In the last year, the Brazilian fintech market has seen a 30% increase in capital invested compared to the previous year. The area in which most of these investments were made was digital payments, followed by blockchain technology and artificial intelligence. These investments reflect the constant growth experienced by the fintech market in Brazil and the choice of these segments for investment is a consequence of the trends being perceived in the fintech market.

In this sense, according to a piece of research undertaken by PwC and the innovation platform Distrito, the areas related to Open Finance, Pix, blockchain technology and artificial intelligence are expected to continue to be relevant trends for fintechs this year. For this reason, it is expected that the Central Bank of Brazil (BCB) will continue with a movement of upscaling regulation for fintechs, their products and technologies, as has been seen in recent years.

In Brazil there are two business models that predominate as regulated credit fintechs, namely direct credit companies (SCD) and peer-to-peer (P2P) lending companies (SEP). In addition, the Brazilian fintech market has several verticals developed with digital services including payment services, foreign exchange, banking as a service, digital banking, financial management, insurance, debt negotiation and multi-services.

Fintechs are regulated by the BCB, the National Monetary Council (CMN), and the Brazilian Securities and Exchange Commission (CVM), depending on their business model and target market. The main models will be described below, as well as their basic regulation. 

Financial Institutions

According to Law No 4.595/1964, these are legal entities whose main or ancillary activity involves the collection, intermediation, or application of their own or third-party financial resources, in national or foreign currency, and the custody of third-party property. They are supervised by the BCB which, together with the CMN, is responsible for regulating banks and financial institutions.

Payment Institutions (IP)

IPs facilitate the purchase and sale of goods and services, as well as the movement of funds within a payment scheme, without the ability to grant loans and financing. IPs are regulated mainly by the BCB Resolution No 80/2021 and, in some cases, may need to request authorisation to operate. 

Credit Fintechs

Credit fintechs are financial institutions of limited scope allowed to operate in the credit sector with less stringent requirements compared to traditional institutions. They are provided by the BCB and can register either as SCD or SEP, according to Resolution CMN No 5,050/2022. The primary difference between them is that SCDs operate with resources originating from their own capital, while SEPs intermediate P2P lending between credit takers and investors.

Fintechs Operating in the Securities Market

These entities have a scope related to the trading of securities and related activities. They are regulated by the CVM, which also oversees capital markets, investment funds, and equity crowdfunding. 

In addition, companies may be subject to specific regulations for certain service scopes, such as the insurance sector, which is supervised by the Private Insurance Superintendence (SUSEP).

Financial and payment institutions may establish any compensation model to charge their clients as long as they comply with the requirements established by regulations regarding the fees that can be charged.

In this sense, for financial institutions, since 2010, the Brazilian financial system has included the right to a free account, which means that banks are required to offer a basic checking or savings account with a minimum package of free services, such as card issuance, statement inquiries, and a quota of transfers per month. Services that exceed the minimum free quotas and other services may be charged.

According to the BCB regulation, financial institutions must present the options of banking services linked to a checking account and their respective costs, including essential services.

The regulation of traditional institutions and fintechs differs primarily because fintechs are subject to lighter regulation. Traditional institutions must meet stricter requirements that depend on various factors, such as categorisation within the National Financial System, type of authorisation from the BCB, and capital, in order to minimise risks.

On the other hand, fintechs and payment institutions must comply with the requirements established by the BCB, such as the economic and financial capacity of the controllers, lawful origin of the resources used, sustainability of the business model, compatibility of the governance structure with the complexity and risks of the business, and minimum capital and equity requirements. Traditional institutions are subject to more rules due to their high transaction volume and activity, while fintechs face fewer requirements due to their lower risk profile.

The BCB is working to introduce norms taking into account the prudential conglomerates that fintechs may be part of, based on size and complexity. Therefore, fintechs with more complex business models could be subject to stricter regulation, considering the inherent risks of their activities.

Brazil has had some regulatory sandbox projects, conducted by different regulators, that allowed innovative projects to start. Regarding financial and payment services, the BCB is promoting the first round of its regulatory sandbox since 2021, in which various entities such as companies, associations, notaries, mixed-economy companies, and public companies are participating.

The BCB’s objective is to promote an environment in which entities are authorised to test innovative projects in the financial or payment areas for a specified period. Entities wishing to submit projects to the sandbox initiative must comply with the rules set by the BCB, which include, for example, anti-money laundering and combating the financing of terrorism (AML/CFT) regulations.

