Brazil's new cryptocurrency regulation promises significant changes for anyone who buys, sells or holds Bitcoin and other digital assets on exchanges. Firms that previously operated without specific authorisation from Brazil's central bank, the Banco Central do Brasil (BC), will now have to follow rules on security, transparency, governance and protection of investor funds, bringing their activity closer to the requirements applied to traditional financial markets.
One of the main changes is the obligation to keep client funds separate from the exchange's own assets, to reduce the risk of client money being misused. Firms will also have to adopt protections against cyberattacks, provide clearer information to users, and submit to supervision by the BC.
The new rules were set out primarily in BCB Resolutions No. 519, 520 and 521, published in November 2025 and in force since 2 February 2026. They created an authorisation and supervision framework for Virtual Asset Service Providers (known in Brazil by the acronym SPSAVs), a category that includes firms engaged in intermediation, trading and custody of cryptocurrencies.
The next milestone falls on 30 October 2026, the deadline for firms already operating when the rules took effect to formally submit their applications for authorisation, allowing them to keep operating while the central bank reviews their case.
For Vanessa Butalla, director of Legal, Compliance and Risk at Mercado Bitcoin (MB), the new requirements mark an important shift in the relationship between exchanges and their clients.
"The new regulation represents an important step forward for investor protection, by setting clearer rules for firms operating in the crypto asset market. In practice, this means exchanges will need to meet minimum standards of security, transparency, governance and risk management, and have a structure and customer support in Brazil for their clients," she says.
The change, however, does not mean that investing in cryptocurrencies becomes risk-free. Bitcoin will remain subject to price swings, and authorisation from the central bank does not guarantee that a given exchange will never face financial or operational problems.
Below are the main protections set out in the new rules and what changes in practice for investors.
Client money and crypto assets will have to be kept separate from exchanges' own funds
One of the most significant measures in the new framework is so-called asset segregation, which establishes a separation between funds belonging to the exchange and those held on behalf of its clients.
BCB Resolution No. 520 requires that users' funds be kept in individualised accounts, offered either by the provider itself, where authorised to do so, or by another institution regulated by the central bank.
In practice, the measure seeks to prevent money deposited by investors from being mixed with the funds an exchange uses to cover expenses, finance its own activities or make its own investments.
Also read: What it now costs to run a crypto firm in Brazil under the central bank's new rules
The separation also applies to crypto assets. Firms will have to keep clients' digital assets in wallets distinct from those used for their own operations, with records that allow the balance belonging to each user to be identified.
The rules allow for limited operational exceptions permitting the use of the firm's own assets within client wallets, subject to specific conditions and controls, but the separation of assets remains the general rule.
The aim is to reduce the risk of situations such as the one seen in the collapse of FTX in 2022, when billions of dollars belonging to clients were misused by the exchange and related firms.
"One of the main advances is the requirement to separate client funds and assets from those belonging to the firms themselves. This measure helps reduce risks linked to the misuse of investors' funds and brings more transparency to how those funds are managed," Vanessa Butalla explains.
Her assessment echoes comments previously made by Isac Costa, director of Brazil's Institute of Technology and Innovation (IBIT) and a former member of Brazil's securities regulator, the Comissão de Valores Mobiliários (CVM). In an interview in May, Costa explained that asset segregation seeks to prevent an exchange's financial problems from affecting its users' funds.
"Asset segregation is meant to ensure that client funds are not mixed up with the firm's own assets," he said.
This separation, however, should not be mistaken for an automatic guarantee of recovering funds if a firm goes bankrupt. Effective protection also depends on how the controls are implemented, the legal status of the assets, and the circumstances of any insolvency.
Exchanges will have to prove reserves and undergo audits
Another change concerns transparency about the amount of cryptocurrency actually held by firms.
The central bank requires providers to have documented procedures for carrying out proof-of-reserves exercises, a mechanism used to demonstrate the existence of the digital assets under their responsibility.
The rules also require independent audits, every two years, covering both the firm's own virtual assets and those of its clients. The audit reports must be made public.
The measure seeks to reduce the chance of an exchange reporting balances to investors that do not match the assets actually held in custody.
