#
BCB's new VASP framework extends existing financial-sector customer-protection, governance, cybersecurity and incident-response requirements to VASPs, bars physical-currency handling, and (via Resolution 561) requires segregated client-fund accounts and monthly reporting for FX-adjacent crypto activity. One claim originally nested here (the Kalshi/Polymarket block) has been identified as deriving from Brazil's fixed-odds betting law rather than the BCB crypto-licensing apparatus and is routed to advennt as a crypto-gambling-nexus overlap.
One claim initially nested in this module needs a caveat carried forward rather than presented as native crypto consumer-protection enforcement. Brazilian authorities blocked the prediction-market platforms Kalshi and Polymarket, citing investor-protection and market-integrity concerns; closer examination shows this action was taken under National Monetary Council Resolution No. 5,298, part of Brazil's fixed-odds betting law, and enforced via Anatel rather than through the BCB's VASP or crypto-licensing apparatus that this module otherwise covers. Kalshi and Polymarket were targeted as unlicensed betting platforms, not as unauthorised virtual-asset service providers, and the corroborating reporting for this specific action is T4-tier only. This item has accordingly been routed to the advennt monitor as a crypto-gambling-nexus overlap rather than asserted here as a native enforcement action within Brazil's crypto consumer-protection regime.
Outlook
Because the core VASP consumer-protection rules are newly codified rather than tested, an actual enforcement track record does not yet exist -- the transition period running through November 2026 is likely to be the first real test of how these obligations are supervised in practice. The prediction-market episode is worth continuing to watch across both this monitor and advennt, given that the underlying jurisdictional boundary between crypto-licensing oversight and betting-law enforcement in Brazil does not yet appear fully settled.
Consumer Protection
Brazil's client-asset segregation duty for virtual-asset service providers continues to apply without substantive change. Under Resolução BCB nº 519/2025, in force since 2 February 2026, virtual-asset service providers must keep clients' financial resources in individualised accounts, separated from the platform's own resources, and must adopt equivalent mechanisms segregating clients' crypto-assets from the firm's own assets. Recent investor-facing commentary restates this duty rather than describing any revision to it, and nothing in the current transition activity changes its scope or application.
The duty is relevant context for the parallel authorisation transition now underway: a virtual-asset service provider that misses the 30 October 2026 filing deadline and enters the 30-day wind-down period remains subject to the same segregation duty while it organises the return of client funds and the transfer of client assets to other institutions. In other words, the segregation obligation does not lapse during wind-down; if anything, it underpins the orderly-exit mechanics that the wind-down period is designed to produce, since segregated client funds and assets are what make an orderly return and transfer possible in the first place.
Outlook
No change to the segregation duty itself is in view. Its practical significance in the near term is as the operational foundation for the wind-down process facing any virtual-asset service provider that does not file for authorisation by 30 October 2026: a firm that has properly segregated client funds and assets throughout its operation is better placed to complete the return and transfer process within the 30-day window than one that has not.
3 earlier distinct update(s)
Consumer Protection
Resolução BCB nº 520/2025 imposes a mandatory custody-segregation duty on Brazilian SPSAVs: client virtual assets must be held segregated from the provider's own resources, in individualised accounts, effective since 2 February 2026. For any exchange that previously commingled client holdings with proprietary assets, this requires an operational reorganisation of custody architecture rather than a mere disclosure or procedural adjustment, and it is one of the more concrete consumer-facing protections to emerge from the 2025-2026 resolution stack.
This custody-segregation requirement sits within a broader prudential structure that also sets minimum regulatory capital for SPSAVs at a level reported to range from approximately R$10.8 million to R$37.2 million depending on licensed activity, giving client-asset protection a capital backstop in addition to the segregation duty itself. Sourcing available this cycle rests on a single Tier-3 source for the segregation requirement specifically; no Tier-1 Banco Central text was independently retrieved to corroborate the precise mechanics of the segregation duty.
Outlook
The segregation duty's practical enforcement, including how the Banco Central verifies ongoing compliance with individualised-account segregation rather than merely requiring attestation at authorisation, was not established this cycle and remains worth monitoring as the transition window toward full authorisation closes on 30 October 2026.
Consumer Protection
Virtual-asset service providers operating in Brazil must identify the owner of a self-custodial wallet and implement and register processes to verify the origin and destination of virtual assets in FX-regulated operations. This probable-confidence, materiality-4 obligation is structural in character: consumer protection in Brazil's new crypto framework operates primarily through the licensing gate and counterparty-verification requirement itself, rather than through an explicit disclosure regime, complaint-handling mechanism, or standalone consumer-rights instrument.
This obligation is dated to take effect 2 February 2026, aligned with the broader BCB VASP authorisation regime under Resolução BCB 521/2025, and sits within the enacted-not-yet-effective regulatory stage pending that date. The practical effect is to require VASPs to build counterparty due-diligence capability, verifying the identity behind self-custodial wallets and confirming the origin and destination of virtual-asset flows, as a condition of continued operation within the FX-regulated perimeter, rather than as a separate consumer-facing protection layer.
The traffic-light rationale for this module reflects that protection here is licensing-gate-based and structural rather than expressed through explicit consumer-facing rules, which is a meaningfully different protective architecture than a disclosure-and-complaints model, with different practical implications for how a consumer would actually exercise a remedy.
Outlook
The key open question is whether Brazil layers an explicit consumer-facing disclosure or complaints mechanism onto this structural, licensing-gate-based protection once the broader VASP framework's grandfathering period closes on 30 October 2026.
Consumer Protection
Consumer protection in Brazil's crypto market has moved from aspiration to binding obligation within the same package of BCB resolutions that established the licensing perimeter. VASPs must now conduct client suitability assessments before granting access to more complex virtual assets, a gatekeeping obligation that did not previously exist in binding form. Alongside suitability, VASPs are required to communicate risks and fees clearly to clients, embedding a disclosure obligation directly into the authorisation framework rather than leaving it to voluntary industry practice.
Operational-resilience obligations round out the package: VASPs are now liable for losses caused by operational failures, and are subject to cybersecurity and stress-testing requirements. Together, suitability, disclosure and liability/resilience obligations constitute a comprehensive consumer-protection layer embedded directly in the primary VASP framework, rather than a separate or lagging consumer-protection statute -- a structural choice that distinguishes Brazil's approach from jurisdictions where licensing and consumer protection are legislated and enforced on separate tracks.
Outlook
As the 270-day grandfathering window progresses, the practical test of these obligations will be supervisory enforcement -- whether the BCB actively examines suitability assessments, fee disclosures, and stress-testing compliance, or whether these remain largely self-certified in the near term. That enforcement posture is not yet visible from this cycle's sourcing and is worth tracking going forward.
Sources and findings (4)
- T4 · CoinDeskVASPs (BR) — handling physical currency (domestic or foreign) and using foreign cash to purchase virtual assetsretrieved M3bindingin forcenew
- T4 · The BlockBCB VASP framework — existing financial-sector requirements including customer protection, governance, internal controls, cybersecurity policies and incident-response protocolsretrieved M4bindingin forcenew
- T4 · CoinDeskBCB Resolution 561 — segregated client-fund accounts for eFX-related crypto activity and detailed monthly reportingretrieved M3bindingin forcenew
- T4 · The BlockBrazilian authorities (National Monetary Council) — prediction-market platforms Kalshi and Polymarket, citing investor-protection and market-integrity concernsretrieved M3bindingin forcenew