In addition to the BCB’s sandbox, there are initiatives from other regulatory agencies such as SUSEP and CVM, that follow the same principles as those mentioned in relation to the BCB.

The Brazilian financial system operates under rules established by the CMN, the BCB, and the CVM.

The main entities responsible for defining and implementing the operating rules of the financial system are the primary reference in the organisational structure of the Brazilian financial system. In this regard, with respect to the monetary, credit, capital, and foreign exchange markets, the CMN is responsible for formulating Brazilian economic policy. The BCB, in turn, is a self-governing body responsible for implementing the strategies established by the CMN, ensuring a solid, efficient, and competitive financial system, as well as promoting the economic well-being of society. In addition to these, there is the CVM, a self-governing body that regulates, develops, monitors and supervises the securities market.

Furthermore, there is the SUSEP, a self-governing body responsible for the insurance, open private pension, and reinsurance market. Finally, there is the Superintendence of Complementary Pension Plans (Previc), which acts as the supervisory and oversight entity for closed complementary pension entities.

In the Brazilian financial system, it is possible for regulated functions to be subcontracted essentially through banking-as-a-service (BaaS) contracts. BaaS contracts are characterised as a financial business that allows companies from different market segments to offer financial and credit products and services by means of a financial institution, without the need to invest in complex technological platforms and without having to worry about regulatory requirements. In other words, the contractor (usually a company without regulatory licence from the BCB) offers products to its customers using the technological platform and regulatory licence of a provider regulated by the BCB. 

In this sense, it is important to note that the provider is responsible for meeting the requirements demanded by regulatory bodies, aiming to ensure the security of the operation. Therefore, the provider must provide access to the contracted service, ensuring the security and confidentiality of its clients’ financial information, in order to comply with existing regulations.

Brazilian fintechs are considered “gatekeepers” with responsibility for the activities on their platforms as they are regulated entities. This means that if the fintech is regulated, it must guarantee that all rules, such as AML/CFT, are being applied, even in cases where it does not directly deal with the end user, as illustrated in 2.13 Impact of AML and Sanctions Rules.

In Brazil, the law on administrative proceedings in financial systems (Law No 13,506/2017) provides for the sanctioning administrative process within the scope of CVM’s activities for capital markets cases, and BCB’s activities for financial markets and the payment sector, as well as for regulating the imposition of fines and penalties. The penalties under this law may range from fines, public warnings, prohibition from providing services and/or operations, disqualification to act as an administrator, among others. It is also provided that individuals and legal entities are allowed to plead guilty to obtain a reduction in their penalties. Additionally, it is worth noting the existence of BCB Resolution No 131, which consolidates, within the regulatory body of the BCB, the rules regarding the procedural aspects of the aforementioned sanctioning administrative process.

In Brazil, there are specific pieces of regulation that must be complied with by financial and payment institutions relating to privacy, cybersecurity, and social media content. Regarding privacy, Law No 13,709/2018, the Brazilian General Data Protection Law (LGPD), applies to any processing of personal data by private and public entities, using automated and non-automated means, in online and offline environments. Whenever the activities developed by fintechs involve processing of personal data, the law applies.

In parallel, there are also regulations issued by the CMN, particularly Resolution No 4,893/2021, that impose certain requirements for the treatment of the cybersecurity policy, based on different structures of companies, using factors such as risk, size, profile, nature of activities, business model of the institution, sensitivity of the data and information in question and complexity of services and products offered. Institutions regulated by the BCB can contract third parties to provide data processing, storage and cloud computing services, provided that the service providers comply with standards defined in the rule.

The activities of industry participants must be reviewed by accounting firms that are authorised to operate by the CVM, besides regulators. In addition, there are a few self-regulators that assist the main regulators to supervise regulated institutions, such as the Brazilian Financial and Capital Markets Association (ANBIMA) and the Brazilian Federation of Banks (FEBRABAN), that are responsible for representing and defending the interests of its members.       

It is possible for industry participants to offer unregulated products and services alongside regulated products and services. However, this scenario is not common, as it is typical for the regulator to have to pre-approve additional services.

In this sense, it is worth noting that some regulated entities have an extremely limited scope of activities and cannot, under any circumstances, offer products and services different from those provided for in the legislation. Therefore, industry participants separate activities into different legal entities, so that the regulated entity will be responsible for offering regulated services, while another unregulated entity will be responsible for providing unregulated services.

