Summary
- Brazil is the fifth largest country for cryptocurrency usage, with an on-chain total of $318.8 billion over the past year, according to CertiK.
- Virtual asset service providers must obtain authorization from the Central Bank by October 30, 2026, and include an independent audit.
- In the first half of 2026, hackers stole $1.32 billion from the crypto sector.
As one of the largest cryptocurrency markets globally, Brazil's regulatory body has established a firm deadline for bringing the sector under formal oversight. A recent report from blockchain security company CertiK details the new requirements and their significance for both businesses and users in the market.
According to data from Chainalysis referenced in the report, Brazil ranks fifth in the world for cryptocurrency adoption, having recorded $318.8 billion in on-chain value in the year leading up to June 2025. Approximately one-third of all crypto activity in Latin America occurred through Brazilian platforms, significantly outpacing Argentina and Mexico combined.
š§š· Brazil's crypto market is entering a new era.
With the October 30, 2026 authorization deadline approaching, VASPs face a fundamental shift: compliance is no longer about promisesāit's about proving security, governance, and operational readiness.
Our latest Intel3D reportā¦ pic.twitter.com/V5YPpKy6IB
ā CertiK (@CertiK) August 10, 2026
The regulatory framework is established under Law 14,478/2022, which serves as the Legal Framework for Virtual Assets. This framework gained attention on November 10, 2025, when the Central Bank of Brazil issued three resolutions that clarify licensing requirements, set minimum capital levels, and align crypto operations with foreign exchange regulations.
Licensing Requirements Explained
All companies facilitating the trading, holding, or transfer of cryptocurrency, referred to as virtual asset service providers (VASPs), must apply for authorization by October 30, 2026. Their application must include a "reasonable assurance report" from an audit firm recognized by the securities regulator, confirming the effectiveness of the firmās anti-money laundering and sanctions measures. Merely claiming compliance is insufficient; it must be validated by an external entity.
The financial entry barriers are significant. Minimum capital requirements range from approximately R$10.8 million to R$37.2 million (around $2 million to $6.7 million), depending on the licensing category. Moreover, the Central Bank prohibits operators from registering their offices in co-working spaces. Currently, around 120 providers are estimated to be active in the market, many of whom lack formal licensing.
Foreign companies that previously operated in Brazil from offshore locations are now required to establish a local presence within 270 days. The report explicitly states its aim: to eliminate the reliance on offshore operations and ensure compliance within Brazilās jurisdiction.
Motivation Behind Central Bank's Actions
Described in the report as a "Stablecoin Nation," Brazil sees about 80% of its declared crypto transactions occur through dollar-pegged tokens, with USDT making up 88.7% of that volume. Total stablecoin transactions reached R$1.13 trillion from 2019 to 2025. As previously reported by Decrypt, Tether's USDT is already redeemable at 24,000 ATMs across Brazil, despite ongoing regulatory pressures, including exchange closures and ATM installations.
This heavy reliance on foreign currency is why the Central Bank is taking a more active role in regulating cryptocurrency than other authorities. CertiK argues, āWhen four out of every five reais in crypto are transacted through instruments linked to a foreign currency, it transcends consumer protection and becomes a matter of monetary policy.ā This reality explains why the Central Bank leads the regulatory efforts, focusing on foreign exchange and cross-border transactions, with stablecoins at the forefront of future regulations.
According to CertiK's Hack3d tracking, $1.32 billion was lost to hacks and scams across 344 incidents in the first half of 2026. Of that amount, $444.5 million resulted from wallet breaches, while phishing attacks accounted for $366.3 million. The largest losses were due to operational failures rather than flaws in smart contracts, with Kelp DAO suffering a $291 million loss and Drift Protocol losing $285 million.
Marcos Rocha from Veirano Advogados, a law firm that assisted with the licensing applications, warned that many in the market underestimate the complexity and time required for submission. He stated, "The review will be thorough, detailed, and highly technical."
AntƓnio Neto, Head of Growth LATAM at the Solana Foundation, noted a notable shift towards licensed operators. "What we're seeing as the first real wave is projects choosing to operate under an authorized PSAV rather than pursue their own license," he added, asserting that the "Brazilian market is structurally moving onto the regulated rail."
The capital requirements and the assurance verification process will significantly transform the market landscape. The report suggests that obtaining a license will become a valuable asset, and acquiring an already-licensed local operator may be the quickest path for foreign entities. This trend mirrors the patterns observed following the implementation of Europeās MiCA and Dubaiās VARA regulations, where unlicensed volumes shifted to compliant entities.
The report also identifies gray areas, such as non-custodial wallets, decentralized finance (DeFi) platforms, and tokenized securities, which the securities regulator (CVM) claims jurisdiction over, regardless of the underlying blockchain technology. The CVM has indicated that a tokenized share is still classified as a share.
In conclusion, the report emphasizes that Brazil's market is evolving into one where the ability to demonstrate compliance takes precedence over mere promises.
For the approximately 120 providers currently catering to Brazilian users, the application must be submitted to the Central Bank by October 30, 2026, along with an independent assurance report.