Brazil's VASP Authorisation Deadline Looms as BCB Bars Banks From Unlicensed Crypto
From October 30, 2026, Brazil's central bank prohibits supervised institutions from dealing with unauthorised VASPs. Resolutions 519, 520, and 521 turn Lei 14.478 into a live licensing regime.
What Changed
Under BCB Resolutions No. 519, 520, and 521 of 2025 — which operationalize Lei 14.478/2022 — the Banco Central do Brasil (BCB) set October 30, 2026 as the date after which financial institutions, payment institutions, and all BCB-supervised entities are prohibited from conducting or facilitating virtual-asset operations with counterparties that provide VASP services without BCB authorization or without being in the authorization process. Resolution 519 defines the authorization pathway for virtual-asset service providers (sociedades prestadoras de serviços de ativos virtuais); Resolution 520 governs their formation, operation, and supervision, mandating segregation of client assets, cybersecurity standards, internal controls, and fee transparency. Firms that neither obtain authorization nor enter the process must cease virtual-asset activity in Brazil and transfer or wind down their operations.
Who It Affects
Domestic and foreign VASPs serving Brazilian users — exchanges, custodians, brokers, and intermediation platforms — plus the banks and payment institutions that provide their fiat rails. Stablecoin and remittance operators relying on Brazilian correspondent banking are directly exposed. Because banking access now hinges on authorization status, the October 30 cutoff effectively decides which crypto firms keep functioning bank relationships in Latin America's largest market.
What to Do
If you serve Brazilian users, file for BCB authorization or confirm you are formally in the authorization process before October 30, 2026, so your banking partners can continue transacting with you. Align client-asset segregation, cybersecurity controls, and governance with Resolution 520. Strengthen onboarding KYC and beneficial-ownership records the authorization review will test. Audit-ready, multi-method verification is a baseline expectation of a supervised VASP.
What is deepidv?
Not everyone loves compliance — but we do. deepidv is the AI-native verification engine and agentic compliance suite built from scratch. No third-party APIs, no legacy stack. We verify users across 211+ countries in under 150 milliseconds.
Learn More