Running a staking service in Brazil sits at the intersection of evolving domestic legislation, the Law 14.478/2022 framework and a token-classification question that can convert a well-structured product into an unregistered securities offering overnight. Brazil's Banco Central do Brasil (BCB) holds primary supervisory authority over virtual asset service providers (VASPs) under the domestic crypto-asset regime, while the Comissão de Valores Mobiliários (CVM) asserts jurisdiction whenever a staking token confers rights that resemble a security. For an inbound operator – or a domestic business building a staking product – the foundational question is classification: does the staked instrument represent a commodity, a service fee arrangement, or a participation right that the CVM will treat as a security? That single determination shapes every downstream decision about licensing, banking, cross-border structure and tax treatment.
The analysis that follows maps the regulated perimeter, the application process, the cross-border interaction with offshore structuring, and the decision point at which counsel becomes essential.
Why Token Classification Comes First in Brazil
Brazil's regulatory regime makes token classification the threshold step, not an afterthought. Under the BCB's supervisory framework, a virtual asset used purely as a medium of exchange or as collateral in a yield-generating arrangement is treated differently from an instrument that grants holders a claim on future profits or revenues. The CVM's 2023 guidance on crypto-asset securities confirmed that substance governs classification, not the label applied in a whitepaper or terms of service.
This matters acutely for staking. A liquid staking token that confers a proportionate share of validator rewards can display every economic characteristic of a passive investment contract. If it does, the CVM's regime applies alongside – or instead of – the BCB's VASP framework. We regularly advise operators who drafted a "utility" staking product without recognising this distinction; the reclassification exposure that follows is significant.
A common assumption among founders is that attaching a utility label in the documentation settles the legal classification. It does not. Every Brazilian and cross-border regulator we have seen engage with staking products looks through the label to the rights actually conferred: the economic exposure, the governance entitlements, and the redemption mechanics. Classification is a facts-and-circumstances analysis, not a drafting choice.
For an inbound operator, the practical effect is that pre-launch classification work is not optional. It determines which regulator to approach, what disclosures to prepare, and whether a full CVM registration process sits between the operator and market access.
What Does the BCB VASP Regime Require for a Staking Service?
A staking service that falls under the BCB's supervisory scope must satisfy the registration and operational requirements set out under the domestic VASP framework, which the BCB administers pursuant to the authority granted by Law 14.478/2022. The BCB's framework imposes AML/CFT obligations, customer identification requirements, and – for entities managing client assets – safeguarding and segregation expectations that track the international baseline set by FATF Recommendation 15.
The practical steps for a service seeking BCB registration broadly follow this sequence:
- Confirm corporate presence. The BCB expects a Brazilian legal entity – or a branch with the requisite domestic footing – rather than a purely offshore arrangement serving Brazilian users. The threshold between a genuine cross-border service and one that requires local establishment is fact-specific.
- Prepare the regulatory filing. This includes a description of the service model, the token mechanics, AML/CFT policies, and an assessment of whether the staking instrument crosses into CVM territory.
- Submit to the BCB's review process. Timelines are not standardised across all applicant profiles; they depend on the complexity of the service and the completeness of the filing. In our cross-border practice, we treat an initial review cycle as a matter of months rather than weeks, with follow-on queries extending that horizon.
- Address CVM coordination if the instrument is dual-regulated. Where the BCB and CVM both have an interest, the operator must satisfy both sets of requirements. This coordination step is frequently underestimated.
- Implement ongoing compliance. AML transaction monitoring, the Travel Rule (the obligation to pass originator and beneficiary data with a virtual asset transfer) and periodic reporting obligations attach from authorisation.
CTA #1 — The steps above describe the standard registration path. Your facts – the staking mechanism, the entity structure, the user base's geography – materially change the analysis. For a scoped assessment of where your staking product sits under the BCB and CVM regimes, contact OBOLUS at info@oboluslaw.com.
How Does Smart Contract Governance Affect Liability in a Brazilian Staking Context?
The legal treatment of smart contracts (self-executing code deployed on a blockchain that automates obligations without intermediary intervention) under Brazilian law is still evolving, but the civil liability principles of the Código Civil apply regardless of whether the agreement is written in natural language or in Solidity. An operator who deploys a staking smart contract that malfunctions – whether through a code error, an oracle failure, or a governance exploit – faces potential liability in contract and in tort to the extent Brazilian courts recognise a proximate link between the operator's conduct and the loss.
This has direct structural implications. Operators that position the smart contract as a fully autonomous protocol and disclaim all operational responsibility still need to account for the possibility that a Brazilian court will look past the documentation to identify who controlled the deployment, who set the parameters, and who collected fees. Those facts can establish a de facto service relationship.
In our practice, we advise operators to treat smart contract governance documentation as a liability instrument, not just a technical specification. Clear allocation of upgrade authority, audit trails, and a defined incident-response protocol each reduce – though they do not eliminate – the exposure arising from a contract failure.
For a staking service specifically, the question of whether the validator logic, the reward distribution formula, and the unstaking queue operate on-chain or off-chain determines which Brazilian legal category applies to the service relationship. Off-chain custody or administrative discretion over rewards tends to attract stronger regulatory scrutiny than a fully on-chain model.
