← Regulations / Brazil / Operating Models / Crypto debit card

Crypto-funded debit card in Brazil

A card program where customer fiat balances are funded from crypto holdings, typically through an off-ramp at point of sale or top-up.

Conditional AI-Generated · Unreviewed

Crypto debit card is conditionally permitted in Brazil with a local entity, subject to AML obligations and high licensing burden.

Verdict Details

Permitted
conditional
Local entity required
Yes
Licensing burden
High
Last updated
2026-07-13

AML Obligations

  • VASP authorization from BCB under Law 14,478/2022 required — AML/CTF program mandatory as part of licensing (COAF oversees suspicious activity reporting)
  • Monthly transaction reporting to RFB (IN RFB 1,888) for crypto transactions above BRL 30,000 per month
  • 15% capital gains tax on disposals above BRL 35,000 per month applies to crypto-to-fiat conversions
  • KYC/AML obligations for cardholders flow from the VASP license — identity verification, source of funds, transaction monitoring required
  • COAF suspicious transaction reporting (SARs) for any unusual or suspicious activity

Key Restrictions

  • Must establish a local legal entity with CNPJ and a local director
  • Stablecoins pegged to BRL may require payment institution authorization from BCB in addition to VASP authorization
  • Tiered minimum capital requirements: BRL 1M–5M (~$200K–$1M USD) depending on activity type
  • 6–12 month licensing timeline; existing operators had grandfathering periods extending to 2025
  • Crypto-to-fiat conversion (off-ramp) is regulated as a VASP activity under BCB supervision — likely requires a payment/EMI license or partnership with a licensed payment institution for the fiat side
  • Must partner with a BCB-licensed payment institution or issuer for the card program (BIN sponsorship / card issuance); a standalone VASP license may not cover card issuance

Key Risks

  • Regulatory ambiguity remains around the precise license categorization for crypto-funded debit cards — whether a full payment institution license (IP/SCM) is needed on top of VASP authorization
  • Stablecoin regulation is in flux — BRL-pegged stablecoins may be reclassified as payment instruments triggering additional BCB oversight
  • CVM continues to actively revise securities token rules (Consulta Pública SDM 05/2025) — potential for card-linked rewards tokens or yield-bearing stablecoin balances to be classified as securities
  • COAF AML enforcement is active — any compliance gaps in transaction monitoring or suspicious activity reporting carry significant penalty risk
  • BCB began comprehensive VASP licensing in February 2026 — operators not yet authorized face enforcement exposure

Evidence

This verdict synthesizes the following facts. Each fact links to its primary source(s).

licensing 95% confidence

The Banco Central do Brasil has been the authority for authorising and supervising virtual asset service providers since Decreto 11.563/2023 took effect on 20 June 2023. Its SPSAV authorisation rules (Resoluções BCB 519 and 520) have been in force since 2 February 2026.

licensing 95% confidence

Lei 14.478 of 21 December 2022 (DOU 22 December 2022), the virtual assets legal framework, entered into force 180 days after publication, on 20 June 2023. It requires virtual asset service providers to obtain prior authorisation from a federal body before operating in Brazil (art. 2), defines VASP services (art. 5), and leaves CVM competence over securities untouched (art. 1 sole paragraph).

licensing 95% confidence

Decreto 11.563 of 13 June 2023, in force 20 June 2023, gives the Banco Central do Brasil the power to regulate, authorise and supervise virtual asset service providers under Lei 14.478/2022 (art. 1 II). It does not apply to virtual assets that represent securities and does not alter CVM competence (art. 3).

licensing 85% confidence

Virtual asset service providers need prior authorisation (Lei 14.478/2022 art. 2), which the Banco Central do Brasil grants (Decreto 11.563/2023). Under Resolução BCB 520, in force 2 February 2026, a provider must be constituted in Brazil with its head office and management in Brazil (art. 1 sole paragraph). It operates as an intermediary, custodian or broker (art. 4). Minimum capital is built from activity components in Resolução Conjunta 14: R$1m for services, R$3m for custody, R$5m for intermediation and R$7m for lending. Resolução BCB 517 maps the modalities onto these activities. Firms already operating had 270 days from 2 February 2026 to apply (Res. 520 art. 88 I).

licensing 90% confidence

Custody of virtual assets requires BCB authorisation. Resolução BCB 520 (in force 2 February 2026) makes custodian (custodiante de ativos virtuais) one of three SPSAV modalities, which may not combine other modalities. Under arts. 28 to 30 every provider must segregate its own funds and virtual assets from those of clients, and document the segregation in a policy that covers proof of reserves.

licensing 85% confidence

Exchanging virtual assets for fiat or other virtual assets is a VASP service under Lei 14.478/2022 art. 5. It requires prior authorisation (art. 2), granted by the Banco Central do Brasil (Decreto 11.563/2023). Tokens that are securities stay under CVM competence (Lei 14.478 art. 1 sole paragraph), and their public offers need CVM registration or exemption (Lei 6.385 art. 19). Since 2 February 2026, buying, selling or exchanging fiat-referenced virtual assets (stablecoins) is part of the FX market under Resolução BCB 521.

licensing 95% confidence

The Central Bank of Brazil (BCB) authorises, regulates and supervises virtual asset service providers under Decreto 11.563/2023. It issued Resoluções BCB 519, 520 and 521 on 10 November 2025 (published 11 November 2025, in force 2 February 2026), covering the authorisation process, constitution and operation, and FX-market treatment. With the CMN it issued Resolução Conjunta 14 (3 November 2025) on minimum capital.

licensing 90% confidence

The Financial Activities Control Council (COAF), created by Lei 9.613/1998 art. 14, is Brazil's financial intelligence unit. It receives, examines and identifies suspicious transactions and applies administrative penalties. Obliged persons, including virtual asset service providers since Lei 14.478/2022 (Lei 9.613 art. 9 sole paragraph XIX), must report suspicious proposals or transactions to COAF within 24 hours (art. 11 II).

Evidence fact br.tax not found (may have been renamed).

Verdict Attribution

Source:
AI-Generated · Unreviewed
AI synthesized:
2026-07-13 (deepseek-chat)
Last updated:
2026-07-13
Confidence:
medium

This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.

Conditional — a crypto-funded debit card program is permissible in Brazil but requires (1) BCB VASP authorization under Law 14,478/2022 with a local entity and local director, (2) likely a payment institution license (or partnership with a licensed payment institution) for the fiat/e-money card-issuance side, (3) partner-bank/BIN-sponsor arrangements with a BCB-regulated issuer, and (4) full AML/KYC obligations including COAF suspicious transaction reporting and RFB monthly reporting above BRL 30,000.

Questions this verdict aims to answer

  • What e-money / payment-institution license is required?
  • How is the crypto-to-fiat conversion regulated?
  • What KYC and AML obligations apply to cardholders?
  • What partner-bank or BIN-sponsor arrangements are required?