Brazil’s Central Bank tightens rules for virtual asset firms
Starting in 2027, virtual asset service providers (SPSAV) in Brazil - companies operating in cryptocurrency and other digital asset markets - will be required to comply with financial security requirements similar to those of securities brokers and distributors.
The stricter rules for virtual asset service providers were approved by the Central Bank of Brazil on Wednesday (Jul. 1). According to the bank, the measure aims to strengthen the security of the financial system and reduce risks for customers and the market, and is part of the regulatory process set out in the legal framework for cryptoassets.
What will change
On January 1, 2027, virtual asset firms will be required to comply with a series of prudential requirements - a set of rules designed to ensure the financial soundness of these institutions and reduce the risk of problems that could affect customers or the financial system.
Among the new requirements are the adoption of risk management policies, the maintenance of a minimum capital reserve to cover potential losses, and the periodic disclosure of information on their financial and operational status.
According to the Central Bank, the measures follow the same model already applied to other financial institutions.
Affected companies
Virtual asset service providers are companies authorized to offer services related to digital assets, such as cryptocurrencies. Their activities include brokering the purchase and sale of such assets, asset custody, and transfer operations between clients.
Under the new regulations, these companies and the economic groups they lead will now be classified as Type 3 institutions, a category subject to rules similar to those applied to securities brokers and distributors.
The Central Bank explains that the change follows the principle that activities with similar risks should be subject to the same level of regulation.
Gradual transition
These companies will be classified in Segment 4 (S4) of banking regulations by June 30, 2028, regardless of their size.
S4 encompasses institutions that must comply with a more robust set of prudential rules, allowing for a gradual adjustment period until all requirements are fully enforced.
At the same time, the Central Bank prohibited institutions classified under Segment 5 (S5) - a category intended for smaller financial institutions subject to simplified rules - from providing services related to virtual assets.
According to the monetary authority, this type of activity requires a higher level of control and risk management, which is incompatible with the simplified regime applied to S5.
Expanded regulation
The requirement is part of a broader set of regulations governing cryptoasset platforms in the country.
In November last year, the Central Bank published the first rules governing the operation of Brazil’s virtual asset market. The regulations formalized the creation of SPSAVs and established criteria for operations, governance, anti-money laundering, and participation in the foreign exchange market.
In February this year, the National Monetary Council (CMN) expanded requirements for the sector by mandating that crypto platforms comply with rules similar to those applied to traditional financial institutions.
As a result, companies were required to maintain confidentiality of customer data and transactions, in accordance with Complementary Law 105, which governs bank secrecy.
In May, the Central Bank began requiring independent audits of cryptoasset companies.
Understanding SPSAVs
SPSAVs are companies authorized to provide services related to virtual assets, such as intermediation, custody, and the trading of cryptocurrencies and tokens.
The creation of this category was provided for by Law 14,478 of 2022, known as the legal framework for cryptoassets. In 2023, a federal decree designated Brazil’s Central Bank as the authority responsible for regulating the sector in the country.