Cross-Border Structuring and the Offshore Entity Question
A significant number of staking services seeking Brazilian market access operate through an offshore parent – often incorporated in a zero-tax or low-tax jurisdiction – with a Brazilian operating entity below it. This structure is commercially rational, but it creates three legal pressure points that a general counsel must address before launch.
First, the BCB applies a substance-over-form analysis to determine whether the offshore parent is genuinely the service provider or whether the Brazilian entity is the functional operator. If the latter, the BCB's registration and capital requirements apply to the Brazilian entity regardless of where revenues book.
Second, the CVM's reach extends to securities-like staking tokens marketed or sold to Brazilian residents, irrespective of the issuing entity's domicile. An offshore issuer marketing yield-bearing staking positions to Brazilian retail users faces CVM jurisdiction on that activity.
Third, Brazil's foreign exchange regime imposes reporting and, in some cases, prior approval requirements on capital flows between a Brazilian entity and its offshore parent. Staking rewards denominated in a non-BRL token and swept to an offshore treasury are not exempt from this analysis. The Banco Central do Brasil has progressively modernised its FX rules, but cross-border token flows still require careful structuring.
We have seen operators build an offshore-only structure to serve Brazilian users, only to discover that BCB supervision attaches to their Brazilian user-facing activity and that their tax position requires material restructuring. Early structuring work – coordinating the licensing, banking and tax stack as one mandate – avoids that rework.
Anonymized micro-matter: In a recent cross-border matter, a liquid staking protocol incorporated in a common-law offshore jurisdiction sought to onboard Brazilian institutional clients. Early classification work confirmed the staking token's characteristics triggered both BCB and CVM oversight. We coordinated a dual filing, restructured the token mechanics to limit the securities-like features, and positioned allied counsel in Brazil to manage the regulatory dialogue. The operator launched with a compliant product structure within the targeted commercial window.
Tokenization, DAO Structure, and the DeFi Protocol Question for Brazilian Operators
A DAO (decentralized autonomous organization) used to govern a Brazilian staking service adds a layer of legal complexity that the current BCB and CVM frameworks have not yet fully resolved. Brazil does not have dedicated DAO legislation. The default position is that a DAO operating a financial service – including staking – for Brazilian users risks being characterised as an unincorporated association carrying on a regulated activity, with the liability consequences that follow.
For operators drawn to a DAO model for governance reasons, the practical solution we most frequently structure is a wrapper entity – a Brazilian limited liability company or a foreign entity with Brazilian nexus – that holds the regulatory licences and interfaces with regulators, while the on-chain governance mechanics operate within the DAO's smart contract layer. This does not eliminate DAO governance; it insulates the regulated activity from the unincorporated-entity risk.
Tokenization of real-world assets as collateral in a staking mechanism adds a further dimension. The CVM has published guidance on tokenization (the process of representing ownership rights in a real-world or financial asset as a blockchain token) that treats a tokenized security as subject to the same regulatory treatment as the underlying. A staking product that uses tokenized receivables or tokenized equity as collateral therefore inherits the CVM's securities regime for those instruments.
In our cross-border practice, operators building DeFi protocols with Brazilian market exposure increasingly confront a multi-regulator reality: BCB for the payment and transfer layer, CVM for any securities-adjacent token, and Brazil's federal tax authority for the income and gains characterization of staking rewards. Structuring these three workstreams in isolation produces gaps; addressing them together produces a deployable product.
Tax and Banking Interaction for Staking Operators in Brazil
Brazil taxes virtual asset gains under a progressive system administered by the Receita Federal (Brazil's federal tax authority), with the characterisation of staking rewards – as income, as capital gain, or as a service-fee receipt – depending on the specific mechanics and the taxpayer's profile. These characterizations are not settled for all staking models; a new mechanism, particularly a liquid staking arrangement with auto-compounding, may not map cleanly onto existing guidance. Operators should treat the tax position as open until formal guidance or a private ruling confirms it.
Banking access for a staking service operating in Brazil presents its own challenge. Brazilian commercial banks have historically applied elevated due diligence to VASP clients. A well-documented regulatory filing, a clear AML/CFT programme, and a local counsel opinion on the service's legal status materially improve the probability of a timely account opening. Operators that approach banking before completing their regulatory work – or with an incomplete understanding of how the BCB classifies the service – consistently face delays or refusals.
For inbound operators banking offshore, cross-border token flows between the Brazilian operating entity and the offshore treasury require BCB reporting under Brazil's foreign capital rules. Structuring the flow of staking rewards, fee income and collateral movements to satisfy these obligations without triggering adverse tax consequences is a multi-disciplinary exercise. We structure licensing, banking and tax as one mandate rather than three disconnected workstreams, because the decisions interact.
CTA #2 — If a prior banking application stalled or a regulatory query has gone unanswered, a second read of the filing and the entity structure often surfaces the reason. To map the licence, banking and tax stack for your staking build in Brazil, write to OBOLUS at info@oboluslaw.com.
Decision Matrix: Which Operator Profile Fits Which Regulatory Path?
