Operating a crypto exchange in Brazil without the correct regulatory authorisation exposes the business to enforcement action, payment-rail suspension and the loss of banking relationships that can take months or years to rebuild. Brazil's digital-asset framework has moved decisively: Law 14,478/2022 – the country's landmark virtual-asset legislation – established the regulated perimeter, and the Banco Central do Brasil (BCB), the central bank, now acts as the primary supervisory authority for virtual asset service providers. Any inbound operator evaluating Brazil must understand what the regime demands, where the cross-border interaction points are, and how the licensing decision connects to the broader corporate, tax and banking stack.
What Does Brazilian Crypto Regulation Actually Require?
The regulated perimeter in Brazil is defined by Law 14,478/2022 and the BCB's implementing regulations, which designate virtual asset service provider activity – including exchange, custody, transfer and brokerage – as a regulated financial activity requiring prior authorisation from the BCB. The term VASP (virtual asset service provider) in the Brazilian context captures any entity that professionally provides at least one of those services to customers in Brazil, regardless of where the entity is incorporated. This extraterritorial reach is the single most common structural issue we encounter when advising inbound operators. A company incorporated in the British Virgin Islands or in a European Union member state that actively markets or onboards Brazilian users is, under the BCB's reading, within the perimeter and required to obtain regulatory authorisation.
The framework aligns closely with the FATF Recommendation 15 standard, which requires countries to regulate VASPs for anti-money-laundering and counter-financing-of-terrorism purposes. Brazil implemented the FATF virtual-asset guidance through the BCB's resolution framework, meaning AML, KYC and – critically – Travel Rule compliance (the obligation to transmit originator and beneficiary data alongside each transfer) is baked into the authorisation requirements from day one. Operators who treat the Travel Rule as an afterthought routinely hit compliance gaps at the onboarding-documentation stage of their BCB submission.
The BCB is the licensing authority for VASPs in Brazil. The Brazilian Securities and Exchange Commission, the Comissão de Valores Mobiliários (CVM), retains jurisdiction over crypto-assets that qualify as securities under Brazilian securities law. The line between BCB territory and CVM territory turns on the nature of the token – and, as operators know, that line is contested. An exchange that lists tokens with equity-like characteristics needs to assess CVM exposure in parallel with the BCB authorisation process.
Who Needs BCB Authorisation to Operate in Brazil?
Any business providing virtual asset services to Brazilian residents on a professional and habitual basis requires BCB authorisation, whether or not the entity has a local corporate presence. The regime does not limit itself to domestic companies. In our practice advising cross-border operators, we see two recurring situations: first, a foreign-incorporated exchange that begins onboarding Brazilian users under the assumption that an offshore licence is sufficient; second, a Brazilian-incorporated entity that launches without a timeline for regulatory authorisation, relying on transitional grace periods that the BCB has progressively narrowed.
A common assumption among operators is that a single offshore licence – a BVI VASP registration or a MiCA-passported CASP authorisation from an EU member state – is sufficient to serve clients globally, including in Brazil. It is not. Brazil's regime is domestic and self-standing. An EU authorisation has no passport effect in Brazil. A BVI registration carries no mutual recognition. The BCB's authorisation is a separate, standalone requirement that sits on top of any group-level licence the operator holds elsewhere.
The practical implication is a dual-track compliance structure for most inbound operators: maintaining the offshore group licence for the jurisdictions in which it operates, while pursuing Brazilian authorisation for the local business. These tracks have different documentation requirements, different KYC standards and different ongoing reporting obligations. Conflating them is a structural error that surfaces during the BCB review process.
For a scoped assessment of your Brazil entry position, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity structure, the user base, the token list and the banking – change the analysis.
How Does the BCB Authorisation Process Work?
The BCB authorisation process for a VASP is a structured administrative procedure requiring the submission of corporate documentation, a compliance programme, a business plan, AML/KYC policies, IT security assessments and, in most configurations, evidence of minimum capital adequacy – the precise capital threshold varies by the scope of authorised activities and the BCB's current published requirements, which operators should verify directly from the BCB's published regulatory instruments before submission. The BCB reviews submissions in phases: a completeness check, a technical review of the compliance framework, a fit-and-proper assessment of the beneficial owners and directors, and a final authorisation decision.
Timeline is one of the most frequently asked questions we receive. The BCB process is not a simple registration – it is a full regulatory authorisation review, and the timeline reflects that. Based on the publicly stated BCB framework and the experience of operators who have engaged with the process, a realistic planning horizon runs from several months from a complete submission to a decision. Incomplete submissions – missing a governance policy, an AML officer appointment or the required corporate chart – reset the clock. Pre-submission preparation is therefore not optional; it is the primary variable an operator controls.
The BCB operates an entity-level authorisation. If the operating entity and the custody entity are separate – a common structure for exchanges that segregate trading from safeguarding – each entity carrying out regulated activity requires its own authorisation. This is a structural decision that should be made before incorporation, not after the first submission has been filed.
