With Brazil's new cryptocurrency regulation now in force, investors using exchanges such as Mercado Bitcoin, Binance, Coinbase and other platforms need to pay attention to one key question: has the company filed its authorisation request with Brazil's central bank, the Banco Central do Brasil, to keep operating in the country?
The question has gained relevance with the 30 October 2026 deadline set for companies that were already providing virtual asset services in Brazil to formalise their applications with the regulator. Institutions that fail to file a request within the set period must halt the services subject to authorisation, following the wind-down rules.
But identifying an exchange's status is not always straightforward. There is a difference between announcing a licence application, having a case under review, and receiving final authorisation from the central bank.
In addition, many platforms operate through Brazilian entities with names different from the brands investors know. An international exchange, for example, may apply for authorisation through a subsidiary that does not carry the same name used in its app.
Read also: Will the central bank control your Bitcoin? Ten myths and facts about Brazil's new crypto regulation
The good news is that there are ways to verify this information, both through companies' official channels and through tools made available by the central bank.
Where to check which companies have applied for authorisation
1. Check the exchange's website and app
The first step in finding out whether an exchange has applied for authorisation is to look for the regulatory information published by the platform itself.
Resolution BCB No. 520, which governs the operation of virtual asset service providers in Brazil, states in Article 52 that companies must publish on their websites and apps information about their authorisation to provide these services, or about an application pending review by the central bank.
The rule also requires disclosure of the institution's regulatory licences, the conditions under which services are provided, and the identification of any other companies involved in the operations.
In practice, investors can look for this information on the exchange's terms and conditions pages, regulatory information sections or institutional documents. If the data cannot be found, they can also request clarification directly from the platform's customer service.
It is worth checking not only whether the company states it has filed the request, but also which legal entity is involved, the type of authorisation sought and the current status of the process.
It is important to remember that the same company may offer different financial services, and not all of them will necessarily be covered by the same authorisation.
An institution may, for instance, hold a licence to operate as a payment institution while still awaiting specific authorisation to offer certain cryptocurrency services.
For that reason, the mere fact that a platform is regulated by the central bank does not necessarily mean that all of its virtual asset services have already been authorised.
2. Cainvest launches a monitor to track crypto licence applications
Another way to track companies' status is the Cainvest SPSAV Monitor, an initiative developed by Cainvest Group to collect information on authorisation requests filed by institutions operating in the digital asset market.
The tool was announced on 27 October, in the final stretch before the regulatory deadline, and tracks cases filed with the central bank, as well as publishing updates on companies that have publicly announced their applications.
According to data released by Cainvest on 29 October, 38 institutions had authorisation requests pending with the regulator. Of that total, three were on the central bank's decision agenda, two were under review, and another two were awaiting the submission of documents or responses from the applicants.
While it is a useful tool — perhaps one of the most comprehensive and easy to use for tracking developments in the sector — the monitor is a private initiative, not an official register of companies authorised by the central bank.
Its findings also represent a snapshot at a given date. A company may not appear in one update and still have filed a request afterwards. It is therefore important to check the date of the information and to distinguish between cases identified in the regulator's own records and those known only through public statements from the institutions themselves.
3. Look up an exchange on the central bank's website
The Banco Central do Brasil offers a tool to search for financial institutions and companies authorised or supervised by the regulator. For now, however, since crypto companies are still in the process of applying for their licences, the service does not yet specifically show virtual asset authorisation status, something that is expected to be updated soon.
The service, called "Find an institution regulated/supervised by the central bank" (Encontre uma instituição regulada/supervisionada pelo BC), allows users to search by company name, Brazilian company registration number (CNPJ) or category of activity. Once an institution is located, users can check registration data, ownership information, contact channels and, where available, financial documents.
A company still awaiting a decision from the central bank may not appear as an authorised virtual asset service provider.
Likewise, an institution's absence from the search tool does not, on its own, prove that it has failed to submit the required documentation.
For that reason, the tool should be used alongside the information published by the companies themselves and the data on the regulatory proceedings.
To confirm whether an institution has received final authorisation, investors can also check the announcements published by the central bank and the decisions published in Brazil's official gazette, the Diário Oficial da União.
The central bank explains that decisions on authorisation proceedings may be disclosed through these channels, making it possible to verify whether a request has been approved or rejected.
An application does not mean a licence has been granted
One of the main questions investors have is whether they can consider an exchange compliant as soon as it announces that it has filed its application. The answer is that the application only marks the start of the authorisation process, not its conclusion.
Brazilian regulation sets out a staged review, in which the central bank examines aspects such as ownership structure, financial capacity, governance, internal controls, cybersecurity and anti-money-laundering measures.
The institution must also demonstrate that it has the operational capacity to offer the services it intends to provide.
Read also: How will Brazil's new crypto regulation protect investors? Understanding what changes under the central bank's rules
For companies that were already operating before the new rules took effect, a transition regime was created. Providers that file their applications within the deadline can keep operating while their case is under review, provided they meet the conditions set by the central bank.
