## What Is Brazil's Legal Framework for Cryptocurrency?
Brazil's cryptocurrency regulatory framework is defined by **Law 14,478/2022**, known as the *Marco Legal das Criptomoedas* (Crypto Assets Legal Framework), signed into law on December 22, 2022. This legislation established the first comprehensive legal definition of virtual assets in Brazil, defining them as digital representations of value that can be traded or transferred electronically. The law designated **Banco Central do Brasil (BCB)** as the primary supervisor for crypto asset service providers, while the **Comissão de Valores Mobiliários (CVM)** retains jurisdiction over crypto assets classified as securities. Brazil is the largest cryptocurrency market in Latin America, with over 10 million active crypto users and estimated annual transaction volumes exceeding USD 50 billion as of 2025.
## How Does Banco Central do Brasil Regulate Crypto Service Providers?
Banco Central became the designated regulator for VASPs following Normative Resolution BCB No. 6/2023. Any entity wishing to provide virtual asset services must obtain a **VASP License** from BCB, demonstrating minimum capital adequacy, internal governance, cybersecurity protocols, and robust AML/CFT controls. As of early 2026, BCB has received over 280 license applications and granted authorization to approximately 45 entities. Penalties for non-compliance range from **BRL 20,000 to BRL 2 billion**.
## What Role Does CVM Play in Crypto Asset Oversight?
CVM exercises authority over crypto assets that meet the definition of **securities under Brazilian law**. CVM Resolution No. 175/2022 clarified that certain tokenized instruments, security tokens, and investment-contract-based digital assets fall within CVM's purview. CVM has taken enforcement action against multiple unregistered token offerings since 2023, issuing fines totaling over **BRL 45 million** in 2024. Crypto asset managers must register with CVM and comply with fund management regulations.
## What Are the VASP Authorization Requirements?
| Requirement | Minimum Standard | Notes |
|---|---|---|
| Minimum Capital | BRL 1,000,000 (exchanges) | Varies by service type |
| AML Compliance Officer | Designated individual required | Must be Brazilian resident |
| Cybersecurity Framework | BCB Resolution No. 4,658 compliant | Annual third-party audit |
| Segregated Client Funds | 100% of client balances | Held in approved institutions |
| Suspicious Activity Reporting | COAF integration mandatory | Real-time reporting capability |
| Travel Rule | FATF Recommendation 16 compliant | Originator and beneficiary identification |
| Board Governance | Minimum 2 directors | Fit and proper assessment |
## What AML/CFT Obligations Apply to Brazilian Crypto Businesses?
Brazil's AML obligations are grounded in **Law 9,613/1998**, operationalized through **COAF** (Conselho de Controle de Atividades Financeiras). VASPs must implement CDD, EDD for high-risk customers, transaction monitoring, and timely STR reporting to COAF. In 2024, Brazilian VASPs reported over 12,000 suspicious transaction reports, a 340% increase over 2022.
## How Does Brazil's Travel Rule Implementation Work?
Brazil adopted the FATF Travel Rule through BCB's VASP regulatory framework, with a threshold of **USD 1,000 (or equivalent in BRL)**. Large VASPs (>BRL 500M annual volume) were required to comply from January 2025, mid-tier VASPs from July 2025. Brazil is a member of **FATF-GAFI** and has participated in Travel Rule working groups.
## How Does Pix Integration Affect Crypto Compliance?
**Pix**, Brazil's instant payment system, is used by over 95% of Brazilian crypto exchanges as the primary fiat on-ramp and off-ramp. BCB requires VASPs using Pix to implement enhanced transaction monitoring given the near-instantaneous settlement. COAF has issued guidance on monitoring layering techniques that exploit Pix speed.
## What Is Drex and How Does It Impact Crypto Regulation?
**Drex** is Brazil's Central Bank Digital Currency (CBDC), a tokenized version of the Brazilian Real. Following successful 2025 pilot phases, BCB is moving toward phased retail rollout. VASPs may eventually hold Drex in client accounts as a regulated digital fiat alternative. Drex transactions will be subject to the same AML reporting obligations as traditional financial transactions.
## How Do Brazilian and Global Frameworks Compare?
| Dimension | Brazil (BCB/CVM) | EU (MiCA) | UAE (VARA) | Singapore (MAS) |
|---|---|---|---|---|
| Primary Regulator | Banco Central + CVM | ESMA + NCAs | VARA | MAS |
| VASP Licensing | Mandatory (BCB) | Mandatory (MiCA) | Mandatory (VARA) | Mandatory (PS Act) |
| Travel Rule Threshold | USD 1,000 | EUR 1,000 | AED 3,500 | SGD 1,500 |
| Stablecoin Rules | In development | MiCA Title III | Separate rules | MAS PS Notice |
| CBDC | Drex (retail rollout) | Digital Euro (pilot) | No public CBDC | No public CBDC |
| Enforcement Activity | Increasing | Active | Moderate | High |
## What Recent Enforcement Actions Have Shaped the Market?
BCB issued first formal penalty notices against unlicensed exchanges in mid-2023, shutting down three operators and blocking over **BRL 380 million** in client funds. CVM pursued enforcement against four token issuers in 2024 with penalties of **BRL 28 million**. Federal Police **Operation Criptus** in 2024 targeted exchanges used for drug trafficking laundering, resulting in 17 arrests and freezing BRL 120 million in assets.
## How Can Defy Help Navigate Brazilian Crypto Compliance?
Defy provides crypto-native compliance solutions designed for VASPs operating in Brazil and across Latin America. Defy's **Live AML** platform delivers real-time wallet screening against COAF typologies and global sanctions lists, while the **Travel Rule** module supports automated data collection compliant with BCB's requirements. Defy's **Investigation** suite enables blockchain forensic analysis aligned with Brazilian law enforcement standards. [Contact Defy](https://getdefy.co/contact) to learn how we support compliance operations in Brazil.