Brazil has emerged as one of Latin America's most consequential digital-asset markets, and its regulatory posture shifted fundamentally when the country enacted a dedicated crypto-asset framework. For any business – exchange, custodian, payment processor, or token issuer – targeting Brazilian users or operating from within the country, the question is no longer whether regulation applies but which obligations have already taken effect and which are still being phased in. Operating without the right authorisation exposes a business to enforcement action, the loss of banking relationships, and the kind of reputational damage that is difficult to reverse once Brazilian regulators act.
Brazil's crypto-asset service provider (VASP) regime is grounded in federal legislation and supervised by the Banco Central do Brasil (BCB), which holds primary jurisdiction over most exchange and payment-related activities. The Comissão de Valores Mobiliários (CVM) retains authority over crypto-assets that qualify as securities. Understanding which regulator controls which activity – and how they interact – is the first structural question every inbound operator must answer.
This page maps the Brazilian regulatory regime, identifies who is caught, outlines the authorisation process, addresses the cross-border reality for international operators, and explains where OBOLUS can support.
What Is the Brazilian Regulatory Regime for Digital Assets?
Brazil's digital-asset framework rests on federal legislation enacted in late 2022, which authorised the executive branch to designate a competent supervisory body. The government subsequently assigned the Banco Central do Brasil as the primary regulator for virtual asset service providers. The BCB now exercises licensing and supervisory authority over businesses that provide virtual-asset services to clients in Brazil, covering exchange, brokerage, custody, and transfer operations. The CVM governs the securities dimension: where a crypto-asset exhibits the characteristics of a collective investment scheme or a securities offering, CVM rules apply alongside or instead of the BCB regime.
This dual-authority structure is not a technicality. In our cross-border practice, we regularly advise operators who build a product that sits squarely at the intersection – a yield-bearing token or a structured crypto fund, for instance – and who must satisfy both bodies simultaneously. Getting the classification wrong at the product design stage can mean rework, delay, and the cost of a second licensing track.
The BCB's implementing regulations have been issued progressively. The core requirement is that any legal entity providing virtual-asset services in Brazil, or to Brazilian-resident clients from abroad, must obtain BCB authorisation before operating commercially. The regime draws conceptually from the FATF Recommendation 15 model (the international standard requiring countries to regulate and supervise virtual-asset service providers), and Brazil has aligned its framework to meet those expectations.
Who Needs BCB Authorisation Under the Brazilian Framework?
The authorisation requirement reaches any entity that habitually provides virtual-asset services as a business, regardless of where that entity is incorporated. The key trigger is the Brazilian nexus: Brazilian-resident users, BRL on-ramps, or a Brazilian marketing presence are each sufficient to bring a foreign entity within scope.
The following activity types are covered under the BCB's supervisory perimeter:
- Exchange and trading services (converting crypto to fiat, or crypto to crypto, on behalf of clients).
- Transfer and settlement services (facilitating the movement of virtual assets between third-party wallets).
- Custody and safeguarding of virtual assets on behalf of clients.
- Administration and issuance services where specifically designated by regulation.
The CVM layer activates when the virtual asset involved qualifies as a valor mobiliário (security) under Brazilian securities law. Token offerings, tokenised investment products, and fund structures with digital-asset exposure all carry this secondary analysis. A business that operates in only one of these layers still needs to evaluate whether the other body's rules create incidental obligations.
Foreign operators are not exempt by distance. A crypto exchange incorporated in the EU, the BVI, or the UAE that actively targets Brazilian users – through Portuguese-language marketing, BRL deposit options, or Brazilian-resident account-holders – is within scope. The BCB has been explicit that the entity's jurisdiction of incorporation does not, by itself, remove the requirement to seek Brazilian authorisation.
To map whether your specific activity profile triggers BCB authorisation, CVM oversight, or both, contact OBOLUS at info@oboluslaw.com. The activity-to-regulator analysis is the necessary first step, and the answer often changes when the product is described precisely rather than categorically.
How Does the BCB Authorisation Process Work?
