Crypto regulation in Brazil is now among the most developed in Latin America, anchored by a dedicated legal framework that governs virtual asset service providers, consumer protections, and anti-money laundering obligations. Brazil';s approach combines a licensing regime administered by the Central Bank of Brazil with tax reporting rules enforced by the Federal Revenue Service. For international founders, investors, and compliance officers, understanding this framework is essential before entering the Brazilian market. This guide covers the core legislation, licensing requirements, ongoing compliance obligations, tax treatment, enforcement trends, and practical considerations for foreign operators.
Brazil';s primary crypto legislation is Federal Law No. 14,478, enacted in late 2022 and commonly known as the Virtual Assets Law or the "Crypto Law." This statute established the legal concept of a virtual asset in Brazilian law, defined the categories of entities that must obtain authorisation to operate, and assigned regulatory authority to a body designated by the executive branch. The executive subsequently designated the Central Bank of Brazil (Banco Central do Brasil, or BCB) as the primary regulator for virtual asset service providers.
The Virtual Assets Law defines a virtual asset as a digital representation of value that can be traded or transferred electronically and used for payments or investment purposes. It explicitly excludes national currency, foreign currency, and financial instruments already regulated under existing securities law. This boundary is important: tokens classified as securities fall under the jurisdiction of the Brazilian Securities Commission (Comissão de Valores Mobiliários, or CVM), not the BCB. Operators dealing in tokenised securities must therefore engage with two regulators simultaneously.
The BCB has since issued a series of normative resolutions fleshing out the licensing framework, conduct standards, and prudential requirements. The CVM, for its part, has issued guidance on crypto-asset investment funds and the treatment of tokens that meet the definition of a security under Brazilian law. Together, these instruments form a layered regulatory architecture that foreign operators must navigate carefully.
A virtual asset service provider (VASP) in Brazil is any legal entity that, on a professional basis, provides services involving the exchange, transfer, custody, or administration of virtual assets, or the participation in financial services related to the issuance or sale of virtual assets. This definition is broad and captures exchanges, brokers, custodians, payment processors accepting crypto, and certain DeFi-adjacent intermediaries that maintain a Brazilian presence.
Foreign companies wishing to offer services to Brazilian residents are required to establish a locally incorporated entity and obtain BCB authorisation before commencing operations. Operating without authorisation exposes the entity and its directors to administrative penalties, fines, and potential criminal liability under Brazil';s financial crimes framework. A common mistake among foreign operators is assuming that serving Brazilian users through an offshore platform, without a local entity, falls outside the regulatory perimeter. The BCB has signalled clearly that the location of the customer, not only the operator, determines jurisdictional reach.
The authorisation process involves submitting a detailed application to the BCB covering corporate documentation, ownership and control structure, business plan, risk management policies, AML/CFT programme, and evidence of minimum capital adequacy. The BCB evaluates the technical and moral suitability of directors and controlling shareholders, a process known as fit-and-proper assessment. Timelines for authorisation have ranged from several months to over a year depending on the complexity of the application and the responsiveness of the applicant to BCB queries.
Practical considerations for applicants include:
In practice, founders should consider engaging local legal counsel before submitting the application, as incomplete filings significantly extend the review period.
Brazil';s anti-money laundering framework for virtual asset providers is governed by Federal Law No. 9,613 (the AML Law), as amended, and by BCB regulations that extend AML obligations specifically to VASPs. The Financial Activities Control Council (COAF) is Brazil';s financial intelligence unit and receives suspicious transaction reports from regulated entities, including authorised VASPs.
VASPs must implement a full AML/CFT programme covering customer due diligence (CDD), enhanced due diligence for higher-risk customers, transaction monitoring, record-keeping for a minimum of five years, and timely reporting of suspicious activity to COAF. The Travel Rule - the obligation to transmit originator and beneficiary information alongside virtual asset transfers - applies to Brazilian VASPs in line with FATF Recommendation 16. The BCB has issued specific guidance on how this rule applies to on-chain transfers, requiring VASPs to collect and transmit identifying information for transfers above a defined threshold.
