Brazil Crypto KYC: BCB VASP Licensing and What It Means for Compliance Teams

On November 10, 2025, Brazil’s Banco Central do Brasil (BCB) published three resolutions, numbered 519, 520, and 521, setting a compliance deadline for every platform serving Brazilian crypto users. The rules took effect on February 2, 2026, with a 270-day transition window that closes on October 30, 2026. Any virtual asset service provider (VASP) operating in Brazil without BCB authorization by that date loses the right to continue.

Brazil is already the 5th largest crypto market globally, recording $40.4 billion in retail transaction volume in Q1 2026, and the Brazil crypto regulatory framework now demands licensing rigor on par with a traditional financial institution. This article maps BCB VASP licensing requirements, the authorization steps, and what Brazil crypto KYC and AML compliance actually means for platform operators.

Why Brazil’s crypto market now demands KYC compliance

Brazil’s adoption figures alone justify the regulatory shift. Crypto transaction volumes climbed 43% year-over-year in 2025, with the average investment per user surpassing 5,700 Brazilian reais. At that trajectory, operating without mandatory licensing had become an untenable gap in Brazil’s financial supervision architecture. The question for compliance teams is not whether to engage with the BCB framework, but how fast they can meet it.

Platforms seeking crypto KYC and AML solutions that meet BCB standards need to understand both the scale of the market and the enforcement attention it now carries.

What BCB Resolutions 519, 520, and 521 require from VASPs

The three resolutions form an interlocking framework that treats VASPs as regulated financial institutions rather than unregistered technology vendors. Resolution 519 governs authorization and capital. Resolution 520, the operational core, covers KYC, AML and Know Your Transaction obligations. Resolution 521 brings virtual asset activity inside Brazil’s foreign exchange regime.

Each of the three resolutions operates on a different dimension of compliance, and teams must map their platform against all three to understand what the Brazil crypto compliance regulations demand of their specific setup.

Resolution 519: authorization, capital, and modalities

Resolution 519 defines who needs BCB authorization and what financial capacity a VASP must demonstrate. Platforms must maintain minimum capital reserves between $181,500 and $544,500 depending on the modalities they operate, per analysis of the BCB framework. Under that framework, VASPs are classified into one of three modalities.

Intermediary platforms handle trading, Custodians manage asset safekeeping, and Broker entities do both. A minimum of three directors or statutory officers resident in Brazil is mandatory for all authorized entities.

Resolution 520: KYC, AML and operational standards

Resolution 520 is where Brazil crypto KYC obligations take their most concrete form. Every user must be identified through their Cadastro de Pessoas Físicas (CPF), Brazil’s individual tax registration number, or their Cadastro Nacional da Pessoa Jurídica (CNPJ) for business entities.

Anonymous trading is no longer permitted on any BCB-authorized platform. Platforms must also screen users against domestic and international sanctions lists, report suspicious activity to COAF, and implement Know Your Transaction (KYT) processes that trace the origin and destination of every asset transfer. Transfers to or from self-hosted wallets carry an additional obligation.

For a broader view of how AML and KYC compliance Brazil obligations fit into a global context, regulatory updates affecting crypto exchanges track parallel developments across other jurisdictions.

Resolution 521: foreign exchange integration

Resolution 521 pulls cross-border crypto activity inside Brazil’s foreign exchange framework. Stablecoin transactions, cross-border payments, and self-hosted wallet transfers are now treated as foreign exchange operations for regulatory purposes. Platforms must submit monthly reports on stablecoin purchases, sales, and exchanges, identifying counterparties to meet both capital control and AML requirements. VASPs face a transaction cap equivalent to $100,000 for foreign exchange activities, per BCB Resolution 521 analysis, separate from the higher limits applicable to banks and licensed financial institutions.

Steps to obtain a VASP license in Brazil

The VASP licensing process Brazil uses is structured in two formal phases, with different entry points depending on whether a platform was already active before February 2, 2026. Existing operators are not exempt from the process, but they benefit from a structured transition path. New entrants must satisfy all authorization requirements from the outset before the BCB grants them the right to operate.

