Brazil -- AML/CFT Compliance Regulatory Overview

Executive Summary

• Cryptocurrency and virtual asset activities are legal in Brazil, with a comprehensive regulatory framework established under Law No. 14,478 of 2022, which amended the existing anti-money laundering law (Law No. 9,613 of 1998) to explicitly include virtual assets within its scope L9613.
• The Central Bank of Brazil (Banco Central do Brasil) is designated as the primary regulator for virtual asset service providers, with the Brazilian Securities and Exchange Commission (CVM) also exercising authority over digital assets that qualify as securities Banco Central do Brasil and the Securities and Exchange Commission....
• The Financial Activities Control Council (COAF) remains the financial intelligence unit responsible for receiving and analyzing suspicious transaction reports, with virtual asset service providers now subject to its reporting requirements L9613.
• Licensing requirements are being implemented, with virtual asset service providers required to obtain authorization from the Central Bank of Brazil; as of 2025-2026, the regulatory framework is transitioning toward formal licensing, though operational specifics continue to be developed Banco Central do Brasil and the Securities and Exchange Commission....
• The practical reality is that Brazil has moved from an unregulated market to a structured regulatory environment, but implementation gaps remain as the Central Bank finalizes its licensing procedures and compliance expectations for the virtual asset industry Regulation.

Regulatory Framework

Regulatory Bodies

• The Central Bank of Brazil (Banco Central do Brasil - BCB) is the primary regulatory authority for virtual asset service providers in Brazil, responsible for authorizing and supervising their operations, with its regulatory authority exercised through the National Financial System framework Banco Central do Brasil and the Securities and Exchange Commission....
• The Brazilian Securities and Exchange Commission (Comissão de Valores Mobiliários - CVM) oversees digital assets that qualify as securities, providing regulatory clarity for tokenized assets and investment contracts involving virtual assets Banco Central do Brasil and the Securities and Exchange Commission....
• The Financial Activities Control Council (Conselho de Controle de Atividades Financeiras - COAF) is the financial intelligence unit responsible for receiving, examining, and identifying suspicious activities, operating under the Ministry of Finance L9613.
• The National Data Protection Authority (Autoridade Nacional de Proteção de Dados - ANPD) oversees data protection compliance, which has implications for KYC and customer data handling by virtual asset service providers under the General Data Protection Law (LGPD) L13709.

Primary Laws

• Law No. 9,613 of March 3, 1998 (as amended) is the principal anti-money laundering legislation in Brazil, establishing the criminal offenses of money laundering and the prevention framework for the use of the financial system for illicit activities, and creating COAF L9613.
• Law No. 12,683 of 2012 substantially amended Law No. 9,613, removing the exhaustive list of predicate offenses and expanding the definition of money laundering to cover any criminal infraction, thereby broadening the scope of AML obligations L9613.
• Law No. 14,478 of 2022, known as the "Legal Framework for Virtual Assets," amended Law No. 9,613 to explicitly include the use of virtual assets as an aggravating circumstance for money laundering penalties, and established the regulatory framework for virtual asset service providers L9613.
• Law No. 13,709 of August 14, 2018, known as the General Data Protection Law (LGPD), governs the processing of personal data, including in digital environments, which applies to KYC and customer due diligence activities of virtual asset service providers L13709.
• CVM Instruction No. 461, of October 23, 2007, establishes the regulatory framework for collective investment vehicles, which may apply to certain virtual asset investment products under CVM jurisdiction CVM INSTRUCTION No. 461, OF OCTOBER 23....

International Standing

• Brazil is a member of the Financial Action Task Force (FATF) and has committed to implementing FATF Recommendations, including the application of AML/CFT measures to virtual assets and virtual asset service providers Banco Central do Brasil and the Securities and Exchange Commission....
• The Central Bank of Brazil actively participates in international forums on financial regulation and has signaled alignment with global standards for virtual asset regulation, including FATF's Travel Rule requirements Banco Central do Brasil and the Securities and Exchange Commission....
• Brazil's AML framework is subject to mutual evaluation by FATF, and the country has committed to addressing deficiencies identified in virtual asset regulation during its most recent evaluation cycle Regulation.
• The Central Bank has engaged in joint statements with the Securities and Exchange Commission regarding the regulatory approach to virtual assets, demonstrating coordination between authorities in implementing international standards Banco Central do Brasil and the Securities and Exchange Commission....

