Most coverage of Brazil’s virtual asset framework describes it as a licensing deadline. That undersells the problem. On 30 October 2026 the consequence of not being in the authorisation queue is not a fine or an enforcement notice. It is that Brazilian banks and payment institutions become prohibited from transacting with you.
For a platform with Brazilian users, that is an operational cut-off rather than a legal one. Your BRL rails stop. Your Pix flows stop. Your settlement relationships stop. The business does not become more expensive; it becomes unable to function in the market.
This note sets out where the deadline comes from, what filing actually buys you, and what a provider that has not yet moved should do with the time remaining.
The framework
On 10 November 2025 the Banco Central do Brasil published Resolutions BCB 519, 520 and 521. They came into force on 2 February 2026, with the reporting provisions of Resolution 521 taking effect on 4 May 2026.
Resolution 519 governs the authorisation process. Resolution 520 governs the constitution and functioning of sociedades prestadoras de serviços de ativos virtuais — PSAVs. Resolution 521 brings virtual asset operations into the foreign exchange market and amends the existing FX and international capital rules accordingly.
Operating as a PSAV presupposes incorporation in Brazil, with the registered office and management located in Brazil and subject to Brazilian law and Brazilian authorities. There is no offshore route.
Where 30 October comes from
A PSAV that was already providing intermediation or custody services when Resolution 520 took effect has 270 days from 2 February 2026 to file its authorisation request. That period expires on 30 October 2026.
Separately, and on the same date, financial institutions and payment institutions become prohibited from carrying out or enabling operations in the virtual asset market with counterparties that provide virtual asset services and are neither authorised nor in the authorisation process.
Those two rules interact in a way that is worth stating precisely, because it is where the commercial opportunity and the commercial risk both sit.
What filing actually buys you
| Your position | What follows |
|---|---|
| Operating on 2 Feb 2026, filed by 30 Oct 2026 | You may continue providing virtual asset services until your authorisation process concludes. You may not take on another modality during that period. |
| Operating on 2 Feb 2026, did not file in time | You must cease providing virtual asset services within thirty days of the deadline. |
| Not operating on 2 Feb 2026 | No transitional route exists. You cannot provide any virtual asset service without prior BCB authorisation. |
The practical consequence is that being in the queue is the whole game. A provider that files a credible application on 29 October is protected and keeps trading while the Central Bank works through it. A provider that files nothing is out of the market thirty days later and, from 30 October, cannot be banked in the meantime.
Filing something credible before the deadline therefore matters considerably more than filing something perfect after it. That is an unusual regulatory posture and it is the single most useful thing to understand about this regime.
Which modality you are filing under
Resolution 520 creates three:
Intermediária. Intermediation of virtual assets on behalf of third parties — subscription, purchase, sale and exchange, portfolio administration, fiduciary agent services, staking, and FX market services where authorised. Additional permitted activities include electronic money issuance, liquidity provision, market making, and structuring or advising on DLT financial offerings.
Custodiante. Safekeeping and control of virtual assets and their access instruments, updating client positions, executing movement instructions, and handling asset events. Custodians face additional requirements: patrimonial segregation, proof of reserves, independent audit, data redundancy, and strict liability for losses. Staking is permitted only where the custodian performs all of the above and notifies the BCB in advance.
Corretora. Both, with functional separation between intermediation and custody, conflict-of-interest mitigation, and internal controls comparable to those of a financial institution.
Existing financial institutions — commercial, investment, multiple and exchange banks, Caixa Econômica Federal, and securities brokers and dealers — may also provide these services, subject to notifying the BCB at least ninety days in advance, providing independent technical certification, and adapting their policies and structures.
How the application is assessed
For a PSAV already in activity, Resolution 519 runs the process in two phases.
Phase one examines proof that the provider was operating when Resolution 519 took effect; the unblemished reputation of administrators, controllers and holders of qualified participation; and compliance with minimum capital and equity requirements, for which the BCB may require audited financial statements.
Phase two examines everything else — economic and financial capacity of controllers, lawful origin of funds, business viability, IT structure, governance, and the reputation of administrators.
The filing must evidence risk management across market, credit, operational and liquidity risk; a cybersecurity policy including incident response and data processing and cloud contracts; internal controls and AML/CFT procedures; compliance with Law 13,810/2019 on international sanctions; and accounting and audit standards under Cosif.
Three structural points that catch groups out
Administrators must be resident in Brazil. Officers in management positions have to be resident, which for an offshore group means either relocating someone or hiring locally, and doing it before the filing rather than after.