Step 1: notify the BCB and confirm your modality

Platforms already active before February 2, 2026 must notify the BCB of their intent to continue providing virtual asset services by October 30, 2026. During that notification, platforms must declare which modality they operate. Options are Intermediary, Custodian, or Broker. The declared modality determines both capital requirements and the scope of the Phase 2 operational review.

Step 2: Phase 1 review of corporate structure

In Phase 1, the BCB verifies the existence and nature of the platform’s activities under Law No. 14,478/2022, Brazil’s foundational Virtual Assets Law enacted on December 22, 2022. The review covers corporate structure, controlling shareholders, and the fitness of qualifying stakeholders. The BCB may request audited financial statements at this stage. Phase 1 is administrative, not operational.

Step 3: Phase 2 review of operational compliance

Phase 2 assesses whether the platform meets the full standards under Resolution 520. The assessment covers a risk management framework that accounts for market, credit, operational, and liquidity risk.

Platforms also need a cybersecurity policy with a documented incident response plan, internal controls against money laundering, and procedures for complying with UN Security Council sanctions. Accounting and audit standards applicable to BCB-authorized financial institutions apply from that point forward.

Step 4: authorization and ongoing obligations

Once BCB grants authorization, the obligations do not end. Client funds held in Brazilian reais must sit in individual payment or deposit accounts in each client’s name. Omnibus account arrangements are prohibited from that point forward. COAF reporting continues as an ongoing requirement, and the Travel Rule compliance timeline applies from the date of authorization.

How Brazil’s crypto framework compares to global standards

Brazil is moving well ahead of the global average on VASP regulation. The Financial Action Task Force (FATF) found, as of 2025, that only 21% of 138 assessed jurisdictions were fully compliant with Recommendation 15 on virtual assets. Brazil’s BCB framework implements Recommendation 15 obligations directly and goes further on capital adequacy and foreign exchange integration.

Compared to Europe’s Markets in Crypto-Assets regulation (MiCA), which took phased effect from December 2024, the Brazilian framework is more prescriptive on capital reserves and self-hosted wallet rules, while MiCA takes a broader approach to token classification and issuer obligations.

Both frameworks mandate Travel Rule compliance and KYC for all users. Within Latin America, Brazil’s approach has become the reference point that other regional regulators are watching. The FATF Mutual Evaluation of Brazil in 2023 recognized progress in AML architecture while flagging gaps in prosecution and interagency coordination. The BCB’s 2025 resolutions directly address several of those gaps in the virtual asset space.

How Shufti helps crypto platforms meet BCB compliance

A BCB-compliant verification stack needs to handle CPF and CNPJ document checks at speed, screen every user against international and domestic watchlists, and produce an audit trail that satisfies both COAF reporting obligations and BCB examination standards.

Shufti’s KYC verification covers identity documents from over 230 countries, which matters for Brazilian platforms onboarding international users alongside domestic account holders. The platform processes full identity checks in under 15 seconds, reducing the manual review burden that compliance teams at growing exchanges absorb before they automate.

For COAF reporting and ongoing transaction risk, Shufti’s AML screening runs against more than 3,500 global watchlists, 2.6 million PEP profiles, and 215 sanction regimes, with data refreshed every 15 minutes. That cadence matters when sanctions lists can change within a single trading day.

Platforms targeting the October 30, 2026 BCB authorization deadline need a KYC and AML stack that already meets Resolution 520’s verification and monitoring standards. The window for in-house capability development is narrow. BCB examiners review applications during the same period, and a compliant integration removes the concurrent execution risk.

BCB authorization is the line between operating with a license and operating at regulatory risk in one of Latin America’s most active crypto markets.

Shufti’s identity verification and AML screening platform maps directly to Resolution 520’s specific requirements, so compliance teams can demonstrate operational readiness from the first day of the BCB review.

Request a demo to see how the platform handles CPF document verification, COAF-aligned AML screening, and Travel Rule workflows in a single API integration.