VASP Authorisation Brazil How to Apply to the Central Bank (BCB)

Brazil has established itself as Latin America’s most significant regulated market for virtual assets, and obtaining VASP authorisation in Brazil is now a concrete, operationalised process. This page is designed for founders, compliance officers, in-house counsel and foreign crypto platforms that need to understand step by step how to secure authorisation from the Banco Central do Brasil (BCB) to operate as a prestadora de serviços de ativos virtuais (virtual asset service provider). The statutory foundation is Law No. 14,478 of 21 December 2022, which assigned the Central Bank primary rule-making and supervisory authority over VASPs. The BCB translated that mandate into actionable guidance through a suite of normative instructions most critically Instrução Normativa BCB No. 704, published on 29 January 2026, with follow-up amendments through May 2026. The market now has a defined pathway: specific documents, phases, transitional deadlines and reporting obligations. This guide walks you through every stage, from preliminary corporate decisions to post-authorisation compliance, with precise regulatory citations and realistic timelines.

At-a-Glance: Quick Facts on VASP Authorisation Brazil

• Legal basis: Law No. 14,478/2022, which defines virtual assets, captures intermediation, custody, exchange and transfer services, and assigns regulatory authority to the BCB.
• Regulator: Banco Central do Brasil (BCB), acting through its Department of Organisation of the Financial System (Deorf) and the Unicad system.
• Core operational guidance: IN BCB No. 704 (29 January 2026) sets out filing requirements, documents and protocol rules; amended by IN BCB No. 739 (29 May 2026).
• Reporting framework effective date: IN BCB No. 693 (effective 2 February 2026) establishes Sisbacen registration and CADOC data-remittance obligations.
• Critical transition deadline: Under Resolução BCB No. 520, banks and payment institutions are prohibited from transacting with unauthorised VASPs from 30 October 2026.

What Is VASP Authorisation in Brazil?

Law No. 14,478 Scope and Definitions

Law No. 14,478/2022 created Brazil’s virtual asset framework (marco legal dos criptoativos). The statute defines a virtual asset as a digital representation of value that can be traded or transferred electronically, expressly excluding assets already regulated under capital-markets or payments legislation. It captures a broad set of services: intermediation or exchange of virtual assets, custody and administration, transfer services, and any other activities defined by future regulation. The law also updated Brazil’s Penal Code to criminalise fraud involving virtual assets and established a duty for VASPs to comply with anti-money-laundering and counter-terrorism-financing norms (PLD/FT). Importantly, Law 14,478 delegated to the executive branch the power to designate a supervisory authority a designation that fell to the BCB via presidential decree.

BCB’s Supervisory Remit and How the Authorisation Operates

The BCB supervises VASPs through the same institutional architecture it uses for banks and payment institutions, adapted for the crypto sector. The principal corporate form for a pure-play crypto platform is the sociedade prestadora de serviços de ativos virtuais (SPSAV), a category created by Resolução BCB No. 520. Other BCB-authorised institutions such as banks, fintechs and payment institutions may also provide virtual-asset services, but they do so under their existing licences with additional conditions. For new market entrants or crypto-native platforms, the SPSAV authorisation is the relevant pathway. IN BCB No. 704 operationalises this by prescribing the exact documents, filing channels and review phases for an SPSAV application. The BCB has continued to refine these rules, most recently through IN BCB No. 739 (29 May 2026), signalling an evolving but increasingly settled regulatory environment.

Step-by-Step: How to Apply for VASP Authorisation in Brazil (BCB Application Process)

The BCB application process can be understood in sequential phases: preliminary readiness, documentation assembly, filing and protocol submission, technical review, possible phased authorisation, and post-authorisation set-up. Below are the eight steps a platform should follow, mapped to the requirements of IN BCB No. 704 and related normative instruments. Items marked with an asterisk (*) are typical supporting materials frequently requested during review; all other items are expressly required by the BCB.

Step 1 Preliminary Readiness and Corporate Decisions

Before engaging with the BCB, applicants must make foundational decisions. The entity type must be an SPSAV (or an already-authorised institution seeking to add virtual-asset services). Applicants should pass a board resolution authorising the application, define a corporate purpose that explicitly references virtual-asset service provision in accordance with Law 14,478, and establish a local presence in Brazil including a physical registered office and at least one locally resident statutory representative. Foreign groups must determine whether to incorporate a Brazilian subsidiary (sociedade limitada or S.A.) or register a branch, keeping in mind that the BCB typically expects a fully capitalised local entity with segregated governance.

