The main regulators for blockchain and crypto-assets in Brazil are the BCB and the CVM. The BCB is the central regulator of virtual asset service providers and certain transactions involving foreign exchange and international capital. Its approach has become increasingly prudential and operational, focusing on governance, internal controls, asset segregation, risk management, anti-money laundering, custody and business continuity.

The CVM acts when the crypto-asset, token or tokenisation structure qualifies as a security or involves a public offering, intermediation, management, advisory or distribution in the capital markets. CVM Guidance Opinion No 40 consolidated the authority’s understanding of crypto-assets that may be considered securities. In these cases, the CVM may supervise and sanction irregular offerings, intermediation and other activities.

Brazilian regulators have sought alignment with international standards, although the domestic model has been built gradually. The Central Bank has incorporated central themes from the FATF agenda, such as VASP authorisation, anti-money laundering, governance, internal controls, traceability of transactions and treatment of self-custodied wallets.

There is also alignment with BIS discussions on the integration of virtual assets with payments, foreign exchange, settlement and prudential supervision. In the capital markets, the CVM follows an approach compatible with IOSCO principles, applying the securities regime where crypto-assets or tokenisation structures have features of collective investment, public offering or regulated intermediation.

Classification and Regulatory Regime for Crypto-Assets and VASPs

Brazilian regulators classify crypto-assets mainly according to their economic function and the rights attributed to the holder. Within the CVM, Guidance Opinion No 40/2022 distinguishes three main categories: payment tokens, utility tokens and asset-referenced tokens. The CVM itself recognises that the same token may fall into more than one category, depending on its characteristics, purpose and associated rights.

Where a crypto-asset has the nature of a security or collective investment contract, capital markets rules apply. In these cases, requirements relating to offering, distribution, intermediation, custody, transparency, risk disclosure and CVM supervision may apply.

Regulated activities involving crypto-assets are mainly concentrated on the provision of virtual asset services on behalf of third parties. Central Bank regulation classifies VASPs into three categories: virtual asset intermediaries, virtual asset custodians and virtual asset brokers. Brokers are authorised to carry out both intermediation and custody activities.

Virtual asset intermediation includes, among other activities, the purchase, sale and exchange of virtual assets on behalf of third parties, subscription of issuances, portfolio management, acting as fiduciary agent, staking transactions and virtual asset services in the foreign exchange market. Under certain conditions, intermediaries may also act as electronic money issuers, liquidity providers, market makers and providers of financial services in distributed ledger systems or similar systems.

Virtual asset custody involves the safekeeping and control of the instruments that allow the exercise of rights over the assets, such as private keys. It also includes maintaining position records, reconciliation with on-chain information, compliance with movement instructions, processing of events affecting the assets and administration of relevant data relating to the holder.

Direct, bilateral and occasional trading of crypto-assets between private parties, carried out in their own name and without organised intermediation, is not expressly prohibited in Brazil. The sensitive regulatory point arises when a P2P model is operated professionally or commercially, with a platform, order matching, escrow, custody, settlement, fee charging or any facilitation of transactions on behalf of third parties, in which case the activity may fall within the VASP perimeter and require Central Bank authorisation.

Even outside this perimeter, transactions carried out without an exchange may trigger reporting obligations to the Brazilian Federal Revenue Service, especially when the monthly volume exceeds the applicable thresholds.

Crypto-as-a-service models are also gaining relevance in the Brazilian regulatory agenda. These models are particularly sensitive when regulated institutions, fintechs or non-crypto platforms begin to offer exposure, trading, custody, staking, payments or other services involving virtual assets through third-party technological or operational infrastructure. The main regulatory concern is to prevent outsourcing of the technology layer from operating as an improper delegation of a regulated activity or as a “lending” of a licence.

For this reason, crypto-as-a-service structures tend to require clear allocation of responsibilities between the licensed entity and the infrastructure provider. Controls over KYC/KYT, AML/CFT, custody, asset segregation, risk management, cybersecurity, operational continuity, transparency to users and supervision of relevant service providers also become relevant.

