Is Crypto Legal in Brazil?

The Banco Central do Brasil has been the authority for authorising and supervising virtual asset service providers since Decreto 11.563/2023 took effect on 20 June 2023. Its SPSAV authorisation rules (Resoluções BCB 519 and 520) have been in force since 2 February 2026.

Resolução CVM 88/2022 governs crowdfunding offers by small companies through online platforms, and tokenised securities offers can use it. Lei 14.478/2022 does not apply to virtual assets that represent securities and leaves CVM competence unchanged (art. 1 sole paragraph). The CVM's Parecer de Orientação 40 of 11 October 2022 classifies tokens functionally. A token is a security when it fits Lei 6.385 art. 2, including as a collective investment contract under art. 2 IX.

Lei 14.478 of 21 December 2022 (DOU 22 December 2022), the virtual assets legal framework, entered into force 180 days after publication, on 20 June 2023. It requires virtual asset service providers to obtain prior authorisation from a federal body before operating in Brazil (art. 2), defines VASP services (art. 5), and leaves CVM competence over securities untouched (art. 1 sole paragraph).

Decreto 11.563 of 13 June 2023, in force 20 June 2023, gives the Banco Central do Brasil the power to regulate, authorise and supervise virtual asset service providers under Lei 14.478/2022 (art. 1 II). It does not apply to virtual assets that represent securities and does not alter CVM competence (art. 3).

Resolução CVM 88 of 27 April 2022 (DOU 28 April 2022) governs public offers of securities issued by small companies through online crowdfunding platforms (plataforma eletrônica de investimento participativo), with registration waived. It revoked Instrução CVM 588 and was amended by Resoluções CVM 158/22 and 226/25. The CVM's approach to crypto tokens is set out separately in Parecer de Orientação CVM 40 of 11 October 2022.

Virtual asset service providers need prior authorisation (Lei 14.478/2022 art. 2), which the Banco Central do Brasil grants (Decreto 11.563/2023). Under Resolução BCB 520, in force 2 February 2026, a provider must be constituted in Brazil with its head office and management in Brazil (art. 1 sole paragraph). It operates as an intermediary, custodian or broker (art. 4). Minimum capital is built from activity components in Resolução Conjunta 14: R$1m for services, R$3m for custody, R$5m for intermediation and R$7m for lending. Resolução BCB 517 maps the modalities onto these activities. Firms already operating had 270 days from 2 February 2026 to apply (Res. 520 art. 88 I).

Custody of virtual assets requires BCB authorisation. Resolução BCB 520 (in force 2 February 2026) makes custodian (custodiante de ativos virtuais) one of three SPSAV modalities, which may not combine other modalities. Under arts. 28 to 30 every provider must segregate its own funds and virtual assets from those of clients, and document the segregation in a policy that covers proof of reserves.

Exchanging virtual assets for fiat or other virtual assets is a VASP service under Lei 14.478/2022 art. 5. It requires prior authorisation (art. 2), granted by the Banco Central do Brasil (Decreto 11.563/2023). Tokens that are securities stay under CVM competence (Lei 14.478 art. 1 sole paragraph), and their public offers need CVM registration or exemption (Lei 6.385 art. 19). Since 2 February 2026, buying, selling or exchanging fiat-referenced virtual assets (stablecoins) is part of the FX market under Resolução BCB 521.

Resolução CVM 88/2022, the CVM crowdfunding rule that tokenised offers can use, was amended by Resoluções CVM 158/22 and 226/25. The CVM acts against unregistered crypto-linked securities offers under Lei 6.385 art. 19 without waiting for new rules. Examples are stop orders in Deliberação CVM 904 (4 November 2025) and Deliberação CVM 907 (15 April 2026).

The Comissão de Valores Mobiliários (CVM) is the federal autarchy that regulates the Brazilian securities market. It was created by Lei 6.385 of 7 December 1976 (art. 5) and is linked to the Ministry of Finance.

