Crypto regulation in Brazil: who oversees what

You buy bitcoin on an exchange, transfer it to your own wallet and, months later, sell it. Along the way, at least four Brazilian authorities have something to say: one authorizes the exchange, another decides whether the asset is a regulated investment, another receives the data for tax purposes and another looks for signs of money laundering.

This article shows who does what, based on the laws and official rules in force or published as of October 8, 2026. It is not a substitute for legal advice, and several of the rules cited here have changed in recent weeks.

Two related topics have their own articles on the site. The rules for stablecoins are in Stablecoin regulation: the international picture. The division of powers in real estate tokenization, which involves registry offices and the Judiciary, is in Real estate tokenization in Brazil: who regulates what. For a comparison with the European model, see MiCA: the European framework for crypto assets.

The foundation: the 2022 legal framework

Law 14,478/2022, known as Brazil’s legal framework for crypto assets, does not regulate the coins themselves. It regulates those who provide services with them (Law 14,478/2022).

Under the law, a virtual asset is a digital representation of value that can be traded or transferred electronically and used for payments or investment. Excluded are official currencies, electronic money, loyalty program points and assets whose issuance or trading already has its own rules, such as securities and financial assets (art. 3).

A virtual asset service provider is a company that, on behalf of others, exchanges crypto assets for reais or other currencies, exchanges one crypto asset for another, transfers, holds or manages crypto assets, or takes part in offerings and sales of these assets (art. 5). In practical terms: exchanges, custodians and intermediary platforms.

The law sets out three central points:

• These companies may only operate with prior authorization from a federal body (art. 2).
• The law does not apply to assets that are securities and “does not change any powers” of the CVM (art. 1, sole paragraph).
• Brazil’s Consumer Protection Code applies, where relevant, to transactions in the virtual asset market (art. 13).

The law took effect 180 days after publication, in June 2023. Decree 11,563/2023 chose the Banco Central do Brasil (Brazil’s central bank) as the body that regulates, authorizes and supervises providers, and left intact the powers of the CVM, consumer protection agencies and the bodies that fight financial crime (Decree 11,563/2023).

Central Bank: who may operate and how

The Central Bank’s rules were issued on November 10, 2025, and have applied since February 2, 2026. There are three resolutions:

• BCB Resolution 519 covers authorization processes.
• BCB Resolution 520 defines how providers operate.
• BCB Resolution 521 brings some crypto transactions under foreign exchange and international capital rules.

Three types of company

Resolution 520 creates the virtual asset service provider company in three forms: intermediary (buying, selling, exchanging, wallet management, staking), custodian (holding private keys and recording each client’s positions) and broker, which may combine both activities. Banks, securities brokers and dealers and foreign exchange brokers may also provide these services after notifying the Central Bank (arts. 4 and 20).

To operate in the country, the company must be incorporated in Brazil, with its head office and management here (art. 1, sole paragraph). A foreign platform that already served Brazilians and wants to continue must, within 270 days, transfer its operations and clients to an eligible Brazilian institution or to a company incorporated here to handle that transition (art. 23). Providers also may not offer credit to clients or raise funds from the public, except by issuing shares (art. 12).

What changes for your money

Some requirements directly affect anyone who uses an exchange:

• Segregated money. Client money must be kept in individual accounts in each client’s name, separate from the company’s own cash (art. 28).
• Segregated crypto assets. Client crypto assets must be held in wallets separate from those used in the provider’s own operations, with proof of reserves and an independent audit whose report must be published on the company’s website (art. 30).
• Listing criteria. The selection of assets offered must follow clear, disclosed criteria, with a minimum analysis set out in an annex to the rule (art. 64).
• No mixers. The use of mechanisms designed to conceal the origin and destination of transactions, known as mixers, is prohibited (art. 90).

The difference between leaving crypto assets on an exchange and holding them in your own wallet is explained in Crypto wallets: custodial and non-custodial. Asset segregation reduces one specific risk, that the company uses or loses what is yours, but does not protect against price drops, which can lead to a total loss.

The transition deadlines

Companies already operating on February 2, 2026, had 270 days to apply for authorization (art. 88). By the editorial team’s count, that deadline ends on October 30, 2026.

On September 23, 2026, BCB Resolution 589 changed an important point of this transition. The original wording of Resolution 520 prohibited banks and payment institutions, from October 30, 2026, from carrying out or enabling transactions with providers that were “not authorized or in the process of authorization”. The new text, in force since October 1, postpones the prohibition to November 6, 2026, and refers only to providers that “are not authorized” to operate in the country (BCB Resolution 589). The ban includes opening payment accounts, conducting foreign exchange and holding assets in custody to enable these transactions. Since the new wording removed the reference to those “in the process of authorization”, the exact scope of the rule for companies with pending applications is worth following in Central Bank announcements.

The same rule requires that, from January 1, 2027, providers send the Central Bank data on client balances, assets held in custody, proof of reserves and amounts allocated to staking. And BCB Resolution 580, from July 2026, classified providers as “Type 3” institutions for prudential purposes and set January 1, 2027, as the date from which they must follow a set of capital calculation rules.

CVM: when a crypto asset is a regulated investment

The CVM (Comissão de Valores Mobiliários, Brazil’s securities regulator) oversees the securities market, such as shares and collective investment contracts. According to the CVM itself, it has authority “only over crypto assets considered securities” (CVM, FAQ, updated February 6, 2026).