The BCB authorisation process is a formal administrative procedure, and the BCB has published guidance on its requirements. The process involves prior engagement with the regulator, a detailed application dossier, and a supervisory review period before authorisation is granted – timelines vary depending on application quality and the category of services applied for.
The application dossier typically addresses:
- Corporate structure and ownership: full ultimate beneficial owner disclosure, including foreign holding entities.
- Business plan and activity scope: the specific virtual-asset services to be provided, the target client base, and the projected volume of operations.
- Capital adequacy: the BCB sets minimum capital requirements that vary by the scope of authorised activity; the specific thresholds are published in the implementing rules and should be confirmed against the current BCB guidance in force at the time of application.
- Governance arrangements: fit-and-proper requirements for directors and senior management.
- AML/CFT programme: a documented anti-money-laundering and counter-financing-of-terrorism policy, including Travel Rule compliance procedures (the obligation to pass originator and beneficiary data with each virtual-asset transfer).
- Technology and cybersecurity controls: safeguarding of client assets, operational resilience, and incident-response procedures.
- Consumer protection measures: disclosure, complaint-handling, and client-asset segregation.
In our practice, we have seen applications that were delayed – not because the underlying business was non-compliant, but because the AML narrative did not address the Brazilian regulatory expectations specifically, or because the corporate structure created a chain of ownership that required additional documentary support. Preparing the dossier with the BCB's published criteria in mind, rather than transposing materials from another jurisdiction's application, materially reduces the risk of a supplemental-information request.
The BCB also requires that authorised VASPs maintain ongoing regulatory capital, report to the regulator periodically, and notify the BCB of material changes to ownership, technology, or service scope. Authorisation is not a one-time event; it creates a continuous compliance relationship.
If your application is in progress or has already received a BCB query, a second read of the dossier can identify the structural reason for the delay and the most direct path to resolution. Write to info@oboluslaw.com to discuss a scoped review.
What Are the AML and Travel Rule Obligations for Brazilian VASPs?
Brazilian VASPs are subject to the country's AML/CFT legal framework, which aligns to the FATF Recommendations, including the Travel Rule obligation requiring VASPs to collect and transmit originator and beneficiary information with every qualifying virtual-asset transfer. Compliance with this obligation requires both a policy framework and technical implementation – counterparty VASPs must be identified, their VASP status confirmed, and the required data fields passed with each transfer.
The BCB expects VASPs to maintain documented customer due-diligence procedures, transaction-monitoring controls, and suspicious-transaction reporting obligations. These requirements apply from the point of authorisation and cannot be treated as a later compliance phase.
Cross-border transfers carry an additional layer of complexity. When a Brazilian-authorised VASP sends or receives a virtual-asset transfer involving a foreign VASP, the Travel Rule obligations must be met on both sides of the transaction. Where a counterparty VASP operates in a jurisdiction without an equivalent regime, the Brazilian entity may need to apply enhanced due diligence or decline the transaction. This is not a theoretical risk: Brazilian regulators have been clear that the AML framework applies to all virtual-asset activity, not merely to fiat on-ramp or off-ramp transactions.
For custodians and asset managers, the customer due-diligence obligations extend to periodic review and enhanced scrutiny for higher-risk client relationships. Operators entering Brazil from a jurisdiction with a lighter AML touch – certain offshore domiciles, for instance – routinely underestimate the depth of Brazil's AML expectations and the BCB's supervisory interest in the quality of a VASP's compliance programme.
The Cross-Border Reality: Operating in Brazil From Abroad
Many digital-asset businesses that serve Brazilian clients are not incorporated in Brazil and may not have physical operations there. The BCB's framework reaches those entities. A business incorporated in the EU under MiCA (the Markets in Crypto-Assets Regulation), in Dubai under the VARA (Virtual Assets Regulatory Authority) regime, or registered with the FCA in the United Kingdom cannot rely on that authorisation to serve Brazilian users without separate Brazilian authorisation.
This is the cross-border reality that a single offshore licence cannot cure. Each jurisdiction determines its own perimeter, and Brazil has chosen a perimeter that includes foreign operators with a material Brazilian nexus.
