Operating a digital-asset business in Brazil without the correct authorisation is no longer a theoretical risk. Brazil's virtual asset service provider regime – established through a dedicated VASP (virtual asset service provider) regulatory framework and administered by the Banco Central do Brasil (BCB) – imposes a mandatory licensing obligation on any entity providing crypto-asset services to clients in the country. The BCB holds primary supervisory authority under the Brazilian crypto law that came into force in 2023, positioning Brazil as a structured, civil-law jurisdiction with a defined authorisation path. This page sets out the legal basis for that obligation, the application process, the cross-border considerations that most inbound operators underestimate, and the decision point at which external counsel materially changes the outcome.
What activities require authorisation in Brazil?
Any business operating as a prestadora de serviços de ativos virtuais – a virtual asset service provider under Brazilian law – must obtain prior authorisation from the Banco Central do Brasil before commencing operations. The BCB's supervisory mandate covers entities that exchange virtual assets for national currency or other virtual assets, transfer virtual assets on behalf of clients, provide custody and administration of virtual assets, and participate in the offering or sale of virtual assets. Providing these services from an offshore entity to Brazilian-resident clients does not itself remove the obligation: the BCB takes a substance-and-nexus view, and regulators in the leading hubs increasingly expect operators to have a local footprint or a recognised cross-border arrangement in place.
The legal basis is the federal law enacted at the end of 2022, which took effect in 2023 and gave the BCB its current mandate. The Comissão de Valores Mobiliários (CVM) retains parallel jurisdiction over virtual assets that qualify as securities under Brazilian capital-markets law. An operator offering tokenised instruments may therefore face a dual licensing obligation – BCB authorisation for the VASP perimeter and CVM registration for the securities layer. This is the first structural complexity that catches inbound businesses: the BCB-CVM boundary turns on the nature of the asset, not the label the issuer applies to it.
CTA #1 — For the reader meeting this issue for the first time. The dual-regulator reality above changes the scope of your application before you file a single document. The entity, the asset classes, the user base and the banking layer all affect which authorisations you need and in which order. For a scoped assessment of your situation in Brazil, contact OBOLUS at info@oboluslaw.com.
Who is required to hold a BCB authorisation?
The BCB authorisation requirement applies to any legal entity, whether incorporated in Brazil or abroad, that conducts VASP activities directed at or habitually accessed by persons in Brazil. A Brazilian entity providing those services clearly falls within scope. A foreign entity operating a platform accessible to Brazilian residents, without a local structure, is also within scope under the nexus analysis the BCB applies.
Several categories of business are caught that do not immediately present themselves as VASPs. Payment initiators that settle in stablecoins, custody providers holding assets on behalf of Brazilian institutional clients, and token issuers conducting public sales to Brazilian investors all require careful analysis against the regulated perimeter. The CVM's parallel remit on securities means a token issuer may need CVM approval for its whitepaper-equivalent disclosure document before the BCB authorisation is complete. We have seen operators underestimate the CVM layer, file a BCB application and then encounter a regulatory hold when CVM asks questions about the token's rights structure.
What does the BCB authorisation process involve?
The BCB application process for VASP authorisation involves a structured pre-filing review, a formal submission of corporate and technical documentation, a suitability assessment of controlling shareholders and directors, and a supervisory evaluation period before authorisation is granted. No specific statutory timeline has been set by the BCB for the full cycle; in practice, the duration is a matter of months and is materially affected by the completeness of the initial submission and the complexity of the corporate structure presented.
Key documentation categories include: evidence of incorporation and corporate governance documents; a detailed business plan describing the services, the client base and the operational model; an AML/CFT programme aligned with the FATF Recommendations, including the Travel Rule (the obligation to pass originator and beneficiary data with a virtual asset transfer); policies for client identification, transaction monitoring, and suspicious activity reporting; IT security and operational resilience documentation; and fit-and-proper material for ultimate beneficial owners and key management personnel.
The BCB conducts a substantive review of the AML/CFT programme. Brazil is a FATF member and the BCB's expectations track FATF Recommendation 15 on virtual assets closely. An operator whose programme does not reflect the Travel Rule and updated customer-due-diligence standards will face a deficiency notice. Addressing deficiency notices extends the timeline considerably – typically several weeks per cycle.
