Overview
Brazil's Crypto Assets Law and BCB Supervision
Brazil enacted Law 14.478 on December 27, 2022, establishing a comprehensive legal framework for virtual asset service providers. Presidential Decree 11.563/2023 subsequently designated the Banco Central do Brasil (BCB) as the regulatory and supervisory authority — a significant choice that signals Brazil's intention to treat crypto as a payments and financial services matter rather than a capital markets issue.
The framework defines virtual assets broadly (excluding financial instruments already regulated under CVM/securities law and central bank digital currencies) and requires all PSAVs — Prestadores de Serviços de Ativos Virtuais — to obtain prior BCB authorization before commencing operations. This applies to exchanges, custodians, transfer service providers, and intermediaries.
Brazil's crypto market is extraordinarily large: estimates suggest over 10 million Brazilians hold crypto assets, and the country has produced globally recognised exchanges such as Mercado Bitcoin and Foxbit. The BCB has a sophisticated regulatory approach informed by its experience with Brazil's Pix instant payment system and open banking (Open Finance) frameworks.
The BCB's capital adequacy approach for VASPs is calibrated to activity type and scale. The BCB also oversees cybersecurity standards, operational resilience, consumer protection, and AML/CFT compliance, with the COAF (Conselho de Controle de Atividades Financeiras) serving as Brazil's financial intelligence unit.
Transition Provisions
Entities already providing virtual asset services in Brazil before the BCB authorization framework fully came into effect were granted transition periods to regularize their operations. New entrants must obtain prior BCB authorization before commencing operations. BCB has been issuing detailed normative instructions and consultation papers that applicants must follow closely.
License Types
BCB PSAV Authorization Categories
Brazil's VASP framework categorizes activities based on function. BCB authorization is required for each category of virtual asset service an entity provides.
| PSAV Category | Core Activities | Oversight Intensity | Notes |
|---|---|---|---|
| Exchange (Corretora) | Spot trading: crypto/fiat and crypto/crypto | High — full BCB supervision | Most common category; high capital requirements |
| Custody (Custódia) | Safekeeping of virtual assets for third parties | High — operational standards | Key management, segregation requirements |
| Transfer Service | Initiating virtual asset transfers | Medium — payment oversight | Intersects with BCB payment regulation |
| Administration/Issuance | Token issuance, fund management | CVM may also apply | Securities analysis required; dual regulation possible |
Requirements
BCB PSAV Authorization Requirements
Legal Entity
Brazilian SA or Ltda
Incorporated in Brazil; SA preferred for larger operations
Capital Adequacy
BCB Activity-Based Assessment
Exchange: ~R$5M–R$20M equiv.; transfer services: lower
COAF Registration
Mandatory AML Registration
Register with COAF; implement BACEN/COAF-compliant AML program
Governance Structure
Board + Executive Officers
BCB-approved governance; Brazilian-resident director required
Cybersecurity Policy
BCB Resolution 4.658/2018 Aligned
Security policy, incident response, BCP/DRP documentation
Consumer Protection
PROCON + BCB Standards
Risk disclosures, complaint channels, transparent fee schedules
Fit & Proper
Directors + 15%+ Shareholders
Full background checks; BCB-specific fit-and-proper criteria
Operational Continuity
BCP + Recovery Plans
Business continuity and operational resilience documentation
Process
BCB PSAV Authorization Process
1
Establish Brazilian Legal Entity and Governance
Incorporate a Sociedade Anônima (SA) or Ltda under Brazilian law. Establish board governance structures meeting BCB standards, appoint qualified directors and executive officers, obtain a CNPJ (tax registration), and open Brazilian bank accounts. Engage Brazilian legal counsel specialising in BCB regulatory matters. Also register with COAF as a PSAV under COAF Resolution 36/2021.
6–10 weeks
2
Develop Compliance Framework and Technical Documentation
Build a comprehensive AML/CFT program aligned with COAF and BCB requirements, including customer due diligence (CDD), KYC procedures, PEP screening, transaction monitoring, and STR filing protocols. Develop cybersecurity policies per BCB Resolution 4.658 (adapted for VASPs), business continuity plans, consumer protection frameworks, and internal audit arrangements.
