#
Brazil's VASP licensing regime, built on Law 14,478/2022 and BCB Resolutions 519-521, has been in force since February 2, 2026, requiring authorisation, minimum capital (R$10.8M-R$37.2M), and applying a nine-month transition window closing in November 2026, after which non-compliant firms must cease operations. Foreign VASPs face an equivalent local-establishment requirement. A sourcing-tier contradiction affecting several Confirmed-tier claims in this module has been escalated for human verification and is not yet resolved.
The capital bars attached to this framework are not nominal. Firms face a baseline minimum capital requirement of roughly R$10.8 million (approximately US$2 million), rising as high as R$37.2 million depending on business type -- a bar high enough to function as a filter on market entry, particularly for smaller or newer VASPs. Existing firms already operating in Brazil before the new rules took effect are inside a nine-month transition window running from February 2026, with a compliance deadline in November 2026; firms that have not completed authorisation by that point are required to cease operations rather than simply facing supervisory censure. This is a materially harder deadline than a typical soft-launch grace period, and it is the single most consequential compliance event in Brazil's crypto calendar this cycle. Foreign VASPs serving Brazilian clients face the same underlying choice in substance: establish a locally authorised entity under the new framework or risk being barred from serving the market, though the strength of this specific inference rests on secondary reporting rather than a direct BCB statement to that effect.
One caveat needs to travel with this module's Confirmed-tier claims. An internal sourcing check this cycle surfaced a contradiction between the reported tier counts in the run's own metadata (all reporting zero at every tier) and the actual tier tags carried by the sources backing several of this module's core claims -- a BCB press release tagged T1, and academic BCB material tagged T2. That contradiction has been escalated for human verification rather than resolved automatically, and the claims it touches -- the core authorisation requirement, the Resolution 519 pathway update, and a related cross-border classification claim -- are held pending that resolution. The underlying facts are not in dispute; the question is whether the sourcing metadata supporting their Confirmed rating is itself trustworthy, and that has not yet been settled.
Outlook
The November 2026 transition deadline is the module's dominant near-term marker: it will reveal how much of Brazil's existing VASP population completes authorisation versus exits the market outright, and by extension how consolidated the licensed industry becomes. Separately, the primary statutory texts underlying this module -- Law 14,478/2022 itself and Decree 11,563/2023 -- have not yet been retrieved directly from Planalto or BCB primary sources this cycle; firming up that anchoring, alongside resolving the sourcing-tier contradiction noted above, is the priority before this module's claims can be treated as fully clear for publication.
Crypto Licensing
Brazil's licensing transition for virtual-asset service providers has acquired three confirmed, dated milestones within days of each other. Under Instrução Normativa BCB nº 704/2026, a virtual-asset service provider already operating in Brazil as of 2 February 2026 must file its first-phase Central Bank authorisation application by 30 October 2026. Filing by that date allows the firm to continue operating while the Central Bank analyses the application; the deadline is a continuity mechanism, not merely a paperwork cut-off.
A firm that does not file by 30 October faces a defined consequence rather than an open-ended one: it has up to a further 30 days — to roughly 29 November 2026 — to wind down its virtual-asset services. That wind-down period requires the firm to organise the return of client funds and the transfer of client assets to other institutions, meaning the consequence of missing the deadline is an orderly exit process with its own timetable, not an immediate cessation.
The third dated element concerns the institutions on the other side of these relationships. Resolução BCB nº 520/2025 restricts BCB-authorised financial and payment institutions from operating with, or facilitating operations for, virtual-asset entities that are not authorised by the Central Bank or in the authorisation process. The Central Bank has clarified that this restriction takes effect from 6 November 2026, correcting an earlier-reported 30 October 2026 start date. Because 6 November falls after both the filing deadline and the start of the wind-down period for non-filers, a virtual-asset service provider's authorisation status as of early November determines whether its banking and payment relationships can continue under the restriction.
The effect of reading these three provisions together is a single sequenced timeline: file by 30 October to preserve continuity and counterparty standing; if not filed, wind down within 30 days; and from 6 November, authorised institutions must treat non-filers as restricted counterparties. This is a materially tighter and more operationally concrete regime than a general authorisation requirement alone would suggest, because each stage now carries a specific date and a specific consequence attached to it.
Outlook
The period to watch runs from 30 October through to roughly 29 November 2026, covering the filing deadline, the subsequent wind-down window for non-filers, and the 6 November commencement of the counterparty restriction. Firms that have not yet filed face a narrowing set of options as 30 October approaches, and those that miss the deadline should expect the 30-day wind-down mechanics — particularly the return of client funds and transfer of client assets — to become the operative compliance task immediately afterward. Further procedural guidance on these transition mechanics is plausible given how closely the three dates are now sequenced.
