Crypto-asset regulation and tokenization in Brazil

In Brazil, a business trading or holding virtual assets for others must define its provider category and Banco Central authorization route. An operation existing when the framework began and a new business do not have the same transitional position.

Where a token represents an investment, CVM analysis is also required. The underlying asset and economic promise matter: describing it as real estate, commercial or utility does not alone place it outside securities rules.

How to separate provider authorization and securities issuance

Law 14,478/2022 establishes the framework for virtual asset services performed for third parties. It excludes securities and certain representations governed by specific financial legislation. Classification depends on the asset, rights and activities. A token connected with real estate, debt or commodities does not automatically fall outside securities regulation because of its commercial label.

BCB Resolutions 519, 520 and 521, all dated 10 November 2025, implement the rules on authorization, operation and transactions within the foreign-exchange market. The core operating framework applies from 2 February 2026; the foreign-exchange reporting timetable must be checked against subsequent amendments, including Normative Instruction 693/2025, as amended by Normative Instruction 756/2026. Their transitional provisions must be read together with later amendments, particularly Resolution 589/2026.

Which authority supervises each activity

Decree 11,563/2023 assigns regulation, authorization and supervision of covered providers to the Central Bank of Brazil, BCB. The law established the framework and the decree specified that allocation. BCB authority does not replace the Securities and Exchange Commission's, CVM, jurisdiction over securities, offerings and capital market services.

CVM Guidance Opinion 40 and official guidance apply a functional approach to tokens. COAF acts as the financial intelligence unit; preventive duties must be identified under the rules applicable to the entity. There is no combined BCB/CVM permission authorizing custody, issuance, trading and every financial activity indiscriminately.

Which permission the business model requires

Articles 4 and 19 of Resolution 520 distinguish virtual asset intermediaries, custodians and brokers. The broker category combines functions that the other two cannot freely accumulate. Companies require authorization to commence, with headquarters and management in Brazil. Resolution 519 requires controller financial capacity, lawful capital sources, viability, governance, infrastructure and suitable management.

Article 88 gives companies already operating when the framework began a maximum of 270 days to apply for authorization. Timely applicants may continue during processing without assuming another category. Those who do not apply within the period cannot continue operating indefinitely: they must cease providing virtual asset services within thirty days after the window closes. The process has two phases; completing adaptation does not mean final authorization has been granted. New entrants cannot automatically use the transition merely by incorporating within that period.

Banks and other expressly eligible intermediaries follow notification and certification rules in Articles 20–22. For those starting this service, the 90-day period after notification is subject to conditions and the BCB's power to prevent commencement. It is not a guaranteed licensing deadline for every technology company.

How holder rights are documented

Under CVM Guidance Opinion 40, tokenization as a technical process does not itself require prior approval. However, securities issued for public distribution, their issuers and intermediation, registration, custody or trading services remain subject to their respective frameworks. Offering collective investment rights may be relevant even where underlying property is real estate or commercial assets.

The CVM expressly refers to its criteria for receivables and fixed-income tokens. An issuance must therefore document the enforceable right, debtor or issuer, transfer conditions and each participant's functions. Recording a transaction on a distributed ledger does not itself establish compliance with formalities governing the underlying right.

The tokenization working group created in July 2026 studies experience, infrastructure and possible reforms. Its establishment neither authorizes a DLT market nor enacts a securities reform. An individual experimental permission should likewise not be extended to every platform, issuance or customer.

Which obligations continue during operations

Resolution 520 requires separation of proprietary and client resources, custody controls, security and money-laundering prevention. Article 89 phases in transfer information through domestic and international stages, with full compliance from February 2028 for covered authorized companies. That transition suspends neither all preventive controls nor customer identification.

Resolution 521 applies foreign-exchange rules to international operations, specified self-custody wallet movements and exchanges involving fiat-referenced assets. For VASP companies, the USD 100,000 international payment or transfer limit depends on the counterparty not being authorized for foreign exchange. It is not a universal limit for every transaction or every bank.

Resolution 589/2026, dated 23 September 2026 and applicable from 1 October on this point, sets 6 November 2026 for the restriction on operations with unauthorized counterparties, retaining the framework's express exceptions. The change is not only one of date: the previous wording of Article 91 of Resolution 520 set 30 October and excepted entities that were authorized or in the process of obtaining authorization, whereas the current wording refers only to those not authorized to operate in the country. From 6 November, having filed an application is no longer enough to be an eligible counterparty, except in the forms expressly authorized by the resolution.

Each operator's conditions for continuity must be checked. Resolution 589's reporting amendments and the anti-fraud measures in Resolution 584 apply from January 2027 and are not described as already mandatory in October. On 30 September 2026 the Central Bank approved Resolution 591, which replaces Resolution 588 of 23 September and amends the anti-money-laundering rule: from 1 October 2026, transfers of virtual assets to or from self-custodied wallets equal to or above the equivalent of USD 10,000 must be reported to COAF. Transactions contracted through 31 December 2026 are reported on the first business day of January 2027.

What to prepare before launching the project

Prepare evidence of operating dates, the requested category and procedural stage. Identify custody, intermediation and international flows, and check permissions for each function and counterparty.

Maintain a timetable by rule and application date, especially for counterparties and foreign exchange reporting. For tokenized issuance, add securities classification, rights agreements and distribution restrictions.

The assessment recognizes an access procedure and defined international operations without attributing final permission to every company in transition. Each application requires verification of category, phase, foreign-exchange permissions and treatment of tokenized securities. The score measures neither taxation, commercial banking access nor actual application processing time.

To understand how this framework applies to your project, discuss your case with our team.