Lei 6.385/1976 art. 1 gives the CVM authority to regulate and supervise securities issuance and distribution, trading and intermediation, the organisation of exchanges and organised markets, securities custody, audits of listed companies, and securities consultancy and analysis. Portfolio management requires CVM authorisation under Resolução CVM 21/2021.

CVM resolutions and guidance opinions are published in the Diário Oficial da União and listed with their consolidated texts on the CVM legislation site. Examples: Parecer de Orientação CVM 40 on crypto-assets was published in the DOU on 14 October 2022, and Resolução CVM 88 in the DOU on 28 April 2022. Draft rules go through CVM public hearings (audiência pública); Resolução CVM 88 went through SDM 02/20.

Under Lei 6.385/1976 art. 1, the CVM regulates and supervises securities activities including issuance and distribution, trading and intermediation, custody, and securities consultants and analysts. Portfolio managers need CVM authorisation under Resolução CVM 21/2021, consultants under Resolução CVM 19/2021, and analysts are governed by Resolução CVM 20/2021. Securities brokers (CTVMs) need Banco Central authorisation to operate (Resolução CMN 5.008/2022 art. 3).

Under Resolução CVM 21/2021, which replaced the earlier portfolio-manager instructions, a portfolio manager seeking CVM authorisation must be domiciled in Brazil if a natural person (art. 3 I) or headquartered in Brazil if a legal entity (art. 4 I). Securities consultants domiciled abroad may instead be recognised by the CVM (Resolução CVM 19/2021 art. 2).

Securities brokers (sociedades corretoras de títulos e valores mobiliários, CTVMs) need Banco Central do Brasil authorisation to operate (Resolução CMN 5.008/2022 art. 3, in force 2 May 2022, issued under Lei 4.728/1965). Their securities-market intermediation is regulated by the CVM under Lei 6.385/1976 art. 1.

Three CVM resolutions dated 25 February 2021 (DOU 26 February 2021) cover these activities. Securities consultancy requires CVM authorisation, or CVM recognition for consultants domiciled abroad (Resolução CVM 19). Securities analysis is governed by Resolução CVM 20, and portfolio management requires CVM authorisation under Resolução CVM 21.

Public offerings of securities need prior CVM registration (Lei 6.385/1976 art. 19). Resolução CVM 160 of 13 July 2022 (DOU 14 July 2022), in force 2 January 2023, governs primary and secondary public distributions. Under Resolução CVM 160, offering coordinators are intermediary institutions registered with the CVM that sign the distribution agreement.

Securities consultants domiciled abroad may provide securities consultancy in Brazil only if the CVM recognises them (Resolução CVM 19/2021 art. 2). To obtain recognition they must be authorised and supervised by the competent authority of their home country and keep a legal representative in Brazil (art. 7).

Non-resident investors in the Brazilian securities market are governed by Resolução CVM 13 of 18 November 2020 (DOU 19 November 2020). It covers their registration, operations and disclosure of information, and was amended by Resoluções CVM 64/21 and 216/24.

The Central Bank of Brazil (BCB) authorises, regulates and supervises virtual asset service providers under Decreto 11.563/2023. It issued Resoluções BCB 519, 520 and 521 on 10 November 2025 (published 11 November 2025, in force 2 February 2026), covering the authorisation process, constitution and operation, and FX-market treatment. With the CMN it issued Resolução Conjunta 14 (3 November 2025) on minimum capital.

The Comissão de Valores Mobiliários (CVM) oversees crypto-assets that qualify as securities, including their public offerings, under Lei 6.385/1976. Lei 14.478/2022 art. 1 sole paragraph preserves that competence, and the CVM set out its approach to tokens in Parecer de Orientação 40 of 11 October 2022.

The Financial Activities Control Council (COAF), created by Lei 9.613/1998 art. 14, is Brazil's financial intelligence unit. It receives, examines and identifies suspicious transactions and applies administrative penalties. Obliged persons, including virtual asset service providers since Lei 14.478/2022 (Lei 9.613 art. 9 sole paragraph XIX), must report suspicious proposals or transactions to COAF within 24 hours (art. 11 II).