For example, if a firm's clients together hold 1,000 bitcoins registered in their accounts, the firm needs controls capable of demonstrating the existence and ownership of the corresponding assets, taking into account the conditions applicable to the service provided.
Proof of reserves alone is not sufficient to demonstrate a firm's financial health, since its liabilities must also be taken into account. This is why audit, record-keeping and internal control requirements matter as a complement to supervision.
The Brazilian Association of Financial and Capital Markets Entities (Anbima) has also published self-regulatory guidelines for the custody of virtual assets, covering proof of reserves, private key management and transaction traceability.
In September 2026, the association released a document with 83 questions and answers to guide firms in implementing these practices, including procedures for identifying each investor's assets even when several users share a single custody wallet.
More protection against hackers, scams and operational failures
Platform security also carries more weight under the new regulatory requirements.
Firms will have to adopt structures proportionate to the size and risks of their operations, including cybersecurity policies, internal controls, monitoring systems and incident-response procedures.
This means it is no longer enough to offer an app for buying and selling cryptocurrencies. Providers will have to demonstrate the capacity to protect the information, systems and assets under their responsibility.
For firms providing custody, protection also extends to private keys, the cryptographic codes that allow digital assets to be moved. Whoever controls those keys generally has the technical ability to transfer the corresponding cryptocurrency.
Custody rules include procedures to control access to these mechanisms, log movements, and reduce the risk of loss, misappropriation or unauthorised transfers.
The aim is to reduce platforms' exposure to attacks, internal fraud and operational problems, although the regulation does not eliminate those risks entirely.
An additional change, due to take effect on 1 January 2027, is the precautionary holding of certain transfers for up to 24 hours.
The measure, set out in BCB Resolution No. 584, applies to transfers to foreign providers or self-custody wallets when amounts exceed US$10,000, either in a single transaction or in total movements by a client on the same day. It may also apply to other transactions that require additional risk analysis, under the relevant regulatory criteria.
During that window, the institution can check for signs of fraud before completing the transfer. The central bank stresses that the hold does not amount to a definitive freeze on funds and that a transaction may be released before the maximum period elapses, once reviewed.
For users, this means additional protection against certain types of fraud, but also the possibility that some transfers will no longer be instant.
More transparency on fees, prices and crypto-related risks
The new rules also set out obligations relating to the information made available to investors.
Providers will have to adopt transparent practices towards clients, disclosing service conditions, the risks involved and each party's responsibilities.
One relevant point is the prevention of conflicts of interest. An exchange may, for example, act as an intermediary for trades while also carrying out its own cryptocurrency transactions. This creates situations in which the platform's interests may differ from those of its clients.
BCB Resolution No. 520 requires controls to manage such conflicts and sets out practices aimed at best execution of orders, the use of independent price references, and fair treatment of users.
In practice, exchanges will have to adopt procedures to prevent certain transactions from being executed in ways that benefit the firm itself or specific clients to the detriment of others.
For investors, the change reinforces the importance of checking the conditions set out by a platform, including fees, bid-ask spreads, custody rules and any restrictions on moving assets.
Firms will also have to make information about their policies and activities available, making it easier to understand the services being offered.
Firms will have to meet financial requirements and will be supervised by the central bank
Authorisation to operate will also depend on an exchange's financial and operational capacity.
BCB Resolution No. 519 sets out criteria such as the lawful origin of funds used as capital, the economic and financial viability of the business, the adequacy of technological infrastructure, and the reputation of controlling shareholders and managers.
In addition, providers will be subject to capital and equity requirements proportionate to their activities and risks.
The aim is to reduce the chance that firms without adequate financial, technological or administrative structures offer services involving the movement and safekeeping of funds belonging to thousands of clients.
Also read: Where each exchange stands in the central bank's authorisation process
Supervision by the central bank adds another layer of protection. Before the new rules, exchanges did not need specific authorisation from the BC to offer virtual asset services. Now, firms covered by the rules will have to go through a formal review process and, once authorised, will be subject to the applicable supervisory requirements.
This allows the regulator to monitor aspects of these institutions' conduct, request information, and take action within its powers when it identifies breaches.