Not every staking service follows the same path through Brazil's regulatory regime. The right approach depends on the operator's profile, the token mechanics, and the target user base.
Profile A – Pure infrastructure provider (no client-facing staking): An operator that provides node infrastructure to other VASPs or institutions, without holding client assets and without issuing a staking token to end users, sits primarily within the BCB's VASP framework. The CVM overlay is lower risk if no securities-like token is issued. The key risk is satisfying the BCB's substance-of-service analysis and confirming no deemed deposit-taking is occurring. Timeline to registration is typically measured in months; the primary variable is filing completeness.
Profile B – Consumer-facing liquid staking platform: An operator issuing a liquid staking token to Brazilian retail users faces the highest regulatory complexity. BCB registration is required. A CVM securities analysis is essential before launch. The token mechanics – particularly whether the liquid token confers a proportionate claim on a pooled yield stream – require careful structuring to avoid the securities characterisation. Timeline extends beyond Profile A because of the dual-regulator dimension and the likely requirement for additional disclosure documentation.
Profile C – Institutional staking-as-a-service for qualified investors: A service offered exclusively to qualified institutional investors may benefit from narrower regulatory perimeters under both the BCB and CVM frameworks. Qualification thresholds and the definition of institutional investor under Brazilian law apply. This profile is more viable for inbound operators who can credibly restrict access; it requires contractual controls and ongoing monitoring to maintain the perimeter.
Profile D – DeFi protocol with Brazilian user exposure and no Brazilian entity: This profile carries the highest unresolved legal risk. The BCB and CVM both assert jurisdiction over activity directed at Brazilian users, regardless of the operator's domicile. An operator in this position should obtain a clear legal opinion before Brazilian users represent a material share of the user base.
Self-Assessment Checklist Before Engaging the BCB and CVM
Before initiating a regulatory filing, an operator should be able to answer each of the following points clearly. Uncertainty on any item signals that legal work is required before filing.
- Is the staking token classified under the BCB's VASP framework, the CVM's securities regime, or both? Has that analysis been documented in a written legal opinion?
- Does the Brazilian operating entity satisfy the BCB's substance requirements, or is the service designed as a cross-border offering without local establishment?
- Are AML/CFT policies – including Travel Rule compliance and customer due diligence – implemented at a standard that satisfies the BCB's baseline requirements?
- Has the smart contract been independently audited, and is there a documented incident-response protocol for contract failure?
- Is the governance model (corporate entity, DAO, hybrid) compatible with the BCB's and CVM's licensing requirements?
- Has the tax characterisation of staking rewards been confirmed with the Receita Federal, or is a private ruling being sought?
- Is the banking strategy confirmed, and does the operator have a regulatory status document to support account-opening due diligence?
- Are cross-border capital flows between the Brazilian entity and any offshore parent structured in compliance with BCB foreign capital reporting requirements?
Related at OBOLUS
- DeFi, Tokenization & Smart-Contract Law – structuring DeFi protocols, token issuances and smart-contract governance for regulated digital-asset businesses
- DeFi Protocol Legal Structuring in El Salvador – comparative structuring analysis for DeFi operators considering El Salvador's Bitcoin Law environment
- VASP Licensing in Liechtenstein – TVTG regime analysis and application guidance for operators seeking a European digital-asset licence
FAQ
Can a DeFi protocol be regulated?
Yes. Brazilian and international regulators assess DeFi protocols on the basis of functional substance, not architectural form. A protocol that provides financial services – including staking, lending or exchange – to Brazilian users will attract BCB and potentially CVM oversight if it meets the activity threshold, regardless of whether the operator describes it as decentralized. The key factors are control over parameters, collection of fees, and the identifiability of a responsible party. Counsel should assess the protocol's governance structure before Brazilian user acquisition reaches a material level.
What legal wrapper suits a DAO?
Brazil has no dedicated DAO legislation. The most workable structure for a DAO operating a regulated staking service is a wrapper entity – typically a Brazilian limitada or an offshore company with Brazilian regulatory nexus – that holds the BCB or CVM authorisation and interfaces with regulators and banking counterparties. The on-chain governance mechanics can remain within the DAO layer. Without a wrapper, the DAO risks characterisation as an unincorporated association conducting regulated activity, which creates unlimited liability exposure for token-holding members who exercise governance rights.
Who is liable when a smart contract fails?
Under Brazilian civil law, liability follows control and causation. An operator who deployed the contract, set its parameters, collected fees from its operation, or held upgrade authority is likely to be treated as a service provider with corresponding liability for losses caused by a code failure, oracle error or governance exploit. Full decentralization does not automatically sever the liability link if the facts show ongoing operational control. Liability exposure can be reduced – though not eliminated – through independent audits, documented governance protocols and clear contractual allocation of risk with users.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We assess classification against the substance of rights, not the marketing label – because misclassification is the most common and most costly mistake in a staking product launch. We structure licensing, banking and tax as one mandate rather than three disconnected workstreams. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.
By Roman Levitt, Technology & DeFi Counsel – specialising in smart contract governance, DeFi protocol structuring and cross-border regulatory analysis for digital-asset businesses operating in emerging and developed markets.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.