Investment funds cannot control a PSAV. A fund may hold qualified participation but may not exercise corporate control or form part of the control group. The BCB may also extend qualified-shareholder requirements to quotaholders with effective power to direct the fund. For a VC-controlled platform this is a restructuring question, not a filing question, and it takes time.
Reporting begins on filing, not on authorisation. Between the protocol of the request and the phase-one decision, a PSAV must provide client and user data to the national financial system register; daily accounting balances held for clients; daily custody data covering total assets held on own account or for third parties, in Brazil or abroad, by quantity and value and per client; monthly verifiable proof of reserves discriminated by asset; and monthly statements of client assets allocated to staking.
That last obligation is routinely underestimated. Daily custody reporting at that granularity is systems work, and it cannot be assembled in the fortnight before a filing.
The foreign exchange overlay
Resolution 521 amends Resolutions BCB 277, 278 and 279 to bring virtual asset operations into the exchange market. It captures international payment or transfer with virtual assets; transfers to or from a PSAV client to settle obligations arising from international card or electronic payment use; transfers to or from self-custodied wallets, where the PSAV must identify the wallet owner and document processes verifying the origin and destination of the assets; and the purchase, sale or exchange of fiat-referenced virtual assets.
International payment or transfer in virtual assets is limited to the equivalent of USD 100,000 where the counterparty is not an institution authorised to operate in the exchange market. As matters stand no PSAV holds BCB authorisation, and so none is authorised to operate in that market — which has immediate consequences for any cross-border stablecoin flow.
The resolution also regulates the use of virtual assets in external credit operations and foreign direct investment, expressly contemplating external credit in fiat-referenced virtual assets and the payment-up of capital in virtual assets.
If you have not moved yet
Four things, in order.
Establish your position on 2 February 2026. Everything follows from whether you were providing services in Brazil on that date. If you were not, the transitional route is closed to you and the question becomes whether to authorise from scratch or to structure around the market.
Fix the modality. Custody carries materially heavier obligations, including strict liability. A business that does not need to custody should establish whether it can file as an intermediária instead.
Clear the structural blockers before drafting. Resident administrators and any investment fund in the control chain are not filing problems; they are corporate ones, and they gate everything else.
Start the reporting build now. Daily balance and custody reporting begins when you file. If the systems are not ready, filing creates an immediate compliance exposure rather than removing one.
Frequently asked questions
What is the Brazilian VASP authorisation deadline?
30 October 2026. A provider already operating when Resolution BCB 520 took effect on 2 February 2026 has 270 days to file its authorisation request.
Can I keep operating in Brazil while my authorisation is pending?
Yes, if you were already operating on 2 February 2026 and file in time. You may continue providing virtual asset services until the authorisation process concludes, but you may not take on another modality during that period.
What happens on 30 October 2026 if I have not filed?
Financial institutions and payment institutions become prohibited from carrying out or enabling virtual asset operations with counterparties that are neither authorised nor in the authorisation process. Separately, a provider that was operating and did not file must cease providing virtual asset services within thirty days of the deadline.
Is there a cap on cross-border stablecoin transfers in Brazil?
Yes. Under Resolution BCB 521, international payment or transfer in virtual assets is limited to the equivalent of USD 100,000 where the counterparty is not an institution authorised to operate in the exchange market.
Can a venture capital fund own a Brazilian virtual asset provider?
A fund may hold qualified participation but may not exercise corporate control of a PSAV or form part of the control group. The BCB may extend qualified-shareholder requirements to quotaholders with effective power to direct the fund.
When do reporting obligations start?
On filing, not on authorisation. From the protocol of the request until the phase-one decision, a PSAV must provide daily accounting balances and daily custody data, and monthly proof of reserves and staking statements.
How we can help
Esquare Legal is based in São Paulo and advises across Brazilian, UAE and Pakistani virtual asset regulation. For operators with exposure in more than one of those markets, that means one engagement rather than three sets of advisers.
If you are unsure whether you are caught, which modality fits, or what your filing is missing, that is a short written opinion rather than a project.
admin@esquarelegal.com · www.esquarelegal.com
Further reading: our guide to Brazilian crypto and BCB licensing, and our analysis of what Pakistan’s final virtual asset regulations changed.
This note is a general summary published for information only and does not constitute legal advice. It reflects the position at the date of publication, based on Resolutions BCB 519, 520 and 521 of 2025 and published analysis of them.