The Receita Federal do Brasil collects crypto-asset transaction reports through the DeCripto, created by Instrução Normativa RFB 2.291 of 14 November 2025. DeCripto has applied since 1 July 2026, replacing the IN RFB 1.888/2019 regime. Its layout (ADE Copes 02/2025) uses code tables from the OECD Crypto-Asset Reporting Framework (CARF) XML Schema.

Virtual-asset services are lawful in Brazil subject to prior authorisation (Lei 14.478/2022 art. 2), with the Central Bank designated to regulate, authorise and supervise providers (Decreto 11.563/2023); Lei 14.478 art. 12 amended Lei 9.613/1998 to make virtual-asset service providers obliged persons (art. 9 sole para. XIX) and to cover virtual assets in transaction records (art. 10 II).

Virtual-asset service providers need prior Central Bank authorisation (Lei 14.478/2022 art. 2); the authorisation and operating rules (Res. BCB 519 and 520 of 10 November 2025) have applied since 2 February 2026, and firms that applied within 270 days may keep operating until their application is decided (Res. 520 art. 88 §6).

The Comissão de Valores Mobiliários (CVM) keeps jurisdiction over virtual assets that are securities, which Lei 14.478/2022 excludes from its scope; it treats crypto-linked collective investment contracts and tokens offered to the public as securities, as in Deliberações 904 (4 November 2025) and 907 (15 April 2026) ordering unregistered offers to stop.

Coaf (Conselho de Controle de Atividades Financeiras), created by Lei 9.613/1998 to receive, examine and identify suspicious activity, is Brazil's financial intelligence unit; under Lei 13.974/2020 it has technical and operational autonomy and is administratively linked to the Central Bank of Brazil.

The ANPD, renamed Agência Nacional de Proteção de Dados by Lei 15.352/2026, is a special autarchy linked to the Ministry of Justice and Public Security that oversees LGPD compliance, including virtual-asset service providers' handling of KYC data.

Lei 9.613 of 3 March 1998, as amended, is Brazil's principal anti-money-laundering statute: it defines the money-laundering offence, sets prevention duties for obliged persons (including virtual-asset service providers since Lei 14.478/2022) and created Coaf.

Lei 12.683 of 9 July 2012 rewrote art. 1 of Lei 9.613/1998, revoking the closed list of predicate offences so that laundering the proceeds of any criminal infraction is an offence, punishable by 3 to 10 years' imprisonment and a fine.

Lei 14.478 of 21 December 2022 established the regulatory framework for virtual-asset service providers and, through art. 12, amended Lei 9.613/1998 so that the money-laundering penalty rises by one-third to two-thirds when the offence is committed through the use of a virtual asset (art. 1 §4).

Lei 13.709 of 14 August 2018, the General Data Protection Law (LGPD), governs personal-data processing including KYC data; Lei 14.478/2022 art. 4 III lists personal-data protection among the guidelines for virtual-asset services, and Res. BCB 520 art. 43 XI requires providers to keep a customer data-protection policy.

CVM Instruction 461 of 23 October 2007 governed the regulated securities markets (stock exchanges, commodities and futures exchanges and organised over-the-counter markets), not collective investment vehicles, and has been revoked by CVM Resolution 135/2022.

Brazil is a member of the FATF (Gafi) and of its regional body GAFILAT, with Coaf coordinating the national delegation; Lei 14.478/2022 art. 4 VII requires virtual-asset services to follow AML/CFT and counter-proliferation-financing principles aligned with international standards.

The Central Bank has enacted a travel rule rather than merely signalling alignment: Res. BCB 520 art. 44 requires virtual-asset service providers to send originator and beneficiary data to the receiving institution, phased in from 2 February 2026 and mandatory for all authorised providers from 2 February 2028 (art. 89).

