Brazil has formalized a comprehensive framework for virtual asset service providers (VASP). This is the moment when the rules become operational, enforceable, and aligned with the scale of activity taking place in the country. For institutions already active in Brazil and those evaluating market entry, this is a shift that raises expectations and lowers uncertainty at the same time.
The volume of institutional crypto activity in Brazil has grown fast. Chainalysis data shows Brazil received an estimated $318.8 billion in crypto value from mid-2024 to mid-2025. That represents almost one-third of all Latin American flows. The bulk of that volume already comes from institutional transactions over ten million dollars. The new rules bring the supervisory structure in line with a market that already exists.
The Central Bank of Brazil (Banco Central do Brasil) has now set out clear requirements for licensing, governance, reporting, custody, stablecoin flows, and FX treatment. Firms have until February 2026 to reach readiness and apply, followed by a nine-month transition period for achieving full compliance.
Fireblocks recently hosted three officials from the Central Bank of Brazil to talk with us about the new regulatory framework, what it means in practice, and how institutions can align with the new expectations to meet upcoming milestones.
The Core of Brazil’s New Framework
With the publication of the new rules, institutions now have a clear picture of what the Central Bank expects from any firm offering virtual asset services in Brazil. These expectations span authorization, custody, segregation, audits, compliance, and the oversight of stablecoin flows.
Licensing
All custodians, intermediaries, brokers, exchanges, and platforms providing virtual asset services in Brazil must obtain authorization as SPSAVs (“Sociedades Prestadoras de Serviços de Ativos Virtuais”). Foreign firms must be authorized before operating and must either establish a local presence or partner with a licensed Brazilian entity. During the consultation process, the Central Bank considered whether liquidity providers should also be directly authorized. The final approach was proportional. Liquidity providers and market makers are not licensed independently in this phase. Instead, SPSAVs that rely on them must fully supervise these activities as part of their own compliance and governance responsibilities.
Brazil’s framework distinguishes between custodian PSAVs, who hold client assets directly and therefore assume the highest regulatory and operational burden, and intermediary PSAVs, who rely on licensed custodians for safekeeping. This two tier structure shapes how firms must architect their custody, risk, and technology stacks
Segregation of assets
Client assets must be segregated from firm assets. This principle was reinforced throughout the public consultation process and remains a central expectation for authorization.
Custody and outsourcing
Digital asset custody can be outsourced, but responsibility cannot. The institution remains accountable for due diligence, for ensuring contractual clarity, for overseeing operations, and for providing supervisory access. The rules also permit the use of foreign custodians, as long as they satisfy Brazil’s compliance and supervisory requirements.
Proof of reserves and audits
Firms must provide monthly public disclosures and undergo independent audits every two years. The Central Bank intentionally avoided mandating a single technical standard for proof of reserves. Instead, supervisors will evaluate whether a firm’s chosen method provides adequate transparency. The two year audit cadence reflects feedback during the consultation period, when firms raised concerns about cost and operational burden. The regulator balanced these concerns with the need for dependable verification.
AML, Travel Rule and Know-Your-Wallet
Firms must apply the Travel Rule, conduct risk assessments, detect fraud, and identify counterparties. One of the more detailed points addressed during the regulatory process was the handling of self custody. The initial consultation contemplated restrictions, but after substantial industry feedback, the Central Bank preserved self custody while requiring institutions to identify who controls any self hosted wallet involved in a transaction. This extends KYC practices into Know-Your-Wallet (KYW) and ensures transparency even when assets move out of a custodial environment.
Stablecoins and FX treatment
Cross border transfers using stablecoins or fiat-referenced tokens are treated as FX transactions. Institutions must identify the client, monitor the transfer, and comply with reporting requirements. The final FX rule is simpler than the version presented during the consultation. Monthly reporting was consolidated, and a separate classification for custody within FX was removed. These changes reflect a proportional approach based on feedback from market participants.
Some aspects of stablecoin regulation are expected to arrive in subsequent phases, including prudential requirements for issuers. The FX treatment published in this round is only one part of a broader roadmap.
Cybersecurity
Cybersecurity controls, continuity plans, identity management, and incident response procedures are explicit regulatory requirements. This reflects the scale of recent global crypto hacks and targeted attacks on the PIX ecosystem.
Brazil Market Entry Checklist: What Institutions Need to Consider
Over the past year, Fireblocks has had a high volume of strategic, compliance, and technical discussions with Brazilian firms as they prepared for or evaluated Brazil’s new VASP/PSAV regime.
Whether it is a neobank navigating local partnerships, a crypto-native platform reassessing custody models, or a traditional financial institution entering the stablecoin settlement space, we see a common pattern: regulatory readiness is a competitive edge.
