Brazil tightens crypto rules

The Central Bank of Brazil published Resolution BCB No. 584/2026 on Aug. 7, 2026, updating Resolution BCB No. 142/2021 and explicitly bringing virtual asset service providers, or PSAVs, under the mandatory fraud-prevention rules that apply to regulated institutions.

24-hour precautionary hold

The new wording adds Article 2-B and says institutions that provide virtual asset services, or that execute payments tied to those services, may only process virtual asset transfer orders 24 hours after receiving the contributed funds when the destination is a foreign entity operating in the virtual asset market or a self-custody wallet whose private key is held exclusively by the owner.

According to ConJur's interpretation, that hold is strictly precautionary, is meant for risk analysis and does not mean the virtual assets become permanently unavailable. The 24-hour period is a ceiling, and the institution may release the operation earlier with a reasoned decision that takes into account, at minimum, the risk profile of the customer, the transaction, the counterparty and the destination jurisdiction.

The measure also covers transfers whose individual value or same-day aggregate for a client exceeds the equivalent of $10,000, although each institution's risk policies and management structures may extend that threshold to lower amounts.

Regulatory scope and industry reaction

The scope of Resolution BCB No. 584/2026 covers the virtual asset services defined in Article 5 of Law No. 14,478/2022, including brokerage, custody, intermediation and services involving stablecoins. In practice, the Central Bank is extending fraud-prevention requirements to a broader range of crypto products.

The rule drew political and market reaction. A federal deputy introduced a bill to отменить the 24-hour block on sending cryptocurrencies, while players in Brazil's crypto sector criticized the rule as potentially ineffective or excessive. Others defended it as a necessary consumer-protection tool.

A regime that had already been tightening

The August resolution builds on a regulatory framework the Central Bank has been refining since 2025. Resolution BCB No. 520/2025, which governs the formation and operation of virtual asset service firms, defines functional PSAV categories for intermediation, custody and brokerage, and requires internal security policies, risk management, rules for contracting key services and separation between proprietary assets and customer assets.

Other readings of the regime say that rule creates three provider categories, ties each one to authorization and minimum-capital requirements, and turns authorization into a substantive process similar to that for new financial institutions. According to market analysis, the required minimum capital can range from about 10.8 million reais to 37.2 million reais, depending on the category.

In the same vein, legal and consulting analyses describe Resolution BCB No. 580/2026 as classifying PSAVs as type 3 institutions, preventing them from fitting into segment 5 through a simplified route, and setting a transition toward stricter prudential requirements. That raises the bar for capital, risk management and reporting for conglomerates led by virtual asset service providers.

Licensing, audits and exiting the market

The licensing framework is also tied to a fixed date. Brazilian rules require any company that lets clients trade, custody or transfer cryptoassets to submit an authorization request to the Central Bank of Brazil by Oct. 30, 2026. That filing must include a reasonable assurance report issued by an audit firm registered with the securities regulator, certifying the effectiveness of anti-money laundering and sanctions controls.

Audit firms and local consultancies say the authorization and operating requirements include a physical presence in Brazil, administrators subject to fit-and-proper criteria, paid-in minimum capital, proof of the lawful origin of funds, biennial independent audits of customer-asset segregation, strong anti-money laundering and cybersecurity programs, adoption of the travel rule and integration with the supervisor's official reporting systems.

International analyses of the licensing regime also explain that Resolution BCB No. 520/2025 took effect on Feb. 2, 2026 and governs both services provided by entities already authorized by the Central Bank and the formation of new companies created specifically for that purpose. Specialized law-firm guidance notes that, without that authorization, companies must cease operations in the country at the end of the 2026 transition period.

At the same time, market reports say foreign providers will have to move their Brazilian clients and operations to a domestic authorized entity within the transition period set by the Central Bank.

What is Resolution BCB No. 584/2026?

Resolution BCB No. 584/2026 tightens cryptoasset rules in Brazil by including PSAVs in the Central Bank's fraud-prevention requirements. Among its main points, the rule provides for a 24-hour precautionary hold on certain transfers and expands oversight of virtual asset transactions.

The text published on Aug. 7, 2026, modifies Resolution BCB No. 142/2021 and applies to services defined in Law No. 14,478/2022, such as intermediation, custody, brokerage and services involving stablecoins. It also adds to a regime that had already been tightened by Resolution BCB No. 520/2025 and by the authorization requirements due by Oct. 30, 2026.