BCB Resolutions No. 519, 520, and 521, published by the Central Bank of Brazil on November 10, 2025, establish the regulatory framework for Virtual Asset Service Providers (VASPs) in the country. The rules address authorization, governance, asset segregation, AML/CFT, cybersecurity, and the integration of cryptoasset operations into the foreign exchange market and cross-border capital rules. This article summarizes the key elements of the resolutions and their impact on exchanges, fintechs, and financial institutions operating in the cryptocurrency sector in Brazil.
- Background: From the Legal Framework to Infra-Legal Regulation
With Law No. 14,478/2022 (“Cryptoassets Legal Framework”), the market began waiting for infra-legal regulation detailing the Central Bank’s supervision of VASPs.
On November 10, 2025, three key regulations were issued:
- BCB Resolution No. 519 – regulates authorization processes for financial institutions, including VASPs;
- BCB Resolution No. 520 – governs the incorporation and operation of VASPs and the provision of virtual asset services by other authorized institutions;
- BCB Resolution No. 521 – incorporates VASP activities and operations into the foreign exchange market and the rules for Brazilian capital abroad and foreign capital in Brazil.
These norms raise the prudential, conduct, and transparency standards applicable to exchanges, custodians, crypto intermediaries, and other financial institutions.
- BCB Resolution No. 519: Authorization and Requirements for VASPs
BCB Resolution No. 519 structures the authorization processes for VASPs. To obtain or maintain authorization, institutions must demonstrate, among other requirements:
- the financial capacity of their controllers and the lawful origin of funds;
- the economic and financial feasibility of the business;
- technology infrastructure compatible with the scale and risk profile of the activity;
- an adequate corporate governance framework;
- the reputation and technical qualifications of managers and controllers;
- compliance with minimum capital requirements and the existence of a dedicated physical headquarters.
The rule also addresses changes of control, corporate reorganizations, criteria for identifying controllers, conditions for holding management positions, and scenarios for denial or review of authorizations, including rules for returning assets and funds to clients if authorization is denied.
- BCB Resolution No. 520: Rules for VASPs (Business Models, Asset Segregation, and Governance)
BCB Resolution No. 520 defines virtual asset service providers as institutions authorized by the Central Bank operating under the following categories:
- virtual asset intermediaries (intermediation, purchase, sale, exchange, staking, FX activities, among others);
- virtual asset custodians (key management, position control, and execution of movement instructions);
- virtual asset brokers (combining intermediation and custody).
VASPs must be incorporated as limited liability companies or corporations, with a corporate purpose focused on regulated activities, a formal governance policy, and a minimum administrative structure, including officers responsible for business, AML/CFT, internal controls, risk management, and cybersecurity.
3.1 Asset Segregation and Proof of Reserves
A core aspect of Resolution No. 520 is the separation of VASP assets from client assets.
- client funds held in individualized accounts, segregated from proprietary resources;
- virtual assets belonging to the VASP and its clients stored in separate wallets, with a segregation policy, proof-of-reserves mechanisms, and periodic independent audits;
- use of client assets for proprietary operations only in limited scenarios, with full transparency and express consent.
3.2 Governance, AML/CFT, Security, and Third Parties
The regulation requires policies on conduct, fraud prevention, risk management, business continuity, cybersecurity, and personal data protection, alongside specific AML/CFT approaches, KYC procedures, recordkeeping obligations, and criteria for hiring liquidity providers, custodians, and other critical third-party service providers. It also establishes rules for listing and offering cryptoassets and stablecoins, focused on transparency and the robustness of reserves.
- BCB Resolution No. 521: Crypto in the FX Market and Cross-Border Capital Rules
BCB Resolution No. 521 adjusts the foreign exchange and cross-border capital framework to incorporate virtual asset services. Key provisions include:
- classification within the FX market of international payments and transfers settled with virtual assets;
- rules for transfers among VASP clients, card issuers, and self-custodial wallets;
- regulation of operations involving fiat-referenced virtual assets (stablecoins);
- prohibitions on the direct payment or receipt of virtual assets in foreign currency for certain operations;
- limits on dealings with non-authorized FX counterparties and enhanced reporting obligations to the Central Bank.
The rule also allows external credit operations and foreign direct investment to be structured using fiat-referenced virtual assets, with reporting in the reference currency through Central Bank systems.
- Implications for Exchanges, Fintechs, and Financial Institutions
Taken together, BCB Resolutions No. 519, 520, and 521 restructure Brazil’s crypto regulatory environment across three axes:
- Authorization and Corporate Structure
Exchanges and other VASPs must adapt to requirements related to authorization, capital, governance, and the qualifications of controllers and management.
- Business Models, Compliance, and Technology
Operational workflows will require updates to ensure segregation of funds and assets, proof-of-reserves mechanisms, AML/CFT compliance, cybersecurity, and data protection, along with revised contracts with liquidity providers, custodians, and other partners.
- Integration with FX and Cross-Border Operations
Crypto operations with a cross-border component will now follow specific FX and international capital rules, including new classification, reporting, and governance obligations.
Transition deadlines and mechanisms will require careful regulatory and operational planning by existing institutions and international players serving clients in Brazil.
- Next Steps and Regulatory Monitoring
BCB Resolutions No. 519, 520, and 521 mark a foundational milestone for Brazil’s cryptoasset ecosystem, but further acts, guidelines, and regulatory interpretations are expected to complement the framework.
b/luz, recognized in top legal rankings for its strategic work in innovation and cryptoassets, closely monitors the implementation of these rules and their implications for VASPs, financial institutions, fintechs, and international players.
The specialized team at b/luz is available to support clients in assessing regulatory impacts, reviewing governance structures, and aligning business models with Brazil’s new crypto regulatory landscape.