Institutions are therefore using the new framework as an opportunity to strengthen governance, formalize controls, and modernize their operating models. Preparing for authorization means aligning internal processes with supervisory expectations, clarifying responsibility across teams and vendors, and building technical and organizational controls that can withstand audits and operational testing.
Many institutions also expect the new regulatory standards to accelerate consolidation in the Brazilian market. As expectations increase, larger banks, regulated custodians, and established exchanges are likely to absorb smaller providers that do not meet the operational and governance requirements set out in the new framework.
This checklist summarizes the priorities most firms should focus on:
- Licensing pathway
Confirm whether you will apply directly or partner with a licensed entity. - Segregation model
Validate full separation between client and firm assets at both the technical and operational levels. - Custody architecture
Decide which services will be handled internally and which will be outsourced under the essential service provider structure. - Travel Rule and Know-Your-Wallet
Select providers, establish deterministic counterparty identification, and implement KYW processes for self custody transactions. - FX monitoring
Integrate monitoring for stablecoin and FX activity subject to Resolution 521. - Audit readiness
Prepare audit logs and build the reporting package for monthly disclosures and the biannual independent audit cycle. - Cybersecurity
Review incident response procedures, continuity planning, identity management, and system level security. - Governance and capital
Align governance structures and capital requirements with the activities your institution plans to pursue.
Looking Ahead
Brazil’s new framework raises the standard for how virtual asset service providers operate. It rewards firms that build the right controls early and positions them to move with confidence as volumes grow and expectations increase.
At Fireblocks, we are already working with institutions across banking, fintech, payments, and digital asset infrastructure as they prepare for authorization, review custody models, and align governance with the new rules. As custodian and intermediary PSAVs navigate this transition, Fireblocks’ institutional-grade infrastructure, governance, and risk controls map directly onto the requirements for both PSAVs and intermediary PSAVs.
If your institution is evaluating its next steps, our team can help you map the requirements, understand the operational implications, and design a compliant and scalable architecture. Connect with us to speak with our Brazil specialists and begin planning your transition into the SPSAV regime.
Frequently Asked Questions About Brazil’s New Virtual Asset Framework
-
Do I need a Brazilian SPSAV license, or can I operate through a partner in Brazil?
Under Brazil’s new framework, any company providing virtual asset services in the country must be authorized as an SPSAV, a Sociedade Prestadora de Serviços de Ativos Virtuais”).. This includes custodians, intermediaries, brokers, exchanges, and platforms. Foreign firms must obtain authorization before operating in Brazil and must either establish a local presence or work through a licensed Brazilian partner. A partnership can satisfy the local-presence requirement, but it does not reduce supervisory expectations. Firms remain responsible for ensuring the arrangement fully complies with Brazilian rules. -
How does Brazil treat self-custody?
Brazil allows self custody, but with strict identification obligations. Institutions must know who controls a self-custody wallet that interacts with their platform. The Central Bank adopted this approach after industry consultation. Firms operating in Brazil must implement “know your wallet’ processes that verify the beneficial owner of self custody addresses and monitor related flows. These requirements align with Brazil’s expectations for Travel Rule compliance, counterparty identification, and AML monitoring. -
How are stablecoin transfers regulated under Brazil’s FX rules?
Brazil treats cross-border transfers using stablecoins or fiat-referenced tokens as FX transactions. Institutions must identify the client involved in the transfer, monitor the transaction, and comply with Brazil’s reporting requirements. The final FX rule is simpler than the original draft. Brazil consolidated monthly reporting and removed the separate FX “custody” classification, reflecting a more proportional and operationally workable approach while still maintaining transparency. -
What does the Central Bank of Brazil expect for proof of reserves and independent audits?
Firms operating in Brazil must publish monthly disclosures and undergo independent audits every two years. The Central Bank intentionally avoided mandating a specific proof of reserves standard. Each institution may choose its method, and Brazilian supervisors will evaluate whether it provides sufficient clarity. The two year audit cycle reflects feedback gathered during Brazil’s consultation process and balances transparency with operational cost. -
Do liquidity providers or market makers need their own authorization in Brazil to operate under the new SPSAV rules?
Not at this stage. During the rulemaking process, the Central Bank considered requiring direct authorization for liquidity providers. In the final Brazilian framework, these entities are not licensed independently. Instead, SPSAVs that use liquidity providers or market makers must oversee them as part of their own governance, compliance, and risk structures. Responsibility sits entirely with the Brazilian-licensed institution. -
What is Brazil’s regulatory position on staking under the new rules?
The rules published in November 2025 include only an initial treatment of staking. The Central Bank explained during the consultation process that staking has characteristics traditionally overseen by the securities regulator. Because of this shared jurisdiction, the new framework does not provide a full operational rule set for staking. It establishes a basic structure for now, and further guidance is expected as the Central Bank and the securities regulator (Comissão de Valores Mobiliários- CVM) continue defining how staking activities should be regulated in Brazil.
