Jurisdictions around the world are adapting their approaches to cryptoassets as they increasingly intersect with traditional finance (TradFi), thereby attracting a greater number of financial institutions. Brazil is one of the latest to do so, expanding financial sector regulation to encompass crypto activities under a comprehensive new framework for the sector. This will provide legal certainty to the market, but comes with a tight deadline of February 2026 (although accompanied by a 9-month grace period), meaning time is running out for companies looking to offer services in Brazil.
Feedback from our own reports and data
In our latest cryptocurrency geography report, we identified Brazil as the largest cryptoasset market in Latin America. In 2024, Brazil received an estimated $318.8 billion worth of crypto (nearly a third of LATAM), with a period-over-period growth rate of 109.9%, ranking 5th in the 2025 Global Cryptocurrency Adoption Index.
In our Road to Regulator report, we expected Brazil solidifying its approach to cryptoassets, like other countries in the region, to be an inflection point for the local cryptoasset sector and related activities. This is based on the fact that while crypto adoption in Brazil is widespread, meaning it is driven by interest from retail and institutional investors, institutional-sized deals (>$10 million) are responsible for most of the growth. Given that institutional adoption is highly dependent on regulators’ approach, we believe that Brazil’s move from high-level principles to an operational framework, which bears many of the key features of other existing regulatory approaches (e.g. MiCA), will constitute a key test for the sector, forcing smaller and foreign players to take a hard look at their structures, potential engagement and service delivery.
What happened
In early November 2025, Banco Central do Brasil (BCB) issued three resolutions that implement the Virtual Assets Law of 2022, while maintaining the 2023 Presidential Decree designating BCB as regulator and the jurisdiction of the Brazilian Securities Commission (CVM) over securities-like tokens and consumer protection issues. Taken together, these resolutions, 519, 520 and 521, establish the cryptographic framework, with key elements including:
- A new authorization route: New entrants and incumbents operating as depositories, exchanges and intermediaries will have to go through the process of becoming Sociedades Prestadoras de Serviços de Ativos Virtuais (SPSAV), all of which will be supervised by the BCB. This also includes foreign companies that are not yet active in Brazil and will need to be authorized before starting their activities. This will either require them to have a local physical presence in the form of a subsidiary, or to partner with an approved local entity.
- New requirements for businesses: To become an approved SPSV, and among other obligations and responsibilities, they must meet requirements regarding:
- Preventing money laundering and terrorist financing: Businesses must have mechanisms in place to conduct appropriate risk assessments, identify and report fraudulent practices and apply the Travel Rule to transactions. BCB Regulatory Director Gilneu Vivan, when announcing these regulations, said they “will reduce the risks of scams, frauds and the use of virtual asset markets for money laundering.”
- Ensure appropriate public transparency: Companies must clearly disclose all applicable information, including regulations, business model, risks and fees; separate customer assets from those of SPSAV and prohibit their use; have a responsible person for each area of activity; and carry out independent audits.
- Reach the minimum capital thresholds: Companies must meet requirements ranging from BRL 10.8 million to BRL 37.2 million, depending on the activity.
- Other: Third party agreements/key outsourcing services; corporate governance, including policies, internal controls over conduct, training, privacy, record keeping, etc.
Cross-border transfers of virtual assets
In early February 2025, Gabriel Galipolo, head of the BCB, said that “around 90% of this volume is in the form of stablecoin movements.” As such, it is not surprising that the new framework sets specific requirements under Resolution 521 that would encompass stablecoins alongside other types of virtual assets (“fiat currency virtual asset benchmarks”) as foreign exchange transactions. The enforcement of foreign exchange regulations fills the gap that left these assets unregulated and means that the following activities involving virtual assets or stablecoins will fall under these rules:
- International payment or transfer using virtual assets;
- Transfer of virtual assets to fulfill obligations arising from the international use of a card;
- Transferring virtual assets to or from a self-custodial wallet;
- And the purchase, sale or exchange of virtual assets referenced in fiat currency.
This means that customer identification, monitoring and reporting requirements apply to these transactions and establish per-transaction limits for certain international payments where the counterparty is not an authorized foreign exchange institution.
This will force businesses to think about the types of data and tools they leverage to meet these requirements. On-chain analytics data and tools, such as KYT, allow businesses to assess a customer’s on-chain activity, creating more accurate risk profiles than traditional KYC methods alone. This approach also facilitates monitoring of inbound and outbound digital asset transactions on their platforms, calibrated for exposure (e.g., to personalized address lists or specific high-risk categories).
Cybersecurity specific
One of the other areas specifically addressed by the regulations is the cybersecurity safeguards and procedures that a company must establish. This is not surprising, given the exposure of crypto-asset companies to cybersecurity threats. In 2024, $2.2 billion has been stolen from cryptocurrency services. In the first six months of 2025 alone, we have seen the largest hack in crypto history, including the $1.5 billion hack of centralized exchange ByBit. Given this and two recent attacks on Pix’s infrastructure, the Brazilian framework requires companies to have comprehensive, documented security measures and procedures for all systems and methods. Specifically, this includes identity management controls, continuity and incident response plans to maintain and restore service delivery in the event of a disruption, as well as the requirement to secure and protect potentially sensitive information.
The BCB also emphasizes that where smart contracts are used for the provision of services, they must be rigorously assessed for risks and tested for robustness, and must be closely monitored on an ongoing basis for potential vulnerabilities. Chainalysis Hexagate provides real-time on-chain monitoring of smart contracts, tokens and protocol activity, enabling detection of exploits, governance abuses and suspicious token flows. It can also automate responses to contain incidents.
The Chainalysis view
These rules represent a potential turning point for crypto – not only in Brazil but also in Latin America more broadly, given the importance of the Brazilian market to the region. By proposing to integrate cryptoassets into existing risk management frameworks, we can expect to see cryptoassets increasingly accepted as a legitimate part of the financial services industry. By establishing compliance with similar requirements and establishing security as a non-negotiable benchmark, the framework provides greater predictability for banks, custodians and issuers seeking to interact with the asset class, as well as enhanced security for users. This could, however, raise barriers to entry for businesses, which could further alienate smaller players and have a broader impact on the pace of innovation.
What’s next?
- More regulatory clarity: The BCB also published Public Consultation 126, which proposes prudential capital rules for companies exposed to digital assets, in line with the international recommendations of the Basel Committee. These rules classify crypto assets into four subgroups based on risk, each with progressively higher capital requirements.
- Continued crackdown on illicit use of cryptography: The new rules come as authorities around the world are increasingly aware of the seizure opportunities that come with effective industry oversight and using the right data analytics and blockchain tools. And Brazil is no stranger to such activities, with cases such as the Lusocoin operation exposing a $540 million cryptocurrency brokerage scheme.
- Sustained expansion of institutions and retail: Expect continued interest from large institutions, such as Itaú, Nubank and Mercado Pago, as well as retail demand for stablecoins for savings, remittances and cross-border payments, which will likely keep Brazil at the center of Latin America’s growth.
This website contains links to third party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to this information does not imply any association, endorsement, approval or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for any products, services or other content hosted there.
This material is provided for informational purposes only and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis assumes no responsibility for any decision made or any other act or omission in connection with the recipient’s use of this material.
Chainalysis does not guarantee the accuracy, completeness, timeliness, suitability or validity of the information contained in this report and will not be liable for any claims attributable to errors, omissions or other inaccuracies in any part of this material.