8–12 weeks
3
Prepare BCB Authorization Application Package
Compile the full BCB authorization application: corporate documents, business plan with 3-year financial projections, technology and cybersecurity documentation, AML/CFT manual, governance policies, fit-and-proper declarations for all relevant persons, capital adequacy documentation, and evidence of operational readiness. BCB requires significant technical detail and thorough documentation.
4–6 weeks
4
Submit to BCB and Navigate Review
Submit the PSAV authorization request through BCB's official channel. BCB will conduct a formal completeness check and assign examiners. Expect multiple rounds of questions and information requests (pedidos de informações complementares). Active engagement with BCB examiners is critical — delays typically result from incomplete documentation rather than substantive objections to the business model.
4–8 months
5
Receive Authorization and Launch
Upon BCB approval, receive the PSAV authorization. The entity is published in BCB's public registry of authorized institutions. Commence operations in accordance with the authorized scope, implementing all required consumer protections and reporting obligations. File periodic reports with BCB and COAF, and prepare for BCB on-site inspections which typically occur within the first year of operations.
2–4 weeks
Costs
BCB PSAV Authorization Cost Breakdown
| Cost Item | Details | Estimated Cost (USD) |
|---|---|---|
| Brazilian Company Formation | SA/Ltda incorporation, CNPJ, registered address (1st year) | $3,000–$8,000 |
| BCB Authorization Fee | BCB-prescribed authorization application fee | $2,000–$5,000 |
| Capital Requirement | Paid-up capital (exchange operations; BCB-assessed) | $1,000,000–$4,000,000+ |
| Brazilian Legal Counsel | BCB regulatory counsel, application preparation, ongoing support | $50,000–$120,000 |
| AML/CFT Framework | COAF-compliant program development, compliance officer | $20,000–$50,000 |
| Technology & Cybersecurity Audit | Security assessment, BCB cybersecurity documentation | $15,000–$40,000 |
| Local Operational Costs | São Paulo/Rio office, local compliance staff, annual running costs | $60,000–$150,000/yr |
| Estimated Total (Year 1) | All-in including capital, setup, legal, compliance (exchange operations) | $1.15M–$4.37M+ |
FAQ
Frequently Asked Questions
Brazil's crypto regulatory framework is governed by Law 14.478 of December 2022 (the Crypto Assets Law / Lei das Criptomoedas), which was regulated by Presidential Decree 11.563 of June 2023. This legislation designated the Banco Central do Brasil (BCB) as the primary supervisor for virtual asset service providers (PSAVs). The CVM (Comissão de Valores Mobiliários) retains jurisdiction over virtual assets that qualify as securities.
Yes. Under Brazil's Crypto Assets Law, any entity providing virtual asset services in Brazil on a professional basis must obtain prior authorization from the Banco Central do Brasil. Operating without BCB authorization is prohibited and may result in significant administrative penalties, prohibition orders, and closure of operations. The requirement applies to both Brazilian-headquartered entities and foreign entities directing services at Brazilian customers.
The BCB PSAV authorization process is estimated to take 6–12 months for a complete, well-prepared application. BCB conducts a thorough review of all aspects of the business, compliance framework, capital adequacy, and technical infrastructure. Multiple rounds of information requests are typical. Applicants who engage Brazilian regulatory counsel and prepare comprehensive documentation upfront tend to have shorter review timelines.
BCB has not published a single fixed minimum capital figure; requirements are graduated based on the type and scale of VASP activities. Exchange and custody operations require substantially higher capital than pure transfer services. BCB evaluates capital adequacy as part of the authorization review. For exchange operations of material scale, capital in the range of R$5M–R$20M (approximately USD 1M–4M) is consistent with BCB standards, though individual requirements may differ.
Yes. BCB authorization requires a Brazilian legal entity — most commonly a Sociedade Anônima (SA) — incorporated in Brazil, with a registered address, qualified local directors, and substantive operational presence in the country. Foreign groups targeting Brazilian customers must establish a Brazilian subsidiary. BCB takes a dim view of structures that seek to provide Brazilian-directed services from offshore entities while avoiding Brazilian regulatory oversight.