Guidance Opinion 40, from October 2022, sets out this understanding. It divides tokens into three categories, which may overlap (CVM, Guidance Opinion 40):

• Payment token, which seeks to perform the functions of money.
• Utility token, used to access a product or service.
• Asset-backed token, which represents another asset, such as a security, a stablecoin or an NFT.

For the CVM, the fact that an asset is on a blockchain is irrelevant to deciding whether it is a security. What counts is its economic substance. If the token works as a collective investment offered to the public, with an expectation of profit from the efforts of others, it is a security and follows capital market rules on public offerings and trading. The CVM page cites as examples tokens that represent traditional securities, tokenized receivables certificates and publicly offered collective investment contracts. The criteria are detailed in the article on real estate tokenization.

On the same page, the CVM states that Bitcoin and most cryptocurrencies are not subject to its regulation, except when derivatives are involved. It also allows Brazilian investment funds to invest indirectly in crypto assets abroad, under specific rules. In practice, this means two different doors: buying bitcoin on an exchange is a Central Bank matter; buying shares in a fund that invests in bitcoin is a CVM matter.

Receita Federal: information, not authorization

The Receita Federal (Brazil’s Federal Revenue Service) neither authorizes nor supervises the operation of exchanges. It receives information about transactions.

Since July 1, 2026, this information has arrived through the Crypto Asset Declaration (DeCripto), created by RFB Normative Instruction 2,291 of November 14, 2025. DeCripto replaced the system of RFB Normative Instruction 1,888/2019, in place since 2019 (Receita Federal, DeCripto manual). The manual includes layouts for providers and also for individuals and companies that traded through a provider based abroad or without any provider. Several records are identified as “for CARF purposes”, the OECD’s Crypto-Asset Reporting Framework for exchanging information on crypto assets.

This article does not cover tax rates or how to declare crypto assets in the income tax return. Those points depend on other rules and change frequently; check the current guidance on the Receita Federal website.

Coaf and money laundering

The Coaf (Council for Financial Activities Control) is Brazil’s financial intelligence unit. It receives suspicious transaction reports and forwards them to the authorities when it finds evidence of crime.

Law 14,478 added virtual asset service providers to the list of those with anti-money laundering duties (Law 9,613/1998, art. 9, item XIX). This means identifying clients, keeping records of transactions above set thresholds and reporting to Coaf, without tipping off the client, transactions that may indicate crime (arts. 10 and 11). The law also increased the penalty for money laundering by one-third to two-thirds when the crime involves a virtual asset.

Since providers are now institutions authorized by the Central Bank, they follow the Central Bank’s own anti-money laundering rules. The most recent is BCB Resolution 591, of September 30, 2026. It requires reporting to Coaf transfers of crypto assets to or from self-hosted wallets, those controlled by the users themselves, worth US$10,000 or more. Reports on transactions from October to December 2026 must be made on the first business day of January 2027. Resolution 591 replaced, one week later, Resolution 588, which dealt with the same subject.

Resolution 520 also provides, in two stages of up to one year each, for the exchange of sender and beneficiary information between providers, first within the country and then with foreign providers (art. 89). This is the Brazilian version of the so-called travel rule.

Police, prosecutors and consumers

The legal framework created in the Penal Code the crime of fraud involving virtual assets, securities or financial assets (art. 171-A). It punishes anyone who organizes, manages, offers or distributes portfolios or intermediates transactions with these assets to obtain an unlawful advantage by deceiving someone, with 4 to 8 years of imprisonment and a fine. The law also brought companies offering virtual asset services under the Law on Crimes against the National Financial System.

In practice, a crypto scam can be investigated by the police and prosecuted by the Public Prosecutor’s Office regardless of whether the company involved is authorized. Warning signs and reporting channels are covered in Crypto scams: how to spot and report them. Consumer problems, such as improper charges or poor service, can be taken to consumer protection agencies, since the Consumer Protection Code applies to these transactions.

The map in brief

Situation as of October 8, 2026, according to the rules cited.

Who	What it does	Main basis
Central Bank	Authorizes, regulates and supervises crypto exchanges and custodians	Law 14,478/2022; Decree 11,563/2023; BCB Resolutions 519, 520, 521, 580, 589 and 591
CVM	Regulates crypto assets that are securities, funds and derivatives	Law 6,385/1976; Guidance Opinion 40
Receita Federal	Receives information on crypto transactions	RFB NI 2,291/2025 (DeCripto)
Coaf	Receives reports of suspicious or specific transactions	Law 9,613/1998
Police and Public Prosecutor’s Office	Investigate and prosecute crimes, such as the fraud in art. 171-A	Penal Code; Law 7,492/1986
Consumer protection	Handles consumer relationship problems	Consumer Protection Code

How to use this map

• Is the company authorized by the Central Bank? Once the transition deadlines are over, this is the first question. An application for authorization is not the same as authorization.
• Is what I am buying a collective investment? If the offering promises returns from someone else’s work, it may be a securities offering and must follow CVM rules.
• Is the platform foreign? From November 2026, Brazilian banks and payment institutions are prohibited from enabling transactions with unauthorized providers, which may affect deposits and withdrawals.
• Regulation is not a guarantee of gains. It reduces the risks of fraud and commingling of assets, but does not prevent losses from price swings, which can be total.

Key takeaways

• The Central Bank authorizes and supervises crypto service providers; the CVM steps in when the asset is a security; the Receita Federal receives data; Coaf receives money laundering reports.
• Deadlines cluster at the end of 2026: October 30 for authorization applications from those already operating, and November 6 for the cutoff of banks and payment institutions from unauthorized providers.
• The rules changed several times in 2026. Before making decisions based on them, check the current text on the responsible body’s website.