Brazil's cryptocurrency market enters a new phase on 30 October 2026, the deadline for companies already providing virtual asset services to file for authorisation with Brazil's central bank, the Banco Central do Brasil. Firms that file within the deadline may keep operating while the regulator reviews their application, while those that do not file will have to wind down these services within 30 days.

The change matters because the sector has stopped being a niche in Brazil. According to the 2nd National Cryptocurrency Survey, carried out by pollster Datafolha and Paradigma, 17.2% of Brazilians over 16 have held crypto assets, equivalent to nearly 29 million people. That is 2.3 times more than the share of Brazilians who have invested in listed shares, at 7.4%.

The new phase follows Brazil's crypto assets framework law, enacted in 2022, which gave the central bank authority to regulate the sector. The specific rules were only published nearly three years later, creating a model that turns previously voluntary practices into mandatory requirements for all platforms.

In practice, the regulation creates a common standard for companies that intermediate, custody or trade crypto assets, covering authorisation, supervision, risk controls, asset segregation and transparency rules, according to an analysis by MB Explica — educational content sent weekly to clients of MB | Mercado Bitcoin.

Here are five points to understand what is changing.

1) Central bank authorisation

The main change is that operating with crypto assets in Brazil will require authorisation from the central bank. The regulation created the PSAV, short for Prestadora de Serviços de Ativos Virtuais (virtual asset service provider), a mandatory licence for companies that intermediate, custody or trade crypto assets in the country. Without this authorisation, a platform will not be allowed to operate.

The requirement also applies to foreign exchanges serving Brazilian clients. According to MB, keeping just an office in the country will not be enough. These companies will have to migrate operations and clients to an institution authorised by the central bank or to a Brazilian PSAV undergoing licensing, with its own physical headquarters and local management.

Also read: Brazil has 29 million crypto investors, more than in the stock market, Datafolha says

This does not mean every platform will disappear in November. Companies already operating in Brazil before the rules took effect were given nine months to comply and file for authorisation. If the filing is made within the deadline, they may continue providing services while the central bank reviews the application, without taking on new business lines during that period.

2) Separate assets

Another key point is asset segregation. The rule aims to prevent client funds from being mixed with company cash, a risk that became evident in international cases such as the collapse of FTX in 2022, when the exchange used client money to fund the operations of a related company.

Under the new rule, clients' financial funds must be held in an individualised payment or deposit account in each user's name. Virtual assets, meanwhile, must be kept separate from the platform's own assets, with a specific custody policy, proof of reserves and independent audit.

For the investor, the change increases protection in the event of financial trouble at the company. The logic is simple: if the exchange fails, client assets should not be treated as company property.

3) Stablecoins enter the foreign exchange market

The regulation also changes how certain crypto asset operations will be treated, especially those involving stablecoins, payments and international transfers. The central bank found that some virtual asset transactions can serve a function similar to foreign exchange operations, and so brought part of that activity under FX rules.

This does not mean stablecoins have been banned or are now treated as foreign currency. What changes is that some operations must now follow specific authorisation, disclosure and registration rules.

In practice, to offer stablecoins broadly, a platform will need not only PSAV authorisation but also authorisation to operate in the foreign exchange market. Without both licences, the product range may be restricted: a company may be able to sell Bitcoin, for example, but not necessarily USDT.

4) Identifying both sides of crypto transfers

The fourth change involves crypto asset transfers. The regulation now requires identification of both sender and recipient, following an international standard known as the Travel Rule. The logic resembles a traditional bank transfer, where the operation carries data on both payer and payee.

The requirement also applies to transfers involving self-custody wallets. In that case, the platform must identify the wallet's owner and keep documented processes to verify the origin and destination of the assets.

For international payments and transfers of virtual assets, whether stablecoins or not, the client will also have to state the purpose of the operation and provide details about the payer or recipient abroad. In addition, transactions above US$10,000 may be held for up to 24 hours for review.

For the user, the most visible effect will be requests for additional information depending on the type of transfer. The experience may feel less “instant” in some situations, but with more traceability and stronger controls against fraud and money laundering.

5) Suitability check before buying crypto

The regulation also brings to crypto platforms a practice already familiar in stock brokerages and funds: suitability, or the investor profile assessment. The goal is to assess knowledge, financial objectives and risk tolerance before the purchase of virtual assets.

According to MB, taking the test will be mandatory, but the result will not automatically block a purchase. If a client has a conservative profile and wants to buy an asset classified as higher-risk, the transaction will still be available, but the platform will have to warn that the asset falls outside the investor's profile and ask for confirmation before the purchase goes through.

The rule reinforces a recurring theme of the new regulation: investors will still be able to access crypto assets, but with more steps for information, confirmation and transparency.

Consolidation likely in the coming months

Adapting to the new rules is expected to accelerate market consolidation. The minimum capital required for a PSAV ranges from roughly 1.81 million EUR to 6.24 million EUR, depending on the activities carried out. The sector also estimates annual costs of between roughly 838,500 EUR and 1.68 million EUR just to maintain compliance, governance, audit, cybersecurity and central bank reporting structures.

The effects are already visible. In recent months, Bitnuvem, NovaDAX and Coinext ended operations in Brazil due to costs and regulatory requirements, while Z.ro Bank stopped serving retail clients and Bybit cut derivatives and migrated clients to a local entity.

Brazil looks set to follow a path similar to other regulated markets, such as Japan and Europe, where stricter rules reduced the number of platforms and favoured larger, better-structured companies. Brazil starts from around 120 service providers and is expected to move towards a market with fewer, but more solid, players.

For investors, October becomes a point of attention. Beyond comparing price, asset range and fees, it will be necessary to check whether a platform has applied for authorisation, how it handles custody, whether it separates client assets from its own, and whether it is prepared to operate in a market directly supervised by the central bank.

Want to invest in the world's largest cryptocurrency on a regulated platform? At MB, you can get started in a few clicks, safely and transparently. Don't put off a promising wallet — make more of your money. Open your account and invest in bitcoin now!