CMS Expert Guide to Crypto Regulation in Brazil

The Central Bank of Brazil (BCB) is the regulatory agency responsible for regulating the provision of virtual asset service providers (VASPs) and their services, but it has not yet published specific rules for the provision of this service or what the applicable compliance rules. However, it is likely that the existing rules will apply, embodied in Circular BCB No. 3,978, of 23 January 2020. This regulation deals with guidelines that operators must comply with regarding (i) Anti-Money Laundering and Terrorist Financing (AML/FT), (ii) risk assessments, (iii) KYC, KYP and KYE procedures, (iv) registration of operations, (v) monitoring and analysis of suspicious operations, (vi) reporting to the Financial Activities Control Board (COAF), (vii) monitoring mechanisms and (viii) control and evaluation of effectiveness.

In addition, there is the industry association ABCripto (Brazilian Association of Cryptoeconomics) which aims to build a set of best practices for operating in the crypto market as a measure of self-regulation in the sector. Provider membership is not mandatory, but is widely regarded as an indicator of a credible governance practice.

Adherence to ABCripto requires compliance with standards, notably its Self-Regulatory Code and the Manual of Good Practices in the Prevention of Money Laundering and Terrorism Financing (“AML/TF Manual”). Among the obligations withing the Code are those of observing guidelines such as: (i) preventing fraud and money laundering, through the creation of policies and procedures that inhibit this occurrence; (ii) prevention of corruption; and (iii) information control and confidentiality.

There is also a mechanism established by ABCripto consisting of the duty to report suspicious operations and situations to the Financial Activities Control Board (COAF). Although virtual asset service providers are not listed as institutions required to report their transactions to COAF under Law No. 9,613/1998, reporting is seen as a good practice, since virtual asset providers perform activities that are similar to those that are subject to the requirements of that law.

In Brazil, Crypto is regulated according to the Law No. 14,478, of 21 December 2022 (“Virtual Assets Act”).

The Virtual Assets Act deals with guidelines for providing services with virtual assets and for regulating providers of these services. The Act defines virtual assets as a digital representation of value that can be traded or transferred electronically and used for making payments or for investment purposes. It also provides for (i) prior authorisation for the provision of services; (ii) the guiding principles of the activity; (iii) the definition of virtual asset service provider services; and (iv) to set new criminal responsibilities in the intermediation of operations involving fraud, in addition to increasing penalties if the practice occurs within the scope of regulations that combat money laundering and organised crime. 

In addition, in November 2024, the BCB published Public Consultation Notices 109, 110 and 111, which propose, respectively, draft regulations for the provision of services related to virtual assets, the authorisation processes for VASPs and the inclusion of virtual asset services in the foreign exchange market.

This regulation will deal with relevant points for the provision of virtual asset services, such as the modalities of operation of VASPs, minimum requirements for operation, grandfathering period, use permissions for stablecoins and international transactions, use of self-custodied wallets, as well as the residual regulations applicable to VASPs in Brazil (such as AML/FT, cybersecurity, etc.).

Although the final rules have not yet been released, they are expected to be published by the end of 2025, broadly maintaining the content proposed in the public consultations, but incorporating adjustments resulting from contributions made by market participants.

The provisions of question 1 apply to this item. In the event that cryptoassets are characterised as securities, Resolution CVM No. 50 of 31 August 2021 applies.

This regulation deals with guidelines that operators must comply with regarding (i) Anti-Money Laundering and Terrorist Financing (AML/FT) policies, (ii) internal risk assessment, (iii) internal procedures and controls, (iv) management responsibilities, (v) KYC procedures, (vi) due diligence by independent auditors, (vii) monitoring, analysis and reporting of suspicious transactions, (viii) file keeping, and (ix) compliance with sanctions imposed by the United Nations Security Council (UNSC).

The Virtual Assets Act lists the services related to virtual assets which will be regulated, including the issuance, exchange, staking, transfer, sale and custody of assets.

However, the regulations that will set out detailed guidance on this issue are currently under Public Consultation by the Central Bank of Brazil (BCB).

Meanwhile, it is noteworthy that the Brazilian Revenue Service Normative Instruction No. 1,888, of 2019 states that any legal entity, even if not financial, that offers services related to operations carried out with cryptoassets, including intermediation, negotiation or custody, and that can accept any means of payment, including other cryptoassets, is subject to some reporting requirements.

Tokenization itself is not subject to prior approval or registration with the Securities and Exchange Commission of Brazil (CVM). CVM has recognised the differentiation of NFTs for fungible assets, but there are still no requirements. However, the direct sale of tokens by issuers, if these tokens are configured as securities, both the issuers and the public offering of such tokens are subject to the rules established by the securities market and the applicable regulations, in accordance to Guidance Opinion CVM No. 40.

Offshore businesses can provide services to local consumers under certain circumstances. As the regulations for virtual asset service providers (VASPs) have not yet been published by the Central Bank of Brazil (BCB), the requirements to offer services in Brazil, such as a Brazilian license, are not yet applicable. Services currently offered by offshore businesses are not prohibited but must follow certain guidelines.