In relation to stablecoins, Bill No 4,308/2024 is also under discussion and seeks to regulate the issuance of virtual assets referenced to fiat currency by entities located in Brazil. The bill proposes rules on full backing, segregation and auditability of reserves, transparency duties, protection of users in issuer insolvency scenarios and the regulatory competence of the Central Bank, without prejudice to the CVM’s role where the asset has the nature of a security.

The use of an investment structure, such as a fund, does not in itself change the regulatory nature of the underlying asset or activity. The main difference is that investors obtain exposure through a regulated vehicle, which brings the analysis within the CVM framework for investment funds, including fiduciary duties, disclosure, suitability, governance and oversight of service providers.

Regulated firms and investment funds with exposure to crypto-assets must assess the regulatory consequences on a case-by-case basis, considering the form of exposure, the legal nature of the asset, the investment strategy and the target audience.

In the case of funds, the CVM allows exposure to crypto-assets within the regulation applicable to investment funds, including under CVM Resolution No 175, provided that the regulations, investment policy and disclosure documents adequately address the risks involved, pricing criteria, service providers, custody, liquidity, suitability and the fiduciary duties of the administrator and manager.

Regulated vehicles, such as crypto-asset ETFs, may even have significant or predominant exposure to digital assets, provided they are structured in accordance with CVM rules and with safeguards compatible with the nature of those assets.

Token Issuance and Disclosure Requirements

In Brazil, there is still no broad ICO or TGE market comparable to that seen in other jurisdictions. The viability of an issuance depends primarily on the economic nature of the token, the rights attributed to its holders and the way in which the offer is structured and distributed to the public.

The CVM has clarified, in its statements on ICOs and in CVM/SIN Circular Letter No 1/2018, that offers of tokens that qualify as securities or collective investment contracts are subject to the capital markets regime. In these cases, rules on registration or exemption from registration, distribution, risk disclosure, supervision and liability before the authority may apply.

White papers do not replace prospectuses, offering documents or other regulatory information required by the CVM, although they may be used as complementary informational material. The logic of the Brazilian capital markets is guided by the principle of full and fair disclosure, so that offering documentation must allow the investor to understand, clearly and sufficiently, the risks, rights, economic structure and use of proceeds involved.

For smaller offerings involving tokens with the nature of securities, CVM Resolution No 88, on investment crowdfunding, may be a relevant regulatory route. In that case, the offering must be conducted through an authorised electronic platform and comply with the applicable limits, information requirements and other conditions.

Within the VASP framework, technical and descriptive documentation for the project also assumes regulatory relevance for the selection and listing of virtual assets. Under the Annex to BCB Resolution No 520, this documentation forms part of the due diligence criteria and must describe, among other elements, the proposal, objectives, concepts, governance, architecture and underlying technology of the project.

In practice, the white paper may perform a relevant function in this process, provided that it contains sufficient technical and economic information to support the VASP’s analysis, without thereby becoming a regulatory document equivalent to a prospectus or offering document required by the CVM.

Market Abuse and Insider Dealing

Brazil has a consolidated framework for preventing and enforcing market abuse and insider dealing rules within the securities market. This regime, provided mainly under Law No 6,385/1976 and CVM regulation, prohibits practices such as price manipulation, the creation of artificial conditions of demand, supply or price, fraudulent transactions, unfair practices and trading based on material information not yet disclosed to the market.

In the crypto-asset market, the application of these rules depends on the legal nature of the token and the transaction. Where the crypto-asset is classified as a security, or where the structure involves a public offering, collective investment contract, intermediation, distribution or trading subject to CVM jurisdiction, the traditional capital markets rules on market abuse apply.

The main difference is that Brazil does not yet have an autonomous and general market abuse regime applicable indiscriminately to all crypto-assets. For assets that do not have the nature of securities, abusive conduct tends to be addressed through a combination of rules applicable to VASPs, consumer protection rules, civil liability, anti-fraud rules, AML/CFT and criminal offences.

As the Central Bank regime for VASPs is consolidated, issues such as operational transparency, transaction monitoring, prevention of conflicts of interest and market integrity are expected to gain greater regulatory relevance.

