Brazil has introduced new rules for companies providing services related to virtual assets. With BCB Resolutions No. 519, 520 and 521, published in November 2025 and effective since February 2026, the Central Bank began establishing specific rules for Virtual Asset Service Providers (PSAVs).
This means that companies providing services such as custody, intermediation and brokerage of virtual assets need to comply with the new rules.
However, obtaining authorization from the Central Bank is only one part of this process. Companies also need to understand which services they intend to offer, which rules apply to their activities, how they will ensure operational security and what infrastructure will be required.
The changes also affect companies that do not intend to become a PSAV but want to incorporate virtual assets into their products or services. In these cases, it is important to understand which activities can be carried out directly and which may depend on an authorized institution.
Who needs to comply with the regulation?
The regulation establishes rules for companies providing certain services related to virtual assets. This includes companies that, for example, provide:
custody of virtual assets;
buying and selling;
transaction intermediation;
brokerage;
other services covered by the regulation.
The impact, however, is not limited to companies seeking their own authorization. A fintech that wants to add virtual asset buying and selling to its app, a payment platform that plans to incorporate cryptocurrencies into its operations, or an exchange that wants to serve Brazilian customers also needs to assess how its activities fit within the new rules.
Therefore, the first step is to understand which activity the company intends to carry out and what structure will be required to offer it.
What are the compliance deadlines?
Companies that were already providing certain virtual asset-related services when the new rules came into effect are subject to a transition period.
For companies covered by the transitional rules of BCB Resolution No. 520, the deadline to file an authorization application with the Central Bank is October 30, 2026.
The regulation also establishes specific rules for foreign exchanges that served Brazilian customers without a formal operation in the country. For these companies, the transition period is 270 days, counted from the effective date of BCB Resolution No. 520, to bring their operations into compliance with the applicable rules.
The deadline is important because obtaining authorization may require changes to the company's structure, the creation of internal processes and the implementation of controls. Therefore, companies that have not yet started this process need to assess their alternatives in advance.
In addition, as of October 30, 2026, institutions authorized by the Central Bank will face restrictions on carrying out or facilitating certain transactions with companies that provide virtual asset services and are not authorized or in the process of obtaining authorization, in accordance with BCB Resolution No. 520.
This makes the regulatory status of financial partners an important consideration for companies working with virtual assets.
What changes for companies working with virtual assets?
The new regulation makes regulatory structure part of business decisions. Before launching or changing a product involving virtual assets, a company needs to understand:
which activities it intends to offer;
which rules apply to the operation;
whether it needs its own authorization;
which controls must be implemented;
which services can be performed by authorized partners;
what infrastructure will be required to maintain the operation.
This assessment is important because regulatory requirements can directly influence how the product is developed and how financial flows are organized.
For a company that works directly with virtual assets, this may mean creating its own structure to meet regulatory requirements. For a company that simply wants to add these services to an existing product, using the infrastructure of an authorized institution may make more sense.
What does a company need to do to comply?
Compliance starts before the authorization application. The company needs to understand how its operation works and which requirements apply to the activities it intends to carry out.
1. Define the operating model
The first step is to identify which services the company intends to offer.
Possibilities include:
custody of virtual assets;
buying and selling;
transaction intermediation;
brokerage.
Each activity may require a different structure.
For companies that do not have virtual assets as their core product, it is also important to assess whether they can carry out a given activity directly or need to work with an authorized institution.
2. Understand the regulatory requirements
After defining the activities, the company needs to identify which rules it must comply with.
This may involve requirements related to the company's structure, capital, organization and the source of funds of controlling shareholders, as well as other provisions established by the regulation.
This assessment should take place before deciding how the product will be developed. After all, regulatory requirements can directly influence the structure of the operation.
3. Establish compliance and risk management
Companies also need to establish processes to identify, monitor and control operational risks. These measures include:
customer identification and monitoring;
prevention of money laundering and terrorist financing;
transaction monitoring;
protection of customer assets;
internal controls;
operational security.
These processes are not only intended to obtain authorization. They need to be part of the company's routine and continuously support the operation.
When working with a regulated partner, it is also important to understand how that partner manages its compliance, risk management and security processes.
4. Assess financial partners
The regulation also affects the relationship between virtual asset companies and other financial institutions.
Banks, payment institutions and other regulated participants must follow specific rules when working with virtual asset service providers. Therefore, companies that depend on accounts, payments, settlement, foreign exchange, custody or liquidity need to consider the regulatory status of the partners providing these services.
Choosing the right partners can be important not only for starting an operation, but also for maintaining and expanding it.
5. Consider international operations
Companies that move funds between different countries also need to assess the rules applicable to international operations involving virtual assets.
In this case, it is not enough to understand how the assets will be bought, sold or stored. It is also necessary to analyze the payment, foreign exchange, currency conversion and fund transfer flows involved in the operation.
This is particularly relevant for companies that combine virtual assets with international payments and foreign exchange operations.
Own authorization or regulated partner?
After understanding the activities and applicable requirements, the company needs to decide how to structure its operation: seek its own authorization or use the infrastructure of an already authorized institution.
The choice depends on the business model and the structure the company already has.
Some questions can help with this decision:
Are virtual assets the company's core product or just one part of it?
Does the company need to start operating quickly, or can it wait for the authorization process?
Is there a team prepared to handle compliance, risk management and security?
Does the expected transaction volume justify maintaining an in-house structure?
Does the operation require custody, liquidity, payments or foreign exchange?
Building an in-house structure can provide greater control over the operation, but it also requires investment, internal processes and the ability to continuously meet regulatory requirements.
Working with an authorized institution, on the other hand, may allow a company to incorporate certain services without having to develop the entire structure internally.
In this case, however, it is not enough to verify that the partner is authorized. It is also important to understand which services are covered by that authorization and which responsibilities remain under the company's own management.
What does this mean?
PSAV regulation means that regulatory considerations need to be taken into account from the beginning of the development of a product or operation involving virtual assets.
Imagine, for example, a fintech that wants to offer virtual asset buying and selling through its app. Instead of building its own custody, liquidity, compliance and technology infrastructure, the company can consider integrating with an authorized institution that provides these services.
In this model, the fintech remains responsible for the activities under its management, while the partner provides the infrastructure components that fall within its regulatory and operational scope.
The decision to build an in-house structure or work with a partner therefore depends on the activities involved, the business model, the launch timeline and the structure the company already has.
For companies that do not intend to obtain their own authorization, working with an authorized institution can be an alternative for incorporating virtual asset services without having to build the entire structure internally.
Transfero operates as a PSAV and provides infrastructure through Crypto as a Service, allowing companies to incorporate virtual asset-related services into their own products and operations.
The solution brings together the infrastructure resources required for virtual asset operations, allowing companies to consider a simpler model for incorporating these services into their business. Talk to our sales team to learn how Transfero's regulated infrastructure can support your company's operations.
