Key facts
- Brazil ranks fifth globally in crypto adoption, with $318.8 billion in on-chain value over the past year.
- Virtual asset service providers must obtain Central Bank authorization by October 30, 2026.
- Applications require an independent audit report on anti-money laundering and sanctions controls.
- Minimum capital requirements for licensed entities range from approximately $2 million to $6.7 million.
- About 80% of Brazil's crypto volume is transacted via stablecoins, primarily USDT.
Brazil's burgeoning cryptocurrency market, which ranks fifth globally in adoption and saw $318.8 billion in on-chain activity over the past year, is now subject to stringent new regulations. Virtual asset service providers (VASPs) must secure authorization from the Central Bank of Brazil (BCB) by October 30, 2026, a deadline that marks a significant shift towards formal supervision.
The new regime, established by Law 14.478/2022 and detailed in three resolutions published in November 2025, mandates that companies facilitating crypto trading, holding, or sending must submit an application. This application must include a "reasonable assurance report" from an independent audit firm, verifying the effectiveness of anti-money laundering (AML) and sanctions controls. This requirement moves beyond self-declarations to independent confirmation of compliance.
Entry costs are substantial, with minimum capital requirements ranging from approximately R$10.8 million to R$37.2 million (about $2 million to $6.7 million), depending on the license category. The BCB also prohibits VASPs from operating out of co-working spaces. For the estimated 120 providers currently serving the Brazilian market, many without formal licenses, this represents a significant hurdle. Foreign firms operating from offshore locations must establish onshore operations within 270 days.
Brazil's regulatory focus on crypto is largely driven by its status as a "Stablecoin Nation," with about 80% of declared crypto volume moving through dollar-pegged tokens, predominantly USDT. This reliance on foreign-pegged instruments elevates crypto's relevance to monetary policy, prompting the Central Bank's direct involvement. CertiK's report highlights that this fact underpins the regulatory framework's emphasis on foreign exchange and cross-border flows.
Security remains a critical concern, with $1.32 billion lost to hacks and exploits across 344 incidents in the first half of 2026 alone, driven by wallet compromises and phishing. Legal advisors note that many in the market have underestimated the complexity and time required for the authorization process, anticipating a thorough and technical review by the BCB.
Industry figures observe a trend towards licensed operators, with some projects opting to work with authorized VASPs rather than seeking their own licenses. This suggests a market consolidation where obtaining a license becomes a valuable asset, potentially leading foreign entrants to acquire existing authorized local operators. The report also acknowledges regulatory gray areas, such as non-custodial wallets and DeFi front-ends, which the securities regulator (CVM) considers its domain.