In Brazil, AML/CFT and sanctioning rules have a significant impact on fintech companies, both regulated and unregulated companies that operate by means of BaaS. Regulated fintech companies are required to comply with AML/CFT and sanctioning regulations set forth by the BCB and other relevant regulatory authorities. They are expected to implement robust AML/CFT compliance programmes, conduct customer due diligence, and report suspicious transactions, among other requirements. Unregulated fintech companies also face AML/CFT and sanctions obligations, as their contractors are subject to the same laws and regulations aimed at preventing money laundering and terrorist financing.

These companies may be required to report suspicious activities of their clients to the Financial Activities Control Council (COAF) and adhere to AML/CFT and sanctioning rules, even if they are not directly supervised by the BCB. Overall, AML/CFT and sanctioning rules impact fintech companies by imposing compliance obligations, reporting requirements, and the need to implement effective AML/CFT controls.

In accordance with Brazilian regulations, different asset classes do not require different business models. There is no specific legal provision for different types of robo-advisers. Thus, robo-advisers are subject to different regulations depending on the asset class and business model used, which may vary among CVM, CMN, and BCB regulations.

Legacy players are implementing solutions introduced by robo-advisers through various means, including:

• integration – legacy players can integrate robo-adviser technology into their existing platforms or systems to offer automated investment advisory services alongside traditional services;
• partnerships – legacy players can establish partnerships or collaborate with robo-adviser firms to leverage their expertise and technology while maintaining their established client base and brand reputation; and
• in-house development – some legacy players may develop their own robo-adviser solutions internally, tailored to their specific client base and investment strategies.

In this sense, it is worth noting that the most common robo-adviser solutions in Brazil are tied to the use of the mechanism to detect more precise and accurate market movements, perform statistical analysis for fund management, and portfolio balancing.

Issues related to the best execution of customer operations concerning robo-advisers encompass several important considerations, such as:

• data quality – robo-advisers heavily rely on algorithms to execute operations automatically based on predefined criteria and client preferences. Ensuring that these algorithms prioritise best execution standards, along with ensuring they process data with the expected quality, can be an issue;
• market impact – it is necessary to consider the potential market impact of operations conducted by robo-advisers. In this regard, market fragmentation could be a problem;
• conflict of interests – conflict of interest may arise between investors and institutions during asset trading; and
• regulatory compliance – robo-advisers must comply with the rules of the BCB and CVM applicable to entities offering services with securities and financial assets. However, the lack of a specific regulatory framework thereon may represent an issue.

However, it is worth noting that, currently, Brazil counts with only one major organised securities market environment, that is B3 (Brasil, Bolsa, Balcão), which makes determinations related to best execution obligations less applicable.

In terms of regulation, there are no major differences in the activity or regulation of loans to individuals, small businesses, and others. However, there are different types of financial institutions that can operate in the online credit sector with defined scopes, namely SCD and SEP.

It is worth noting that, as per CMN Resolution 5,004/2022, financial institutions must use the interest rate agreed in the contract to calculate the present value of payments for the purpose of early settlement, in whole or in part, of credit operations for natural persons, including individual entrepreneurs, as well as micro-enterprises and small businesses contracted at fixed rates.

There are rules dictated by the BCB that guide the credit risk procedures to be adopted by financial institutions. Thus, the underwriting processes vary from one financial institution to another, depending on their credit business models based on risk. Therefore, the trend is for fintechs and smaller institutions to have lighter credit approval investigations, while traditional institutions tend to conduct more exhaustive credit analyses.

In Brazil, each source of loan financing presents unique legal and regulatory challenges aimed at protecting investors, borrowers, and the overall stability of the financial system. Some particularities of each source can be observed as follows:

• peer-to-peer lending – P2P lending is regulated by the BCB and CVM. P2P platforms must comply with specific requirements, such as registration and disclosure of information to investors;
• capital raised by the lender – legal and regulatory issues are related to consumer protection and compliance with lending and credit laws, as this model involves a lender using their own capital to grant loans;
• acceptance of deposits – financial institutions that accept deposits are subject to BCB regulation, which aims to ensure the safety and soundness of the financial system, including capital, liquidity, and governance requirements;
• securitisations – loan securitisation is regulated by the CVM and BCB, with specific requirements for the structuring and disclosure of securitisation operations.

Overall, it is noted that securities-related activities are subject to CVM regulation, while other types of lending activities are regulated by the CMN and BCB. Additionally, consumer protection legislation may be applied in all cases, given that all loan scenarios are considered as service provision in general.

There is no specific legal or regulatory provision for loan syndication among financial institutions. However, it is possible to structure syndication through different arrangements.