For inbound operators, the structural question is whether to establish a Brazilian legal entity – typically a sociedade limitada or a sociedade anônima – or to apply as a foreign entity under the BCB's rules for non-resident applicants. The choice affects corporate governance requirements, the tax treatment of Brazilian-sourced income, and the speed of the authorisation process. We map those options as part of a pre-application assessment, working with allied counsel in Brazil on the corporate and local regulatory mechanics.
Banking access is a related pressure point. Brazilian banks have developed their own due-diligence expectations for VASP clients, and an entity seeking to open a BRL account will typically be asked to demonstrate regulatory status, AML programme quality, and beneficial-owner transparency. A business that approaches Brazilian banking before it has secured or at least applied for BCB authorisation is likely to find the process significantly harder.
A micro-matter from our recent work illustrates the timing risk: an exchange operator incorporated in a European jurisdiction had been onboarding Brazilian-resident users for several months under the assumption that its EU authorisation was sufficient. When a Brazilian banking partner flagged the issue and suspended the BRL settlement account, the business faced both an immediate operational problem and the need for an urgent BCB pre-engagement. We structured a remediation path that separated the immediate banking issue from the longer authorisation track and prioritised the steps that would restore settlement capacity fastest. The outcome was a phased resolution rather than an operational shutdown.
Tax and Banking Interaction for Brazil-Licensed VASPs
Brazilian tax treatment of digital assets is a distinct layer that every licensed VASP must address. The Receita Federal (Brazil's federal tax authority) has issued guidance on the reporting of crypto-asset holdings and transactions for both individuals and legal entities. Brazilian-resident legal entities operating as VASPs are subject to Brazilian corporate income tax on profits arising from their virtual-asset activities, and the classification of specific token types for tax purposes – income versus capital treatment, withholding obligations on cross-border payments – requires a jurisdiction-specific analysis.
VAT equivalents in Brazil (particularly ICMS and ISS) interact differently with digital-asset services depending on whether the activity is characterised as a financial service, a brokerage, or a software service. The classification matters because the applicable tax rate and the tax authority competent to collect it differ across categories. We advise clients to resolve this classification before beginning operations, not after the first audit query.
Banking for Brazilian VASPs involves both local and correspondent relationships. BRL settlement requires a licensed local account. USD or EUR liquidity for cross-border settlements is accessed through correspondent banking, and Brazilian correspondent banks apply enhanced scrutiny to VASP-related flows. Demonstrating BCB authorisation and a documented AML programme is the practical baseline for sustained correspondent access.
How Does Brazil Compare for an Inbound Operator?
For a digital-asset business assessing where to build or anchor its Latin American operations, Brazil presents a specific risk-opportunity profile. The market is large: Brazil accounts for a material share of Latin American crypto transaction volume, and a BRL-denominated offering addresses a user base that cannot be replicated from any other single jurisdiction in the region.
Against that opportunity, the regulatory entry cost is genuine. The BCB authorisation process requires a substance commitment – a properly capitalised legal entity, a governance structure that meets fit-and-proper standards, and a compliance infrastructure that satisfies BCB expectations. A business that treats Brazil as a secondary market and attempts to serve it from an offshore shell will find the approach increasingly untenable as BCB enforcement matures.
Compared to jurisdictions with lighter VASP registration regimes – certain Caribbean jurisdictions, for instance, or older EU member-state regimes before the MiCA transition – Brazil demands more upfront compliance investment. Compared to the UAE's VARA regime or Singapore's MAS Payment Services Act track, the Brazilian process is broadly comparable in depth, though the specific documentary requirements differ.
The decision matrix for an inbound operator reduces to three profiles:
Profile A – Full market entry: A business that intends to operate a Brazilian exchange or custody service for Brazilian-resident clients should plan for a BCB authorisation application, a local legal entity, and a compliance programme built to BCB standards. The authorisation timeline is measured in months, not weeks, and the capitalisation commitment is material. The market opportunity justifies the investment for operators with a genuine Latin America strategy.
