For a payments or digital-asset business targeting Brazilian users, the legal question is not simply "which licence do we need" – it is whether the entity, its agreement with a PSP (payment service provider) or acquirer (the institution that processes card and account-to-account transactions on behalf of merchants), and its cross-border banking stack all sit inside the Brazilian regulatory perimeter. Operating without the right authorisation exposes the business to enforcement by the Banco Central do Brasil (BCB), the central bank that supervises payment institutions, contract termination by the acquiring partner, and the loss of fiat rails that took months to build. This page sets out the regulated basis, the inbound process, the cross-border interaction with tax and banking, and the decision point a counsel must reach before signing an acquiring or PSP agreement in Brazil.
Brazil's payments regime is governed by the BCB under the framework established by the Lei do Sistema de Pagamentos Brasileiros (the Brazilian Payments System Law) and the subsequent regulatory acts that created the Pagamentos Instantâneos infrastructure, better known as Pix. Any business that intermediates, acquires or settles payment transactions involving Brazilian residents must either hold a BCB authorisation or operate through an authorised partner under a formal agreement that allocates regulatory responsibility. For digital-asset businesses, a second layer applies: since the enactment of Brazil's Lei das Criptomoedas (the virtual assets law), service providers to Brazilian users require a licence from the BCB as a VASP (virtual asset service provider). The two regimes interact directly when a crypto business seeks an acquiring agreement.
Who Needs a PSP or Acquiring Agreement in Brazil?
Any business that accepts Brazilian reais from local users – whether for fiat-to-crypto conversion, merchant settlement or subscription billing – needs a contractual relationship with a BCB-authorised institution to move those funds. A foreign entity cannot simply open a merchant account with a Brazilian acquirer and begin processing; the acquirer is required by BCB rules to verify that its counterparty meets the applicable legal standard. For a crypto exchange or custodian, that standard now includes the VASP licensing requirement that came into effect under Brazil's virtual assets law. In practice, this means a business must resolve two parallel questions before it signs an acquiring or PSP agreement: does the business itself need a BCB authorisation, and does the agreement create a regulated relationship that the Brazilian institution can legally enter into?
The answer turns on the substance of the activity, not the label. A business that simply accepts payment for goods or services sits in a different category from one that holds client funds, converts currencies or provides payment initiation services. BCB has established licence categories for payment institutions – including issuers of electronic money, payment account holders and acquirers – and the applicable category determines both the authorisation route and the capital expectations. A digital-asset business offering conversion services sits closest to the issuer-of-electronic-money category, which carries its own client-money safeguarding obligations.
Brazil's Crypto Law and the BCB VASP Regime
Brazil's virtual assets law created a mandatory licensing regime for VASPs operating in or from Brazil, administered by the BCB following its designation as the competent authority. The regime covers entities that provide virtual asset services – including exchange, transfer, custody and the administration of virtual asset trading platforms – to users located in Brazil. The key threshold is not the location of the entity but the location of the users: a Cayman- or BVI-registered exchange targeting Brazilian residents falls within scope. BCB has issued implementing regulations that set out the categories of activity, the fit-and-proper requirements for controllers and managers, the AML/CFT obligations aligned with FATF Recommendation 15, and the minimum organisational standards.
For a business already operating under a foreign licence – whether a MiCA CASP (crypto-asset service provider) authorisation from an EU member state, a Singapore MAS digital payment token licence or a VARA authorisation from Dubai – the Brazilian regime does not provide automatic equivalence or passporting. Each of those regimes governs activity within its own perimeter. Brazil requires a separate analysis and, for most activities, a separate authorisation or an operating model built around an authorised local partner. In our cross-border practice, we have seen businesses assume that an EU or Gulf licence satisfies Brazilian requirements; it does not. The BCB conducts its own review of the entity's fitness, its AML programme and its technical infrastructure before granting authorisation.
To discuss your Brazil entry model before signing an acquiring or PSP agreement, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the user base, the banking – change the analysis. Map your options
What Does a PSP or Acquiring Agreement Actually Require?
A Brazilian PSP or acquiring agreement is a regulated contract, not merely a commercial arrangement. The BCB requires authorised institutions to conduct due diligence on their merchant and business partners, and the terms of the agreement must reflect the allocation of regulatory obligations between the parties. For a digital-asset business, the key provisions that a Brazilian acquirer or PSP will scrutinise include: the nature of the underlying transaction (is it a sale of goods, a conversion of virtual assets, or a payment initiation?); the VASP status of the counterparty; the AML/KYC programme in place; and the data-residency and customer-notification requirements under Brazilian consumer protection law.
In practice, Brazilian acquirers and PSPs have become significantly more cautious about onboarding crypto businesses since the virtual assets law came into force. An institution that signs an agreement with an unlicensed VASP assumes a compliance risk it cannot easily shed. As a result, the onboarding timeline for a crypto business seeking a Brazilian acquiring agreement is longer than for a conventional e-commerce merchant – it routinely involves a legal opinion on the business model, a review of the AML programme, and in some cases a pre-approval inquiry with BCB before the contract is finalised.