In Brazil, enforcement activity involving crypto-assets has been more intense where the transaction enters the CVM’s perimeter of competence, especially in cases of irregular offerings of securities, collective investment contracts, fraud, unauthorised intermediation or inadequate disclosure of information to the market.

The main consequences include stop orders, market alerts, administrative enforcement proceedings, the imposition of significant fines and communication to other competent authorities, including for criminal investigation or the assessment of offences in other spheres.

In cross-border transactions, Brazilian regulators tend to consider the offer, distribution or solicitation of investors resident in Brazil as a sufficient connecting factor to justify local action, even if the offeror, platform or part of the technological infrastructure is located abroad.

This approach is relevant where there is advertising directed at the Brazilian public, content made available in Portuguese, acceptance of local investors or the use of payment and relationship channels aimed at the domestic market.

The trend is for continuity of the approach already adopted: controlled openness to innovation, combined with greater requirements for regulatory compliance, governance, internal controls, AML/CFT, transparency and risk prevention.

Within the BCB’s sphere, as the regime applicable to VASPs is consolidated, supervision is likely to become more operational and preventive, especially in relation to licensing, custody, asset segregation, transaction reporting and conduct towards users.

A licensing requirement arises when a company intends to provide virtual asset services in Brazil, especially intermediation, custody or brokerage activities. The Central Bank regime does not regulate the mere use of blockchain, but rather the professional provision of services involving virtual assets, whether by companies specifically incorporated as VASPs or by other institutions already authorised to operate by the Central Bank.

From a territorial perspective, the operation of a VASP in Brazil presupposes incorporation in the country, with its registered office and management located in Brazil and subject to Brazilian law and authorities.

Accordingly, foreign entities intending to provide virtual asset services to the Brazilian market may be required to establish a local presence and obtain Central Bank authorisation. Factors such as solicitation of clients resident in Brazil, offerings directed at the local public, or relevant management or operational control from the country may indicate a sufficient connection with Brazilian jurisdiction.

The authorisation process is governed by the Central Bank regime, in particular BCB Resolution No 519, which establishes the procedures applicable to VASPs.

As the licensing requirements are recent, the regulation provides for a transitional procedure for VASPs that were already operating on the effective date of the rule. This process occurs in two stages: first, the institution must evidence pre-existing activity and undergo analysis of controllers, holders of qualified shareholdings and minimum capital requirements; afterwards, it is subject to the assessment of the other regulatory requirements imposed by the Central Bank.

Companies falling within this transitional regime may continue the regularisation process, but they are not exempt from obtaining definitive authorisation. In the event of refusal, they must cease providing the services, notify their clients and adopt the necessary measures to return or transfer the virtual assets and financial resources under their responsibility.

To obtain authorisation as a VASP in Brazil, the applicant must initiate a process before the Central Bank and demonstrate capacity compatible with the nature, size, complexity and risks of the intended activity. The analysis includes, among other requirements:

• financial and economic capacity of the controllers;
• lawful origin of funds;
• economic and financial viability of the undertaking;
• technology infrastructure compatible with the complexity and risks of the business;
• adequate governance structure;
• good reputation of administrators, controllers and holders of qualified shareholdings;
• knowledge by management of the sector and its risks, and technical qualification of administrators;
• compliance with minimum capital and net worth requirements; and
• indication of an effective and exclusive physical headquarters, with the use of a coworking space or virtual office as headquarters being prohibited.

The Central Bank may require a business plan, technical certification or independent assessment, additional documents, interviews with controllers, holders of qualified shareholdings and administrators, as well as carry out a pre-operational inspection to verify whether the implemented structure is compatible with the authorisation requested.

In terms of local substance, management positions require residency in Brazil. In the case of limited liability companies, administrators must have a fixed term of office not exceeding four years.

The acquisition, transfer or change of control of a licensed VASP in Brazil depends on prior authorisation from the Central Bank. BCB Resolution No 519 submits these transactions to regulatory analysis, considering that the identity, financial capacity, reputation and structure of the controllers are relevant elements for maintaining the authorisation.