Step 2 Governance and Compliance Framework

The BCB expects applicants to present a mature governance and compliance framework at the time of filing. This includes a comprehensive AML/PLD programme aligned with Law 14,478’s requirements and the BCB’s broader PLD/FT norms covering customer due diligence, enhanced due diligence for high-risk clients, suspicious-transaction identification and reporting to COAF (Brazil’s financial-intelligence unit). Applicants must appoint a dedicated compliance officer (diretor responsável pela PLD/FT), establish an internal-controls function, and document audit arrangements (internal and external). The governance section should also describe the board composition, committee structures, risk-management policies, and the escalation process for regulatory notifications. Anti-money-laundering compliance is a central pillar of the BCB’s assessment; platforms without a robust PLD programme at filing are almost certain to face objections.

Step 3 Technical and Security Documentation

Applicants must submit detailed technical documentation describing their system architecture, custody model, wallet infrastructure (cold/hot wallet controls, key-management protocols), and cybersecurity framework. The BCB expects third-party risk assessments for any outsourced technology component, penetration-test reports conducted by an independent firm, business-continuity and disaster-recovery plans, and an incident-response procedure. The custody model must demonstrate clear segregation between client assets and proprietary assets, with documented reconciliation processes. Platforms using multi-signature wallets, hardware security modules (HSMs) or institutional custody providers should describe these arrangements in detail, including contractual and operational safeguards.

Step 4 Financials and Capital Requirements

The application must include audited financial statements prepared in accordance with Brazilian accounting standards (NBC TG), proof of initial capital or funding adequate for the proposed scale of operations, a detailed ownership structure (including ultimate beneficial owners), and consolidated group information where the applicant belongs to a conglomerate. The BCB’s accounting and reporting layouts CADOC documents 5710 and 5711 define the chart of accounts and data format that authorised VASPs must adopt. Applicants should begin mapping their financial data to these layouts early, as misalignment is a common source of delay. While the BCB has not published a single fixed minimum-capital figure applicable to all SPSAVs, Resolução BCB No. 520 provides the framework for capital adequacy and prudential requirements.

Step 5 Regulatory Filings and Protocol Submission

Filing is conducted through the BCB’s established channels. IN BCB No. 704 (29 January 2026) specifies the protocol rules: applications are submitted via the Deorf/Unicad system, with supporting documentation digitally signed using ICP-Brasil certificates. The application package must be assembled in the sequence prescribed by the normative instruction, accompanied by a cover letter identifying the applicant, the requested authorisation type (SPSAV), and a summary of the services to be provided. Certain declarations including fitness-and-propriety attestations for directors and controlling shareholders must follow specific BCB templates. Applicants should confirm that all digital signatures are current and that the complete package has been uploaded before requesting protocol; incomplete submissions will be returned without review.

Step 6 Third-Party Certifications and Technical Attestation

The BCB requires independent technical certification of certain operational elements. IN BCB No. 701 and related instructions set the expectations for technical attestation: an independent certifier must validate the platform’s information-security controls, custody architecture and operational resilience. The certifier’s report should address compliance with the BCB’s cybersecurity requirements (aligned with Resolução BCB No. 520 and supplementary guidance), confirm that penetration tests have been performed, and attest that the platform’s infrastructure meets minimum operational standards. Engaging a qualified certifier early ideally during the readiness phase can materially accelerate the review timeline.

Step 7 Phased Authorisation and Go-Live

The BCB may grant authorisation on a phased or probationary basis, particularly where the platform has not yet completed production-environment testing at the time of the decision. IN BCB No. 713 addresses conditions that may attach to an authorisation, including volume limits, restricted product offerings, or enhanced reporting requirements during an initial operating period. The platform must demonstrate readiness to meet all post-authorisation obligations before proceeding to full go-live. During the phased period, the BCB may conduct remote or on-site inspections to verify compliance with the authorisation conditions.