In Brazil, payment processors are generally required to use existing payment rails that are regulated and authorised by the BCB. The BCB oversees and regulates the payment schemes in the country, in accordance with Law No 12,865/2013, and payment processors are expected to operate within the framework of the established payment infrastructure. Creating or implementing new payment rails would likely require approval and oversight from the BCB to ensure compliance with regulatory requirements and the stability of the financial system.

In this sense, a payment processor may create or implement new payment rails as long as they comply with the regulation in force in Brazil, which means that there is an obligation to obtain authorisation from the BCB to operate within the Brazilian Payments System (SPB).

In 2021, Law No 14.286/21 (foreign exchange and international capital law) was approved in order to simplify transactions involving the receipt of international payments and the making of international remittances, in such a way as to make the Brazilian foreign exchange market more modern, reduce bureaucracy and speed up transactions.

Currently cross-border payments and remittances are regulated considering new business models and innovations in technology linked to international payments and transfers. According to the applicable regulation:

• all payments made in Brazil for local services must be made in Brazilian reais, but there are certain exceptions in which an obligation can be denominated in foreign currency in contracts entered into; and
• cross-border payments and remittances are possible as long as they comply with the provisions of BCB Resolution No 277 which, among others, requires that a foreign exchange contract be signed with a Brazilian financial or payment institution authorised to operate in the foreign exchange market;
• companies receiving foreign capital or foreign credit must register it with the BCB system, under the terms of BCB Resolution No 278 and Brazilian individuals or entities with assets abroad must register it with the BCB system, under the terms of BCB Resolution No 279; and
• fintechs can carry out foreign exchange transactions as long as they comply with the legislation in force.

In addition, according to BCB Resolution No 277, there is the so-called “eFX”, a mechanism for international payment or transfer services which, by means of a foreign exchange transaction or movement in reais in a non-resident account, enables an overall simpler channel for acquisition, transfer and withdrawal of funds, subject to the quantitative limits of the legislation.

In this sense, the operational and regulatory requirements for small companies to operate in the foreign exchange market have been reduced, making it easier for fintechs to operate in international transactions.

Fund administrators are regulated by the CVM and have ANBIMA as a self-regulatory body. All fund administrators need a prior authorisation from CVM to operate and must comply with the updated codes published by ANBIMA with specific standards applicable to them.

In Brazil, fund advisers often seek to impose contractual terms on fund administrators to assure performance and accuracy. These terms typically include provisions related to obligations, responsibilities, liability limitations, and termination rights.

In addition, the specific provisions sought by fund advisers may be influenced by industry practice, but they are also subject to regulation by CVM and other relevant regulatory bodies. For example, the CVM’s regulations may dictate certain requirements for fund administrators in terms of reporting, compliance, and internal controls.

In Brazil, there are different types of marketplaces and trading platforms that are permissible, each subject to specific regulatory regimes. The main types include:

• stock exchanges – the main stock exchange in Brazil is B3, which operates the equities, derivatives, and fixed income markets. B3 is regulated by the CVM and is subject to specific rules related to trading, listing requirements, and market operations;
• over-the-counter (OTC) markets – OTC trade exists for securities that are not listed on formal exchanges. OTC markets are also regulated by the CVM, with specific rules governing trading, disclosure, and investor protection;
• electronic trading platforms – electronic trading platforms, including alternative trading systems (ATS) and electronic communication networks (ECN), are allowed in Brazil for certain types of securities. These platforms are subject to regulation by the CVM, which sets forth rules related to order matching, transparency, and fair access;
• foreign exchange market – the foreign exchange market in Brazil is regulated by the BCB, which oversees the authorisation and operation of foreign exchange trading platforms. The regulatory regime for foreign exchange market trading platforms includes rules related to capital requirements, risk management, and AML/CFT measures; and
• commodity exchanges – commodity trading platforms, including those for agricultural and financial commodities, are regulated by the CVM and may also be subject to oversight by specific commodity regulators. 

The regulatory regimes for each type of marketplace and trading platform may differ in terms of licensing requirements, operational standards, market surveillance, and investor protection measures.

Different asset classes are subject to different regulatory regimes. The regulatory framework for publicly traded asset classes such as equities, fixed income securities, derivatives, and real estate investment funds may vary based on the specific characteristics and risks associated with each asset class. For example, equities are regulated by the CVM and are subject to rules related to public offerings, trading, and disclosure requirements. Fixed income securities also fall under the oversight of the CVM, but they may be subject to specific regulations governing debt instruments and bond issuances. Derivatives, including futures and options, are regulated by both the CVM and the B3, with rules aimed at ensuring market integrity and investor protection. 