The rule also defines who may exercise direct control over a VASP. Such control may be held by natural persons, institutions authorised by the Central Bank, financial or similar institutions based abroad, or Brazilian legal entities whose exclusive corporate purpose is to hold equity interests in institutions authorised by the Central Bank. Investment funds may not act as controllers or form part of the control group of a VASP.

The Central Bank may require a shareholders’ or quotaholders’ agreement to clarify the control structure, request additional documents and information, access public or private information and summon controllers for interview. If irregularities are identified, the authority may require the transaction to be regularised, including by unwinding the acquisition or disposal of the equity interest.

International Reach of Brazilian Authorisation

An authorisation granted in Brazil enables the institution to operate only within the national regulatory perimeter and does not operate as a passport to other jurisdictions. Accordingly, a Brazilian VASP intending to provide services abroad must assess, on a case-by-case basis, the local rules applicable to VASPs, payment services, foreign exchange, custody, intermediation, securities, AML/CFT and consumer protection.

Even so, Brazilian authorisation may facilitate access to other markets from a practical and reputational perspective. This is because it demonstrates that the institution has undergone regulatory analysis covering governance, financial capacity, lawful origin of funds, internal controls, administrators, technological structure and prudential requirements.

To benefit from this, it will normally be necessary to conduct a separate regulatory process in the destination jurisdiction. This process may involve submitting corporate documents, compliance policies, information on ultimate beneficial owners, operational structure, AML/CFT controls and, where applicable, evidence of authorisation and supervision in Brazil.

In Brazil, the cross-border sale of blockchain and crypto-asset services is not analysed solely on the basis of the place of incorporation or licensing of the foreign entity. The central point is whether there is a material connection with the Brazilian market and whether the activity, by its economic content, enters the local regulatory perimeter.

The offering, making available, intermediation, contracting or performance of products and services directed at clients resident or domiciled in Brazil may attract the application of Brazilian regulation. This is especially relevant when the activity falls within the Central Bank regime, as the provision of virtual asset services, or within the CVM regime, where it involves securities, derivatives, collective investment contracts or tokenised structures subject to capital markets rules.

The absence of physical presence in Brazil does not, in itself, eliminate regulatory risk. Elements such as onboarding of Brazilian clients, commercial channels directed at the country, a website in Portuguese, local advertising, financial flows originating in Brazil or operational infrastructure aimed at the Brazilian market may indicate an active offering to the local public.

Brazilian law does not provide for a general and systematic safe harbour for reverse solicitation. Reverse solicitation may be invoked only as a narrow interpretative argument, depending on evidence that the Brazilian client approached the foreign entity spontaneously and independently. This argument tends to lose force where there is targeted advertising, organised solicitation, active offering or structured availability of products to the Brazilian market.

Even in reverse solicitation scenarios, the analysis does not automatically exclude other regulatory consequences if the contractual, operational or financial structure reveals material involvement in the Brazilian market. As to advertising, Brazil does not have a specific code equivalent to the UK model for crypto-asset advertising. Even so, general rules on transparency, consumer protection and prevention of misleading offers apply, in addition to CVM or Central Bank rules on disclosure, offering, intermediation, conduct, risks and suitability of the product to the target audience, where applicable.

White Label Structures and Use of Regulatory Licences

In Brazil, a foreign or unlicensed company may, in principle, structure a white label operation with a duly authorised local entity, provided that the regulated activity is effectively performed by the licensed institution. The licence cannot be treated as a mere formal cover for an unauthorised third party to carry out, in practice, regulated VASP activities.

BCB Resolution No 520 allows VASPs to contract relevant services, including custody, technology, liquidity and other services necessary for their activities. Such contracting, however, must occur under the responsibility of the authorised institution, which remains responsible before clients, users, other market participants and the regulator. The contracted provider must act on behalf of and under the guidelines of the contracting VASP, and not as an independent entity offering regulated services in Brazil without its own authorisation.