A non-obvious requirement is that VASPs must also screen customers and transactions against lists maintained by the Brazilian government and international bodies, including UN sanctions lists. Many underestimate the operational complexity of integrating these screening obligations into real-time transaction flows, particularly for high-volume retail platforms.
Penalties for AML non-compliance are substantial. The BCB can impose fines, suspend operations, and revoke authorisation. COAF can refer cases to the Federal Police and the Federal Prosecution Service for criminal investigation. Directors and compliance officers can face personal liability, including criminal charges, for systemic failures in the AML programme.
If you are building or restructuring a compliance programme for a Brazilian VASP, contact info@vlolawfirm.com. We can help structure the setup correctly the first time.
The Federal Revenue Service (Receita Federal do Brasil, or RFB) treats virtual assets as financial assets for income tax purposes. Brazilian tax residents - whether individuals or legal entities - are required to report virtual asset holdings and transactions in their annual income tax declarations. Capital gains arising from the disposal of virtual assets are subject to progressive rates depending on the gain amount, with lower rates applying to smaller gains and higher rates to larger ones.
The RFB has issued specific normative instructions requiring Brazilian exchanges and brokers to report transaction data on their customers to the tax authority on a monthly basis. This reporting obligation covers the volume and value of transactions, the identities of the parties, and the nature of the assets involved. Foreign exchanges with Brazilian customers are also subject to reporting obligations if they have a legal presence in Brazil or if their Brazilian customers use them through a locally registered intermediary.
A practical scenario: a foreign entrepreneur establishes a Brazilian holding company that holds crypto assets acquired at a low cost basis. When the company disposes of those assets at a significant gain, the gain is taxable in Brazil at the corporate income tax rate applicable to financial income. The entrepreneur must ensure that the company';s accounting reflects the cost basis accurately and that the disposal is reported in the correct tax period. Failure to report correctly triggers interest, penalties, and potential classification as tax evasion.
A second scenario: an individual who relocates to Brazil and holds crypto assets acquired before becoming a Brazilian tax resident must establish the cost basis of those assets at the time of becoming resident. The RFB';s position on the valuation method for this purpose has evolved through recent normative instructions, and the choice of valuation method can materially affect the tax liability on future disposals.
Brazil has not enacted a specific VAT-equivalent exemption for crypto-to-crypto exchanges, and the tax treatment of DeFi activities - staking rewards, liquidity provision income, and yield farming - remains an area where RFB guidance is still developing. Operators in these segments should monitor RFB publications closely and seek specific advice.
The CVM';s jurisdiction over crypto assets is triggered when a token meets the definition of a security (valor mobiliário) under Brazilian law, specifically Federal Law No. 6,385. The CVM applies a functional test similar in spirit to the Howey test used in other jurisdictions: if a token represents an investment in a common enterprise with an expectation of profit derived from the efforts of others, it is likely a security.
The CVM has issued guidance on crypto-asset investment funds, permitting regulated funds to allocate a portion of their portfolios to virtual assets traded on authorised platforms. Fund managers wishing to include crypto assets must comply with CVM rules on fund registration, disclosure, and custody. The custody of crypto assets held by regulated funds must be performed by a CVM-authorised custodian or, where no such custodian is available, through arrangements approved by the CVM on a case-by-case basis.
Initial coin offerings (ICOs) and token generation events (TGEs) that involve the issuance of securities tokens require CVM registration or an applicable exemption. The CVM has taken enforcement action against unregistered token offerings targeting Brazilian investors, including against foreign issuers whose tokens were marketed in Brazil. Foreign projects planning to raise capital from Brazilian investors through token sales must assess CVM jurisdiction carefully before launch.
The boundary between BCB and CVM jurisdiction is not always clear in practice. Hybrid tokens - those with both payment and investment characteristics - may fall under both regulators. The two agencies have issued a joint resolution clarifying their respective competences, but grey areas remain, particularly for utility tokens that appreciate significantly in secondary markets.
Foreign companies entering the Brazilian crypto market face a combination of regulatory, operational, and cultural challenges that differ materially from other jurisdictions. Brazil';s regulatory process is document-intensive and conducted primarily in Portuguese. All submissions to the BCB and CVM must be in Portuguese, and the BCB';s fit-and-proper assessments require certified translations of foreign documents.
