Crypto in Brazil: the regulatory map

Last reviewed: October 8, 2026. Each statement below comes from the documents linked in the Sources list. Brazilian crypto rules are changing quickly, so dates may move.

Brazil regulates crypto-assets through a split system. The central bank (Banco Central do Brasil, BCB) authorizes and supervises the companies that provide crypto services. The securities regulator (Comissão de Valores Mobiliários, CVM) keeps its role over crypto-assets that are securities. The tax authority (Receita Federal) collects transaction data through a new declaration called DeCripto. This guide maps who does what and what to ask before you commit capital.

At a glance

Crypto service providers may operate in Brazil only with prior authorization from a federal body (Law 14.478/2022, art. 2). Decree 11.563/2023 names the BCB as regulator and supervisor.
The BCB’s rules (Resolutions 519, 520 and 521, published in November 2025) took effect on February 2, 2026.
Providers already operating before the rules took effect must apply for authorization by a final deadline set for October 2026.
Assets that are securities are outside Law 14.478 and stay under the CVM.
Reporting to the tax authority moves from the 2019 rule to DeCripto. The new rule does not create a tax: taxation follows the specific legislation for each operation.

Who regulates what

Authority	Role
Banco Central do Brasil (BCB)	Regulates, authorizes and supervises providers of virtual-asset services (Decree 11.563/2023, art. 1). It also decided which crypto activities fall within the foreign-exchange market.
Comissão de Valores Mobiliários (CVM)	Keeps its powers over assets that represent securities. Law 14.478 does not apply to them (art. 1, sole paragraph).
Receita Federal (tax authority)	Receives information on crypto operations through DeCripto (Normative Instruction RFB 2.291/2025).

The legal framework, in order

Date	Rule	What it does
Law of Dec 21, 2022; in force 180 days after publication	Law 14.478/2022	Defines a virtual asset as a “digital representation of value that can be traded or transferred by electronic means” and sets guidelines for service providers. Providers need prior authorization. It adds a crime of fraud with virtual assets to the Penal Code (art. 171-A, 4 to 8 years of imprisonment and a fine), brings providers under the anti-money-laundering law (Law 9.613/1998) and applies the Consumer Defense Code to these operations.
In force June 20, 2023	Decree 11.563/2023	Gives the BCB the power to regulate, authorize and supervise virtual-asset service providers.
Nov 10, 2025; in force from Feb 2, 2026	BCB Resolutions 519, 520 and 521	Authorization process, operating rules for providers, and the treatment of crypto operations in the foreign-exchange market.
Nov 14, 2025	Normative Instruction RFB 2.291/2025	Creates DeCripto and revokes Normative Instructions RFB 1.888/2019 and 1.899/2019.

What the BCB rules cover

Who is covered. Virtual-asset service companies (SPSAVs), plus banks, securities brokers and distributors, and foreign-exchange brokers that offer these services.
Three kinds of service: intermediation, custody, and brokerage, which combines both.
Providers already operating may keep operating while they show compliance and request authorization, within the transition deadline.
Market conduct. Providers must prevent practices such as price manipulation and the use of inside information.
Decision times. A BCB board vote of February 19, 2026 (Voto 18/2026) proposed deadlines for the BCB to decide on providers already operating: 360 days for Phase 1, 720 days for Phase 2, and 1,080 days (about three years) in total. Phase 1 reviews, among other things, the requirements for controllers and holders of qualified stakes.

Cross-border rules and foreign exchange

The BCB decided which crypto activities belong to the foreign-exchange market. According to its November 2025 presentation of the rules, they are:

international payments or transfers made with virtual assets;
transfers of virtual assets to settle obligations from international use of cards or other electronic payment means;
transfers to or from self-custody wallets; and
buying, selling or swapping virtual assets referenced to a fiat currency, such as stablecoins.

Only providers authorized to operate in the foreign-exchange market may offer these operations. For self-custody wallets, providers must identify the counterparties that hold the wallets they receive assets from or send assets to. Providers must send the BCB detailed information on these operations from May 2026.

Newer controls on transfers. BCB Resolution 584 (August 7, 2026) amended Resolution 142 to allow institutions to hold, for up to 24 hours, transfers of virtual assets to self-custody wallets above US$10,000. The board vote behind it (Voto 90/2026) covers transfers to foreign virtual-asset entities as well, calls the hold precautionary, and set entry into force for January 1, 2027. A later board vote (Voto 107/2026, September 22, 2026) proposed that transfers to or from self-custody wallets of US$10,000 or more be reported to the financial-intelligence unit (Coaf).

Securities law: when a token is a security

Law 14.478 does not apply to assets that represent securities, and it leaves the CVM’s powers unchanged. Under Law 6.385/1976, article 2, item IX, the securities regime also covers, when publicly offered, “any other securities or collective investment contracts” that give rights of participation, partnership or remuneration “whose returns come from the efforts of the entrepreneur or of third parties”.

In Guidance Opinion 40 (October 11, 2022), the CVM states that a crypto-asset is a security when it fits that broad concept, which requires analyzing its features case by case. It lists criteria such as the contribution of funds, the collective character, the expectation of gain and dependence on the efforts of others. Each token therefore needs its own analysis.

Reporting and tax

DeCripto. Normative Instruction RFB 2.291/2025 requires crypto operations to be reported in the Crypto-Asset Declaration (DeCripto), filed through the tax authority’s e-CAC portal. It must be filed by:

crypto service providers that are tax residents in Brazil, are managed in Brazil or provide crypto services in Brazil; and
individuals and entities resident or domiciled in Brazil, for operations carried out through a provider abroad, through a decentralized platform or without a provider, when the monthly value of the operations exceeds R$35,000 (art. 5).

Monthly information is due by the last business day of the following month. Annual information is due by the last business day of January of the following year. The instruction took effect on publication in November 2025. The annual-information article applies from January 1, 2026, and the monthly-information articles and the revocation of the 2019 rule apply from July 1, 2026.

Tax. The instruction states that the taxation of these operations follows the specific legislation on the nature and features of each operation (art. 16). It creates no tax of its own. For individuals, the capital-gains rates in Law 8.981/1995, article 21, are: 15% on the part of the gain up to R$5 million, 17.5% on the part above R$5 million, 20% on the part above R$10 million and 22.5% on the part above R$30 million. How those rules apply to a given crypto transaction depends on the facts, and this guide does not cover it.

Questions to ask before you commit capital

Is my provider authorized, or has it applied for authorization? Which legal entity holds my account?
Is the provider authorized to operate in the foreign-exchange market, if my operation involves international transfers or stablecoins?
Which of my operations will be reported through DeCripto, and what records do I need to keep?
How will transfers to my own wallet be handled, given the identification duties and the new holds for larger transfers?
Does the token I am buying or issuing look like a security?
What are the tax consequences in the country where I am a tax resident?

What to watch

The October 2026 deadline for providers already operating to apply for authorization.
The BCB’s decisions on individual applications.
The start of the 24-hour hold on larger transfers (January 1, 2027, under the board vote).
Whether the proposed Coaf reporting of self-custody transfers is adopted.