Brazil's fourth-round FATF/GAFILAT mutual evaluation ran from September 2022 to October 2023, with an on-site visit in March 2023; the FATF plenary adopted the report on 27 October 2023, the first evaluation of Brazil since 2010.

A virtual-asset service provider is a legal entity that performs, on behalf of third parties, at least one of: exchange between virtual assets and national or foreign currency; exchange between virtual assets; transfer; custody or administration of virtual assets; or services related to an issuer's offer or sale of virtual assets (Lei 14.478/2022 art. 5); it needs prior authorisation, granted by the Central Bank (art. 2; Decreto 11.563/2023).

Lei 14.478/2022 does not apply to virtual assets that represent securities under Lei 6.385/1976 and leaves CVM competence unchanged; public offers of such assets, including crypto-linked collective investment contracts, need CVM offer registration or exemption under art. 19 of Lei 6.385, as the CVM applied in Deliberação 904 of 4 November 2025.

Institutions already authorised by the Central Bank that were active in virtual assets when Res. BCB 520 took effect do not need a separate VASP authorisation; they must send the Central Bank a formal communication within 270 days, accompanied by an independent technical certification that they meet the resolution (art. 22).

A virtual-asset service company must be incorporated in Brazil with its head office and management in Brazil, organised as a limitada or a sociedade anônima with virtual-asset services as its main corporate object (Res. BCB 520 arts. 1 and 14), and must show corporate governance compatible with the complexity and risks of the business to obtain authorisation (Res. BCB 519 art. 2 V).

Under Res. BCB 519/2025, VASP authorisation requires proof of the controllers' financial capacity and lawful source of funds, an economically viable business with an up-to-date business plan, IT and governance suited to the business risks, fit-and-proper management and minimum capital; the Central Bank publishes the documents and deadlines for each process (arts. 2 and 4).

The Central Bank assesses VASP applications on the unblemished reputation and technical capacity of managers, controllers and qualifying holders, the controllers' financial capacity and governance and IT suited to the business risks (Res. BCB 519 art. 2), and firms already operating must evidence risk-management, cyber-security and AML internal controls when applying (Res. BCB 520 art. 88 II).

For firms already operating on 2 February 2026, the Central Bank reviews authorisation in two phases (Res. BCB 519); the adaptation period ends when the Central Bank rules on phase 1, and firms that applied within 270 days may keep operating until the process ends, while late filers must stop within 30 days (Res. BCB 520 art. 88 §§1, 6, 7).

Central Bank-authorised virtual-asset service companies must adopt a risk-based AML/CFT policy approved with senior-management commitment (Circular BCB 3.978 arts. 2–3), formally appoint a director responsible for compliance (art. 9) and assess the policy's effectiveness (art. 62); Res. BCB 520 art. 43 VII requires an up-to-date AML/CFT policy kept available to the Central Bank.

The Central Bank of Brazil issued the VASP licensing rules on 10 November 2025: Resolução BCB nº 519 (authorisation process) and nº 520 (constitution and operation of virtual-asset service companies), published 11 November 2025 and in force since 2 February 2026; firms already operating had 270 days from that date to apply (Res. 520 art. 88 I).

Virtual-asset service companies are institutions authorised by the Central Bank (Res. BCB 520 art. 4), so Circular BCB 3.978/2020 applies: they must identify, qualify and risk-classify customers (art. 13) and may not start a business relationship before identification and qualification are complete, with a maximum 30-day allowance for incomplete qualification data (art. 23).

Under Circular BCB 3.978/2020, which binds Central Bank-authorised virtual-asset service companies, customers are classified into risk categories and reclassified when their profile changes (art. 20), politically exposed persons require compatible controls and senior sign-off on the relationship (art. 19 §§2–3), and operations with PEPs or with countries having strategic FATF deficiencies must be specially monitored (art. 39 I d, e, g).

