VASP licensing in Brazil: Legal Requirements for Businesses
Brazil's Virtual Asset Service Provider (VASP) regime is now a statutory obligation, not a voluntary registration. Enacted through the federal Virtual Assets Act and operationalized under Banco Central do Brasil (BCB) regulation, the regime requires any legal entity providing virtual-asset services in Brazil – whether incorporated locally or operating inbound from abroad – to obtain regulatory authorization before conducting business. Operating without that authorization exposes a business to enforcement action, termination of banking relationships, and reputational harm that is difficult to reverse. This page maps the regulated perimeter, the authorization process, and the cross-border considerations that matter most to an inbound operator.
What Does Brazil's VASP Regime Actually Cover?
Brazil's statutory framework defines the regulated perimeter broadly: any entity that provides virtual-asset services on a professional basis to third parties is subject to licensing requirements under the Virtual Assets Act. The Banco Central do Brasil serves as the primary supervisory authority for VASPs in Brazil, with oversight responsibilities that include authorization, ongoing supervision, and enforcement. The regime covers exchange services, transfer services, custody arrangements, and activities ancillary to virtual asset administration – a scope that mirrors the FATF Recommendation 15 standard on virtual assets and the obligations it imposes on member jurisdictions.
The critical threshold question is whether activity crosses the professional-services line. A business routing client orders through a Brazilian interface, accepting Brazilian reais, or holding virtual assets on behalf of Brazilian residents is almost certainly inside the perimeter regardless of where the legal entity is incorporated. The BCB's supervisory framework applies to the service, not only to the legal domicile of the provider. An entity incorporated in the BVI or the Cayman Islands and actively marketing to Brazilian users must engage with BCB authorization requirements – the offshore-entity route does not create an exemption.
In our cross-border practice, we consistently see businesses underestimate this extraterritorial pull. The question is not whether you have a Brazilian subsidiary; it is whether Brazilian residents are receiving your services. Where they are, the regulatory clock has already started.
Who Regulates VASPs in Brazil – and How?
The Banco Central do Brasil is the competent authority for VASP authorization and prudential supervision in Brazil, having received this mandate through the Virtual Assets Act and implementing normative instructions. The BCB sits within a broader regulatory architecture that includes the Comissão de Valores Mobiliários (CVM) for crypto-assets that meet the definition of securities under Brazilian law. The interaction between the BCB regime and CVM oversight is a defining feature of Brazil's crypto regulatory structure – a token that functions as a security falls under CVM jurisdiction, while payment-function tokens and exchange services fall under BCB authority.
Businesses should not assume that a clean non-security token classification avoids CVM entirely. The CVM has issued guidance on the token-classification test, which focuses on the economic rights conferred and the investor-expectation standard. A utility token built on a promise of future returns can migrate toward security treatment. Conversely, a payment stablecoin will sit squarely in BCB territory.
The FATF framework has shaped Brazil's design choices. Brazil has committed to the Travel Rule (the obligation to transmit originator and beneficiary information with virtual-asset transfers above defined thresholds), and BCB implementing rules embed this obligation for authorized VASPs. The de minimis threshold and the precise technical standard for transmission follow from BCB normative instructions; operators should consult current BCB guidance for the operative figure.
How Does the BCB Authorization Process Work?
BCB authorization follows a structured pre-qualification and licensing sequence, with the BCB reviewing organizational, operational, and compliance fitness before granting a license to operate as a VASP in Brazil. The process begins with formal submission to the BCB, supported by a complete dossier covering corporate structure, shareholder information, AML/CFT program documentation, IT security standards, and a business plan that demonstrates the operator's capacity to meet prudential expectations on an ongoing basis.
The BCB evaluates fitness-and-propriety for controlling shareholders, directors, and key management. This means that beneficial-ownership clarity is a prerequisite, not an afterthought. Complex offshore holding structures – multi-layer BVI or Cayman arrangements without transparent ownership registers – typically require restructuring before an application will be considered complete. We have seen applications stall at precisely this point: a structure designed for tax efficiency becomes an obstacle to regulatory transparency.
A candid assessment of the timeline: authorization periods vary depending on the completeness of the application and the volume of applications under review at any given time. The BCB has not published a fixed statutory decision window equivalent to MiCA's standardized timeframes. Operators should plan for an authorization timeline measured in months rather than weeks, with a significant portion of that time front-loaded in the document-preparation and internal compliance-build phase. Early engagement with the BCB, including pre-application dialogue, can reduce the risk of a request for information that resets the clock.
The operating requirements that attach to the license are substantive. Authorized VASPs must maintain AML/CFT programs aligned with COAF (Brazil's financial intelligence unit) standards, implement transaction monitoring, carry out customer due diligence consistent with FATF guidance, and report suspicious transactions through the prescribed channels. Custody VASPs face additional obligations around asset segregation.