How does a Brazil VASP authorisation interact with international operations?
Brazil's VASP regime does not operate in isolation, and an operator serving clients across Latin America, Europe or Asia will face questions that the BCB application alone does not resolve. Three cross-border interactions are the most consequential for inbound businesses.
First, the EU passporting question. Under MiCA (the EU Markets in Crypto-Assets Regulation, supervised by ESMA and national competent authorities), a CASP authorised in one EU member state may passport across the EU/EEA. Brazil has no such passporting relationship with the EU or with MiCA jurisdictions. An operator holding a BCB authorisation has no automatic right to service EU clients; a separate CASP authorisation through a MiCA-eligible jurisdiction is required. Operators we advise regularly face this two-track structure: Brazil for the LatAm operating entity, and a MiCA-eligible jurisdiction (Lithuania, Malta or another EU hub) for the EU-facing entity.
Second, the banking interaction. Correspondent banking for crypto-licensed entities in Brazil is managed through BCB-regulated financial institutions. The BCB's authorisation does not itself guarantee banking access, and Brazilian banks apply their own onboarding criteria to VASPs, which can be more conservative than the regulatory minimum. An operator should map its banking relationships concurrently with the licensing process, not after authorisation is granted. A licence without a banking rail is commercially inert.
Third, the tax dimension. Brazilian tax law treats virtual assets as financial assets for income-tax purposes in the hands of individuals, with disclosure obligations administered by the Receita Federal. For a VASP entity, corporate income tax, social contributions (PIS/COFINS) and the applicable transfer-pricing regime all interact with the business model. An operator running a foreign holding company above a Brazilian operating subsidiary must structure the intercompany arrangements to withstand BCB prudential scrutiny and Receita Federal transfer-pricing review simultaneously. The two analyses are independent and both are mandatory.
What are the most common errors in a Brazil crypto licensing application?
In our cross-border practice, the errors that generate the most material delays in BCB applications fall into three categories.
The first is submitting a generic AML/CFT programme that was drafted for a different jurisdiction's regime. The BCB's supervisory expectations reflect Brazilian domestic law and FATF standards calibrated to Brazil's own FATF evaluation cycle. A programme written for an EU or Singaporean standard needs localisation before submission, not after a deficiency notice.
The second error is presenting a corporate structure that includes an intermediate holding company in a jurisdiction the BCB treats with elevated scrutiny. The fit-and-proper review reaches through the holding structure to the ultimate beneficial owners, and a complex multi-jurisdictional chain without a clear commercial rationale generates questions that delay the process.
The third – and most consequential – error is treating the BCB authorisation as the end of the legal analysis. The CVM's securities remit, the banking layer and the tax structure are not post-authorisation problems. They are concurrent work streams. An operator that sequentially resolves each element instead of managing them in parallel typically loses several months and sometimes finds that its initial corporate structure needs to be unwound.
A cross-border VASP authorisation: what the process looks like in practice
In a recent matter, a payments and exchange operator incorporated outside Brazil approached us after receiving a BCB deficiency notice on its AML/CFT documentation late in an authorisation process it had managed without local counsel. The programme had been drafted to FATF standards but without localisation to BCB supervisory expectations. We coordinated a redraft of the programme, aligned the Travel Rule procedures to the BCB's technical specifications, and prepared a response to the deficiency notice with supporting technical annexes. The BCB review cycle resumed and the application progressed to the next supervisory stage. Concurrently, we mapped the operator's EU-facing entity against the MiCA CASP authorisation timeline through allied counsel in a MiCA-eligible jurisdiction, so the two licensing tracks moved in parallel rather than sequentially. The operator avoided a further multi-month delay.
Which operator profile should prioritise a Brazil authorisation?
The decision to seek BCB authorisation – rather than restrict services away from Brazil entirely – turns on the operator's strategic exposure to the Brazilian and broader Latin American market. Three profiles appear consistently in our practice.
Profile A – the LatAm-first operator is building a business where Brazil is the primary market. This operator should pursue BCB authorisation as its anchor licence and build the corporate structure around the BCB's fit-and-proper and capital expectations from the outset. The key risk is a CVM dimension that goes unaddressed. The indicative path, absent complexity, runs to a period of several months from a complete submission.
