Publications

Aligned with Law No. 14,478/2022, this new regulatory framework establishes clear guidelines for exchanges and other fintechs operating with cryptoassets, bringing greater transparency, stability, and legal certainty to the sector.

What Has Changed — and the Focus of the Regulation

The new rules, consolidated in BCB Resolutions No. 519, 520, and 521, focus on essential governance and security pillars, placing PSAVs under oversight standards similar to those applied to other regulated financial institutions.

1. Authorization and Operations (BCB Resolution No. 520)

This rule outlines the requirements for incorporating and operating SPSAVs (legal entities providing virtual‑asset services), including:

Governance and Compliance

• Mandatory cybersecurity mechanisms
• Risk‑management frameworks
• Oversight requirements for critical third‑party providers

Minimum Capital Requirements

• Capital and net‑equity thresholds aligned with Joint Resolution No. 14, resulting in significantly higher financial requirements than initially proposed.

Prohibited Activities

• Public fundraising activities (except via issuance of shares) are prohibited.
• New conditions apply to lending and financing using virtual assets.

2. Licensing Procedures (BCB Resolution No. 519)

This resolution defines the step‑by‑step authorization process to operate under the Central Bank’s supervision.

Expanded Scope

Authorization requirements apply not only to SPSAVs, but also to:

• Foreign‑exchange brokers
• CTVMs — Corretoras de Títulos e Valores Mobiliários (securities broker‑dealers)
• DTVMs — Distribuidoras de Títulos e Valores Mobiliários (securities distributors)
  …whenever these institutions wish to provide virtual‑asset services.

Strict Requirements

Institutions must meet:

• Financial‑capacity standards
• Fit‑and‑proper criteria for management
• Robust IT and cybersecurity infrastructure

These measures seek to ensure market integrity and safeguard users.

3. Integration with Brazil’s Foreign‑Exchange Framework (BCB Resolution No. 521)

This rule integrates virtual‑asset operations into the country’s foreign‑exchange system, setting requirements for:

International Transactions

• Rules for cross‑border payments and transfers conducted using cryptoassets.

Investments

• Alignment of virtual‑asset investment operations with regulations governing:
  • Brazilian capital held abroad
  • Foreign capital entering Brazil

Compliance Deadlines: What Companies Need to Know

The new regulatory framework takes effect on February 2, 2026. Companies already active in the market — including foreign exchanges serving Brazilian customers — must follow critical deadlines:

270‑Day Deadline

PSAVs operating on the effective date have 270 days to:

• Submit their authorization request to the Central Bank
• Begin their internal compliance‑adjustment process

Foreign Entities

Foreign exchanges must either:

• Transfer clients and operations to a locally incorporated SPSAV, or
• Operate through a financial institution already authorized by the BCB

Transition Rules

Traditional financial institutions (banks, broker‑dealers, securities distributors) working with cryptoassets must formally notify the Central Bank within the same 270‑day window.

Regulatory Refinements

Updates include:

• Permission for self‑custody transfers, previously restricted
• Temporary authorization allowing PSAVs undergoing licensing to conduct cross‑border payments and transfers

These refinements aim to balance security and innovation during the transition.

DGN Advogados and Regulatory Compliance

The new capital, compliance, and licensing requirements create a complex and high‑impact regulatory challenge for fintechs and financial‑technology businesses.

DGN Advogados has deep expertise in Brazil’s regulated markets and is prepared to support companies throughout this transition, providing legal and strategic guidance for:

• Preparing and filing authorization requests with the Central Bank
• Reviewing and adapting governance structures, asset segregation rules, and cybersecurity controls
• Ensuring full compliance with capital‑adequacy and risk‑management requirements