Brazil Crypto Regulation 2026: PSAV Authorization and the 24-Hour Hold

Brazil crypto regulation entered its licensing phase on 2 February 2026, when the Banco Central do Brasil began applying three resolutions that put Brazil crypto law, Lei 14.478/2022, into practice.

For exchanges, OTC desks, custodians, and payment companies already serving Brazilian clients, the first milestone is procedural: filing phase one of the authorization request by 30 October 2026.

In phase two, an independent auditor must give an opinion on the provider's whole PLD/FT framework, from policy and KYC to monitoring and transaction records.

From 1 January 2027, Resolução BCB 584 adds a hold of up to 24 hours on large transfers to providers abroad and to unhosted wallets. Both rest on the same premise: a provider must be able to show, with records, how it assessed a client or a transfer and why it acted as it did.

Now the same withdrawal looks very different. And that's exactly the gap crypto screening has to close. A list check can tell you whether an identifier is listed, but not where the funds came from, where they're going, or how close they sit to a sanctioned entity.

Brazil Crypto Regulation in 2026: Key Dates

How Brazil's Crypto Law Works

Brazil crypto law sets the basic requirement: businesses offering virtual asset services need authorization. Lei 14.478/2022 establishes that rule, while the BCB (Brazil Central Bank) explains how companies apply and operate.

Three BCB regulations put the law into practice.

• Resolution 519 covers applications.

• Resolution 520 sets operating rules, including AML controls and the transition period for existing providers.

• Resolution 521 covers crypto activities treated as foreign exchange.

All three have applied since 2 February 2026.

Who Needs PSAV Authorization in Brazil?

Under Brazil crypto regulation, PSAV authorization depends on the services a company provides. Businesses exchanging, transferring or safeguarding virtual assets for customers fall within Brazil's regulatory framework. New providers need BCB authorization before starting, while certain already-regulated financial institutions follow a notification process.

An SPSAV can apply as an intermediary, which trades on behalf of clients; a custodian, which safeguards keys and executes custody instructions; or a broker, which combines both activities .

Banks and certain other regulated financial institutions can also offer crypto services without a separate SPSAV authorization. This includes securities brokers and distributors (CTVMs and DTVMs), as well as FX brokers, which are limited to intermediation. Institutions newly adding crypto services must have held BCB authorization for at least 365 days and wait 90 days after notifying the BCB before starting.

Foreign providers serving Brazilian clients

Brazil crypto law also affects foreign providers serving Brazilian customers. They have until 30 October 2026 to move their local operations and clients to a BCB-authorized institution.

Those that do not complete the transfer must stop serving the market.

A further restriction begins on 6 November 2026: BCB-authorized institutions generally cannot conduct virtual asset operations with providers that lack BCB authorization. Under Resolução BCB 589, having an authorization application pending no longer automatically exempts a provider from this restriction.

How PSAV Authorization Works: Phase 1 and Phase 2

Existing PSAVs follow a two-phase authorization process. Phase one determines whether they qualify to continue under the transition regime. Phase two allows the BCB to examine the business, its management and the controls it uses in practice.

Phase 1

To complete phase one, providers submit evidence that they were already active on 2 February 2026, information on ownership and control, proof of the controllers' reputation and audited financial statements for the previous three fiscal years.

Businesses that file on time may continue operating while the BCB reviews their applications, provided they meet periodic reporting requirements. Those that do not file must stop providing virtual asset services within 30 days.

After a favorable phase-one decision, the provider has 60 days to submit phase two, with a possible additional 60 days. The BCB reviews the controllers' finances and source of capital, the managers' qualifications, the business plan, cybersecurity and internal controls.

Phase 2

Phase two also requires an independent auditor registered with Brazil's securities regulator, the CVM, to issue a reasonable assurance report on the provider's PLD/FT controls. IN BCB 739 introduced this requirement. New entrants submit the complete set of documents in one application.

Applications rejected or archived by the BCB, and missed deadlines, can require a provider to wind down operations within 30 days. For firms that reach phase two, the independent PLD/FT audit becomes one of the main ways to demonstrate that the controls work.

What Auditors Look For in PLD/FT Controls

The phase-two auditor reviews eight parts of a PSAV's PLD/FT program, from policies and risk assessment to monitoring, fraud prevention and transaction records. Under IN BCB 739, the auditor provides reasonable assurance, which means examining how controls operate as well as how they are designed.

The table connects the areas in Annex IV of IN BCB 704 with the kinds of records that can support the review.

Some requirements in areas V–VIII apply specifically to providers that were already operating on 2 February 2026. These include parts of alert handling in V, fraud monitoring in VI, and all of VII and VIII (Annex IV, §1). Auditors may also take earlier reports into account if they cover the same areas and were issued within the previous 12 months.

For crypto businesses, this means proving that standard AML controls work with blockchain activity:

• Transaction monitoring needs to address direct and indirect exposure.

• Sanctions screening should cover wallet addresses.

• KYB has to assess partners such as overseas providers and liquidity firms.