Profile B – Cross-border service with a Brazilian user base: A business incorporated elsewhere that already has Brazilian users must address the BCB perimeter analysis immediately. The options are to obtain Brazilian authorisation, to restructure the product to remove the Brazilian nexus, or to cease Brazilian-resident onboarding while the authorisation track progresses. None of these is consequence-free; the choice depends on the volume of Brazilian business, the timeline for authorisation, and the risk appetite of the business and its investors.
Profile C – Token issuer or structured product: An issuer whose token may qualify as a security under CVM standards must run the securities analysis alongside or before the BCB authorisation analysis. CVM oversight adds a second regulatory relationship, additional disclosure obligations, and potentially a different capital and governance standard. Early classification advice is essential.
To pressure-test your entry structure before committing resources, message us via t.me/oboluslaw.
What Are the Most Common Mistakes Inbound Operators Make?
A common assumption among operators expanding into Brazil is that a well-regarded offshore or EU licence, combined with strong internal compliance, is sufficient to manage Brazilian regulatory risk. It is not. The BCB requires a separate and jurisdiction-specific authorisation, and the CVM's securities analysis is independent of any foreign regulatory determination.
Beyond the licence assumption, we regularly see the following errors in our practice:
Underestimating the AML/CFT depth. Brazil's AML expectations are substantive and operationally detailed. An AML policy written for a lighter regime will not satisfy a BCB review without material revision.
Delaying the banking conversation. Approaching Brazilian banks for a settlement account before BCB authorisation is in hand – or at least formally applied for – extends the timeline and increases the risk of a cold response. Sequencing the authorisation and banking tracks correctly is a practical necessity.
Misclassifying the token. Operators that classify a token as "utility" for marketing purposes, without a formal CVM analysis, expose themselves to a later securities determination that invalidates the product structure. The CVM applies a substance-over-label test.
Ignoring the ongoing compliance commitment. BCB authorisation creates periodic reporting, capital maintenance, and change-notification obligations. Businesses that treat authorisation as the end of the regulatory relationship rather than the beginning of it will accumulate compliance arrears that are costly to remedy.
We map the licence stack – operating, custody, payment, and securities layers – before a client commits to the Brazilian market. That pre-commitment analysis is the most cost-effective intervention.
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – how we structure multi-jurisdiction licence stacks from pre-application through authorisation.
- VARA Licence Application Under Heightened Scrutiny – a parallel regime comparison for operators weighing UAE versus LatAm entry.
- Stablecoin Issuance Authorisation Under Heightened Scrutiny – the BCB and CVM implications for stablecoin issuers targeting Brazilian users.
FAQ
How long does a crypto licence take to obtain?
In Brazil, BCB authorisation timelines vary depending on the category of services, the completeness of the application dossier, and the BCB's own review capacity at any given time. Applicants should plan for a process measured in months rather than weeks. Incomplete applications, or dossiers that require supplemental information, extend the timeline materially. Preparing a comprehensive application at first submission is the most effective way to manage the duration.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer. The right jurisdiction depends on where your users are located, where your banking is anchored, the nature of your product, and your capital position. Brazil is necessary for any business with a material Brazilian-resident user base; it cannot be substituted by an offshore licence. For operators building a global or regional stack, Brazil will typically be one authorisation among several – alongside EU MiCA, VARA, MAS, or other regimes relevant to the target markets.
Do I need a separate custody licence?
Custody of virtual assets on behalf of clients is a regulated activity under the BCB's framework. If your business holds client virtual assets – even as an ancillary function to an exchange or payment service – the custody activity falls within the BCB's authorisation perimeter. Whether it requires a separate authorisation or is covered within a broader VASP licence depends on the scope of your application and the BCB's current implementing rules. We recommend addressing custody as a discrete line item in any pre-application assessment.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before you commit – so structural problems are resolved before they become enforcement problems. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in market-entry authorisation and multi-layer licence structuring for digital-asset businesses across the Americas and major international hubs.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.