Licensing Requirements

Who Needs a License

• Virtual asset service providers, defined as legal entities that execute, on behalf of third parties, at least one of the following services: exchange between virtual assets and fiat currency, exchange between one or more virtual assets, transfer of virtual assets, custody or administration of virtual assets, or participation in financial services related to virtual assets, are required to obtain authorization from the Central Bank of Brazil Banco Central do Brasil and the Securities and Exchange Commission....
• Entities engaged in activities involving virtual assets that qualify as securities under Brazilian law may also require registration and authorization from the Brazilian Securities and Exchange Commission (CVM) in addition to or instead of Central Bank authorization, depending on the specific nature of the activities Banco Central do Brasil and the Securities and Exchange Commission....
• Financial institutions already authorized by the Central Bank that wish to engage in virtual asset activities must obtain specific authorization for such activities, even if they hold existing banking or financial licenses Banco Central do Brasil and the Securities and Exchange Commission....
• Companies providing virtual asset services must be established as legal entities under Brazilian law, with a registered office in Brazil, and must comply with corporate governance requirements applicable to regulated financial institutions Regulation.

Application Process and Timeline

• The application process for virtual asset service provider authorization is conducted through the Central Bank of Brazil's electronic systems, with applicants required to submit comprehensive documentation including business plans, compliance programs, and corporate structure information Regulation.
• The Central Bank evaluates applications based on the fitness and propriety of controlling shareholders, directors, and officers, as well as the adequacy of the proposed compliance and risk management frameworks Banco Central do Brasil and the Securities and Exchange Commission....
• The regulatory approval process may take several months from submission to final decision, as the Central Bank conducts thorough due diligence on applicants and their proposed operations Regulation.

Structural Requirements

• Virtual asset service providers must maintain a permanent presence in Brazil, including a registered legal entity, local management structure, and adequate physical and technological infrastructure to support their operations and comply with regulatory obligations Regulation.
• The company must implement a comprehensive compliance program that includes AML policies and procedures, a designated compliance officer, internal controls, and independent audit mechanisms L9613.
• Virtual asset service providers must maintain adequate corporate governance structures, including board oversight of compliance matters and clear lines of responsibility for AML/CFT obligations Regulation.

Licensed Entities Status

• As of 2025-2026, the Central Bank of Brazil has been developing the formal licensing framework for virtual asset service providers following the enactment of Law No. 14,478 of 2022, but the specific implementing regulations detailing the licensing process are still being finalized Banco Central do Brasil and the Securities and Exchange Commission....
• It must be stated prominently that no entities have been formally licensed as virtual asset service providers under the new regulatory framework as of the current period, as the Central Bank continues to develop its rulemaking and licensing procedures Banco Central do Brasil and the Securities and Exchange Commission....

AML/KYC Requirements

Customer Due Diligence (CDD)

• Virtual asset service providers are required to conduct customer due diligence measures, including identifying and verifying the identity of their customers through valid identification documents, and collecting information on the customer's professional activities and financial capacity L9613.
• CDD measures must be applied when establishing a business relationship, when conducting occasional transactions above established thresholds, and whenever there is suspicion of money laundering or terrorist financing L9613.
• Virtual asset service providers must identify the beneficial owner of legal entities and arrangements, as well as the natural persons ultimately controlling such entities L9613.
• The General Data Protection Law (LGPD) imposes additional obligations on the processing of personal data during CDD, requiring that data collection be limited to what is necessary for compliance purposes and that customers be informed about the use of their data L13709.

Enhanced Due Diligence (EDD)

• Enhanced due diligence measures must be applied to customers classified as high-risk, including politically exposed persons (PEPs), customers from high-risk jurisdictions, and transactions involving complex or unusually large volumes L9613.
• Virtual asset service providers must implement additional monitoring and verification measures for high-risk customers, including more frequent review of account activity and enhanced transaction monitoring Banco Central do Brasil and the Securities and Exchange Commission....
• For customers identified as politically exposed persons, virtual asset service providers must apply additional CDD measures, including establishing the source of funds and source of wealth, and subjecting the business relationship to enhanced monitoring L9613.

Suspicious Transaction Reporting (STR)

• Virtual asset service providers are required to report suspicious transactions to COAF, the financial intelligence unit, and must establish procedures for identifying and reporting operations that may constitute money laundering or terrorist financing L9613.
• Reports must be submitted to COAF within the established deadlines, and the identity of the reporting entity and the information contained in the report must be kept confidential L9613.
• Virtual asset service providers must also report transactions that exceed specified monetary thresholds, with the thresholds established by COAF regulations and the Central Bank's implementing rules Banco Central do Brasil and the Securities and Exchange Commission....
• The obligation to report suspicious transactions applies regardless of the transaction amount, and failure to report may result in administrative penalties L9613.