For a scoped assessment of your authorization path under the BCB regime, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity structure, the user base, the banking relationships, and the asset types – change the analysis in ways that a generic description cannot capture. Map your options
What Must an Inbound Business Do Before Serving Brazilian Users?
An inbound operator – a business incorporated outside Brazil that intends to serve Brazilian retail or institutional users – faces a direct choice: establish a locally authorized entity or restrict access to Brazilian users until an authorization is in place. The "restrict and monitor" path is less commercially attractive than it appears. Geo-restriction alone, without technical controls that demonstrably prevent Brazilian access, is unlikely to satisfy BCB expectations for a business whose service is otherwise accessible.
The preferred route for an inbound operator is to establish a Brazilian legal entity – typically a Sociedade Limitada (Ltda.) or Sociedade Anônima (S.A.) – and to pursue BCB authorization through that entity. The entity needs genuine substance: a physical presence, local management with defined responsibilities, and an AML/CFT program calibrated to Brazilian law. Shell structures with nominal local directors do not satisfy the BCB's substantive requirements.
A practical consideration that is often underweighted: Brazilian banking for a new VASP is not automatic. Brazilian banks have historically been cautious about crypto-business relationships, and the BCB authorization does not guarantee banking access. Operators should run the banking relationship process in parallel with the authorization application, not sequentially. A business that receives BCB authorization and then spends months looking for a bank account has wasted a significant part of its window.
For businesses with existing licenses in other jurisdictions – say, a MAS-licensed digital payment token service in Singapore or a VARA-authorized exchange in Dubai – the Brazilian process is additive, not substitutive. There is no mutual recognition or passporting arrangement between Brazil and any foreign VASP regime. Each jurisdiction requires its own authorization, its own local compliance program, and its own banking stack. This is the multi-jurisdiction reality that every operator expanding into Latin America confronts.
How Do Tax and Banking Interact With VASP Licensing in Brazil?
The tax treatment of virtual assets in Brazil has evolved alongside the regulatory regime, and it creates obligations that operate in parallel with BCB authorization requirements. The Receita Federal do Brasil (RFB) requires residents and entities with Brazilian nexus to report virtual-asset holdings and transactions above defined thresholds. For an authorized VASP, this creates a dual reporting obligation: BCB supervisory reporting on one channel and RFB tax reporting on another.
Capital gains treatment of virtual-asset disposals, the corporate tax position of exchange operations, and the transfer-pricing implications of intra-group arrangements between a Brazilian operating entity and an offshore holding company are all areas where early structuring advice materially affects the outcome. Structures that are efficient offshore can create unexpected Brazilian tax exposure – particularly where the Brazilian entity generates the economically valuable activity but the contractual and IP arrangements sit offshore.
VAT (ICMS and ISS in the Brazilian context) treatment of crypto-asset services is an area where the position is still developing. The federal and state-level indirect tax regimes do not map cleanly onto virtual-asset services, and the classification of exchange fees, custody fees, and token-issuance proceeds as services or other economic activity attracts different consequences. Operators should not treat the tax question as a post-authorization issue: the structure chosen at formation will determine the tax character of flows for years.
Banking access, as noted above, is a parallel constraint. Established Brazilian banks have become more engaged with the BCB authorization regime as it has matured – authorization provides a regulatory baseline that improves the operator's profile in an internal bank compliance review. But underwriting still varies, and businesses offering higher-risk product lines (derivatives, leveraged products, cross-border stablecoins) should anticipate a more demanding banking-access process than a simple spot-exchange operation.
How Does the BCB-CVM Split Affect Token-Issuing Businesses?
Token issuers must resolve the BCB-CVM jurisdictional question before they build, not after they launch. The outcome of that analysis determines which regulator you file with, which disclosure obligations attach to your token, and whether a separate securities-law prospectus or registration is required.
The CVM's approach draws on the investment-contract concept familiar from US securities law – the economic substance test, not the label. A token that offers holders a share of profits, a residual claim on assets, or a contractual expectation of return generated by the efforts of a third party is likely to meet the CVM's security threshold. That classification triggers the full CVM regulatory regime, including registration, ongoing disclosure, and distribution restrictions. Non-compliance with the CVM regime is a separate risk strand from BCB non-authorization – a business can be compliant with BCB requirements and simultaneously in breach of CVM rules if its token sits in the wrong classification.
In recent months, the CVM has signaled active enforcement interest in tokens that are marketed as utility instruments but exhibit security characteristics. We advise token-issuing clients to undertake a written classification analysis – supported by external legal opinion – before any public launch or investor-facing communication. A defensible classification memo does not guarantee a clean outcome, but it demonstrates good faith and materially reduces enforcement risk.