How Does the Inbound Process Work?
The inbound process for a foreign digital-asset business entering Brazil through a PSP or acquiring arrangement typically follows five stages, each of which has a legal dimension that affects the timeline.
First, the business must determine whether its activity requires a BCB VASP authorisation or whether it can operate under a commercial agreement with an authorised local institution that carries the regulatory burden. This is a substance question: if the foreign entity is the actual service provider to the Brazilian user, a direct authorisation is the cleaner path. If the local institution is the service provider and the foreign entity provides only technology or infrastructure, a different structure may be available.
Second, if a direct BCB authorisation is required, the business must establish a Brazilian legal presence – typically a sociedade limitada (limited liability company) or a sociedade anônima (corporation) – and appoint Brazilian-resident management who meet BCB's fit-and-proper standards. The corporate formation process itself adds to the timeline, as does the registration with the Receita Federal (the Brazilian tax authority) for a CNPJ (corporate taxpayer identification number).
Third, the BCB application process for a payment institution or VASP authorisation is document-intensive. BCB requires a detailed business plan, a description of the technology infrastructure, evidence of compliance systems, and a governance structure that satisfies the applicable regulatory acts. The review period varies by category and complexity; based on the regime's design, businesses should plan for a process measured in months rather than weeks.
Fourth, while the BCB application is pending, the business must simultaneously negotiate the acquiring or PSP agreement itself. The two processes overlap; a well-structured application to BCB is supported by evidence that the acquiring relationship is in place or substantially agreed. This requires coordination between the regulatory filing and the commercial negotiation.
Fifth, once both the authorisation and the agreement are in place, the business must maintain ongoing compliance: periodic reporting to BCB, AML/CFT programme updates, Travel Rule compliance for virtual asset transfers above the applicable threshold, and adherence to Brazilian consumer protection and data protection law under the Lei Geral de Proteção de Dados (LGPD).
Cross-Border Interaction: Tax and Banking
The tax and banking dimensions of a Brazilian PSP or acquiring agreement are inseparable from the regulatory analysis. Brazil taxes foreign exchange transactions through the IOF (Imposto sobre Operações Financeiras), a financial operations tax that applies to cross-border fund flows. The rate and exemption structure varies by the nature of the transaction, and the applicable treatment for virtual asset conversions requires specific analysis under the current BCB and Receita Federal guidance. A business that structures its fiat settlement outside Brazil to avoid IOF exposure runs a material risk: BCB and the Receita Federal cooperate on cross-border payment flows, and a structure that appears designed to strip the Brazilian tax base will attract scrutiny.
On the banking side, the challenge for foreign crypto businesses in Brazil mirrors the pattern we observe across other jurisdictions: Brazilian banks are cautious about holding correspondent balances for unlicensed VASPs, and an acquiring agreement that routes settlement through a foreign entity without a clear regulatory status creates a concentration of compliance risk that Brazilian institutions prefer to avoid. The practical implication is that the banking stack must be resolved before the acquiring agreement is signed, not after. A business that arrives at the contract negotiation without a clear answer on where settlement funds will sit, how they will be reported and who holds the regulatory relationship with the BCB will find the negotiation stalling on precisely those points.
In our cross-border practice, we regularly advise on the sequencing of these steps: entity formation, tax registration, BCB engagement, banking arrangements and then the acquiring agreement – in that order, with overlap managed carefully to avoid a situation where the commercial agreement is signed before the regulatory position is resolved.
A Cross-Border Exchange Structures Its Brazil Entry
In a recent matter, a digital-asset exchange registered in a Gulf free zone approached us after its initial attempt to onboard with a Brazilian PSP was declined. The PSP had cited the absence of a Brazilian corporate entity and an unresolved VASP licensing question under the BCB regime. We reviewed the business model, confirmed that the activity fell within the BCB's VASP perimeter, and structured a two-phase entry: an interim commercial agreement through an authorised local institution for a limited scope of activity, while the BCB VASP application was prepared and filed. The transaction set was narrow enough that the interim model was sustainable; the BCB application was structured around the full intended activity. By the time the authorisation was granted, the acquiring relationship was already operational for the permitted scope, and the expansion to full activity required only a notification to the PSP rather than a new commercial negotiation. The matter resolved within a single fiscal year.