The viability of the structure depends on concrete segregation of functions, responsibilities and risks. The licensed entity must maintain effective control over onboarding, KYC/KYT, AML/CFT, custody, asset segregation, compliance, regulatory obligations, risk management and its relationship with the regulator, where applicable. The white label partner may act in technological, commercial or operational layers, but should not assume functions reserved to the authorised institution without its own licence.

If the structure involves securities, derivatives or tokenisation subject to the CVM, the capital markets regime must also be observed.

This logic is also relevant to crypto-as-a-service models, in which a regulated institution, fintech, digital platform or non-crypto company begins to offer virtual asset functionalities to its own clients through the infrastructure of a VASP or another specialised provider.

These models may be viable, but require clear contractual and operational allocation of responsibilities, so that the authorised entity retains control of the regulated activities and the commercial partner does not, in practice, act as a virtual asset service provider without its own licence.

DeFi and Areas of Regulatory Uncertainty

In Brazil, DeFi is not prohibited, but remains in an area of regulatory uncertainty, without a specific and complete regime. The new Central Bank framework was designed mainly for centralised CeFi structures, in which there is an identifiable entity that intermediates, custodies, executes or enables virtual asset services.

Permissionless, open-source DeFi protocols with self-custody and on-chain governance remain in an area of lower regulatory definition. The main difficulty is identifying who the regulated person would be when there is no traditional intermediary or central entity responsible for performing the service. The Brazilian regulatory debate itself recognises this gap, especially regarding the need for clearer treatment of financial transactions carried out in decentralised environments.

CeFi, VASPs and other regulated entities may, in principle, interact with DeFi protocols to structure or offer products and services in Brazil. Such use, however, requires regulatory caution, particularly where the centralised entity maintains the client relationship, selects the protocol, controls the interface, intermediates access, administers financial flows or participates in the economic execution of the transaction.

The main concerns involve custody or self-custody, asset segregation, transaction traceability, AML/CFT, smart contract audits, on-chain governance, counterparty risk, liquidity, cybersecurity and identification of the layers effectively controlled by the centralised entity.

Brazil still does not have a specific corporate form or dedicated regime for the incorporation and operation of DeFi structures. In practice, where there is some centralised layer in the country, such as software development, an access interface, treasury, governance, commercial activities, service provision or user relationship, projects tend to be organised through traditional legal structures, usually limited liability companies or corporations.

DAOs are also not recognised as an autonomous corporate type in Brazil. Therefore, where they need to contract, hold treasury, interact with service providers, define responsibilities, comply with tax obligations or interact with regulators, a complementary legal structure is usually required, such as a business company, association or foundation, depending on the purpose and degree of centralisation of the project.

If the local structure carries out typical VASP activities, such as intermediation, custody, brokerage, intermediated staking or the organised provision of virtual asset services, Central Bank authorisation and compliance with substance and prudential requirements may be required. These requirements include an effective physical headquarters, qualified administrators, governance, internal controls, AML/CFT, technological infrastructure compatible with the risks of the activity and applicable minimum capital.

BCB Resolution No 520 does not create a specific regime for DeFi, but regulates the provision of virtual asset services and includes concepts relevant to this market, such as smart contracts, staking, wallets, market makers and liquidity providers. This may bring certain layers of DeFi projects closer to the regulatory perimeter where there is intermediation, identifiable control or organised provision of services to the market.

This level of requirement, although appropriate for centralised structures that effectively provide regulated services to the market, may not always be proportionate to early-stage DeFi projects, especially where there is no custody, traditional intermediation or direct control over users’ assets. For this reason, a specific and proportionate regulatory approach to DeFi could be more appropriate, distinguishing open protocols and experimental structures from models that, in practice, reproduce functions typical of regulated institutions.

The trend is that regulation will not treat every DeFi protocol as a traditional financial institution, nor adopt a binary reading between centralised and decentralised structures. The analysis tends to shift to the real architecture of the protocol and to the identification of the layers in which there is effective capacity for control, intervention or economic influence.

This includes access interfaces, on-ramps and off-ramps, sequencers, oracles, bridges, liquidity providers, governance mechanisms, multisigs, administrative keys, pause or blocking functions, and settlement flows. In this logic, the regulatory focus becomes less the formal existence of an intermediary and more the identification of who can act, change parameters, control risks or response for critical failures in each layer of the infrastructure.

