← Regulations / Brazil / Operating Models / Custodial SaaS

Custodial wallet / SaaS in Brazil

Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).

Conditional AI-Generated · Unreviewed

Custodial SaaS is conditionally permitted in Brazil with a local entity, subject to AML obligations and high licensing burden.

Verdict Details

Permitted
conditional
Local entity required
Yes
Licensing burden
High
Last updated
2026-07-13

AML Obligations

  • VASP authorization under Law 14,478/2022 triggers full AML/CTF obligations, including KYC/CDD on all end users (both the SaaS operator's direct customers and, if the white-label client is a VASP, flow-through obligations may apply via contract).
  • Registration with COAF (Financial Activities Control Council) as the AML reporting authority; suspicious transaction reporting (STR) to COAF is mandatory.
  • Record-keeping obligations for all transactions and KYC documentation for a minimum of 5 years (standard under Brazilian AML framework).
  • Tiered capital requirements: BRL 1M–5M (~$200K–$1M USD) depending on activity scope — this acts as an AML/CTF solvency filter.
  • SaaS provider must ensure white-label clients also have independent VASP authorization or contractual AML pass-through provisions; ambiguity persists on allocation of SAR/STR duties between platform and white-label client.

Key Restrictions

  • Must establish a local entity with CNPJ registration and appoint a local director in Brazil.
  • Asset segregation required under VASP custody rules — customer assets must be legally and operationally segregated from corporate assets.
  • Proof-of-reserves and/or audit requirements expected under BCB prudential supervision (Resolutions 519, 520, 521/2025 and Joint Resolution No. 14).
  • Stablecoins pegged to BRL may trigger additional payment institution authorization from BCB, increasing licensing burden.
  • If any hosted assets qualify as securities tokens (per CVM criteria), dual registration with CVM under Resolution 88/2022 may be required.
  • Grandfathering period for existing operators has deadlines extending to 2025; post-grandfathering, unauthorized operation is unlawful.

Key Risks

  • Regulatory ambiguity: BCB's comprehensive licensing only launched in February 2026; interim enforcement posture and grandfathering deadlines create transitional risk.
  • CVM actively enforcing oversight over cryptoasset securities (token offerings) without waiting for full licensing rules — risk of securities classification for custody assets.
  • AML allocation between SaaS platform and white-label client is not explicitly resolved in current regulation — potential for dual liability or enforcement gaps.
  • Tiered capital requirements (BRL 1M–5M) represent a meaningful cost barrier for smaller SaaS operations.
  • Dynamic regulatory landscape: primary government domains and references are frequently updated, creating compliance monitoring burden.
  • Brazil has recently tightened derivatives rules and blocked prediction market platforms, indicating a proactive enforcement posture that could expand to custody products.

Evidence

This verdict synthesizes the following facts. Each fact links to its primary source(s).

licensing 95% confidence

The Banco Central do Brasil has been the authority for authorising and supervising virtual asset service providers since Decreto 11.563/2023 took effect on 20 June 2023. Its SPSAV authorisation rules (Resoluções BCB 519 and 520) have been in force since 2 February 2026.

[primary] Decreto nº 11.563, de 13 de junho de 2023 [primary] Resolução BCB nº 519, de 10 de novembro de 2025 (DOU 11 nov 2025)
licensing 95% confidence

Lei 14.478 of 21 December 2022 (DOU 22 December 2022), the virtual assets legal framework, entered into force 180 days after publication, on 20 June 2023. It requires virtual asset service providers to obtain prior authorisation from a federal body before operating in Brazil (art. 2), defines VASP services (art. 5), and leaves CVM competence over securities untouched (art. 1 sole paragraph).

[primary] Lei nº 14.478, de 21 de dezembro de 2022 — texto compilado [primary] Lei nº 14.478, de 21 de dezembro de 2022 — texto compilado
licensing 95% confidence

Decreto 11.563 of 13 June 2023, in force 20 June 2023, gives the Banco Central do Brasil the power to regulate, authorise and supervise virtual asset service providers under Lei 14.478/2022 (art. 1 II). It does not apply to virtual assets that represent securities and does not alter CVM competence (art. 3).

[primary] Decreto nº 11.563, de 13 de junho de 2023
licensing 85% confidence

Virtual asset service providers need prior authorisation (Lei 14.478/2022 art. 2), which the Banco Central do Brasil grants (Decreto 11.563/2023). Under Resolução BCB 520, in force 2 February 2026, a provider must be constituted in Brazil with its head office and management in Brazil (art. 1 sole paragraph). It operates as an intermediary, custodian or broker (art. 4). Minimum capital is built from activity components in Resolução Conjunta 14: R$1m for services, R$3m for custody, R$5m for intermediation and R$7m for lending. Resolução BCB 517 maps the modalities onto these activities. Firms already operating had 270 days from 2 February 2026 to apply (Res. 520 art. 88 I).

