Jurisdictions worldwide are adapting their approaches to cryptoassets as they increasingly intersect with traditional finance (TradFi), drawing greater numbers of financial institutions in. Brazil is among the latest to do so, extending financial sector regulation to encompass crypto activities as part of a comprehensive new framework for the sector. This will provide the market with legal certainty but comes with a tight deadline of February 2026 (albeit accompanied by a 9-month grace period), meaning that time is of the essence for firms seeking to offer services in Brazil.
Commentary from our own reports and data
In our latest Geography of Cryptocurrency Report, we identified Brazil as the largest market for cryptoassets in LATAM. In 2024, Brazil received an estimated $318.8 billion in crypto value (nearly one-third of LATAM), with a 109.9% period-over-period growth rate, ranking 5th on the 2025 Global Crypto Adoption Index.
In our Road to Regulation report, we expected that Brazil solidifying its approach to cryptoassets, in the same way we see other countries in the region doing, would be an inflection point for the local cryptoasset sector and associated activity. This was based on the fact that, while Brazilian crypto adoption is broad-based, meaning it is driven by interest from both retail and institutional investors, institutional-sized transactions (>$10M) are responsible for most of the growth. Given that institutional adoption is highly dependent on the approach of regulators, we expect that Brazil’s move from high-level principles to an operational framework, which bears many of the key hallmarks of other existing regulatory approaches (e.g. MiCA), will be a key test for the sector, forcing smaller and overseas players to consider their structures, potential engagement, and service delivery closely.
What happened
In early November 2025, Banco Central do Brasil (BCB) published three resolutions that operationalize the 2022 Virtual Assets Law, while maintaining the 2023 Presidential decree designating the BCB as the regulator and the Brazilian Securities Commission’s (CVM) jurisdiction over securities-like tokens and consumer protection issues. Taken together, these resolutions, 519, 520, and 521, set up the crypto framework, with key elements including:
- A new authorization pathway: Both new entrants and incumbents operating as custodians, exchanges, and intermediaries will need to go through the process to become Sociedades Prestadoras de Serviços de Ativos Virtuais (SPSAVs), all of whom will be supervised by the BCB. This also includes overseas firms not yet operating in Brazil, who will be required to be authorised before commencing operations. This will either require them to have a physical, local presence in the form of a subsidiary or to partner with a licensed local entity.
- New requirements for firms: In becoming authorized SPSVs, and among other obligations and responsibilities, they must follow requirements around:
- Preventing money laundering and terrorist financing: Firms must have mechanisms in place to make appropriate risk assessments, identify and report fraudulent practices, and apply the Travel Rule to transactions. The BCB Director of Regulation, Gilneu Vivan, on announcing these regulations, stated that they “will reduce the scope for scams, fraud, and the use of virtual asset markets for money laundering.”
- Delivering appropriate public transparency: Firms must clearly disclose any applicable information, including regulations, business model, risks, and fees; segregate client assets from those of the SPSAV and prohibit their use; have a person responsible for each area of activity; and perform independent audits.
- Meeting minimum capital thresholds: Firms must meet requirements from R$10.8 million to R$37.2 million, depending on the activity.
- Other: Agreements with third parties/outsourcing key services; firm governance, including policies, internal controls around conduct, training, personal data protection, record-keeping, etc.
Cross border virtual asset transfers
In early February 2025, Gabriel Galipolo, BCB chief, stated that “around 90% of that volume is in the form of stablecoin movements.” As such, it is no surprise that the new framework sets specific requirements under Resolution 521 that would capture stablecoins alongside other types of virtual assets (“virtual assets reference in fiat currency”) as FX transactions. The application of FX regulations closes the gap that left such assets as unregulated and means that the following activities involving virtual assets or stablecoins will fall under these rules:
- International payment or transfer using virtual assets;
- Transfer of virtual assets to fulfill obligations arising from the international use of a card;
- Transfer of virtual assets to or from a self-custodied wallet;
- And the purchase, sale, or exchange of virtual assets referenced in fiat currency.
This means that client identification, monitoring, and reporting requirements apply to such transactions and establish per-transaction limits for certain international payments where the counterparty isn’t an authorized foreign exchange institution.
This will require firms to consider the types of data and tools they leverage to meet these requirements. Chainalysis data and tools, such as KYT, enable firms to assess a customer’s on-chain activity, creating more accurate risk profiles than traditional KYC methods alone. This approach also facilitates transaction monitoring of incoming and outgoing digital asset transactions on their platforms, calibrated for exposure (e.g., to custom address lists or specific high-risk categories).
Cybersecurity specific
One of the other areas that the regulations specifically address is the cybersecurity safeguards and procedures that a firm must establish. This is unsurprising, given the records of cryptoasset firms’ exposure to cybersecurity threats. In 2024, $2.2 billion was stolen from cryptocurrency services. In the first six months of 2025 alone, we saw the largest hack in crypto history, including the $1.5 billion hack of centralized exchange ByBit. With this and two recent attacks on the infrastructure of Pix in mind, the Brazilian framework requires that firms have comprehensive security measures and procedures in place and documented for all systems and methods. Specifically, this includes identity management controls, continuity, and incident response plans to maintain and recover service delivery in the event of disruption, as well as the requirement to secure and protect potentially sensitive information.
The BCB also outlines that, when smart contracts are leveraged for service delivery, they should be rigorously risk-assessed and tested for robustness, and should be closely monitored on an ongoing basis for potential vulnerabilities. Chainalysis Hexagate provides real-time, on-chain monitoring of smart contracts, tokens, and protocol activity, enabling the detection of exploits, governance abuse, and suspicious token flows. It can also automate responses to contain incidents.
The Chainalysis view
These rules represent a potential watershed moment for crypto — not just in Brazil but also in LATAM more broadly, given the significance of the Brazilian market to the region. By proposing to integrate cryptoassets into existing risk management frameworks, we can expect to see cryptoassets increasingly accepted as a legitimate part of the financial services sector. By setting compliance with similar requirements and establishing security as a non-negotiable baseline, the framework provides greater predictability for banks, custodians, and issuers seeking to interact with the asset class, as well as enhanced security for users. It does, however, potentially raise the barrier to entry for firms, which could force smaller players further to the sidelines and have a broader impact on the pace of innovation.
What’s next?
- More regulatory clarity: The BCB also published Public Consultation 126, which proposes prudential capital rules for firms with exposure to digital assets, in line with international Basel Committee recommendations. These rules categorize crypto assets into four subgroups based on risk, each with progressively higher capital requirements.
- Continued crackdown on illicit use of crypto: The new rules come as authorities across the globe are increasingly aware of the seizure opportunities that come with effective oversight of the sector and the use of the right data and blockchain analytics tools. And Brazil is no stranger to such activity, with cases such as Operation Lusocoin exposing a $540 million crypto-broker scheme.
- Sustained institutional and retail expansion: Expect to see sustained interest from major institutions, such as Itaú, Nubank, and Mercado Pago, as well as retail demand for stablecoins for savings, remittances, and cross-border payments, which is likely to keep Brazil at the center of LATAM growth.
This website contains links to third-party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to such information does not imply association with, endorsement of, approval of, or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for the products, services, or other content hosted therein.
This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with Recipient’s use of this material.
Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material.