The Central Bank of Brazil issued three resolutions on 10 November 2025—Resolutions 519, 520, and 521—implementing comprehensive regulations for virtual asset service providers (VASPs) under the country's Virtual Assets Law. The rules establish governance structures, minimum capital requirements, risk-management standards, and licensing conditions for VASPs, including those already operating in Brazil.
The new regulatory regime will enter into force on 2 February 2026, with some foreign-exchange provisions of Resolution 521 following on 4 May 2026.
GOVERNANCE, CAPITAL AND CLIENT SEGREGATION REQUIREMENTS
Under the resolutions, VASPs must maintain governance frameworks, including clearly defined lines of accountability and independent oversight functions. The resolutions also set minimum capital requirements for VASPs.
The framework includes client asset segregation requirements. VASPs are required to hold client funds and digital assets entirely separately from their own proprietary assets, a rule designed to prevent customer holdings from being commingled with company resources.
The resolutions include cybersecurity requirements. The rules also include specific conditions governing the handling of cross-border virtual asset transfers.
AML STANDARDS AND LICENSING
The regime includes anti-money laundering and counter-terrorism financing compliance obligations. The BCB has aligned Brazil's requirements with international standards, expecting VASPs to implement customer due diligence procedures, transaction monitoring systems, and suspicious activity reporting mechanisms consistent with those applied to conventional financial institutions under Brazil's existing financial crime framework. Non-compliance with these obligations will expose operators to formal regulatory sanctions that can include suspension or revocation of their licence to operate.
Licensing standards under the resolutions define the conditions VASPs must satisfy to operate legally in Brazil, including fit-and-proper assessments for key personnel, minimum organisational requirements, and ongoing reporting obligations to the BCB.