Step 8 Post-Authorisation Compliance Set-Up

Upon authorisation, the VASP must register its systems in Sisbacen (the BCB’s information system) and begin data remittance according to the cadence prescribed by IN BCB No. 693 (effective 2 February 2026). This includes periodic submission of CADOC 5710/5711 reports, transaction-monitoring data, and foreign-exchange operations reports where applicable. The platform must also implement ongoing AML/KYC transaction monitoring, maintain a change-notification register (informing the BCB of material changes to directors, ownership, technology or corporate purpose), and prepare for the annual submission of audited financial statements. Establishing these workflows before go-live is critical to avoiding enforcement action in the first reporting cycle.

Download the VASP Application Checklist (PDF) a comprehensive, itemised document list mapped to IN BCB No. 704 and all supporting normative instructions.

Comparison Table: Brazil vs Selected LatAm Jurisdictions

For platforms evaluating where to establish their regional hub, the following high-level comparison provides a starting point. The table focuses on structural features; detailed procedural analysis for Mexico and Argentina is beyond the scope of this page.

Key Requirements and Eligibility for VASP Authorisation

Corporate and Ownership Requirements

Applicants must operate through a Brazilian legal entity typically a sociedade limitada (Ltda.) or sociedade anônima (S.A.) with a corporate purpose explicitly covering virtual-asset services as defined by Law 14,478. The beneficial-ownership structure must be transparent to the BCB, including identification of all individuals holding direct or indirect control or significant influence. Foreign controlling shareholders must provide equivalent corporate documentation authenticated and apostilled. The entity must maintain a physical registered office in Brazil with adequate operational infrastructure.

Governance and Suitability (Fit and Proper)

Directors, officers and controlling shareholders are subject to fit-and-proper assessments conducted by the BCB. Applicants must submit detailed CVs, criminal and civil background checks (including international clearance for foreign nationals), financial-integrity declarations, and evidence of relevant professional experience. The BCB may interview proposed directors as part of its review. Governance arrangements must include clearly defined roles, documented decision-making processes, and an effective internal-audit function.

Financial and Prudential Requirements

Audited financial statements prepared and signed by an independent auditor registered with the CVM are mandatory. The BCB assesses whether the applicant’s capital is adequate for its proposed operations, taking into account the nature, volume and complexity of the virtual-asset services offered. Resolução BCB No. 520 establishes the prudential framework, and applicants should be prepared to demonstrate ongoing capital adequacy, not merely point-in-time funding at application.

AML / PLD / KYC Obligations

Law 14,478 subjects VASPs to Brazil’s AML architecture, requiring implementation of customer identification and verification (KYC), ongoing monitoring, record-keeping for a minimum of five years, and reporting of suspicious transactions to COAF. The BCB’s PLD/FT norms apply in full, including enhanced due diligence for politically exposed persons (PEPs), cross-border transactions, and correspondent relationships. Failure to present a compliant PLD programme at the time of filing is one of the most common grounds for application objection.

Transitional Rules for Foreign Platforms

Foreign crypto platforms that serve Brazilian customers or interact with Brazilian financial institutions face a clear regulatory deadline. Resolução BCB No. 520 establishes that, from 30 October 2026, banks, payment institutions and other BCB-supervised entities are prohibited from maintaining transactional relationships with VASPs that have not been authorised or are not in the process of being authorised by the BCB. In practice, this means that foreign platforms must either obtain SPSAV authorisation, partner with an authorised Brazilian entity, or file a notice of interest and demonstrate progress toward authorisation before the cut-off date. Practical steps for foreign platforms include appointing a local legal representative, initiating corporate formation in Brazil, conducting a gap analysis against BCB requirements, and filing a preliminary engagement with the Deorf to document the platform’s intent to apply. Industry observers expect the BCB to treat platforms that have filed a complete application before the deadline more favourably than those that have not engaged at all.

Likely Processing Times and What Slows an Application

The BCB has not published a single fixed statutory clock for the complete VASP authorisation process under IN BCB No. 704. However, the normative instructions do prescribe specific phases completeness review, substantive analysis and decision and set deadlines for applicants to respond to information requests (typically 30 to 60 days, after which an incomplete file may be archived). Based on the structure of these phases and market experience with analogous BCB authorisation processes (e.g., payment institutions), GLE estimates the following indicative timelines:

• Initial completeness review: 30–90 days from protocol submission.
• Substantive technical and governance review: 60–180 days, depending on the complexity of the application and the quality of initial documentation.
• Board decision (Diretoria Colegiada): additional 30–60 days following completion of the technical review.