These differences in regulatory regimes reflect the unique characteristics and risks associated with each asset class, and they are designed to provide a tailored regulatory approach to address the specific needs and challenges of each market segment.

The emergence of cryptocurrency exchanges, both centralised and decentralised, has presented unique challenges for regulation in Brazil.

Nonetheless, at the end of 2022, Law 14,478/2022 was passed and brought into effect a minimum legal framework for the crypto-economy in Brazil. Among other innovations, this law created the legal definitions of virtual assets and virtual asset service providers (this latter includes among other types of business the so-called cryptocurrency exchanges).

Presidential Decree No 11,563/23 regulated Law 14,478 and attributed powers to the BCB to oversee and create ancillary regulations on the virtual asset market, including by creating conditions for virtual asset service providers to operate in Brazil.

As of now, virtual asset service providers have not been explicitly regulated by the BCB, but there have been ongoing discussions and proposals to regulate them.

In this regard, in December 2023, the BCB published Public Consultation 97/23 in order to obtain information from the general public about the virtual asset market. Public Consultation 97/23 was divided into eight themes, covering topics such as asset segregation and risk management, governance and conduct rules, cybersecurity and the provision of information and customer security. This consultation is one of the BCB’s efforts to interact with the sector as an attempt to draw up specific regulations on the subject, aimed at increasing efficiency and legal certainty in the market.

The existing standards in Brazil regarding admission to listing essentially entail requirements for financial stability, transparency, and quality of management. In addition, there may be other distinct listing requirements that are specific to certain platforms, such as minimum capital, internal controls, information obligations, and restrictions on the listing of securities with limited market liquidity. The CVM is the authority responsible for regulating listing, but the organised market environments, such as B3, can also apply and enforce their own rules.

The rules governing order handling are applicable as imposed by the CVM. According to the regulatory agency, market participants operating trading platforms, stock exchanges, and similar venues must comply with pre-trade transparency requirements, best execution practices, and post-trade reporting, in order to ensure fair, transparent, and efficient markets to protect investors from potential misconduct.

For this purpose, the CVM may monitor trading activities, conduct audits, and eventually impose sanctions against market participants who violate the rule.

The rise of P2P trading platforms in Brazil impacts both traditional and fintech players in several ways. For traditional players such as banks and financial institutions, P2P trading platforms may pose increased competition, as they provide alternative channels for individuals and businesses to access financing and investment opportunities outside of the traditional banking system. This can lead to a potential loss of market share for traditional players.

For fintech players, the impact can be twofold. On one hand, P2P trading platforms can provide fintech companies with opportunities to collaborate and integrate their services, potentially expanding their customer base and offerings. On the other hand, they may also face increased competition from these platforms, especially if they offer similar services such as peer-to-peer lending or investment opportunities.

In terms of regulatory challenges, the rise of P2P trading platforms may pose challenges for regulators in ensuring consumer protection, risk management, and compliance with existing financial regulations. Regulators may need to adapt existing frameworks or create new regulations to address issues such as investor protection, anti-money laundering measures, and the oversight of peer-to-peer lending activities. Additionally, ensuring fair competition and preventing market abuse in the context of these platforms may also be a regulatory challenge.

The requirement for best execution of client trades in Brazil is contemplated within the context of the country’s financial markets rules. Best execution refers to the obligation of institutions operating under the jurisdiction of the BCB and the CVM to execute client orders in a manner that achieves the best available conditions, taking into consideration factors such as price, execution speed, likelihood of execution, and total cost.

However, as Brazil currently counts with only one major organised securities market environment, that is B3, determinations related to best execution obligations tend to be less applicable in practice.

In Brazil, payment for order flow is not prohibited, however, the practice is subject to supervision. There are regulations from the BCB and the CVM aimed at preventing potential market manipulation and other forms of abuse that could impact the integrity of financial markets. Additionally, according to regulation, transparency and fairness of financial transactions are ensured, which may be interpreted as a limitation on financial institutions accepting payment for order flow.       

In addition, institutions operating under the jurisdiction of the BCB and the CVM must execute client orders in a manner that achieves the best available conditions, taking into consideration factors such as price, execution speed, likelihood of execution, and total cost.

In Brazil, BCB and CVM regulate and supervise the activities of financial institutions and the securities market respectively. It is well-known that both institutions are governed by basic principles of market integrity and prevention of abuses, which include various principles such as transparency, equity, integrity, prevention of conflicts of interest, and prohibition of market manipulation.