In this context, possible regulatory paths include smart contract audits, greater transparency regarding on-chain governance, proportionate security and operational resilience criteria, and capital or reserve requirements calibrated according to the degree of centralisation, operational control and user exposure.

In Brazil, there is still no consolidated case law or significant enforcement action specifically focused on liability for harm caused by DeFi protocols in the strict sense. To date, regulators and courts have approached the issue indirectly, based on existing legal categories, such as irregular offering of securities, fraud, civil liability, consumer protection, money laundering, attachment of crypto-assets and unauthorised provision of regulated services.

The CVM already treats crypto-assets and DeFi as relevant topics for study, monitoring and supervision, but its enforcement activity has focused on structures with identifiable issuers, offerors, managers or intermediaries, especially where there is potential classification as a security or collective investment contract. In truly decentralised structures, the main difficulty remains identifying responsible persons, points of control and legal duties attributable to developers, interface operators, governance participants, liquidity providers or other relevant agents.

In practice, liability tends to depend less on the formal classification of the protocol as “DeFi” and more on the concrete analysis of who exercised control, promoted the offering, managed risks, maintained the relationship with users or economically benefited from the structure. For this reason, eventual disputes involving harm in DeFi are likely to be examined through a combination of general rules on civil liability, consumer protection, capital markets, anti-fraud rules and, where applicable, VASP regulation.

In Brazil, crypto-assets may be used in certain payment structures, although they do not have legal tender status and are not equivalent to the national currency. Their use is possible in private arrangements, provided that the rules applicable to the nature of the transaction, the economic function performed by the asset and the agents involved in the transactional chain are observed.

In practice, many crypto-asset payment models are structured through integration with traditional payment arrangements, including cards linked to schemes, issuers, acquirers and other participants in the acceptance and settlement chain. In these cases, the crypto-asset or stablecoin usually functions as the economic source of the funds or conversion asset, while the merchant normally receives fiat currency through the conventional rails of the payment system.

The regulatory analysis must start from the structure actually adopted, and not from the generic notion of “payment in crypto”. In the specific case of crypto cards, BCB Resolution No 521 recognises the transfer of virtual assets for the fulfilment of obligations arising from the international use of a card or other electronic means of payment, bringing these transactions into the foreign exchange market where cross-border elements are present.

Where there is custody, conversion, transfer, intermediation, settlement, cross-border payment or participation of VASPs, Central Bank rules may apply, together with AML/CFT, traceability, transparency, operational governance and user protection obligations. Payments with crypto-assets are therefore not prohibited, but their regulatory structuring depends on the function performed by the asset, the participants involved and the rails used for settlement.

In Brazil, tokenised assets and real-world assets (RWAs) are not regulated solely because of the technology used, but mainly according to the economic and legal nature of the underlying asset. Tokenisation, by itself, does not change the legal regime applicable to the represented asset.

Accordingly, if the token represents or confers rights over a security, credit, receivable, real estate, commodity or other regulated asset, the rules corresponding to the traditional asset continue to apply. This may include rules on issuance, offering, distribution, custody, registration, bookkeeping, transparency, suitability and investor protection.

The main difference lies in the operational and technological layer. When the asset is represented, transferred or traded through blockchain, additional issues become relevant, including token governance, control of ownership, interoperability between on-chain and off-chain records, custody of private keys, traceability, prevention of fraud, secondary liquidity and responsibility of the agents involved in the structure.

Where tokens have the nature of securities or collective investment contracts, the CVM tends to apply the capital markets regime. Where the activity involves intermediation, custody, trading or transfer of virtual assets by VASPs, the Central Bank regime may also apply.

Brazil therefore adopts a functional approach: tokenised RWAs tend to be treated, to a large extent, as their traditional equivalents, but with additional requirements arising from the digital infrastructure used. Tokenisation projects must therefore reconcile the legal regime of the underlying asset with the rules applicable to offering, trading, custody and provision of virtual asset services.