The most common factors that delay applications include incomplete AML/PLD programmes, missing or outdated audited financial statements, insufficiently detailed custody-model documentation, absence of third-party technical certification reports, and slow responses to BCB information requests. Applicants can materially shorten the process by conducting a pre-filing readiness audit, engaging technical certifiers before submission, and assembling all documentation in the format and sequence prescribed by IN BCB No. 704.

Post-Authorisation Obligations and Supervision

Authorisation is not the end of the regulatory journey it is the beginning of ongoing supervisory engagement with the BCB. Authorised VASPs must comply with a structured reporting cadence, submitting CADOC 5710 and 5711 reports (accounting and operational data) at intervals prescribed by IN BCB No. 693. Registration in the Sisbacen system is mandatory, and the VASP must maintain current data in Unicad regarding its directors, shareholders, corporate structure and authorised services. The BCB conducts both remote monitoring (based on submitted data) and on-site inspections. Material changes to ownership, directors, technology infrastructure, custody arrangements or corporate purpose must be notified to the BCB in advance or within prescribed deadlines. Annual audited financial statements must be filed. VASPs engaging in foreign-exchange-related operations face additional reporting requirements. Incident-reporting obligations require the platform to notify the BCB promptly of cybersecurity events, data breaches or significant operational disruptions. Custody and asset-segregation rules mandate that client virtual assets be held separately from proprietary assets at all times, with documented reconciliation procedures.

Risks, Common Rejections and Remediation

BCB reviews are thorough, and applications are frequently returned or objected to on specific grounds. The most common reasons for rejection or delay include:

• Incomplete AML/PLD programme: Ensure the programme addresses all Law 14,478 and BCB PLD/FT requirements, including COAF reporting procedures. Remediation: engage a specialist PLD consultant before filing.
• Weak or undocumented custody controls: The BCB expects detailed wallet architecture, key-management protocols and segregation evidence. Remediation: commission a third-party custody audit.
• Unclear ownership structure: Failure to disclose ultimate beneficial owners or provide authenticated foreign-shareholder documents. Remediation: prepare a complete ownership chart with apostilled supporting documents.
• Missing or outdated audited accounts: Financial statements must be current and signed by a CVM-registered auditor. Remediation: engage auditors early in the process.
• Absent or inadequate technical certifications: Independent attestation is a gating requirement. Remediation: identify and engage a qualified certifier during the readiness phase.

Next Steps and Resources

The window for securing VASP authorisation in Brazil before the critical 30 October 2026 counterparty deadline is narrowing. Platforms should take immediate action:

• Conduct a pre-filing readiness gap analysis: Map your current governance, AML programme, custody model and technical infrastructure against IN BCB No. 704 requirements.
• Assemble core documentation: Prioritise audited financial statements, a compliant PLD programme, and beneficial-ownership disclosure.
• Engage an independent technical certifier: Identify a qualified firm to attest your cybersecurity and operational-resilience controls before filing.
• Begin corporate formation: If you are a foreign platform, initiate Brazilian entity incorporation and appoint a local legal representative.

Obtaining VASP authorisation in Brazil requires careful planning, rigorous documentation and expert guidance on the BCB’s evolving normative framework. Platforms that begin early and file complete, well-structured applications will be best positioned to operate in Latin America’s largest digital-asset market.

Sources

• Lei nº 14.478, de 21 de dezembro de 2022 Câmara dos Deputados
• Instrução Normativa BCB nº 704, 29 January 2026 Banco Central do Brasil
• Resolução BCB nº 520, 10 November 2025 Banco Central do Brasil
• Instrução Normativa BCB nº 693, 2 February 2026 Banco Central do Brasil
• Instrução Normativa BCB nº 739, 29 May 2026 Banco Central do Brasil
• CADOC 5710 Leiaute de Documentos Banco Central do Brasil
• Diário Oficial da União 11 November 2025, p. 110