Cryptoassets that are characterised as securities must follow the rules established by the securities market and the Brazilian Securities and Exchange Commission (CVM), both in relation to their issuance and distribution.

CVM understands, in accordance with Guidance Opinions CVM No. 32 and 33, that foreign VASPs securities offering operations do not constitute an irregularity if (i) the investor prospecting activity has been carried out abroad and (ii) the operation is not characterised as a public offering to residents in Brazil. 

Therefore, for the time being, VASPs outside Brazil can offer services freely as long as the cryptoassets offered are not characterised as securities. If this is the case, they cannot act on active solicitation basis, but only on reverse solicitation basis under the aforementioned guidelines.

Operators must, , in order not to be perceived as irregular offerors, take effective measures to prevent the general public from having access, indicate that the investments were not created for the general public, and not have texts to attract Brazilian investors, even if they are in a foreign language.

Virtual asset service providers (VASPs) will need a license to act as crypto exchanges, in addition to formally registering as a company in Brazil and reporting to the Financial Activities Control Board (COAF), as well as to Central Bank of Brazil (BCB) and the Securities and Exchange Commission of Brazil (CVM), depending on the provided activities.

As the regulations for the Virtual Assets Act, which are the responsibility of the BCB, are still in the process of Public Consultation, there are no further details on how to obtain the license, its costs or the estimated time of this process. As soon as the regulations are published, which is expected to be at some point in 2024 according to the regulator's priority list, the BCB will publish the licensing rules and will not be able to set a deadline of less than 6 months for VASPs to comply with these rules.

Using the existing licensing process of the BCB as a proxy, one can expected that a new license would take approximately a year to be used.

When the final regulations are published by the BCB, a license as a VASP can be obtained more easily and quickly if the company is already based in Brazil or, at least, if it is already carrying out operations in Brazilian territory. For this situation to be characterised, it is essential that the company is reporting its activities to the Brazilian Federal Revenue Service. Otherwise, without a local operation before the publication of the regulation, we estimate that obtaining a licence as a VASP could take between 1 and 2 years.

For now, all VASPs can operate without a specific license, unless they are required to have a license because their activities fall under traditional banking, payments or securities regulation.

Using the existing licensing process of the BCB as a proxy, one can expected that a new license would demand an initial capital investment of 1 to 3 million BRL. However, the costs associated to structure a business that will comply with proposed regulations might easily reach upwards from 5 million BRL.

For now, all VASPs can operate without a specific license, unless they are required to have a license because their activities fall under traditional banking, payments or securities regulation.

If the virtual asset service provider (VASP) provides services that are characterised as payment, credit or investment, it may need to comply with the rules of the Central Bank of Brazil (BCB) or the Securities and Exchange Commission (CVM).

The Anti-Money Laundering rules in relation to entities regulated by the BCB are set out in Circular BCB No. 3,978, of 23 January  2020. This regulation deals with guidelines that operators must comply with regarding (i) Anti-Money Laundering and Terrorist Financing (AML/FT) policies, (ii) risk assessments, (iii) KYC, KYP and KYE procedures, (iv) registration of operations, (v) monitoring and analysis of suspicious operations, (vi) reporting to the Financial Activities Control Board (COAF), (vii) monitoring mechanisms and (viii) control and evaluation of effectiveness. 

The Anti-Money Laundering rules in relation to entities regulated by the CVM are set out in Resolution CVM No. 50 of August 31, 2021. This regulation deals with guidelines that operators must comply with regarding (i) Anti-Money Laundering and Terrorist Financing (AML/FT) policies, (ii) internal risk assessment, (iii) internal procedures and controls, (iv) management responsibilities, (v) KYC procedures, (vi) due diligence by independent auditors, (vii) monitoring, analysis and reporting of suspicious transactions, (viii) file keeping, and (ix) compliance with sanctions imposed by the United Nations Security Council (UNSC).

Some services related to cryptoassets can be mistaken with payment, credit or investment services, which may require a license from the Central Bank of Brazil (BCB) or the Securities and Exchange Commission (CVM). In these cases, setting up a cryptoasset business in Brazil may be more costly.

Future regulations to be issued by the BCB may cover certain services that are currently regulated separately. Thus, setting up a cryptoasset business after the new regulation has been issued could generate greater scalability and efficiency gains compared to the current regulation.

In addition, for the time being, the proposed regulations for Public Consultations indicate that the BCB may prohibit three activities: (i) the use of stablecoins for international transfers; (ii) the transfer of virtual assets to self-custodied wallets by non-residents of Brazil; and (iii) the transfer of stablecoins to self-custodied wallets of any user.

These proposals were heavily criticised by the market during the Public Consultation. Therefore, it is still uncertain whether they will be maintained in the final version of the regulation resulting from the Public Consultations.