An exchange processing BRL 50 million a month has a board meeting next week. The question on the table is whether to keep building its own authorization as a PSAV, the Brazilian term for VASP, or to run on someone else’s infrastructure. The application budget is approved; nobody has priced what comes after it.
The PSAV compliance cost goes far beyond the application: minimum capital, team and governance, anti-money laundering controls, cybersecurity, certification, reporting to the Central Bank and asset segregation are ongoing expenses. That is why many companies compare their own authorization with operating on the infrastructure of a provider that already carries this structure.
Which costs does a PSAV carry?
The framework comes from Law No. 14,478, of December 21, 2022, and from BCB Resolutions No. 519, 520 and 521, of November 10, 2025, in force since February 2, 2026. Resolution 520 sets how providers are incorporated and operate.
Six cost lines follow from those rules. Each one has a setup cost and a cost that keeps running.
Minimum capital
Capital follows Joint Resolution No. 14, of November 3, 2025, and rises in stages through December 31, 2027. It is not an expense in the accounting sense, but it is money the company must keep committed to the PSAV instead of using it elsewhere.
Team and governance
A PSAV needs its own management, a compliance officer, risk management and internal controls. These are permanent roles, not a project team that leaves after the application.
AML/CFT and KYC
Anti-money laundering and counter-terrorist financing controls require onboarding checks, transaction monitoring, sanctions screening and the tools that run them. Costs grow with the number of clients and transactions.
Cybersecurity
Systems, data and, for custodians, private keys need protection, testing and incident response. Security is an operating line that has to keep pace with the threats, not a one-time purchase.
Audits and reporting
Independent reviews, certifications and regular reporting to the Central Bank of Brazil (BCB) add specialist hours and systems that produce reliable data. Every report depends on clean data, so reporting cost is also a data quality cost.
Asset segregation
Client assets must be kept separate from the provider’s own assets. That requires account structures, reconciliation and controls that run every day.
Which costs are one-off and which are recurring?
Some lines are paid once, when the structure is built. Most keep running for as long as the company holds the authorization.
Cost line | One-off | Recurring
|
|---|---|---|
Incorporation and application | Legal work, documentation, business plan | — |
Minimum capital | Initial contribution | Increases in stages through December 31, 2027 |
Team and governance | Hiring and policies | Salaries, training, board time |
AML/CFT and KYC | Tool selection and integration | Licenses, monitoring, case review |
Cybersecurity | Architecture and setup | Testing, monitoring, incident response |
Audits and reporting | Data and reporting setup | Periodic reviews and reports to the BCB |
Asset segregation | Account structure | Daily reconciliation and controls |
Weighing your own authorization against using licensed infrastructure? Talk to our team.
How do you compare with operating through a partner?
Take the exchange with BRL 50 million a month. The table lists the cost lines on each path, without values, because they depend on the company’s size, modality and contracts.
Cost line | Own authorization | Licensed infrastructure
|
|---|---|---|
Minimum capital | Carried by the exchange | Carried by the provider |
Compliance team | Built and paid by the exchange | Smaller team to manage the relationship |
AML/CFT and KYC tools | Contracted and run by the exchange | Built into the provider’s flow |
Cybersecurity and custody | Run by the exchange | Run by the provider |
Audits and reporting | Prepared by the exchange | Prepared by the provider for its own activity |
Asset segregation | Operated by the exchange | Operated by the provider |
Provider fees | — | Defined in the contract |
The partner path does not remove costs; it changes their shape. Fixed structure becomes a contracted service, and part of the control moves into the contract.
Switching costs belong in the comparison too. Moving users from a provider to an own structure later, or the other way around, requires migration of balances, data and onboarding records. Writing those steps into the contract from day one keeps both paths open.
Transfero’s analysis of custody, liquidity and compliance in CaaS infrastructure shows how those functions sit inside a provider.
When does your own authorization pay off?
When crypto is the core of the business and the volume can carry the fixed structure. The more the company depends on virtual asset services, the more control over product, pricing and roadmap is worth.
Time horizon also matters. The fixed costs pay off over years, not months, and the capital requirement keeps rising in stages through 2027.
A partner tends to fit when crypto is one service among others, when the company needs to launch before an application could be prepared and reviewed, or when it wants a bridge while its own structure is built. Transfero’s overview of VASP regulation in Brazil covers the rules behind each path.
Some companies combine the two. They file for their own authorization and serve clients through a licensed provider while the structure is built and the application is reviewed. The legal design of that combination deserves review with counsel.
Two dates weigh on the decision. The filing window for providers already operating closes on October 30, 2026, under article 88 of Resolution 520. And from November 6, 2026, under BCB Resolution No. 589, of September 23, 2026, banks and payment institutions may only work with authorized providers.
How does Transfero’s licensed infrastructure fit this decision?
Transfero’s Crypto as a Service (CaaS) gives exchanges, fintechs, neobanks and wallets ramps, swaps, payments and custody through an API, as licensed infrastructure within a regulated framework with built-in KYC and AML.
BRL on-ramps and off-ramps through Pix, via Transfero’s crypto infrastructure
Custody powered by Fireblocks
Swaps and payments in the same integration
KYC and AML built into the flow
The platform processed more than 9.8 million transactions in 2025.
Questions to ask before choosing a path
How central are virtual asset services to your revenue over the next three years?
Can your balance sheet carry the capital stages of Joint Resolution 14 through 2027?
Do you already have compliance, AML and cybersecurity teams you can extend?
How fast do you need to launch, and can the timeline wait for a BCB decision?
Which controls would you keep in-house, and which would move to a provider’s contract?
How will your banking partners treat you from November 6, 2026?
Offer crypto services in Brazil on Transfero’s licensed infrastructure. Talk to us.
Frequently asked questions
What is the minimum capital required?
Minimum capital follows Joint Resolution No. 14, of November 3, 2025. The amount depends on the provider’s category and activities and rises in stages through December 31, 2027. Model the capital plan against each stage before deciding, because the requirement grows over time.
Does a PSAV need an external audit?
Authorized providers are subject to independent reviews and reporting obligations set by the BCB. The exact scope depends on the category and the activities, so confirm the requirements with legal counsel when building the budget. Plan for audits as a recurring line, not a one-time cost.
How many people does a compliance structure need?
It depends on the category, the number of clients and the volume of transactions. A structure usually includes a compliance officer, AML and KYC analysts, risk and internal controls, and security. Size it against your projected volume, not only against the launch.
Is the partner’s cost fixed or volume-based?
Each provider sets its own model in the contract. Some combine fixed fees and volume-based fees, others charge per transaction. Compare the total cost at your expected volume and growth, not only the entry price.