Record Retention

• Virtual asset service providers must maintain records of their AML compliance activities, including CDD information, transaction records, and suspicious transaction reports, for a minimum period as established by law and regulation L9613.
• Records of customer identification and transaction details must be maintained in a manner that allows for timely reconstruction of individual transactions and provision of information to competent authorities upon request L9613.
• The General Data Protection Law (LGPD) imposes additional record-keeping obligations regarding the processing of personal data, including maintaining records of data processing operations and implementing appropriate technical and organizational measures to protect personal data L13709.

Beneficial Ownership and PEP Screening

• Virtual asset service providers must implement procedures to identify and verify the beneficial owners of their customers, including collecting information on the ownership and control structure of legal entities L9613.
• Providers must maintain up-to-date beneficial ownership information and ensure that this information is available to competent authorities upon request L9613.
• Virtual asset service providers must implement systems and procedures for screening customers against lists of politically exposed persons and other designated persons, including sanctions lists maintained by Brazilian and international authorities L9613.

Enforcement Actions

• The Brazilian authorities have conducted enforcement actions against unauthorized virtual asset businesses operating without proper licensing, with penalties including cease-and-desist orders and administrative fines Banco Central do Brasil and the Securities and Exchange Commission....
• COAF has actively investigated suspicious transactions involving virtual assets, with cases referred to law enforcement authorities for further investigation and potential criminal prosecution under Law No. 9,613 L9613.
• The criminal penalties for money laundering under Article 1 of Law No. 9,613 include imprisonment of three to ten years and fines, with penalties increased by one-third to two-thirds when the crime is committed through the use of virtual assets L9613.
• The penalty enhancement provision for virtual asset-related money laundering was added by Law No. 14,478 of 2022, reflecting a legislative response to the growing use of virtual assets in criminal activities L9613.

Tax Treatment

• Under the current Brazilian regulatory framework, virtual assets are treated as financial assets for tax purposes, and capital gains from the sale or exchange of virtual assets are subject to income tax (Imposto de Renda) in accordance with the general rules applicable to capital gains Banco Central do Brasil and the Securities and Exchange Commission....
• The Brazilian Federal Revenue Service (Receita Federal do Brasil) requires taxpayers to declare virtual assets held, and capital gains realized from the disposal of virtual assets above the exemption threshold are subject to taxation at progressive rates L9613.
• Virtual assets are not subject to ICMS (state sales tax) in most jurisdictions, but transactions involving virtual assets used as payment instruments may be subject to relevant indirect taxes depending on the specific circumstances Banco Central do Brasil and the Securities and Exchange Commission....
• Companies engaged in virtual asset services must comply with corporate income tax obligations on their earnings, including applicable surcharges and social contribution on net profit Regulation.

Key Gaps & Risks

• The principal gap in the current regulatory framework is that the Central Bank of Brazil has not yet issued the specific implementing regulations for licensing virtual asset service providers, creating uncertainty for businesses seeking to operate legally in the Brazilian market Banco Central do Brasil and the Securities and Exchange Commission....
• The absence of a fully operational licensing regime means that virtual asset service providers are technically operating in a regulatory gray area until the Central Bank completes its rulemaking, exposing businesses to compliance uncertainty and potential regulatory enforcement actions Banco Central do Brasil and the Securities and Exchange Commission....
• The coordination between the Central Bank and CVM regarding the classification of digital assets as virtual assets versus securities remains a challenge, particularly for tokenized assets and investment products that may fall under either regulatory framework Banco Central do Brasil and the Securities and Exchange Commission....
• Compliance with data protection obligations under the LGPD creates additional operational burdens for virtual asset service providers, who must balance AML/KYC requirements with data minimization and privacy obligations L13709.
• The penalty enhancement for virtual asset-related money laundering under Law No. 9,613 creates heightened criminal risk for businesses that fail to implement adequate AML controls, yet the practical application of these enhanced penalties has yet to be tested in the courts L9613.
• The regulatory framework relies heavily on the practical implementation of FATF standards, but without specific guidance on the Travel Rule and other virtual asset-specific requirements, there is a risk of inconsistent implementation across the industry Banco Central do Brasil and the Securities and Exchange Commission....

Sources

• Reuters Brazil News
• L13709 - General Data Protection Law
• Banco Central do Brasil and the Securities and Exchange Commission Joint Statement
• L9613 - Anti-Money Laundering Law
• Financial Market Infrastructures
• CVM Instruction No. 461
• Banco Central do Brasil Regulation
• Action of the State and the role of the Central Bank of Brazil