Brazil Shuts the Door on Banks Dealing With Rogue Crypto

Brazil's central bank is about to enforce its crypto licensing regime through the one channel no provider can route around: the banking system. Under Resolução BCB No. 520, banks, payment institutions, and all other entities supervised by the Banco Central do Brasil (BCB) are prohibited from maintaining transactional relationships with virtual-asset service providers (VASPs) that have not been authorised or have not filed for authorisation by 30 October 2026.Roughly 120 unlicensed providers, plus foreign entities required to onshore within 270 days, face a hard cutoff that makes compliance a survival question rather than a regulatory preference. The 270-day period runs from the framework's 2 February 2026 effective date, bringing the foreign-entity deadline to the same 30 October 2026 cutoff.

Banks Do the Cutting Off, Not Enforcement Actions

Most jurisdictions that have introduced crypto licensing rely on enforcement actions brought directly against non-compliant firms. Brazil has taken a structurally different approach. Rather than chasing individual providers, the BCB placed the obligation on its existing regulated network. After the deadline, any supervised institution that continues to process transactions for a VASP that is neither authorised nor in the process of being authorised is itself in breach of the BCB's regulatory framework. The mechanism converts banks into gatekeepers, cutting off fiat rails, settlement channels, and payment processing for any provider that has not filed for authorisation.The enforcement pressure flows in only one direction, and a crypto firm that misses the deadline does not receive a fine or a warning letter. It loses access to Brazilian banking infrastructure entirely, which in practice means it cannot serve Brazilian customers through any regulated financial channel. For a market that received approximately $318.8 billion in on-chain value in the twelve months through June 2025, according to industry data, that is a commercially fatal outcome.Australia's securities regulator, ASIC, is running a parallel deadline, and ASIC issued a final call in September for Australian crypto firms to apply for formal licensing before its 30 September cutoff. The mechanisms differ, but the trend is the same: jurisdictions are moving from guidance to hard operational deadlines with real consequences for non-compliance.

What Providers Must File and What It Costs

The authorisation framework rests on three resolutions, Nos. 519, 520, and 521, published on 10 November 2025 under Lei nº 14.478/2022, the statute that established Brazil's virtual-asset regulatory foundation. Instrução Normativa BCB No. 739, issued on 29 May 2026, specifies the documentation requirements. Applications must eventually include a reasonable-assurance report prepared under NBC TO 3000 standards by an audit firm registered with the Comissão de Valores Mobiliários (CVM), Brazil's securities regulator.However, firms already operating before 2 February 2026 only have to produce the report at the second phase of the authorisation process. The report must evaluate the effectiveness of the applicant's anti-money-laundering and counter-terrorist-financing controls.Marcos Rocha of Veirano Advogados told FinanceFeeds: "The most common issue we have observed is the underestimation of the complexity and timing involved in preparing an authorisation application." The capital threshold alone is significant. Minimum capitalisation ranges from R$10.8 million to R$37.2 million, depending on the provider category, covering intermediaries, custodians, and brokers offering exchange, transfer, custody, or asset-offering services.Post-authorisation obligations are equally demanding. Firms must submit CADOC 5710 (monthly) and CADOC 5711 (daily) reports under Instrução Normativa BCB No. 713, publish monthly proof of reserves and the biennial independent audit report on their own website, segregate client assets from firm assets, and undergo independent audits every two years.Cross-border stablecoin transfers are classified as foreign-exchange transactions requiring full client identification and compliance reporting.

Why Banking-Channel Enforcement is Harder to Route Around

The banking-channel approach carries a structural advantage that direct enforcement lacks. When a regulator fines or sues a non-compliant crypto firm, the firm can relocate, restructure, or simply ignore the action from another jurisdiction. When the banking system itself refuses to transact, there is no alternative settlement path within the country's regulated financial infrastructure. The provider cannot receive customer deposits, cannot settle trades in reais, and cannot process withdrawals through any supervised payment institution.Brazil's stablecoin market illustrates why this matters, and more than 80% of the country's declared crypto volume runs through stablecoins, with USDT accounting for 88.7% of that flow. Stablecoin issuance and redemption depend on banking relationships, which means the BCB's 30 October deadline captures the dominant transaction type in the market, not just a marginal segment.The regime also addresses a gap that other jurisdictions have left open. Liquidity providers and market makers are not independently licensed under the framework; the authorised SPSAV (Sociedade Prestadora de Serviços de Ativos Virtuais) remains fully responsible for their oversight. That prevents the regulatory arbitrage of outsourcing sensitive functions to unregulated third parties while claiming compliance at the entity level.For UK, EU, and Australian firms watching from the outside, Brazil's approach offers a template. The question is whether regulators in those jurisdictions will adopt the same mechanism: making banks the enforcement layer, rather than relying on direct action against crypto firms that can relocate faster than regulators can litigate.