This means investors need to understand several different regulatory situations.
An exchange with a filed application may be authorised to keep operating during the transition period while not yet holding final authorisation. A company that has received authorisation, by contrast, has had its request approved by the central bank for the corresponding activities.
There are also institutions that have decided not to apply for authorisation and must therefore wind down their regulated services.
Which companies have applied, and which have decided to leave Brazil?
The rollout of the new regulation has led several companies to publicly announce their intention to remain in the Brazilian market.
Exchanges that have disclosed authorisation applications include Binance, Mercado Bitcoin, Coinbase, Foxbit, Bybit, OKX and Ripio. Other companies, such as Liqi, Ripple, Avenia, Lumx, Bloquo and Nonco, have also announced moves related to the new licensing regime.
It is also worth noting that not all of these companies operate as exchanges. Some provide infrastructure for international payments, custody, inter-institution trading or asset tokenisation — activities that may require different types of authorisation.
On the other side, companies such as Coinext, NovaDAX and Digitra.com have announced that they are ending their cryptocurrency operations in Brazil.
Revolut decided to temporarily suspend its crypto offering to Brazilian customers, while Bitso ended the direct provision of certain retail services and announced a partnership to migrate its clients elsewhere. These decisions do not necessarily mean the companies are ending all activities in the country — a firm may stop offering cryptocurrency trading while continuing to operate in other areas.
The market may also go through further reorganisation, including partnerships, client transfers, mergers and changes to ownership structures.
For this reason, the most important step is to check the current status of the specific company responsible for the service being used, rather than relying on old news about a particular brand.
Do banks also need authorisation to offer Bitcoin?
The new regulation does not apply in the same way to every company. Banks and certain financial institutions that already hold authorisation from the central bank can use a specific procedure to formalise their virtual asset activities.
In these cases, Resolution BCB No. 520 provides for a formal notification to the regulator, provided the set conditions are met. This was the route taken by Itaú, one of Brazil's largest banks, which notified the central bank of its activities in cryptocurrency intermediation and custody.
This situation differs from that of an independent exchange, which must apply for authorisation to operate as a virtual asset service provider.
However, financial groups may also choose to set up separate companies to carry out cryptocurrency activities. In those cases, the legal entity responsible for the services may need to go through its own authorisation process.
For that reason, when checking the status of a bank or fintech, it is important to identify which entity is actually offering the digital assets and which regulatory procedure applies to it.
What should I do if my exchange has not applied for authorisation?
If an exchange subject to the new regulation does not file its application within the deadline set by the central bank, it cannot continue indefinitely providing the regulated services.
Resolution BCB No. 520 provides for an additional 30-day period after the deadline closes for these companies to wind down their activities.
During this process, customers should follow official announcements about withdrawing funds, transferring cryptocurrencies and closing accounts. Depending on the platform's structure, the company may offer mechanisms to transfer assets to another exchange, send them to a self-custody wallet, or sell positions and withdraw the proceeds.
Read also: What happens to exchanges that fail to apply for a central bank licence by 30 October?
Specific procedures and timelines must be communicated by each institution and may vary depending on the services offered.
If a company does not clarify its regulatory status, investors should request information through its official channels and keep records of the responses received.
It is also important to avoid links sent by unknown parties or messages demanding urgent transfers on the claim that the central bank has ordered accounts to be frozen.
The new regulation does not require all investors to sell their bitcoin or transfer their cryptocurrencies to a specific platform.
How to check whether an exchange is compliant before investing
With the new regulation in force, an exchange's regulatory status is now an important factor in choosing a platform.
Before opening an account or transferring funds, investors should identify the company responsible for providing the service, check its regulatory information and verify whether it has been granted authorisation, has an application under review, or follows a specific notification procedure with the central bank.
It is also advisable to check which activities are covered by the authorisation or application. An institution may hold a licence for payments or foreign exchange, for example, without this automatically meaning authorisation for every cryptocurrency service it intends to offer.
Finally, it is worth remembering that central bank authorisation does not eliminate the risks of investing in Bitcoin and other digital assets.
Cryptocurrencies remain subject to price swings, and authorisation does not represent a guarantee of returns, nor does it turn these investments into products covered by Brazil's deposit guarantee fund, the Fundo Garantidor de Créditos (FGC).
The main change is that companies now face specific obligations on security, governance, transparency and the handling of client funds.
For investors, keeping track of an exchange's regulatory status and confirming who is responsible for the services they use are steps that help reduce risk and avoid problems with platforms that do not meet Brazil's requirements.
Want to invest in cryptocurrency with confidence? Mercado Bitcoin is offering readers a special bonus: use the code PORTAL250 when you sign up and get 8 EUR in Bitcoin when you buy 42 EUR worth of assets. Click here to open your account.