In a recent engagement, a Latin American payments company sought to add virtual asset exchange services to an existing regulated operation in Brazil. The entity had BCB authorisation for payment services but had not assessed whether the virtual asset activities required a separate VASP authorisation. We reviewed the activity scope, identified the gap, and structured the authorisation application to align the existing compliance programme with the BCB's virtual asset requirements. The outcome was a clean submission with no material queries from the BCB on the compliance framework – a result that, in our experience, depends almost entirely on the quality of the pre-submission preparation.
What Corporate Structure Works Best for Brazil Entry?
The optimal corporate structure for a crypto exchange entering Brazil depends on three variables: the scope of activities, the group's existing jurisdictional footprint and the tax treatment of the Brazil operation. Most inbound operators face a choice between establishing a Brazilian subsidiary (a sociedade limitada or a sociedade anônima, the Brazilian equivalent of a limited liability company or a joint-stock company) that applies for BCB authorisation in its own name, or establishing a representative or service structure that routes regulated services through a locally authorised entity.
The subsidiary model is the cleaner path for an exchange that intends to onboard Brazilian retail or institutional clients directly. It creates a clear regulatory perimeter, a defined capital base and a single point of accountability for the BCB. The service or representative structure may be appropriate for operators providing infrastructure or white-label services to a locally authorised exchange, but it carries its own tax and transfer-pricing considerations that require careful analysis before implementation.
Tax interaction is not a secondary concern. Brazil taxes corporate income at rates that, combined with the social contributions applicable to financial entities, can produce an effective rate that is materially higher than the equivalent in Singapore, the UAE or a common-law offshore hub. Withholding tax on cross-border payments – royalties, service fees, interest – requires attention when the Brazil subsidiary is paying group entities for technology or IP licences. The Brazilian transfer-pricing regime has been substantially revised in recent years to align more closely with OECD standards, and the implications for inbound digital-asset groups require specific analysis. We structure these mandates as a single licence, banking and tax review rather than three disconnected workstreams.
How Do Banking and Payment Rails Work for Crypto Exchanges in Brazil?
Banking access is the operational bottleneck that most legal analyses of Brazil underweight. BCB authorisation resolves the regulatory question. It does not, on its own, open a bank account. Brazilian financial institutions – including the digital banks that have been relatively open to fintech relationships – conduct their own KYC and compliance reviews of VASP clients, and a number of incumbent banks remain cautious about onboarding crypto exchange operators, even authorised ones.
The Brazilian real-time payment system, PIX, is deeply integrated into the retail financial environment and is the primary payment rail for consumer-facing crypto on-ramps and off-ramps in Brazil. Access to PIX requires a relationship with a BCB-regulated participant institution. For a newly authorised VASP, securing a PIX-enabled banking relationship requires engagement with smaller payment institutions or fintechs that have a risk appetite for the sector, while larger banks are engaged in parallel on a longer timeline.
The cross-border dimension adds another layer. Remittances out of Brazil – moving trading proceeds or operational revenue to a group treasury entity – are subject to BCB foreign exchange rules and CVM reporting requirements where securities are involved. Operators who have not modelled the cross-border cash-flow structure before applying for authorisation routinely find that the banking and FX architecture does not support the flow of funds the business model requires.
If a prior banking relationship failed or a prior application stalled, a second read of the structure can surface the reason and the route back. To discuss a specific situation, write to info@oboluslaw.com or message us at t.me/oboluslaw.
What AML and Travel Rule Obligations Apply to Brazilian VASPs?
Brazilian VASPs are subject to the full FATF-aligned AML/CFT regime administered by the BCB, including mandatory customer due diligence, transaction monitoring, suspicious transaction reporting to the Conselho de Controle de Atividades Financeiras (COAF) – Brazil's financial intelligence unit – and compliance with the Travel Rule for virtual asset transfers. The BCB's implementation of the Travel Rule requires VASPs to collect, verify and transmit originator and beneficiary information on qualifying transfers; the applicable threshold and technical transmission standards are set in the BCB's published regulatory instruments, and operators should verify current requirements directly rather than relying on earlier-cycle summaries.
The AML programme submitted as part of the BCB authorisation application is not a box-checking exercise. The BCB expects a programme that is calibrated to the operator's specific risk profile: the customer base, the geographic footprint of counterparty VASPs, the token list and the transaction size distribution. Generic AML templates that are not adapted to the Brazil operation are among the most common causes of BCB queries at the technical review stage.
COAF reporting obligations run from the date of authorisation – and, where a transitional arrangement applies, from the date the operator commences business in Brazil. The first reporting cycle is frequently where newly authorised VASPs encounter compliance gaps, not because the programme is deficient, but because the operational team has not been trained to the Brazilian reporting standard specifically. Pre-launch compliance training tied to the specific BCB and COAF requirements is, in our view, a non-negotiable part of the go-live checklist.