The total cost typically ranges from BRL 150,000 to BRL 500,000 depending on your business model and complexity, including application fees, legal counsel, compliance infrastructure, and ongoing operational expenses. The BCB does not publish fixed licensing fees, but you should budget for consulting services, audit requirements, and system implementations to meet regulatory standards. Banking setup costs can add an additional BRL 50,000 to BRL 200,000 depending on your chosen financial institution.
Required documents include detailed business plans, AML/KYC policies, organizational structure charts, financial statements for the last two years, IT security assessments, shareholder identification documents, and proof of compliance infrastructure. You must also provide evidence of adequate cybersecurity measures, transaction monitoring systems, and customer due diligence procedures aligned with COAF (Financial Activities Control Council) standards. A comprehensive risk management framework addressing operational, market, and legal risks is mandatory.
Brazil's BCB PSAV process typically takes 6 to 12 months, making it longer than Mexico's fintech licensing (4-6 months) but comparable to Argentina's regulatory framework. Unlike El Salvador's Bitcoin-friendly approach, Brazil requires comprehensive compliance documentation similar to Chile's more rigorous standards. The extended timeline reflects Brazil's cautious regulatory stance and the BCB's thorough due diligence process.
Crypto VASPs must comply with income tax on trading profits (assessed at corporate rates between 15% and 34% depending on structure), VAT on certain services, and mandatory reporting to the Federal Revenue Service (RFB) through the Sistema Público de Escrituração Digital (SPED). You are also subject to PIS/COFINS taxes on gross revenue and must report client transactions to COAF if they exceed notification thresholds. Tax-qualified accounting and legal advisors specializing in crypto are essential to avoid penalties.
Major banks like Banco do Brasil, Itaú, and Bradesco have established crypto-friendly protocols, though many require BCB authorization confirmation before opening accounts. Smaller banks and fintech institutions like Nubank and Inter have more flexible policies but still demand comprehensive compliance documentation. Banking relationships remain challenging due to de-risking concerns; many institutions still view crypto businesses as high-risk and may impose additional due diligence or higher fees.
Licensed VASPs must submit annual compliance reports to the BCB, maintain real-time transaction monitoring systems, and conduct yearly internal audits with third-party validation. Regulations require continuous updates to AML/KYC procedures as regulatory guidance evolves, and capital requirements may be reassessed based on operational scale. Non-compliance can result in fines up to BRL 2 million, license suspension, or revocation.
Brazil's regulatory environment remains subject to rapid changes, with the BCB and Congress potentially implementing stricter capital requirements or transaction limits without advance notice. Consumer protection agencies and the Federal Public Ministry have increased scrutiny of crypto platforms following fraud cases, creating litigation and reputational risks. Additionally, uncertainty around stablecoin regulation and potential restrictions on peer-to-peer transfers could impact your business model mid-operation.
Related Jurisdictions
Compare Latin American Crypto Licenses
◆ KEY METRICS
Brazil VASP Authorization Requirements 2026
R$ 500,000
Minimum Capital Requirement
90-120 Days
BCB Processing Timeline
R$ 25,000
Initial Authorization Fee
15%
Corporate Income Tax Rate
Banco Central do Brasil
Regulatory Authority
Crypto-Native Regulation
Key Benefit: Law 14.478/2022
◆ LICENSING PROCESS
BCB VASP Authorization Timeline 2026
1
Week 1-2
Document Preparation & Registration
Compile corporate bylaws, AML/CFT policies, governance structure, beneficial ownership disclosures, and technical infrastructure documentation
2
Week 3-4
BCB Portal Submission
Submit complete application via BCB's online portal with proof of R$ 500,000 minimum capital and authorization fee payment
3
Month 2-3
Initial Review & Deficiency Resolution
BCB conducts completeness review; respond to information requests and provide additional documentation if required
4
Month 3-4
Substantive Evaluation
BCB evaluates compliance with Law 14.478/2022, operational readiness, risk management framework, and VASP category authorization requirements
5
Month 4
Authorization & Registration
BCB issues formal VASP authorization certificate; entity registers in official BCB register and begins regulated virtual asset service operations