Resolution 520 also requires joint PLD/FT controls with contracted service providers to identify sanctioned wallets.

Indirect exposure matters,  because risk can sit several transactions away from an exchange.

In Global Ledger's High-Risk Exposure Benchmark, researchers analyzed BTC, ETH and USDT on Tron flows involving 99 centralized exchanges between 2021 and 2025. In 2025, sanctions-related exposure was, on average, 3.06 value-weighted blockchain hops away from exchanges. The study used a five-hop tracing scope for its analysis.  Those distances help explain why checking only the immediate counterparty can miss relevant on-chain connections.

Brazil Stablecoin Regulation and Foreign Exchange Rules

Stablecoins bring another set of requirements for Brazilian crypto providers. Under Resolution 521, buying, selling or exchanging a virtual asset pegged to fiat currency is treated as a foreign exchange (FX) operation. The resolution also prohibits paying or receiving foreign currency in those operations.

Resolution 520 adds a separate requirement: intermediaries must set eligibility criteria before offering fiat-referenced assets.

The FX rules also cover international payments settled in crypto, certain card-linked international transfers and transfers involving self-custodied wallets. When the counterparty is not authorized to operate in the FX market, PSAVs face a USD 100,000 limit on these operations. For CTVMs, DTVMs and FX brokers, the limit is USD 500,000.

For example, buying USDT with reais is an FX operation. If a client later withdraws more than US$10,000 in USDT to their own wallet, that transfer also falls under the Resolution 584 hold from 1 January 2027. The trade and the withdrawal therefore require different compliance checks.

The asset used can also affect the risk assessment.

Global Ledger's High-Risk Exposure Benchmark found a 1.24% high-risk deposit exposure rate for USDT on Tron in its sample of 99 exchanges over 2021–2025. That was more than twice the rate for BTC (0.51%) and over three times the rate for ETH (0.35%), with high-risk connections traced through up to five blockchain hops.

For Brazilian PSAVs, these findings highlight the importance of checking where stablecoin funds originate and their exposure to high-risk entities when assessing transactions under the new FX and withdrawal rules.

24-Hour Withdrawal Hold Under Resolution 584

From 1 January 2027, institutions must normally wait 24 hours before executing certain transfers above US$10,000 to foreign virtual asset entities or self-custodied wallets. The rule takes account of both individual transfers and the total sent by a client in one day. An earlier release is possible when supported by a documented risk assessment (Resolução BCB 584, art. 2-B).

Resolution 584 applies to banks, payment institutions and PSAVs, including providers still in the authorization process.

The main steps are:

• Trigger. The hold applies above US$10,000. Below that amount, the institution's risk policy determines when to pause a transfer, using client, operation, counterparty and jurisdiction risk profiles.

• Clock. The 24 hours start when the client's wallet receives the funds, whether in reais or virtual assets.

• Client notice. The provider must tell the client that the hold is precautionary and how long it will last.

• Decision. After reviewing the risk, the institution releases or rejects the transfer.

• Early release. A provider can release sooner if it documents a reasoned decision covering the four risk criteria and keeps it available for BCB review.

Providers must also keep daily records of fraud and attempted fraud, including the steps taken in response. If an institution violates the rule, the BCB can impose stricter conditions, such as longer holds, a lower threshold or limits on early release (Resolution 584).

Coaf reporting and the withdrawal hold serve different functions. The report provides information to the authorities; the hold gives an institution time to assess a transfer before executing it.

The hold also faces a legislative challenge. PDL 926/2026, filed in August 2026, proposes to suspend Resolution 584. The proposal needs approval from both houses of Congress. Until that happens, the 1 January 2027 effective date remains in place.

To apply the hold, providers must identify where withdrawals go: a foreign virtual asset business, a self-custodied wallet or a domestic authorized institution. They also need a running daily total for each client. Global Ledger's guide to sanctions screening APIs explains what exposure and attribution data can support these pre-transfer checks.

PSAV Compliance Checklist: Phase Two and January 2027

The checklist brings together preparation for the phase-two audit, Coaf reporting and the January 2027 withdrawal rules. Each action has its own deadline.

How Global Ledger Supports PSAV Compliance

Brazil's new regulations require PSAVs to demonstrate that their AML controls work in practice. From phase-two audits to the new withdrawal requirements, providers need reliable data to identify risky transactions, assess counterparties, and document their decisions.

Global Ledger helps PSAVs meet these demands across their crypto operations. KYT supports ongoing monitoring of deposits and withdrawals, sanctions and wallet screening identifies exposure to sanctioned and high-risk entities, and KYB provides intelligence on crypto counterparties, including their licensing status and risk exposure. Сentralized exchange solutions show how these capabilities work together.

Together, these capabilities help compliance teams investigate suspicious activity, assess transactions before release, and maintain the evidence needed for regulatory review. From onboarding to withdrawal decisions, Global Ledger helps PSAVs understand the risks behind crypto activity and demonstrate to auditors and regulators how they manage those risks.

FAQ