‍

Virtual assets, which include well-known cryptocurrencies, were recently regulated by the Central Bank of Brazil (BACEN – Banco Central do Brasil, or BCB) through Rules #519/2025, #520/2025, and #521/2025. This follows the enactment of Federal Statute #14,478/22 in 2022, which established “guidelines to be observed in the provision of virtual asset services and in the regulation of virtual asset service providers,” thereby inaugurating regulation on this matter in Brazil. The aforementioned law, however, was limited to establishing general guidelines and requiring prior authorization for companies to operate in the sector. It did not detail the procedure for obtaining this authorization or expressly designate the responsible regulatory body – though it was anticipated that this responsibility would fall to the BACEN.

For this reason, the implementing regulations were highly anticipated. In practice, there were still no concrete requirements for companies to meet in order to offer services in Brazil, leaving the issue in a regulatory limbo.

To develop these rules, BACEN previously submitted regulatory proposals for public consultation, allowing market participants to contribute to the discussion. After extensive debate and several deadline extensions, the BCB finally issued Rules #519, #520, and #521 in the second half of 2025, bringing the regulation of the cryptocurrency sector to fruition.

‍

BCB's Rule #519/2025

BCB's Rule #519 is the foundation of the new framework, as it defines which institutions must obtain authorization from BACEN to provide virtual asset services. The institutions are: (i) foreign exchange brokers; (ii) securities brokerage firms; (iii) securities distributors; and (iv) virtual asset service companies.

The regulation clarifies that to operate in Brazil, these Virtual Asset Service Providers (VASPs) must obtain BACEN’s authorization and, in doing so, demonstrate:

• The economic and financial capacity of their controlling shareholders;
• The origin of funds used to pay up share capital, acquire control, or acquire a qualified shareholding;
• The economic and financial viability of the business project;
• An information technology infrastructure compatible with the complexity and risks of the business;
• A corporate governance structure compatible with the complexity and risks of the business;
• The unblemished reputation of directors, controllers, and holders of qualified shareholdings where they are individuals;
• Management's knowledge of the business sector, the intended market segment, market dynamics, funding sources, activity management, and associated risks;
• The technical skills of managers, compatible with their intended functions;
• Compliance with minimum capital and equity requirements stipulated in regulations; and and
• Information regarding the physical address of the institution's headquarters.

Rule #519 also stipulates that the authorization process for institutions already operating when the rule takes effect (February 2, 2026) will occur in two phases. In Phase 1, companies must prove they were operational on the effective date, demonstrate the unblemished reputation of their administrators and controlling shareholders, and show they meet the minimum capital requirements. In Phase 2, they must demonstrate compliance with all other requirements.

Companies beginning operations after the effective date must, from the outset, demonstrate that they meet all established requirements.

‍

BCB’s Rule #520

BCB’s Rule #520, delves deeper, classifying the operations considered virtual asset services and addressing the required organizational structure and governance mechanisms for service providers.

Notably, this Rule incorporates security and compliance requirements already demanded of other financial institutions under BACEN’s oversight, such as:

• A governance structure compatible with the size, complexity, and risk of its activities;
• Formal internal control policies and procedures;
• Mechanisms for identifying, assessing, monitoring, and mitigating risks, including operational, cyber, and market risks;
• Policies for preventing money laundering and the financing of terrorism.

A particularly relevant aspect of BCB’s Rule #520 is the creation of three VASP categories, which are defined by the nature of their activities:

• Intermediary Service Providers: Entities responsible for negotiating or brokering virtual asset transactions on behalf of third parties, enabling the purchase, sale, exchange, or conversion of these assets into fiat currency, as well as executing user transactions.
• Custodian Service Providers: Entities responsible for the safekeeping, administration, and protection of third-party virtual assets, exercising operational control over access mechanisms and assuming specific duties related to security and asset segregation.
• Brokerage Service Providers: Entities that perform both intermediation and custody functions cumulatively.

Another key point is the requirement for the segregation of funds, which dictates that VASPs must keep their own resources separate from those belonging to clients. The goal is to prevent any commingling of assets, ensuring greater protection in scenarios of insolvency, intervention, or liquidation.

This set of measures aligns the operations of virtual asset service providers with standards already required of other BACEN-regulated entities, reinforcing the sector's integration into the formal financial system.

Finally, BCB’s Rule #520 stipulates that companies already operating when the resolutions take effect (February 2, 2026) may request authorization within 270 days of publication and may continue operating while their application is processed.

‍

BCB’s Rule #521

BCB’s Rule #521 complements the regulatory framework by classifying transactions with virtual assets within the foreign exchange and international capital regime. Based on this resolution, virtual asset service providers will be treated as entities conducting foreign exchange and international capital market operations.

Furthermore, the regulation extends existing BACEN supervisory obligations to VASPs. This includes submitting periodic reports with detailed operational information, thereby strengthening oversight and transparency in the sector.

‍

Conclusion

BCB’s Rules #519, #520, and #521 consolidate a new regulatory standard for the virtual asset market in Brazil, aligning VASPs with governance, risk management, and transparency requirements similar to those applied to other supervised institutions. The framework enhances predictability, reduces information asymmetries, and increases user protection – particularly through measures like asset segregation, clear authorization rules, and the integration of operations into the foreign exchange regime. Under this new structure, service providers will operate under clearer rules with requirements commensurate to the relevance and risks of their activities.