These principles aim to ensure the credibility and stability of the Brazilian financial markets, promoting a fair and transparent environment for participants. This means that the violation of these principles may result in penalties and sanctions by regulatory authorities.

There is no specific regulation issued by the regulators for the creation and usage of high-frequency and algorithmic trading. However, B3 issued some regulations about the relationship between the B3 itself and investors that intend to perform high-frequency trading (HFT), with specific tariffs.

As per CVM Resolution No 133/2022, market makers need to register with authorised entities to operate in organised markets in Brazil in order to execute operations aimed at promoting the liquidity of securities admitted to trading on markets administered by entities such as B3.

According to the regulations in force, there is no distinction between funds that engage in high-frequency and algorithmic transactions and dealers engaged in the same activities.

There are no specific regulations relating to programmers who develop and create trading algorithms.

DeFi in Brazil is not explicitly governed by specific regulations tailored to its unique characteristics. The regulatory framework for DeFi is still evolving, and there is ongoing discussion about how to address the regulatory challenges posed by decentralised financial activities. However, existing financial regulations and laws, including those related to securities, banking and anti-money laundering, may apply to certain aspects of DeFi activities.

For example, CVM has been exploring the implications of DeFi in the context of securities regulations, particularly in relation to tokenisation and digital asset offerings. Additionally, the BCB has been monitoring developments in the DeFi space and considering how existing regulations on banking and financial services may apply to decentralised financial activities, particularly those involving virtual assets (eg, cryptocurrencies).

Financial research platforms will be regulated Brazil depending on the nature of their activities and the content of the research they provide.

General research materials of purely factual nature are unlikely to trigger any licensing requirements in Brazil. Notwithstanding that, research materials that provide recommendations in relation to securities, for instance, may be considered investment advice, and would therefore be regulated under the jurisdiction of CVM.

On the other hand, if the financial research platform is somehow used to induce clients to enter into investment activity, then this could constitute a financial promotion, and could then therefore be subject to previous authorisation.

According to current legislation, there are no specific provisions to regulate the dissemination of rumours and other unverified information on financial research platforms. Therefore, the control of information must be guided by the platform’s own terms and conditions, as well as internal policies.

According to regulations in force, there is no obligation for platforms to monitor content published by third parties. However, the CVM prohibits trading securities using insider information, and administrative, civil and criminal sanctions can be imposed on anyone engaging in insider trading activities. 

Furthermore, it is noted that the platforms themselves have terms of use and conditions for their use, so that non-compliance can result in sanctions for the infringing user, even though there is no obligation for the platforms to moderate content.

In Brazil, insurtechs, like traditional insurance companies, use underwriting processes to assess and price risks associated with insurance policies. The underwriting processes used by industry participants, including insurtechs, typically involve the evaluation of various factors such as the applicant’s risk profile, the type of insurance coverage sought, and the potential for claims. In this sense, the insurer can use internal technologies or hire other platforms to assist them. 

The underwriting process is influenced by regulations set forth by SUSEP, the regulatory body overseeing the insurance industry in Brazil. SUSEP establishes guidelines and requirements related to risk assessment, pricing transparency, and consumer protection, which impact the underwriting practices of all insurance industry participants, including insurtechs. It is important for insurtechs to ensure that their underwriting processes comply with the regulatory framework established by SUSEP to maintain transparency, fairness, and compliance with industry standards. Additionally, the use of innovative technologies in underwriting processes should align with regulatory expectations and consumer protection principles.

The different types of insurance (eg, life, annuities, property, casualty) are treated differently under Brazilian legislation. The main distinction is introduced by the Brazilian Civil Code itself, which differentiates between life insurance and property insurance. In addition to this major distinction, there are regulations from SUSEP and National Private Insurance Council (CNSP) that define various differences and specific rules for each type of insurance mentioned above.

Regtech providers, which are companies that offer technological solutions to help financial institutions with regulatory compliance, are not specifically regulated in Brazil. However, depending on the activities they carry out, they may be subject to regulation by different regulatory bodies.

In view of the previous answer, which mentioned the lack of specific regulation for regtechs, it should be noted that companies should adopt the contractual terms that best suit their reality.

Traditional players in the financial services industry in Brazil are exploring different ways of implementing blockchain technology to improve efficiency, security and transparency in their operations. Some of the main areas where blockchain is being considered or implemented include payment services, digital identity verification, tokenisation, as well as the use of the technology in traditional products such as securities and carbon credits.

