Brazil's Central Bank (BCB) has issued three new resolutions (519, 520, and 521) effective February 2, 2026, requiring all virtual asset service providers (VASPs) to obtain prior authorization. The rules mandate capital between $2 million and $7 million-a significant increase from earlier proposals.
Beyond capital, the framework enforces anti-money laundering protocols, including a phased Travel Rule for sharing transaction data, plus cybersecurity standards and asset segregation to prevent commingling of customer and company funds. Virtual asset transactions with non-authorized parties are capped at $100,000.
A subsequent Normative Instruction requires VASPs to undergo independent audits by CVM-registered entities; without the audit, no license is granted. Existing operators have 270 days to apply for authorization or face shutdown.
What This Means: The high capital requirements are likely to drive market consolidation, favoring established banks and large brokerages. Asset segregation and independent audits aim to prevent scenarios like the FTX collapse. Institutional players face friction on cross-border transfers over $100,000. The limited pool of CVM-registered auditors could bottleneck the licensing process, making it crucial to watch which operators successfully navigate the 270-day window versus those that exit.