5 earlier distinct update(s)
Crypto Licensing
Brazil's VASP licensing regime, established under Lei 14,478/2022 and implemented through BCB Resoluções 519-521/2025, is in its incumbent-transition phase. Virtual-asset service providers already offering services before 2 February 2026 must protocol an authorisation request with the Banco Central do Brasil by 30 October 2026, a 270-day window from the regime's entry into force, in order to continue operating pending review. Firms that miss this deadline must cease operations within thirty days of the cutoff date. This transitional mechanism is sourced from law-firm secondary commentary rather than independently confirmed against the primary resolution text this cycle, so the precise statutory basis and any exceptions to the 270-day window remain to be verified against the primary instrument.
Separately, the Comissão de Valores Mobiliários opened a distinct regulatory channel for tokenised securities. Resolução CVM nº 249/2026, dated 14 October 2026, creates the Programa Piloto DLT, a sixty-day experimental environment, extendable by thirty days, for issuance, offer, distribution, trading, bookkeeping, custody, central depositary and settlement of securities on DLT networks. Within this pilot, the CVM suspends the application of its normal rules governing registration of public securities offerings and related requirements for experimental operations conducted on test networks while the Resolution remains in force. This is a Confirmed, Tier-1-sourced development, quoting directly from the Resolution's own text, and stands apart from the BCB's VASP authorisation track: it addresses tokenised securities under CVM jurisdiction rather than general-purpose virtual assets under BCB jurisdiction.
Outlook
The 30 October 2026 VASP incumbent authorisation deadline is the principal item to track; firms that miss it face a thirty-day cessation clock. The CVM's DLT pilot sandbox, opened 14 October 2026, runs for an initial sixty days extendable by thirty, after which the experimental regulatory carve-outs it provides will lapse absent further CVM action to make them permanent or extend the pilot.
Crypto Licensing
Brazil's VASP licensing framework rests on Lei nº 14.478/2022 together with BCB Resoluções nº 519, 520 and 521/2025, administered by the Banco Central do Brasil. Resolução BCB nº 519/2025 requires that any entity already providing virtual-asset intermediation or custody services as of 2 February 2026 file an authorisation request within 270 days, placing the hard deadline at 30 October 2026. From that date, the same resolution prohibits BCB-authorised institutions from intermediating for any virtual-asset service provider that is neither authorised nor in the authorisation process, converting the filing deadline into an effective market-access cliff for any VASP that has not begun the process.
The regime is binding and in force, but the authorisation window itself remains technically open until the deadline arrives, and the CVM's parallel tokenization rulemaking, expected from 2027 via a dedicated tokenization division and pilot or sandbox programme, has not yet produced a binding regime. This leaves Brazil's licensing architecture split between an operative, hard-deadline authorisation regime for custody and intermediation services at the BCB, and an as-yet-unformed tokenization-specific regime at the CVM.
Outlook
The 30 October 2026 deadline is the determinative near-term event. Late filers reportedly receive a further 30 days before mandatory cessation is enforced, but any VASP that has not at minimum entered the authorisation process by the deadline faces exclusion from intermediation by every BCB-authorised institution. The CVM tokenization track remains a 2027-horizon development with no binding rule yet, so it does not affect near-term licensing exposure.
Crypto Licensing
Brazil's SPSAV authorisation regime, created by Resoluções BCB nº 519/2025 and 520/2025 under Lei 14.478/2022 and Decreto 11.563/2023, requires prior Banco Central authorisation together with Brazilian incorporation and seat, in force since 2 February 2026. Minimum regulatory capital for SPSAVs is reported to range from approximately R$10.8 million to R$37.2 million depending on the specific licensed activity, a prudential structure that scales with the scope of activity a given provider undertakes rather than applying a single flat figure across all licensees.
The transitional mechanics governing existing providers carry a specific and unresolved date conflict. Existing VASPs must file authorisation requests with the central bank by 30 October 2026, 270 days after Resoluções BCB nº 519, 520 and 521 of 2025 took effect; firms that miss this window must cease virtual-asset operations in Brazil. Separately sourced reporting states that authorised institutions may no longer transact with unauthorised virtual-asset providers from 6 November 2026. Both figures are specific and independently sourced, and the inconsistency between them is treated as a Disputed finding rather than simple thinness, since it may reflect either a drafting inconsistency between the resolutions or a staggered implementation sequence that commentary has not yet correctly captured.
No penalty-schedule provision text addressing breach of SPSAV conditions, or operating as an unauthorised VASP after the transition window closes, was retrieved this cycle. This leaves the consequence of missing either deadline, in terms of specific sanctions rather than the general cessation requirement, as an open question.
Outlook
The most consequential near-term development to watch is whether Banco Central do Brasil clarifies the relationship between the 30 October and 6 November 2026 dates before either passes. A related open question is whether the BCB has issued, or will issue, a separate regulatory track for incumbent banks offering crypto intermediation, distinct from the dedicated VASP/SPSAV regime; this distinction was not established this cycle and is flagged as a known under-indexed area.