Profile B – the global operator adding Brazil already holds a licence in Singapore, the EU or the UK and is extending into Brazil. This operator should expect that its existing compliance programme will need material localisation and that its holding structure will receive BCB scrutiny. The cross-border tax and transfer-pricing dimension is particularly acute for this profile. Timing must be coordinated with the home-jurisdiction regulator's notification requirements, if any.
Profile C – the institutional services provider is a custodian, prime broker or institutional-grade exchange that is not yet serving retail clients in Brazil but holds assets or provides services to Brazilian institutional counterparties. This profile should complete the BCB perimeter analysis before any institutional relationship is formalised, because the regulated perimeter may be engaged even without a retail-facing presence.
CTA #2 — For the reader who has already attempted a filing or encountered a structural issue. If a prior BCB application stalled on a deficiency notice, or if a banking relationship was declined after authorisation, a second structural read can identify the root cause and the route forward. Write to us at info@oboluslaw.com.
A common assumption: offshore registration is a substitute for Brazilian authorisation
A common assumption among businesses entering Latin America is that a VASP registration in the BVI, the Cayman Islands or another offshore centre is sufficient to serve Brazilian clients without separate BCB authorisation. It is not. The BVI FSC's registration under the Virtual Asset Service Providers Act 2022 and CIMA's registration under the Cayman VASP Act are both domestic licensing obligations for entities incorporated in those jurisdictions. Neither constitutes a recognised authorisation for Brazilian-market activity under the BCB's supervisory regime.
The same applies to a MiCA CASP authorisation issued in the EU. MiCA's passporting covers EU and EEA member states. Brazil is outside that perimeter. An operator relying on its EU CASP to serve Brazilian clients without BCB authorisation is operating outside its licensed scope in Brazil, even though it is fully authorised in the EU. We have seen enforcement enquiries initiated on precisely this basis. The practical consequence is that an operator building a genuinely multi-market business requires a deliberate licence-stack design – not a single offshore registration and an assumption that it travels.
Related at OBOLUS
- Licensing and registration for digital-asset businesses – end-to-end counsel on VASP and exchange licensing across 70+ jurisdictions
- Crypto exchange setup in Lithuania – how a MiCA-eligible EU jurisdiction works for the EU-facing entity
- Client funds safeguarding in South Korea – cross-border custody and client asset protection obligations
FAQ
How long does a crypto licence take to obtain?
Timeline varies by jurisdiction and by the completeness of the initial submission. In Brazil, the BCB's authorisation process runs to several months for a well-prepared application with no deficiency notices. Deficiencies add multiple weeks per correction cycle. In MiCA jurisdictions, national competent authority timelines differ; some have issued guidance on target review periods but operational timelines reflect application volume and structural complexity. We size the timeline estimate after reviewing the specific corporate structure and business plan.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer. The right jurisdiction turns on where your users are, where your banking relationships sit, what services you provide and your corporate structure. Brazil is the correct primary jurisdiction for any operator with a genuine Brazilian or LatAm market. For EU access, a MiCA CASP authorisation through an EU member state is required. Most multi-market operators need a licence stack across two or more jurisdictions, not a single offshore registration. We map the stack before you commit to a structure.
Do I need a separate custody licence?
In most leading regulatory regimes, custody of virtual assets on behalf of clients is a regulated activity that requires its own authorisation or an express extension of an existing licence. Under MiCA, custody and administration of crypto-assets is one of the defined CASP services. In Brazil, the BCB's VASP perimeter captures custody services. In Singapore, MAS licensing under the Payment Services Act covers digital payment token services including custody. Whether your operating structure requires a standalone custody authorisation or an extension depends on the regime and the activity mix. We analyse the full activity perimeter before advising on the filing strategy.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We map the licence, custody and payment stack across operating layers before our clients commit to a structure – identifying the BCB, CVM and cross-border interactions that a single-jurisdiction analysis misses. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in VASP authorisation processes across LatAm, the EU and Asia-Pacific, with a focus on inbound-operator structuring for BCB and MiCA filings.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.