[primary] Lei nº 14.478, de 21 de dezembro de 2022 — texto compilado [primary] Decreto nº 11.563, de 13 de junho de 2023 [primary] Resolução BCB nº 520, de 10 de novembro de 2025 — texto consolidado
licensing 90% confidence

Custody of virtual assets requires BCB authorisation. Resolução BCB 520 (in force 2 February 2026) makes custodian (custodiante de ativos virtuais) one of three SPSAV modalities, which may not combine other modalities. Under arts. 28 to 30 every provider must segregate its own funds and virtual assets from those of clients, and document the segregation in a policy that covers proof of reserves.

[primary] Resolução BCB nº 520, de 10 de novembro de 2025 — texto consolidado [primary] Resolução BCB nº 520, de 10 de novembro de 2025 — texto consolidado
licensing 95% confidence

The Central Bank of Brazil (BCB) authorises, regulates and supervises virtual asset service providers under Decreto 11.563/2023. It issued Resoluções BCB 519, 520 and 521 on 10 November 2025 (published 11 November 2025, in force 2 February 2026), covering the authorisation process, constitution and operation, and FX-market treatment. With the CMN it issued Resolução Conjunta 14 (3 November 2025) on minimum capital.

[primary] Decreto nº 11.563, de 13 de junho de 2023 [primary] Resolução BCB nº 519, de 10 de novembro de 2025 (DOU 11 nov 2025) [primary] Resolução BCB nº 520, de 10 de novembro de 2025 — texto consolidado
licensing 90% confidence

The Comissão de Valores Mobiliários (CVM) oversees crypto-assets that qualify as securities, including their public offerings, under Lei 6.385/1976. Lei 14.478/2022 art. 1 sole paragraph preserves that competence, and the CVM set out its approach to tokens in Parecer de Orientação 40 of 11 October 2022.

[primary] Lei nº 14.478, de 21 de dezembro de 2022 — texto compilado [primary] Parecer de Orientação CVM nº 40, de 11 de outubro de 2022 — Os CriptoAtivos e o Mercado de Valores Mobiliários [primary] Lei nº 6.385, de 7 de dezembro de 1976 — texto compilado
licensing 90% confidence

The Financial Activities Control Council (COAF), created by Lei 9.613/1998 art. 14, is Brazil's financial intelligence unit. It receives, examines and identifies suspicious transactions and applies administrative penalties. Obliged persons, including virtual asset service providers since Lei 14.478/2022 (Lei 9.613 art. 9 sole paragraph XIX), must report suspicious proposals or transactions to COAF within 24 hours (art. 11 II).

[primary] Lei nº 9.613, de 3 de março de 1998 — texto compilado [primary] Lei nº 9.613, de 3 de março de 1998 — texto compilado
licensing 80% confidence

Resolução CVM 88/2022, the CVM crowdfunding rule that tokenised offers can use, was amended by Resoluções CVM 158/22 and 226/25. The CVM acts against unregistered crypto-linked securities offers under Lei 6.385 art. 19 without waiting for new rules. Examples are stop orders in Deliberação CVM 904 (4 November 2025) and Deliberação CVM 907 (15 April 2026).

[primary] Resolução CVM 88, de 27 de abril de 2022 [primary] Deliberação CVM nº 904, de 4 de novembro de 2025 [primary] Deliberação CVM nº 907, de 15 de abril de 2026
licensing 90% confidence

Securities brokers (sociedades corretoras de títulos e valores mobiliários, CTVMs) need Banco Central do Brasil authorisation to operate (Resolução CMN 5.008/2022 art. 3, in force 2 May 2022, issued under Lei 4.728/1965). Their securities-market intermediation is regulated by the CVM under Lei 6.385/1976 art. 1.

[primary] Resolução CMN nº 5.008, de 24 de março de 2022 (DOU 28 mar 2022) [primary] Lei nº 6.385, de 7 de dezembro de 1976 — texto compilado
licensing 85% confidence

Public offerings of securities need prior CVM registration (Lei 6.385/1976 art. 19). Resolução CVM 160 of 13 July 2022 (DOU 14 July 2022), in force 2 January 2023, governs primary and secondary public distributions. Under Resolução CVM 160, offering coordinators are intermediary institutions registered with the CVM that sign the distribution agreement.

[primary] Lei nº 6.385, de 7 de dezembro de 1976 — texto compilado [primary] Resolução CVM 160, de 13 de julho de 2022 — texto consolidado

Verdict Attribution

Source:
AI-Generated · Unreviewed
AI synthesized:
2026-07-13 (deepseek-chat)
Last updated:
2026-07-13
Confidence:
medium

This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.

Conditional — custodial wallet/SaaS providers can serve Brazilian residents only after obtaining VASP authorization from BCB (Law 14,478/2022), establishing a local entity with a local director, segregating customer assets, meeting tiered capital requirements (BRL 1M–5M), and complying with COAF AML reporting, with additional CVM registration if custody involves securities tokens.

Questions this verdict aims to answer

  • What custody license / qualified-custodian status applies?
  • What segregation, insurance, and proof-of-reserves rules apply?
  • What AML obligations attach to the SaaS vs the white-label client?