documentation and review. We present this as an estimate, not a guarantee. Timelines depend heavily on how complete the initial filing is and how quickly the applicant can answer the BCB's follow-up requests.

Transition period for existing operators

Existing operators are not shut out overnight. They may continue operating during a compliance window provided they meet baseline conditions and must file for authorization or regularize within a transition window reported around late 2026 (sources cite roughly 270 days from publication, variously late October or November 2026). We confirm the exact deadline against the BCB normative text before relying on it. Separately, already BCB-supervised institutions such as banks, investment banks, FX banks and securities brokers may operate as PSAVs via simple prior notification rather than a fresh authorization.

Security Tokens, Cross-Border Flows and Special Cases

Not every crypto project follows the standard BCB VASP route. Securities, foreign institutions and cross-border flows each have their own treatment, and getting these distinctions right early avoids filing under the wrong regime.

When CVM (not BCB) applies: security tokens

If your token is a security, the BCB VASP route does not apply. Security tokens fall outside Law 14.478 and remain under the CVM and Law 6.385/1976. This carve-out is built into the art. 3 definition of a virtual asset, which excludes securities and financial assets already regulated by existing law. The practical consequence: a tokenized security issuance is a CVM matter, governed by securities law, not a BCB VASP authorization.

Foreign and already-licensed institutions

Foreign and already-licensed players have different paths. Already BCB-supervised institutions may operate as PSAVs via prior notification, a lighter route than full authorization. A fully foreign or offshore VASP serving Brazilian clients typically needs a Brazilian entity and BCB authorization, but the precise extraterritorial reach depends on how the provider serves Brazilian clients and should be confirmed against current BCB guidance rather than assumed (see VERIFY notes). For most market-entry projects, planning for a local entity is the prudent baseline. If you are also building the operating business, our guide on how to start a licensed crypto exchange covers the technical and legal layers.

Cross-border and FX reporting (Resolution 521)

Resolution BCB 521 brings virtual-asset cross-border flows into the foreign-exchange framework. Declarations are required for virtual assets sent or received abroad, and crypto câmbio operations become subject to FX-style reporting. Some of these FX provisions are reported to be phased to May 2026 rather than effective on 2 February 2026, a point to confirm against the BCB text. For any business with international flows, Resolution 521 reporting is a standing operational obligation, not a one-off filing.

How Crypto Valley Partners Helps You Get Authorized in Brazil

Crypto Valley Partners AG, based in Zug, Switzerland, advises founders, exchange operators and compliance officers on obtaining and maintaining crypto and VASP licenses worldwide. Brazil's prudential authorization model rewards precise preparation: the difference between a filing that progresses and one that stalls is usually the quality of the classification, governance and capital documentation submitted up front.

From our practice across jurisdictions, the recurring early wins are the same ones Brazil now demands: classify the activity against the statute before incorporating, confirm whether any token is a security so you file with the right regulator, design client-asset segregation into the operating model rather than bolting it on, and name a credible AML/CFT executive before review begins. We do not publish fixed timelines or fee figures, because each authorization depends on the activity mix, the capital tier and the completeness of the file. What we offer is a primary-source-grounded reading of Resolutions 519, 520 and 521 and a clear map of the steps ahead.

If you want to understand where Brazil sits relative to other markets, our pillar guides let you compare crypto licensing jurisdictions and read sibling country guides such as Dubai VARA crypto licensing and El Salvador crypto registration. For the compliance backbone every VASP needs, see our AML and KYC requirements guide, and for the broader role, our overview of VASP licensing explained.