Crypto-asset regulation and tokenization in Brazil

In Brazil, a business trading or holding virtual assets for others must define its provider category and Banco Central authorisation route. An operation existing when the framework began and a new business do not have the same transitional position.

Where a token represents an investment, CVM analysis is also required. The underlying asset and economic promise matter: describing it as real estate, commercial or utility does not alone place it outside securities rules.

How to separate provider authorisation and securities issuance

Law 14,478/2022 establishes the framework for virtual asset services performed for third parties. It excludes securities and certain representations governed by specific financial legislation. Classification depends on the asset, rights and activities. A token connected with real estate, debt or commodities does not automatically fall outside securities regulation because of its commercial label.

BCB Resolutions 519, 520 and 521 develop authorisation, operation and transactions included in the foreign-exchange market. The core operating framework applies from 2 February 2026; the foreign-exchange reporting timetable must be checked against subsequent amendments, including Normative Instruction 756/2026. Transitional provisions must be read with later amendments, particularly Resolution 589/2026.

Which authority supervises each activity

Decree 11,563/2023 assigns regulation, authorisation and supervision of covered providers to the Central Bank of Brazil, BCB. The law established the framework and the decree specified that allocation. BCB authority does not replace the Securities and Exchange Commission's, CVM, jurisdiction over securities, offerings and capital market services.

CVM Guidance Opinion 40 and official guidance apply a functional approach to tokens. COAF acts as the financial intelligence unit; preventive duties must be identified under the rules applicable to the entity. There is no combined BCB/CVM permission authorising custody, issuance, trading and every financial activity indiscriminately.

Which permission the business model requires

Articles 4 and 19 of Resolution 520 distinguish virtual asset intermediaries, custodians and brokers. The broker category combines functions that the other two cannot freely accumulate. Companies require authorisation to commence, with headquarters and management in Brazil. Resolution 519 requires controller financial capacity, lawful capital sources, viability, governance, infrastructure and suitable management.

Article 88 gives companies already operating when the framework began a maximum of 270 days to apply. Timely applicants may continue during processing without assuming another category. The process has two phases; completing adaptation does not mean final authorisation has been granted. New entrants cannot automatically use the transition merely by incorporating within that period.

Banks and other expressly eligible intermediaries follow notification and certification rules in Articles 20–22. For those starting this service, the 90-day period after notification is subject to conditions and the BCB's power to prevent commencement. It is not a guaranteed licensing deadline for every technology company.

How holder rights are documented

Under CVM Guidance Opinion 40, tokenization as a technical process does not itself require prior approval. However, securities issued for public distribution, their issuers and intermediation, registration, custody or trading services remain subject to their respective frameworks. Offering collective investment rights may be relevant even where underlying property is real estate or commercial assets.

The CVM expressly refers to its criteria for receivables and fixed-income tokens. An issuance must therefore document the enforceable right, debtor or issuer, transfer conditions and each participant's functions. Recording a transaction on a distributed ledger does not itself establish compliance with formalities governing the underlying right.

The tokenization working group created in July 2026 studies experience, infrastructure and possible reforms. Its establishment neither authorises a DLT market nor enacts a securities reform. An individual experimental permission should likewise not be extended to every platform, issuance or customer.

Which obligations continue during operations

Resolution 520 requires separation of proprietary and client resources, custody controls, security and money-laundering prevention. Article 89 phases in transfer information through domestic and international stages, with full compliance from February 2028 for covered authorised companies. That transition suspends neither all preventive controls nor customer identification.

Resolution 521 applies foreign-exchange rules to international operations, specified self-custody wallet movements and exchanges involving fiat-referenced assets. For VASP companies, the USD 100,000 international payment or transfer limit depends on the counterparty not being authorised for foreign exchange. It is not a universal limit for every transaction or every bank.

Resolution 589/2026, applicable from 1 October on this point, sets 6 November 2026 for the restriction on operations with unauthorised counterparties, retaining the framework's express exceptions. Each operator's conditions for continuity must be checked. Its reporting amendments and the anti-fraud measures in Resolution 584 apply from January 2027 and are not described as already mandatory in October.

What to prepare before launching the project

Prepare evidence of operating dates, the requested category and procedural stage. Identify custody, intermediation and international flows, and check permissions for each function and counterparty.

Maintain a timetable by rule and application date, especially for counterparties and foreign exchange reporting. For tokenized issuance, add securities classification, rights agreements and distribution restrictions.

The assessment recognises an access procedure and defined international operations without attributing final permission to every company in transition. Each application requires verification of category, phase, foreign-exchange permissions and treatment of tokenized securities. The score measures neither taxation, commercial banking access nor actual application processing time.

To understand how this framework applies to your project, discuss your case with our team.