If a prior application stalled or a token-classification question is unresolved, a structured review can identify the path forward. Contact OBOLUS at info@oboluslaw.com or message us at t.me/oboluslaw. Map your options
What Does an Authorization Engagement Look Like in Practice?
In a recent licensing matter, a digital-asset exchange incorporated in a common-law offshore jurisdiction sought to extend its operations into Brazil. The group had an existing VASP registration in a European jurisdiction under the pre-MiCA transitional regime, but had not anticipated that Brazilian authorization would require a locally incorporated subsidiary with genuine substance rather than a representative office. We assisted the group in restructuring its holding architecture to provide BCB-legible beneficial ownership disclosure, incorporating a Brazilian S.A. with resident directorship, building the required AML/CFT program to COAF standards, and preparing the authorization application dossier. Banking engagement was initiated in parallel, and the group received conditional banking terms before the BCB authorization was finalized. The matter resolved within a commercially planned window, and the Brazilian operating entity launched within the group's announced roadmap.
What Are the Most Common Mistakes in Brazil VASP Licensing?
The errors we see most often follow a recognizable pattern. The first is treating the offshore-entity question as resolved: a business assumes that a BVI or Cayman holding company with a Brazilian bank account and a Portuguese-language platform is not within the BCB's perimeter. It is. The second mistake is deferring the AML/CFT build. The BCB evaluates the adequacy of the compliance program, not the adequacy of a compliance plan. A roadmap does not satisfy the standard; an operational program does.
The third common error is sequential rather than parallel execution. Banking applications, tax-structure review, and BCB authorization preparation are treated as phases, each starting when the prior one completes. In practice, the banking market and the BCB have overlapping information requirements, and running all three workstreams simultaneously compresses the go-live timeline. A business that runs them sequentially typically adds several months to its window.
A common assumption in this market is that a single offshore licence is sufficient to serve clients globally, including in Brazil. That assumption is incorrect. Brazil has enacted a sovereign VASP regime with its own authorization requirement, its own supervisory authority, and its own enforcement track record. No foreign license – not a MiCA CASP authorization, not a Singapore MAS DPT license, not a VARA approval from Dubai – substitutes for BCB authorization when serving Brazilian users. The jurisdictions do not recognize each other's licensing decisions for this purpose.
The fourth error is failing to address the BCB-CVM split at the outset. A business that builds a product assuming BCB-only jurisdiction, then discovers that the CVM classifies the token as a security, faces a materially more expensive and time-consuming compliance build than one that resolved the question before development began.
Related at OBOLUS
- Licensing and registration for digital-asset businesses – end-to-end licensing across 70+ jurisdictions, from first assessment to authorization
- Crypto exchange setup in Abu Dhabi Global Market (ADGM) – the FSRA regime, application process, and timeline for exchange operators in the ADGM
- VAT treatment of crypto services for established operators – how indirect tax interacts with virtual-asset service revenues across licensing structures
FAQ
How long does a crypto licence take to obtain?
Authorization timelines vary by jurisdiction and by the completeness of the application. In Brazil, the BCB does not publish a fixed statutory decision window, and timelines are measured in months. The document-preparation and compliance-build phase is typically the longest component. Jurisdictions with statutory review periods – such as MiCA-regulated EU member states – offer more predictable timelines, but even there, pre-authorization dialogue and application quality heavily influence the actual duration. We map the realistic timeline for each jurisdiction before a client commits resources.
Which jurisdiction is best for licensing my crypto business?
There is no single best jurisdiction; the right answer depends on where your users are, what services you offer, your banking requirements, and your tax position. An exchange serving Latin American retail users will need BCB authorization in Brazil regardless of where the holding company sits. A custody operation with institutional European clients needs to engage with the MiCA CASP regime. We assess the full operating, custody, and payment layer before recommending a licensing stack – a single offshore registration does not satisfy multi-market obligations.
Do I need a separate custody licence?
In Brazil, custody of virtual assets on behalf of third parties is a regulated activity that falls within the VASP perimeter. Whether it requires a standalone authorization or sits within a broader VASP license depends on the scope of services offered and BCB implementing guidance applicable at the time of application. In other flagship jurisdictions – Singapore, Hong Kong, and the UAE – custody is treated as a separate regulated activity requiring its own authorization. Operators building a combined exchange-and-custody model should address both authorization tracks from the start rather than adding custody compliance after the exchange license is secured.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before you commit – giving clients the structural clarity to launch, scale, and bank in markets as demanding as Brazil without backtracking. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in inbound VASP authorization processes across Latin America and the Asia-Pacific licensing hubs.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.