The Brazilian regulation regarding blockchain is still under development. Currently, there is no specific legislation regulating the use of blockchain in Brazil. However, the topic has been the subject of discussions and studies by regulatory bodies and lawmakers, especially regarding the use of blockchain in sectors such as finance, smart contracts, and data protection.

In this sense, it is worth commenting on the public consultation published by the BCB in December 2023 (Public Consultation 97/23) to obtain contributions and information from the public on the virtual assets market, including those based on blockchain technology. The main objective of this public consultation is to provide the BCB with inputs for the authority to draft the sectoral regulatory framework for the virtual assets market in the terms of Law No 14,478/22, known as the Crypto-assets Legal Framework or Crypto-assets Law, which established important rules and guidelines for the sector, such as the concept of virtual assets, and Decree No 11,563/23, which regulates Law No 14,478/22 and establishes specific powers for the BCB.

In addition, it is worth mentioning Drex, which is the Brazilian digital currency, produced and regulated by the BCB and based on blockchain technology. Drex does not have an official launch date yet, but it has been tested in restricted environments since March 2023 and is expected to be released for tests with the population in 2024.

From the points mentioned, it is possible to see that, although there is no specific regulation for blockchain technology, it is a relevant topic on the Brazilian regulatory agenda.

In Brazil, not all blockchain assets are considered a form of regulated financial instrument.

Some blockchain assets may fall into the definition of virtual assets as provided for in Law 14,478/2022. Pursuant to this law, virtual assets are digital representations of value that can be negotiated or transferred by electronic means and used to make payments or for investment purposes, not including: (i) the national currency and foreign currencies; (ii) electronic currency or electronic money, pursuant to Law 12,865/2013; (iii) instruments that provide their holder with access to specified products or services or to benefits arising from these products or services, such as points and rewards from loyalty programmes; and (iv) representations of assets whose issuance, bookkeeping, negotiation, or settlement is provided for by law or regulation, such as securities and financial assets.

Currently there is no assertive definition in Brazilian laws for whether virtual assets are considered financial instruments, although virtual assets themselves will consist of a type of regulated asset.

Other types of blockchain assets such as utility tokens, which in essence give their holders access to some sorts of products and services, are out of the scope of Law 14,478/2022 and do not fall in principle in any other category of regulated asset. In this sense, utility tokens are currently not regulated.

CVM Guidance Opinion No 40/2022 proposes a more general classification of “crypto-assets”. Pursuant to CVM Guidance Opinion No 40/2022, crypto-assets are digitally represented assets, protected by cryptography, which can be the object of transactions executed and stored by means of distributed ledger technologies (DLT).

According to CVM Guidance Opinion No 40/2022, crypto-assets can be classified into different categories, depending on their characteristics and purposes:

• payment token or cryptocurrency – these are digital assets that operate on a blockchain network and are mainly used as a means of exchange. They seek to replicate the functions of currency, being used as a means of exchange and store of value, as well as a unit of account;
• utility token – these are tokens issued on a blockchain platform to provide access to products or services within that platform; and
• asset-backed token – these are tokens issued on a blockchain platform and represent one or more assets, tangible or intangible. As per CVM Guidance Opinion No 40/2022, security tokens, stablecoins and non-fungible tokens (NFT) may fall into this definition.

The CVM is of the opinion that an asset-backed token may or may not be a security. Such characterisation depends on the economic essence of the rights conferred on its holders, as well as on the function it assumes during the performance of the project related thereto.

Moreover, the aforementioned categories are not exclusive. In this sense, a single crypto-asset can fall into one or more categories, depending on the functions it performs and the rights associated with it.

It is worth noting that tokenisation itself is not subject to approval or registration with the CVM, but the issuance and public offering of crypto-assets that represent securities, as well as market administration, are subject to applicable regulations.

According to Law 14,478/2022, issuers of securities tokens are regulated by the CVM, and must be registered with the CVM in order to carry out a public offering of these tokens.

On the other hand, there are currently no specific regulations for issuers of tokens that do not fall into the definition of securities. Law 14,478 does not regulate issuers per se, but rather “virtual asset service providers”, which can be understood as entities that, among other things, participate in financial services and services related to the offer or sale of virtual assets. This definition does not encompass the issuer in principle, which is the reason why issuers of non-security tokens are not regulated.

Law 14,478/2022 defines virtual asset service providers as legal entities that perform, on behalf of third parties, one of the following services:

• exchange between virtual assets and national or foreign currency;
• exchange between one or more virtual assets;
• transfer of virtual assets;
• custody or administration of virtual assets or instruments that enable control over virtual assets; or
• participation in financial services and the provision of services related to the offer by an issuer or sale of virtual assets.