"In addition, supervision by the central bank introduces a new layer of oversight over how these institutions operate," Vanessa notes.
The requirement, however, also comes at a cost. As a result, while the new regulation may improve the security of services, it is also reshaping the sector, with some firms shutting down, scaling back products, or seeking new structures to keep operating.
Investors gain more protection in customer service and complaints handling
Another development is that virtual asset service providers are now included in a broader set of rules governing relationships with clients and users of the financial system.
Institutions will have to meet requirements on transparency, customer service and complaints handling, in line with the rules applicable to their activities.
The central bank also sets out governance requirements and rules for identifying who is responsible for operations.
For investors, this means dealing with a formally identified firm subject to obligations in Brazil, rather than relying solely on customer support from a foreign platform with no local presence.
That distinction can matter in cases of unprocessed withdrawals, balance discrepancies, operational failures, or difficulty obtaining information about funds held on an exchange.
The fact that a firm is authorised by the central bank, however, does not mean the regulator will resolve individual disputes directly or guarantee automatic reimbursement of losses.
Even so, a regulated structure tends to make it easier to identify those responsible, route complaints, and enforce the obligations a provider has taken on.
"For investors, the main benefit is a safer environment, with clear rules on the responsibilities of firms offering crypto asset buying, selling and custody services, and the assurance that their rights can be exercised here in Brazil," Vanessa says.
Fighting fraud and money laundering may mean more information requests for users
The new rules also expand exchanges' obligations to identify their clients and monitor transactions considered suspicious.
In practice, users may have to provide additional information to open accounts, move large sums, or transfer cryptocurrency to certain wallets.
These requirements are part of anti-money-laundering and counter-terrorist-financing mechanisms, aimed at making it harder to use platforms to move funds linked to crime.
Among the changes, the central bank introduced specific obligations covering transactions with self-custody wallets, where investors control their own private keys.
Since 1 October 2026, transfers between regulated providers and such wallets, for amounts equal to or above the equivalent of US$10,000, must be reported to Brazil's financial intelligence unit, the Conselho de Controle de Atividades Financeiras (Coaf).
The measure does not ban the use of self-custody wallets but expands monitoring of certain transactions carried out through regulated institutions.
For users, the practical effect may be requests for more information about the origin and destination of funds, along with the need to provide data that helps an institution assess the risks of a transaction.
The central bank argues these mechanisms are intended to make financial fraud and the circulation of illicit funds harder, particularly in transactions involving the rapid transfer of cryptocurrency abroad.
What the new regulation does not guarantee investors
Despite the new protections, it is important to distinguish the security of platforms from the security of an investment.
The regulation does not prevent Bitcoin's price from falling, a cryptocurrency from losing most of its value, or a given project from ceasing to exist.
Nor does it turn cryptocurrencies into assets covered by Brazil's deposit guarantee fund, the Fundo Garantidor de Créditos (FGC), a scheme that protects certain bank deposits and investments up to the limits and conditions set out in its rules — broadly comparable to a national deposit guarantee scheme in Europe.
This means holding Bitcoin on an authorised exchange does not offer the same protection as a Brazilian bank deposit certificate (CDB) covered by the FGC.
Likewise, the regulation is not a promise that an exchange can never fail or suffer a cyberattack. The new requirements aim to reduce those risks and define responsibilities, not eliminate them.
Another important point is that applying for authorisation from the central bank is not the same as receiving a final licence.
Firms that were already operating may continue their activities during certain stages of the regulatory process, provided they meet the transition conditions set by the BC.
For this reason, when assessing an exchange, investors should distinguish between those that have already been authorised and those that have merely submitted an application and are awaiting the regulator's decision.
The new regulation marks a shift in how cryptocurrency firms are supervised in Brazil. For investors, its main effect is to establish clearer obligations around how funds are handled, how secure platforms must be, and the responsibilities of these institutions.
How effective these protections prove to be, however, will depend both on the central bank's supervision and on firms' ability to implement the required controls.
If you want to invest in cryptocurrency with confidence, Mercado Bitcoin has a special offer for our readers: use code PORTAL250 when you sign up and get a €8 bonus in Bitcoin when you buy €42 worth of assets. Click here to open your account.