What a Single Offshore Licence Cannot Do in Brazil
A common assumption among businesses entering Brazil is that a well-regarded offshore licence – whether from a British Virgin Islands VASP registration, a Cayman CIMA authorisation, or an EU MiCA CASP – satisfies Brazilian regulatory requirements by virtue of its status in the issuing jurisdiction. It does not. Brazil's virtual assets law is explicit: the BCB's jurisdiction extends to service providers operating in Brazil or targeting Brazilian users, regardless of the entity's domicile. An offshore licence demonstrates that the business meets the standards of another regime; it does not substitute for BCB review. In fact, BCB's implementing regulations require that the entity operating in Brazil – whether a branch, subsidiary or local partner – independently satisfies Brazilian fit-and-proper, AML and governance requirements.
The same logic applies to the acquiring agreement. A Brazilian acquirer or PSP that onboards a foreign entity relying solely on an offshore licence is itself taking a BCB compliance risk. In practice, the acquirer will require evidence of Brazilian regulatory status – or a clear legal opinion that the specific activity falls outside the BCB's licence perimeter – before it will finalise the agreement. A business that arrives without that evidence will either face a prolonged due-diligence process or a contractual structure that limits the permitted activity to a point where it is commercially unworkable.
If a prior application stalled or an acquiring negotiation hit a wall, a structured legal review can surface the reason and the route forward. Contact OBOLUS at info@oboluslaw.com or message us via t.me/oboluslaw. Map your options
Decision Point: Which Structure Fits Your Profile?
The right structure for a Brazil entry depends on three variables: the nature of the activity, the intended user volume, and the timeline to revenue. We summarise the principal profiles below.
A business offering virtual asset exchange or conversion services directly to Brazilian retail users requires a BCB VASP authorisation and, for fiat settlement, an acquiring or PSP agreement with an authorised Brazilian institution. The timeline for this path is measured in months. The risk of proceeding without the authorisation is enforcement by BCB and loss of the acquiring relationship.
A business offering payments technology or infrastructure to a Brazilian institution – rather than to end users directly – may be able to operate under a commercial agreement without a direct BCB authorisation, provided the Brazilian institution carries the regulatory relationship. This structure requires careful legal drafting to ensure that the activity does not inadvertently cross into the regulated perimeter. It is faster to implement but imposes constraints on the commercial model.
A business with a long-term Brazil strategy that includes custody, lending or asset management will require a more complex authorisation profile, potentially spanning multiple BCB licence categories. In our practice, we map this full stack before the client commits to entity formation, to avoid the cost of restructuring mid-application.
The decision matrix is not static. BCB's implementing regulations are still evolving as the VASP regime matures, and the practical expectations of Brazilian acquirers and PSPs are calibrated to the current state of BCB guidance. A structure that was workable under the prior AML-only registration regime may require updating to comply with the full VASP framework.
Related at OBOLUS
- Banking, Payments and EMI Onboarding for Digital-Asset Businesses – how we structure the fiat and banking layer for crypto operators across jurisdictions
- EMI Onboarding for VASPs: The Disputes Angle – what happens when an EMI relationship breaks down and the account is closed
- Stablecoin Issuance Authorisation in Estonia – the EU route for stablecoin issuers under the MiCA EMT regime
FAQ
Why do banks close crypto company accounts?
Banks close crypto company accounts primarily because of perceived AML/CFT risk and the compliance burden of monitoring virtual asset transaction flows. Many institutions apply blanket de-risking policies rather than conduct client-by-client analysis. A business that presents clear licensing status, a documented AML programme and a defined transaction profile – rather than a generic crypto description – substantially improves its onboarding prospects. The approach differs by institution and jurisdiction; in our practice, we prepare clients for the specific documentation a target bank requires before the application is submitted.
How can a VASP onboard with an EMI?
A VASP onboarding with an EMI (electronic money institution) must demonstrate regulatory status in its operating jurisdiction, a compliant AML/KYC programme, Travel Rule capability for virtual asset transfers, and a business model the EMI can underwrite from a compliance perspective. Most EMIs require a formal onboarding pack that includes the licence document, the AML policy, the ultimate beneficial owner structure and a description of the expected transaction flows. The process takes weeks to months depending on the EMI's internal review capacity and the complexity of the VASP's model.
What does client-money safeguarding require?
Client-money safeguarding requires that funds held on behalf of users are segregated from the business's own assets, held in a designated account at an authorised institution, and ring-fenced against the business's insolvency. The specific requirements vary by jurisdiction and licence category: under Brazil's payment institution regime, the BCB sets safeguarding expectations for electronic money issuers; under MiCA, CASP authorisation carries its own segregation requirements. In either case, the safeguarding obligation is a structural element of the licence – not an operational choice – and must be built into the banking and custody arrangement from day one.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before you commit – so the structure is right before the agreement is signed. We advise crypto exchanges, custodians, token issuers and funds across more than seventy licensing jurisdictions. To discuss your situation, contact info@oboluslaw.com.
To map the licence, banking and acquiring stack for your Brazil build, write to info@oboluslaw.com. Map your options
By Victor Olsen, Regulatory & Compliance Analyst – specialising in payment institution and VASP regulatory regimes across Latin America and the EU.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.