Central Bank-authorised virtual-asset service companies must check whether customers are politically exposed persons or their relatives or close associates, apply controls compatible with that status, weigh it in risk classification and have a more senior officer approve the relationship (Circular BCB 3.978 art. 19); obliged persons must also consult the national PEP register CNPEP (Lei 9.613 art. 12-A §2).

Virtual-asset service providers are obliged persons under Lei 9.613/1998 (art. 9 sole para. XIX) and must report suspicious operations to Coaf (art. 11 II); as Central Bank-authorised institutions they must run monitoring, selection and analysis procedures to detect suspected money laundering and terrorist financing (Circular BCB 3.978 arts. 38 and 48).

Obliged persons must report to Coaf without informing anyone, including the person concerned (Lei 9.613 art. 11 II); for Central Bank-authorised institutions, suspicious operations are analysed within 45 days of selection and reported to Coaf by the next business day after the decision to report (Circular BCB 3.978 arts. 43 and 48), without notice to the parties (art. 50).

Suspicious-transaction reporting to Coaf under Lei 9.613 art. 11 and Circular BCB 3.978 art. 48 carries no minimum amount, unlike the R$50,000 cash-operation reports (Circular art. 49); obliged persons that fail these duties face warnings, fines up to R$20 million, disqualification of managers or loss of authorisation (Lei 9.613 art. 12).

Virtual-asset service providers must keep transaction records available to the Central Bank for at least five years (Res. BCB 520 art. 45 II); Lei 9.613 art. 10 §2 sets a five-year minimum for customer and transaction records, and Circular BCB 3.978 art. 67 requires KYC information and transaction records to be kept for ten years.

The LGPD (Lei 13.709/2018) requires controllers and processors to keep records of their personal-data processing operations (art. 37) and to adopt technical and administrative security measures protecting personal data (art. 46), duties that apply to virtual-asset service providers' customer data.

For corporate customers, Central Bank-authorised virtual-asset service companies must trace the ownership chain to the natural-person beneficial owner using a risk-based ownership threshold no higher than 25% (Circular BCB 3.978 arts. 24–25), and Lei 9.613 art. 10 requires obliged persons to keep customer records, including owners of corporate customers, up to date.

Virtual-asset service providers must keep internal controls to monitor sanctions lists and sanctioned wallet addresses in Brazil and abroad (Res. BCB 520 art. 34 III), share suspicion and restrictive lists with other institutions (art. 43 §2 V), have procedures to execute Lei 13.810/2019 sanctions measures (art. 88 II d) and consult the national PEP register CNPEP (Lei 9.613 art. 12-A §2).

On 29 August 2023 the CVM fined G.A.S. Consultoria e Tecnologia and its two principals R$34 million each (R$102 million in total) for an unregistered public offer in the 'Faraó dos Bitcoins' bitcoin scheme, and barred them for 102 months for fraudulent operation (PAS CVM 19957.002835/2022-47).

Money laundering under art. 1 of Lei 9.613/1998 is punished by 3 to 10 years' imprisonment and a fine; the penalty rises by one-third to two-thirds when the offence is repeated, committed through a criminal organisation or committed through the use of a virtual asset (art. 1 §4, as amended by Lei 14.478/2022).

The one-third to two-thirds penalty increase for money laundering committed through the use of a virtual asset was inserted into art. 1 §4 of Lei 9.613/1998 by art. 12 of Lei 14.478/2022, in force since 20 June 2023.

Individuals' capital gains on the disposal of goods and rights of any nature are subject to income tax at progressive rates of 15% up to R$5 million, 17.5% to R$10 million, 20% to R$30 million and 22.5% above (Lei 8.981/1995 art. 21, as amended by Lei 13.259/2016).

The Receita Federal requires Brazilian crypto exchanges, and residents trading on foreign exchanges or off-exchange, to report crypto-asset operations under IN RFB 1.888/2019, replaced by the DeCripto return (IN RFB 2.291/2025) from 1 July 2026; individuals' capital gains on assets are taxed at 15% to 22.5% (Lei 8.981 art. 21 as amended by Lei 13.259/2016).