The corporate structure of a Brazilian VASP matters for regulatory purposes. The BCB requires that the entity be incorporated as a Brazilian legal entity - typically a sociedade anônima (S.A.) or a sociedade limitada (Ltda.) - with a defined ownership and governance structure. Foreign shareholders are permitted, but the BCB scrutinises the ultimate beneficial ownership chain and requires disclosure of all shareholders above a defined threshold. Nominee arrangements that obscure the true beneficial owner are prohibited and can result in denial of authorisation.
Minimum capital requirements for VASPs have been set by BCB regulation and vary depending on the type of services offered. Custodians and exchanges face higher capital thresholds than payment processors. The capital must be held in Brazil and must be demonstrably available, not merely pledged from an offshore parent.
A common mistake is underestimating the timeline for BCB authorisation and launching marketing or onboarding activities before authorisation is granted. The BCB has issued cease-and-desist orders against entities that began operations prematurely, and such orders can complicate or delay the authorisation process itself.
Brazil';s consumer protection framework, enforced by PROCON and the National Consumer Secretariat (SENACON), also applies to VASPs. Operators must provide clear, accurate information about fees, risks, and the nature of virtual assets. Misleading advertising or failure to honour contractual terms can trigger consumer protection investigations independent of BCB or CVM proceedings.
For international operators structuring their Brazilian market entry, contact info@vlolawfirm.com. We can assist with documents and filings across the full regulatory lifecycle.
What is the main risk of operating a crypto platform in Brazil without BCB authorisation?
Operating without BCB authorisation as a VASP in Brazil constitutes a breach of the Virtual Assets Law and exposes the entity and its directors to administrative sanctions, including substantial fines and a prohibition on operating in the Brazilian financial system. The BCB has authority to issue public cease-and-desist orders, which can damage the entity';s reputation and complicate any subsequent authorisation application. In serious cases, the matter can be referred to the Federal Prosecution Service for criminal investigation under Brazil';s financial crimes legislation. Directors and controlling shareholders can face personal liability, including asset freezes, during investigations. The risk is not theoretical: the BCB has already taken enforcement action against unauthorised operators.
How long does the BCB authorisation process take, and what are the main cost drivers?
The BCB authorisation process has typically taken between six months and over a year from the date of a complete application submission. The main variables are the complexity of the applicant';s ownership structure, the quality of the AML/CFT documentation submitted, and the speed with which the applicant responds to BCB requests for additional information. Cost drivers include local legal counsel fees for preparing the application, the cost of establishing a Brazilian legal entity, minimum capital requirements that must be held in Brazil, and the ongoing cost of a resident compliance officer. Professional fees for a full authorisation project typically start from the mid-to-high thousands of USD, and can be significantly higher for complex structures.
Does Brazil';s crypto regulation apply to DeFi protocols and non-custodial wallets?
Brazil';s current regulatory framework is primarily designed for intermediaries that provide services on a professional basis to customers. Purely non-custodial wallets, where the user retains full control of private keys and no intermediary holds assets, are not directly regulated as VASPs. However, DeFi protocols that involve a Brazilian legal entity, a Brazilian development team, or active marketing to Brazilian users occupy a grey area. The BCB and CVM have not yet issued definitive guidance on decentralised protocols, but both agencies have indicated that the substance of the activity, rather than its technical architecture, will guide their analysis. Operators of DeFi platforms with significant Brazilian user bases should seek specific legal advice rather than assume they fall outside the regulatory perimeter.
Brazil has established a comprehensive and actively enforced crypto regulatory framework that international operators cannot afford to treat as a formality. The combination of BCB licensing, CVM securities oversight, RFB tax reporting, and AML/CFT obligations creates a multi-layered compliance environment that requires careful planning before market entry.
VLO Law Firms advises international clients on crypto regulation in Brazil. We can assist with VASP authorisation applications, AML/CFT programme design, CVM securities analysis, tax structuring, and ongoing regulatory compliance. To request a consultation, contact: info@vlolawfirm.com