Crypto Licensing
Brazil's virtual-asset licensing regime moved from framework-design to near-implementation this cycle. Entities providing virtual-asset services in Brazil must obtain Banco Central do Brasil authorisation as a Sociedade Prestadora de Serviços de Ativos Virtuais (SPSAV), or, where already an authorised financial institution, must notify BCB of intent to continue providing virtual-asset services. This core authorisation requirement, assessed at probable confidence, sits at the centre of the new Resolução BCB 519/2025 regime.
Resolução BCB 519/2025 establishes a 270-day grandfathering period ending 30 October 2026, during which existing virtual-asset providers may continue operating pending notification or authorisation. This transitional design is deliberate and material: it gives the market a defined runway to come into compliance while the rules themselves are already enacted and dated, taking effect 2 February 2026. The regime rests on Lei 14.478/2022 and Decreto 11.563/2023 as primary and secondary legal basis, with Resoluções BCB 519, 520 and 521/2025 supplying the operative detail, all under the supervisory authority of the Banco Central do Brasil.
Sourcing for the core authorisation and grandfathering requirements rests on Notabene's coverage of the resolutions rather than a bcb.gov.br-hosted primary text, a gap that is registered but does not undermine the underlying finding, since multiple independent secondary sources corroborate the instrument numbers and effective dates. Separately, reported minimum capital figures for SPSAVs by activity class, cited in press coverage as ranging from R$10.8 million to R$37.2 million, have not been confirmed against a primary BCB text this cycle and are held as an unconfirmed figure.
Outlook
The defining near-term marker is 30 October 2026, when the grandfathering period closes and providers that have not secured authorisation or completed notification lose the ability to continue operating in reliance on the transitional window. Watch for whether a BCB primary-source document becomes available to confirm the licensing regime's minimum capital requirements and to move confidence above probable.
Crypto Licensing
Brazil's crypto licensing regime moved from statute-on-the-books to operating perimeter with the entry into force of BCB Resolutions 519, 520 and 521 on 2 February 2026. Every virtual asset service provider -- exchanges, custodians, and other intermediaries -- must now hold prior authorisation from the Banco Central do Brasil, completing the licensing architecture envisaged under the 2022 Virtual Assets Law (Law 14,478/2022). This is a landmark completion of a framework rather than a first announcement: the underlying statute has existed since 2022, and this cycle marks the point at which the implementing resolutions actually bind the market.
The capital regime attached to authorisation is tiered by risk classification, with minimum prudential capital reported to range from R$10.8 million to R$37.2 million. Market commentary characterises this threshold as materially favouring larger, already-capitalised incumbents, with smaller operators facing pressure toward consolidation or exit rather than straightforward compliance. This is a structural design choice within the resolutions rather than an incidental side effect, and it is worth tracking whether smaller VASP exits or mergers become visible in coming cycles as the grandfathering window narrows.
Transition mechanics soften the immediate compliance shock for existing operators. A 270-day grandfathering period, running from 2 February to 30 October 2026, allows already-operating VASPs to notify or apply for BCB authorisation without an enforced operational gap. Distinctly, banks, brokers and distributors that already hold authorisation for other regulated financial activities may extend into virtual-asset services through a notification-only pathway rather than pursuing a full new authorisation -- a materially lighter compliance lift than that facing standalone crypto-native VASPs, and one that may accelerate incumbent financial institutions' entry into the space relative to crypto-native competitors.
Foreign VASPs are treated distinctly and more restrictively. Those unable to demonstrate a significant existing Brazilian customer base as of 2 February 2026 face a licensing process that can extend up to two years, a materially longer timeline than the grandfathering track available to entities already established in-market. This creates a meaningful first-mover advantage for foreign VASPs with pre-existing Brazilian user bases and a corresponding barrier for genuinely new foreign entrants.
Outlook
The grandfathering window's 30 October 2026 close is the next hard date on the calendar: VASPs that have not completed notification or authorisation by then face a binding compliance cliff rather than a soft deadline. Separately, the up-to-two-year foreign VASP licensing timeline implies that genuinely new foreign entrants without an existing Brazilian footprint are unlikely to receive authorisation before roughly early 2028, a timeline worth monitoring for any acceleration or further guidance from the BCB in subsequent cycles.
Sources and findings (5)
- T1 · Banco Central do BrasilBanco Central do Brasil (BCB) — VASPs to operate, classified as intermediary, custodian, or virtual asset broker, under Resolution BCB 520retrieved M5bindingin forcenew
- T1 · Banco Central do BrasilResolution BCB 519 — VASP operating-authorisation process, updating rules for segments previously regulated by CMN (FX brokers, securities brokers/distributors)retrieved M4bindingin forcenew
- T4 · The BlockExisting VASPs (transition cohort) — November 2026 compliance deadline (nine-month transition from Feb 2, 2026), after which non-compliant firms must cease operationsretrieved M4bindingin forcenew
- T4 · CoinDeskVASP firms (BR) — R$10.8 million baseline (~US$2M), up to R$37.2 million for certain business typesretrieved M4bindingin forcenew
- T4 · CoinDeskForeign VASP firms serving Brazilian clients — the new BCB VASP framework or risk being barred from the marketretrieved M4bindingin forcenew