Decree No 11.563/23 sets forth that the BCB is the authority responsible for regulating the provision of virtual asset services. However, the jurisdiction of the BCB does not reach assets representing securities, which are the responsibility of the CVM.

CVM Resolution 175/2022 expressly allowed Financial Investment Funds (FIFs) to invest directly in crypto-assets traded in entities authorised by the Central Bank of Brazil or by the CVM, or, in the case of operations abroad, by a local supervisor who has the legal competence to supervise and inspect the operations.

Furthermore, CVM Resolution 175/2022 sets forth that FIFs must comply with the limit of up to 10% of net equity to invest in some assets, which include crypto-assets.

Based on the provisions of Law 14,478/2022, virtual currencies such as Bitcoin are defined as virtual assets. Blockchain assets, on the other hand, may encompass many different assets, including securities. The regulatory treatment of blockchain assets will depend on their specific legal status.

There is no definition of DeFi in Brazilian regulations, nor any requirements imposed on DeFi platforms. However, the sector is subject to the rules of the Crypto-assets Act and other laws of general scope. In addition, during the period of public consultation, the BCB has signalled that it intends to regulate activities within DeFi.       

NFTs and NFT platforms are not part of the fintech regulatory perimeter in Brazil. The reason for this is that there is no provision in current Brazilian legislation that specifically regulates NFTs. Furthermore, according to CVM Guidance Opinion No 40/22, NFTs are considered asset-backed tokens, as they represent one or more tangible or intangible assets. However, even though they are a type of token recognised by the CVM, they are not part of the fintech regulatory perimeter, since there are no specific regulations on them.

However, if the NFT is considered to be a digital representation of value that can be traded or transferred by electronic means and used to make payments or for investment purposes, it will be considered a virtual asset under the Crypto-assets Law. Also, if it fits the legal definition of security, it will fall under the scope of regulation of the CVM.

Open Banking in Brazil is regulated by the BCB, which establishes the guidelines and requirements for the implementation of Open Banking (named Open Finance after the inclusion of insurance and investment products) within its scope. The legislation defines the rules for sharing financial data and services among authorised institutions, aiming to promote competition and innovation in the banking sector.

Open Finance in Brazil requires financial and payment institutions authorised to operate by the BCB to comply with security measures in the digital environment and the privacy of personal data. Open Finance works on the basis of an Application Programming Interface (API) which ensures that information is shared between institutions confidentially and securely, under the supervision of the BCB. Therefore, the data is shared in encrypted form, following the mandatory steps of consent, authentication and confirmation.

Moreover, the Brazilian General Data Protection Law (LGPD) impacts Open Finance directly, as data can only be shared after the express consent of the customer, who must provide authorisation for the sharing after presenting information in clear, objective and adequate language to refer to the purposes specified in the consent, which has a maximum validity period of 12 months and can be revoked at any time. Furthermore, the consent given by the customer cannot be presumed or inferred by means of adhesion contracts or pre-printed forms.

There are several types of fraud involving financial services and fintechs. However, the most common are tied to:

• identity fraud – involves the use of third-party personal information or arises from the use of falsified documents;
• financial fraud – involves temporary control of victims’ bank accounts for sequential transfers to third-party accounts, such as the so-called “Pix scams”;
• phishing – involves attempts to obtain confidential information through fraudulent electronic communications;
• data breach – involves the exposure of confidential data from companies or individuals and generally may lead to other scams;
• investment fraud – occurs when investors are deceived by fraudulent investment schemes, such as fraudulent betting sites that promise quick gains with low investment;
• credit card fraud – involves the theft of credit card data in electronic means; and
• money laundering – involves the use of financial services and fintechs to conceal the illicit origin of funds.

Regulators are most closely focused on the following types of fraud:

• financial fraud, such as the “Pix scams”;
• investment fraud, particularly concerning crypto-assets and online betting;
• data protection and privacy;
• money laundering; and
• cybersecurity frauds, such as identity fraud.

In view of the legislature’s concern about fraud, Joint Resolution 6/23 was published in May 2023 and complemented by BCB Resolution 343. Both deal with the sharing of data and information on signs of fraud by financial institutions, payment institutions and other institutions authorised to operate by the BCB, with the exception of consortium administrators. As such, the rules establish that institutions must record, in a common database shared by all authorised entities, the identification of individuals whose activities were flagged as potentially fraudulent while opening accounts, requiring credit or using payment services. The measures demonstrate the regulatory bodies’ concern about fraud.