Which Operator Profile Should Prioritise Brazil?
Not every crypto business should prioritise Brazil as its first or primary licensing jurisdiction. The following decision matrix maps four common operator profiles to the Brazil entry question.
Profile A – a well-capitalised exchange with an existing LATAM user base: Brazil is a high-priority market. The user base already exists, the regulatory regime is established, and delay creates enforcement exposure as the BCB tightens transitional arrangements. The right move is a dedicated Brazil authorisation, a Brazilian subsidiary and a PIX-enabled banking relationship, structured in parallel. Timeline: several months from a complete and well-prepared submission.
Profile B – a mid-size exchange planning LATAM expansion: Brazil is the anchor jurisdiction. Authorising in Brazil does not preclude separate licensing in other LATAM jurisdictions, but it creates the compliance infrastructure – AML programme, governance framework, BCB reporting – that can be adapted across the region. The decision axis is whether to start with Brazil or with a smaller market for proof of concept. In most cases, beginning with Brazil is the more defensible commercial and regulatory decision.
Profile C – a token issuer without exchange services: The BCB perimeter captures exchange and transfer services. A pure token issuance may fall primarily within the CVM's jurisdiction if the token is characterised as a security, or may require a separate analysis if it is structured as a payment or utility instrument. The regulatory question must be resolved before launch, not after.
Profile D – a custody-only operator: Custody of virtual assets for third parties is a regulated activity under the Brazilian framework. A custody-only operator requires BCB authorisation scoped to the custody activity. The capital and compliance requirements for a custody operation differ from those for a full exchange, but the authorisation requirement is the same.
What Are the Most Common Mistakes in Brazilian Crypto Licensing?
Operating without BCB authorisation while serving Brazilian users is the foundational error, and it is more common than the industry acknowledges. Operators frequently underestimate the extraterritorial scope of the regime, assuming that because their entity is incorporated offshore and their servers are outside Brazil, Brazilian regulation does not apply. The BCB's position – consistent with the FATF standard – is that the relevant fact is where the customer is, not where the server is.
A second recurring mistake is treating the Brazilian authorisation as procedurally similar to a simpler registration regime, such as the BVI VASP Act or the earlier Lithuanian VASP registration. It is not. The BCB process is substantively closer to a full licence application in Singapore or Hong Kong than to a lighter registration model. Operators who staff it as a documentation exercise rather than a compliance-architecture exercise routinely produce submissions that are returned for substantive revision.
Third, the custody and exchange perimeters are frequently conflated. An exchange that holds client assets – even temporarily, in a hot wallet during a transaction cycle – may be carrying out custody as a regulated activity alongside the exchange service. Mapping the activity precisely against the BCB's activity categories before submission avoids the structural error of under-scoping the authorisation.
Fourth, AML programme adaptation. Operators with a compliant AML programme for an EU or Singapore operation sometimes submit that programme to the BCB with minimal adaptation. The BCB expects a programme calibrated to the specific risk profile of the Brazil operation and aligned to COAF reporting standards. The gap between a generic global AML policy and a BCB-ready AML programme is usually significant.
Related at OBOLUS
- Licensing and registration for digital-asset businesses – the full practice overview across 70+ jurisdictions and licensing structures.
- Digital-asset licensing in the Isle of Man – an alternative common-law hub with a distinct regulatory approach for VASPs and token businesses.
- MiCA whitepaper review in the British Virgin Islands – how BVI-incorporated groups manage MiCA compliance for EU-facing token offerings.
FAQ
How long does a crypto licence take to obtain?
In Brazil, the BCB authorisation process is a full regulatory review, not a simple registration. Timeline from a complete submission varies depending on the complexity of the business model and the quality of the compliance framework submitted. A realistic planning horizon runs from several months. Incomplete submissions and generic AML documentation are the most common causes of delay. Pre-submission preparation is the primary variable the operator controls.
Which jurisdiction is best for licensing my crypto business?
There is no single answer. The optimal jurisdiction depends on where your users are, where you can bank, the scope of your services, your corporate and tax structure, and your group's existing regulatory footprint. For businesses serving Brazilian users, BCB authorisation is a standalone requirement that no offshore licence replaces. For the group-level structure, the answer turns on the specific facts. We map the full licence stack before you commit to any structure.
Do I need a separate custody licence?
In Brazil, custody of virtual assets for third parties is a regulated activity under the BCB framework. If your exchange holds client assets – even in the course of a transaction cycle – the custody element may require authorisation in its own right, or the exchange authorisation must be scoped to cover it. The answer depends on the precise activity and how it maps to the BCB's published activity categories. Mapping this accurately before submission avoids a material gap in the authorisation.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We structure licensing, banking and tax as one mandate rather than three disconnected workstreams – mapping the full licence stack across operating, custody and payment layers before you commit. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in inbound licensing strategy for crypto exchanges and digital-asset businesses across emerging and frontier regulatory regimes, including Latin America.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.